alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / ps_module
Matching passage: Sigma rule: Detects remote PowerShell sessions. Logsource: windows / ps_module. Rule: title: Remote PowerShell Session (PS Module) id: 96b9f619-aa91-478f-bacb-c3e50f8df575 status: test description: Detects remote PowerShell sessions references: - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-08-10 modified: 2023-01-20 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains|all: - ' = ServerRemoteHost ' - wsmprovhost.exe filter_pwsh_archive: ContextInfo|contains: \Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1 condition: selection and not 1 of filter_* falsepositives: - Legitimate use remote PowerShell sessions level: high
Near-miss passage: Sigma rule: Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common L. Logsource: windows / process_creation. Rule: title: Registry Modification Attempt Via VBScript id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf related: - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a type: similar - id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2 type: similar status: experimental description: 'Detects attempts to modify the registry using VBScript''s CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs. It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell. Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools. ' references: - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ date: 2025-08-13 author: Swachchhanda Shrawan Poudel (Nextron Systems) tags: - attack.persistence - attack.execution - attack.defense-impairment - attack.t1112 - attack.t1059.005 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - CreateObject - Wscript.shell - .RegWrite condition: selection falsepositives: - Unknown level: medium
Query: exploit The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang)
Matching passage: CVE-2015-8035. CWE: CWE-399. CVSS: 2.5999999046325684. The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
Near-miss passage: CVE-2015-3725. CWE: CWE-399. CVSS: 4.300000190734863. MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.
Query: alert when Detects WMI command line event consumers
Matching passage: Sigma rule: Detects WMI command line event consumers. Logsource: windows / image_load. Rule: title: WMI Persistence - Command Line Event Consumer id: 05936ce2-ee05-4dae-9d03-9a391cf2d2c6 status: test description: Detects WMI command line event consumers references: - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/ author: Thomas Patzke date: 2018-03-07 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1546.003 - attack.persistence logsource: category: image_load product: windows detection: selection: Image: C:\Windows\System32\wbem\WmiPrvSE.exe ImageLoaded|endswith: \wbemcons.dll condition: selection falsepositives: - Unknown (data set is too small; further testing needed) level: high
Near-miss passage: Sigma rule: Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stea. Logsource: windows / process_creation. Rule: title: SQLite Firefox Profile Data DB Access id: 4833155a-4053-4c9c-a997-777fcea0baa7 status: test description: Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/ author: frack113 date: 2022-04-08 modified: 2023-01-19 tags: - attack.credential-access - attack.t1539 - attack.collection - attack.t1005 logsource: category: process_creation product: windows detection: selection_sql: - Product: SQLite - Image|endswith: - \sqlite.exe - \sqlite3.exe selection_firefox: CommandLine|contains: - cookies.sqlite - places.sqlite condition: all of selection_* falsepositives: - Unknown level: high
Query: vulnerability: PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vector
Matching passage: CVE-2015-3256. CWE: CWE-264. CVSS: 4.599999904632568. PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation."
Near-miss passage: CVE-2015-0012. CWE: CWE-264. CVSS: 6.900000095367432. Microsoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly validate the roles of users, which allows local users to obtain server and virtual-machine administrative privileges by establishing a server session with Active Directory credentials, aka "Virtual Machine Manager Elevation of Privilege Vulnerability."
Query: detection rule: Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linu
Matching passage: Sigma rule: Detects changes of sensitive and critical files. Monitors files that you don't expect to change without planning on Linu. Logsource: linux / process_creation. Rule: title: Potential Suspicious Change To Sensitive/Critical Files id: 86157017-c2b1-4d4a-8c33-93b8e67e4af4 status: test description: 'Detects changes of sensitive and critical files. Monitors files that you don''t expect to change without planning on Linux system. These files include, but are not limited to, system configuration files, authentication files, and critical application files. Attackers often target these files to maintain persistence, escalate privileges, or disrupt system operations. ' references: - https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview#which-files-should-i-monitor author: '@d4ns4n_ (Wuerth-Phoenix)' date: 2023-05-30 modified: 2026-03-18 tags: - attack.impact - attack.t1565.001 logsource: category: process_creation product: linux detection: selection_img_1: Image|endswith: - /cat - /echo - /grep - /head - /more - /tail CommandLine|contains: '>' selection_img_2: Image|endswith: - /emacs - /nano - /sed - /vi - /vim selection_paths: CommandLine|contains: - /bin/login - /bin/passwd - /boot/ - /etc/*.conf - /etc/cron. - /etc/crontab - /etc/hosts - /etc/init.d - /etc/sudoers - /opt/bin/ - /sbin - /usr/bin/ - /usr/local/bin/ filter_main_mdadm.conf: Image|endswith: /bin/sed CommandLine|startswith: - sed -i /^* - sed -ne s/^ CommandLine|endswith: /etc/mdadm/mdadm.conf condition: 1 of selection_img_* and selection_paths and not 1 of filter_main_* falsepositives: - Some false positives are to be expected on user or administrator machines. Apply additional filters as needed. level: medium
Near-miss passage: Sigma rule: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should. Logsource: windows / process_creation. Rule: title: PrintBrm ZIP Creation of Extraction id: cafeeba3-01da-4ab4-b6c4-a31b1d9730c7 status: test description: Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation. references: - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/ author: frack113 date: 2022-05-02 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.004 logsource: product: windows category: process_creation detection: selection: Image|endswith: \PrintBrm.exe CommandLine|contains|all: - ' -f' - .zip condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0645
Matching passage: CVE-2015-0645. CWE: CWE-20. CVSS: 7.800000190734863. The Layer 4 Redirect (L4R) feature in Cisco IOS XE 2.x and 3.x before 3.10.4S, 3.11 before 3.11.3S, 3.12 before 3.12.2S, 3.13 before 3.13.1S, 3.14 before 3.14.0S, and 3.15 before 3.15.0S allows remote attackers to cause a denial of service (device reload) via malformed (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCuq59131.
Near-miss passage: CVE-2015-6849. CWE: CWE-20. CVSS: 7.800000190734863. EMC NetWorker before 8.0.4.5, 8.1.x before 8.1.3.6, 8.2.x before 8.2.2.2, and 9.0 before build 407 allows remote attackers to cause a denial of service (process outage) via malformed RPC authentication messages.
Query: CVE similar to CVE-2015-1477
Matching passage: CVE-2015-1477. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the CMSJunkie J-ClassifiedsManager component for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a viewad task to classifieds/offerring-ads.
Near-miss passage: CVE-2015-7877. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: describe CVE-2015-6925
Matching passage: CVE-2015-6925. CWE: CWE-399. CVSS: 7.5. wolfSSL (formerly CyaSSL) before 3.6.8 allows remote attackers to cause a denial of service (resource consumption or traffic amplification) via a crafted DTLS cookie in a ClientHello message.
Near-miss passage: CVE-2015-6286. CWE: CWE-399. CVSS: 5.699999809265137. Cisco Application Visibility and Control (AVC) 15.3(3)JA, when FlexConnect is enabled, allows remote attackers to cause a denial of service (access-point outage) via a crafted UDP packet, aka Bug ID CSCuu47016.
Query: containment actions for EDR alert: possible Cloud Service Discovery (T1526)
Matching passage: Playbook for T1526 Cloud Service Discovery. 1) Validate alert telemetry against T1526. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They
Near-miss passage: Playbook for T1018 Remote System Discovery. Different response path focused on discovery.
Query: CVE similar to CVE-2015-3826
Matching passage: CVE-2015-3826. CWE: CWE-119. CVSS: 5.0. The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to cause a denial of service (integer underflow, buffer over-read, and mediaserver process crash) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3828.
Near-miss passage: CVE-2015-6750. CWE: CWE-119. CVSS: 7.5. Buffer overflow in Ricoh DL FTP Server 1.1.0.6 and earlier allows remote attackers to execute arbitrary code via a long USER command.
Query: Sigma rule for Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc
Matching passage: Sigma rule: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a loc. Logsource: windows / image_load. Rule: title: DLL Load By System Process From Suspicious Locations id: 9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c status: test description: Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public" references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2023-09-18 tags: - attack.stealth - attack.t1070 logsource: product: windows category: image_load detection: selection: Image|startswith: C:\Windows\ ImageLoaded|startswith: - C:\Users\Public\ - C:\PerfLogs\ condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress. Logsource: windows / process_creation. Rule: title: Compressed File Creation Via Tar.EXE id: 418a3163-3247-4b7b-9933-dcfcb7c52ea9 status: test description: 'Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. ' references: - https://unit42.paloaltonetworks.com/chromeloader-malware/ - https://lolbas-project.github.io/lolbas/Binaries/Tar/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage author: Nasreddine Bencherchali (Nextron Systems), AdmU3 date: 2023-12-19 tags: - attack.collection - attack.exfiltration - attack.t1560 - attack.t1560.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tar.exe - OriginalFileName: bsdtar selection_create: CommandLine|contains: - -c - -r - -u condition: all of selection_* falsepositives: - Likely level: low
Query: risk of Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
Matching passage: CVE-2015-5409. CWE: CWE-119. CVSS: 7.5. Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-3664. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3665 and CVE-2015-3669.
Query: Sigma rule for Hides the file extension through modification of the registry
Matching passage: Sigma rule: Hides the file extension through modification of the registry. Logsource: windows / registry_set. Rule: title: Registry Modification to Hidden File Extension id: 5df86130-4e95-4a54-90f7-26541b40aec2 status: test description: Hides the file extension through modification of the registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd - https://unit42.paloaltonetworks.com/ransomware-families/ - https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A author: frack113 date: 2022-01-22 modified: 2023-08-17 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection_HideFileExt: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt Details: DWORD (0x00000001) selection_Hidden: TargetObject|endswith: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden Details: DWORD (0x00000002) condition: 1 of selection_* falsepositives: - Administrative scripts level: medium
Near-miss passage: Sigma rule: Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded. Logsource: windows / security. Rule: title: HackTool - NoFilter Execution id: 7b14c76a-c602-4ae6-9717-eff868153fc0 status: test description: 'Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators ' references: - https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp - https://github.com/deepinstinct/NoFilter - https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation - https://x.com/_st0pp3r_/status/1742203752361128162?s=20 author: Stamatis Chatzimangou (st0pp3r) date: 2024-01-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1134.001 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Policy Change needs to be enabled' detection: selection_5447: EventID: 5447 FilterName|contains: RonPolicy selection_5449: EventID: 5449 ProviderContextName|contains: RonPolicy condition: 1 of selection_* falsepositives: - Unknown level: high
Query: alert when Detects potential DLL sideloading of "ShellDispatch.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "ShellDispatch.dll". Logsource: windows / image_load. Rule: title: Potential ShellDispatch.DLL Sideloading id: 844f8eb2-610b-42c8-89a4-47596e089663 status: test description: Detects potential DLL sideloading of "ShellDispatch.dll" references: - https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/ author: X__Junior (Nextron Systems) date: 2023-06-20 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \ShellDispatch.dll filter_main_legit_path: - ImageLoaded|contains|all: - :\Users\ - \AppData\Local\Temp\ - ImageLoaded|contains: :\Windows\Temp\ condition: selection and not 1 of filter_main_* falsepositives: - Some installers may trigger some false positives level: medium
Near-miss passage: Sigma rule: Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can con. Logsource: windows / process_creation. Rule: title: Setup16.EXE Execution With Custom .Lst File id: 99c8be4f-3087-4f9f-9c24-8c7e257b442e status: test description: 'Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility. ' references: - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/ author: frack113 date: 2024-12-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: ParentImage: C:\Windows\SysWOW64\setup16.exe ParentCommandLine|contains: ' -m ' filter_optional_valid_path: Image|startswith: C:\~MSSETUP.T\ condition: selection and not 1 of filter_optional_* falsepositives: - On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare. level: medium
Query: vulnerability: Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.
Matching passage: CVE-2015-4232. CWE: CWE-264. CVSS: 4.599999904632568. Cisco NX-OS 6.2(10) on Nexus and MDS 9000 devices allows local users to execute arbitrary OS commands by entering crafted tar parameters in the CLI, aka Bug ID CSCus44856.
Near-miss passage: CVE-2015-8941. CWE: CWE-264. CVSS: 7.800000190734863. drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices does not properly validate array indexes, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28814502 and Qualcomm internal bug CR792473.
Query: Sigma YAML for windows / appxpackaging-om
Matching passage: Sigma rule: Detects execution of AppX packages with known suspicious or malicious signature. Logsource: windows / appxpackaging-om. Rule: title: Suspicious Digital Signature Of AppX Package id: b5aa7d60-c17e-4538-97de-09029d6cd76b status: test description: Detects execution of AppX packages with known suspicious or malicious signature references: - Internal Research - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 tags: - attack.execution - attack.stealth logsource: product: windows service: appxpackaging-om detection: selection: EventID: 157 subjectName: CN=Foresee Consulting Inc., O=Foresee Consulting Inc., L=North York, S=Ontario, C=CA, SERIALNUMBER=1004913-1, OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: windows / process_creation. Rule: title: PUA - TruffleHog Execution id: 44030449-b0df-4c94-aae1-502359ab28ee related: - id: d7a650c4-226c-451e-948f-cc490db506aa type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \trufflehog.exe selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_trufflehog/info.yml