alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Adversaries may look for details about the network configuration and settings of systems they access or through informat
Matching passage: Sigma rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat. Logsource: windows / process_creation. Rule: title: Firewall Configuration Discovery Via Netsh.EXE id: 0e4164da-94bc-450d-a7be-a4b176179f1f status: test description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules - https://ss64.com/nt/netsh.html author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-12-07 modified: 2025-10-18 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - netsh - 'show ' - 'firewall ' CommandLine|contains: - 'config ' - 'state ' - 'rule ' - name=all condition: all of selection_* falsepositives: - Administrative activity level: low
Near-miss passage: Sigma rule: Detects suspicious Powershell code that execute COM Objects. Logsource: windows / ps_script. Rule: title: Suspicious GetTypeFromCLSID ShellExecute id: 8bc063d5-3a3a-4f01-a140-bc15e55e8437 status: test description: Detects suspicious Powershell code that execute COM Objects references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md#atomic-test-2---powershell-execute-com-object author: frack113 date: 2022-04-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - ::GetTypeFromCLSID( - .ShellExecute( condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Query: detect Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". in logs
Matching passage: Sigma rule: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".. Logsource: windows / process_creation. Rule: title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 related: - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c type: similar - id: f9999590-1f94-4a34-a91e-951e47bedefd type: similar - id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 type: similar status: test description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/ - https://twitter.com/0gtweet/status/1674399582162153472 author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-08-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: SOFTWARE\Microsoft\Provisioning\Commands\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects DNS queries for subdomains related to "Put.io" sharing website.. Logsource: windows / dns-client. Rule: title: DNS Query To Put.io - DNS Client id: 8b69fd42-9dad-4674-abef-7fdef43ef92a status: test description: Detects DNS queries for subdomains related to "Put.io" sharing website. references: - https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure author: Omar Khaled (@beacon_exe) date: 2024-08-23 tags: - attack.command-and-control logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|contains: - api.put.io - upload.put.io condition: selection falsepositives: - Legitimate DNS queries and usage of Put.io level: medium
Query: describe CVE-2015-9313
Matching passage: CVE-2015-9313. CWE: CWE-89. CVSS: 9.800000190734863. The newstatpress plugin before 1.0.5 for WordPress has SQL injection related to an IMG element.
Near-miss passage: CVE-2015-10015. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, has been found in glidernet ogn-live. This issue affects some unknown processing. The manipulation leads to sql injection. The patch is named bc0f19965f760587645583b7624d66a260946e01. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217487.
Query: vulnerability: IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not proper
Matching passage: CVE-2015-0116. CWE: CWE-74. CVSS: 3.5. IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Near-miss passage: CVE-2015-3200. CWE: CWE-74. CVSS: 7.5. mod_auth in lighttpd before 1.4.36 allows remote attackers to inject arbitrary log entries via a basic HTTP authentication string without a colon character, as demonstrated by a string containing a NULL and new line character.
Query: EDR alert: possible LSA Secrets (T1003.004)
Matching passage: T1003.004 LSA Secrets. Tactics: credential access. Description: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.(Citation: Passcape LSA Secrets)(Citation: Microsoft AD Admin Tier Model)(Citation: Tilbury Windows Credentials) LSA secrets are stored in the registry at <code>HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets</code>. LSA secrets can also be dumped from memory.(Citation: ired Dumping LSA Secrets) [Reg](https://attack.mitre.org/software/S0075) can be used to extract from the Registry. [Mimikatz](https://attack.mitre.org/software/S0002) can be used to extract secrets from memory.(Citation: ired Dumping LSA Secrets)
Near-miss passage: T1003.005 Cached Domain Credentials. Tactics: credential access. Description: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.(Citation: Microsoft - Cached Creds) On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.(Citation: PassLib mscache) The number of default cached credentials varies and can be altered per system. This hash does not allow pass-the-hash style attacks, and instead requires [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to recover the plaintext password.(Citation: ired mscache) On Linux systems, Active Directory credentials can be accessed through caches maintained by software like System Security Services Daemon (SSSD) or Quest Authentication Services (formerly VAS). Cached credential hashes are typically located at `/var/lib/sss/db/cache.[domain].ldb` for SSSD or `/var/opt/quest/vas/authcache/vas_auth.vdb` for Quest. Adversaries can use utilities, such as `tdbdump`, on these database files to dump the cached hashes and use [Password Cracking](https://attack.mitre.org/techniques/T1110/002) to obtain the plaintext password.(Citation: Brining MimiKatz to Unix) With SYSTEM or sudo access, the tools/utilities such as [Mimikatz](https://attack.mitre.org/software/S0002), [Reg](https://attack.mitre.org/software/S0075), and secretsdump.py for Windows or Linikatz for Linux can be used to extract the cached credentials.(Citation: Brining MimiKatz to Unix) Note: Cached credentials for Windows Vista are derived using PBKDF2.(Citation: PassLib mscache)
Query: CVE similar to CVE-2015-0231
Matching passage: CVE-2015-0231. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.
Near-miss passage: CVE-2015-4297. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in Cisco WebEx Node for Media Convergence Server (MCS) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted HTTP request parameters, aka Bug ID CSCuv32136.
Query: rule covering Detects attempts to create and add an account to the admin group via "sysadminctl"
Matching passage: Sigma rule: Detects attempts to create and add an account to the admin group via "sysadminctl". Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via Sysadminctl id: 652c098d-dc11-4ba6-8566-c20e89042f2b related: - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b type: obsolete status: test description: Detects attempts to create and add an account to the admin group via "sysadminctl" references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos - https://ss64.com/osx/sysadminctl.html author: Sohan G (D4rkCiph3r) date: 2023-03-19 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /sysadminctl CommandLine|contains|all: - ' -addUser ' - ' -admin ' condition: selection falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: load malicious registered COM objects. Logsource: windows / process_creation. Rule: title: Rundll32 Registered COM Objects id: f1edd233-30b5-4823-9e6a-c4171b24d316 status: test description: load malicious registered COM objects references: - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-02-13 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: - '-sta ' - '-localserver ' CommandLine|contains|all: - '{' - '}' condition: all of selection_* falsepositives: - Legitimate use level: high
Query: detect Search Threat Vendor Data
Matching passage: T1681 Search Threat Vendor Data. Tactics: reconnaissance. Description: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023) Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.(Citation: Sentinel One Contagious Interview ClickFix September 2025) This technique is distinct from [Threat Intel Vendors](https://attack.mitre.org/techniques/T1597/001) in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information.
Near-miss passage: T1592.003 Firmware. Tactics: reconnaissance. Description: Adversaries may gather information about the victim's host firmware that can be used during targeting. Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, etc.). Adversaries may gather this information in various ways, such as direct elicitation via [Phishing for Information](https://attack.mitre.org/techniques/T1598). Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).(Citation: ArsTechnica Intel) Gathering this information may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [Supply Chain Compromise](https://attack.mitre.org/techniques/T1195) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their na. Logsource: windows / process_creation. Rule: title: HackTool - Impacket Tools Execution id: 4627c6ae-6899-46e2-aa0c-6ebcb1becd19 status: test description: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives) references: - https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries author: Florian Roth (Nextron Systems) date: 2021-07-24 modified: 2023-02-07 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection: - Image|contains: - \goldenPac - \karmaSMB - \kintercept - \ntlmrelayx - \rpcdump - \samrdump - \secretsdump - \smbexec - \smbrelayx - \wmiexec - \wmipersist - Image|endswith: - \atexec_windows.exe - \dcomexec_windows.exe - \dpapi_windows.exe - \findDelegation_windows.exe - \GetADUsers_windows.exe - \GetNPUsers_windows.exe - \getPac_windows.exe - \getST_windows.exe - \getTGT_windows.exe - \GetUserSPNs_windows.exe - \ifmap_windows.exe - \mimikatz_windows.exe - \netview_windows.exe - \nmapAnswerMachine_windows.exe - \opdump_windows.exe - \psexec_windows.exe - \rdp_check_windows.exe - \sambaPipe_windows.exe - \smbclient_windows.exe - \smbserver_windows.exe - \sniff_windows.exe - \sniffer_windows.exe - \split_windows.exe - \ticketer_windows.exe condition: selection falsepositives: - Legitimate use of the impacket tools level: high
Near-miss passage: Sigma rule: Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setuid Capability Set on a Binary via Setcap Utility id: ed447910-bc30-4575-a598-3a2e49516a7a status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setuid'' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setuid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setuid condition: selection falsepositives: - Unknown level: low
Query: exploit The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other pr
Matching passage: CVE-2015-7551. CWE: CWE-20. CVSS: 8.399999618530273. The Fiddle::Handle implementation in ext/fiddle/handle.c in Ruby before 2.0.0-p648, 2.1 before 2.1.8, and 2.2 before 2.2.4, as distributed in Apple OS X before 10.11.4 and other products, mishandles tainting, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted string, related to the DL module and the libffi library. NOTE: this vulnerability exists because of a CVE-2009-5147 regression.
Near-miss passage: CVE-2015-2514. CWE: CWE-20. CVSS: 9.300000190734863. Windows Journal in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows remote attackers to execute arbitrary code via a crafted .jnt file, aka "Windows Journal RCE Vulnerability," a different vulnerability than CVE-2015-2513 and CVE-2015-2530.
Query: vulnerability: The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from pro
Matching passage: CVE-2015-1670. CWE: CWE-200. CVSS: 4.300000190734863. The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, allows remote attackers to obtain sensitive information from process memory via a crafted OpenType font on a web site, aka "OpenType Font Parsing Vulnerability."
Near-miss passage: CVE-2015-0991. CWE: CWE-200. CVSS: 5.0. Inductive Automation Ignition 7.7.2 allows remote attackers to obtain sensitive information by reading an error message about an unhandled exception, as demonstrated by pathname information.
Query: SIEM correlation: execution activity consistent with Visual Basic
Matching passage: T1059.005 Visual Basic. Tactics: execution. Description: Adversaries may abuse Visual Basic (VB) for execution. VB is a programming language created by Microsoft with interoperability with many Windows technologies such as [Component Object Model](https://attack.mitre.org/techniques/T1559/001) and the [Native API](https://attack.mitre.org/techniques/T1106) through the Windows API. Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.(Citation: VB .NET Mar 2020)(Citation: VB Microsoft) Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript. VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.(Citation: Microsoft VBA)(Citation: Wikipedia VBA) VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host. VBScript is a default scripting language on Windows hosts and can also be used in place of [JavaScript](https://attack.mitre.org/techniques/T1059/007) on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).(Citation: Microsoft VBScript) Adversaries may use VB payloads to execute malicious commands. Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) payloads (which may also involve [Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005) to enable execution).(Citation: Default VBS macros Blocking )
Near-miss passage: T1059.012 Hypervisor CLI. Tactics: execution. Description: Adversaries may abuse hypervisor command line interpreters (CLIs) to execute malicious commands. Hypervisor CLIs typically enable a wide variety of functionality for managing both the hypervisor itself and the guest virtual machines it hosts. For example, on ESXi systems, tools such as `esxcli` and `vim-cmd` allow administrators to configure firewall rules and log forwarding on the hypervisor, list virtual machines, start and stop virtual machines, and more.(Citation: Broadcom ESXCLI Reference)(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021)(Citation: LOLESXi) Adversaries may be able to leverage these tools in order to support further actions, such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) or [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486).
Query: describe CVE-2015-4777
Matching passage: CVE-2015-4777. CWE: UNKNOWN. CVSS: 6.900000095367432. Unspecified vulnerability in the Data Store component in Oracle Berkeley DB 11.2.5.1.29, 11.2.5.2.42, 11.2.5.3.28, and 12.1.6.0.35 allows local users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2583, CVE-2015-2624, CVE-2015-2626, CVE-2015-2640, CVE-2015-2654, CVE-2015-2656, CVE-2015-4754, CVE-2015-4764, CVE-2015-4775, CVE-2015-4776, CVE-2015-4778, CVE-2015-4780, CVE-2015-4781, CVE-2015-4782, CVE-2015-4783, CVE-2015-4784, CVE-2015-4785, CVE-2015-4786, CVE-2015-4787, CVE-2015-4789, and CVE-2015-4790.
Near-miss passage: CVE-2015-1231. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in Google Chrome before 41.0.2272.76 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.