alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples
Matching passage: Sigma rule: Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples. Logsource: windows / process_creation. Rule: title: HackTool - LocalPotato Execution id: 6bd75993-9888-4f91-9404-e1e4e4e34b77 status: test description: Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples references: - https://www.localpotato.com/localpotato_html/LocalPotato.html - https://github.com/decoder-it/LocalPotato author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2024-11-23 tags: - attack.privilege-escalation - cve.2023-21746 - attack.stealth logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \LocalPotato.exe selection_cli: CommandLine|contains|all: - .exe -i C:\ - -o Windows\ selection_hash_plain: Hashes|contains: - IMPHASH=E1742EE971D6549E8D4D81115F88F1FC - IMPHASH=DD82066EFBA94D7556EF582F247C8BB5 condition: 1 of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential pers. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Netsh Helper DLL - Registry id: c90362e0-2df3-4e61-94fe-b37615814cb1 related: - id: 56321594-9087-49d9-bf10-524fe8479452 type: similar - id: e7b18879-676e-4a0e-ae18-27039185a8e7 type: similar status: test description: 'Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper ' references: - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/ author: Anish Bogati date: 2023-11-28 modified: 2025-10-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.007 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\NetSh Details|contains: .dll filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe Details: - ipmontr.dll - iasmontr.dll - ippromon.dll condition: selection and not 1 of filter_main_* falsepositives: - Legitimate helper added by different programs and the OS level: medium
Query: playbook for alert: EDR alert: possible Disable or Modify Tools (T1685)
Matching passage: Playbook for T1685 Disable or Modify Tools. 1) Validate alert telemetry against T1685. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or
Near-miss passage: Playbook for T1685.005 Clear Windows Event Logs. Different response path focused on defense impairment.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (
Matching passage: CVE-2015-2182. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the (1) schltr parameter in a brands action or (2) brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-5322.
Near-miss passage: CVE-2015-3219. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Orchestration/Stack section in OpenStack Dashboard (Horizon) 2014.2 before 2014.2.4 and 2015.1.x before 2015.1.1 allows remote attackers to inject arbitrary web script or HTML via the description parameter in a heat template, which is not properly handled in the help_text attribute in the Field class.
Query: risk of Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to S10 Branded Zone.
Matching passage: CVE-2015-2589. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to S10 Branded Zone.
Near-miss passage: CVE-2015-4842. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60, and Java SE Embedded 8u51, allows remote attackers to affect confidentiality via vectors related to JAXP.
Query: detection rule: Identifies when a privilege role can be activated without performing mfa.
Matching passage: Sigma rule: Identifies when a privilege role can be activated without performing mfa.. Logsource: azure / pim. Rule: title: Roles Activation Doesn't Require MFA id: 94a66f46-5b64-46ce-80b2-75dcbe627cc0 status: test description: Identifies when a privilege role can be activated without performing mfa. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-dont-require-multi-factor-authentication-for-activation author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: noMfaOnRoleActivationAlertIncident condition: selection falsepositives: - Investigate if user is performing MFA at sign-in. level: high
Near-miss passage: Sigma rule: Detects the addition of a new network route to a route table in AWS.. Logsource: aws / cloudtrail. Rule: title: New Network Route Added id: c803b2ce-c4a2-4836-beae-b112010390b1 status: test description: 'Detects the addition of a new network route to a route table in AWS. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateRoute condition: selection falsepositives: - New VPC Creation requiring setup of a new route table - New subnets added requiring routing setup level: medium
Query: exploit Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL
Matching passage: CVE-2015-4371. CWE: UNKNOWN. CVSS: 5.800000190734863. Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter.
Near-miss passage: CVE-2015-0428. CWE: UNKNOWN. CVSS: 4.900000095367432. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Resource Control.
Query: playbook for alert: EDR alert: possible Cloud Service Discovery (T1526)
Matching passage: Playbook for T1526 Cloud Service Discovery. 1) Validate alert telemetry against T1526. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They
Near-miss passage: Playbook for T1018 Remote System Discovery. Different response path focused on discovery.
Query: describe CVE-2015-6176
Matching passage: CVE-2015-6176. CWE: CWE-79. CVSS: 4.300000190734863. Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection mechanism via unspecified vectors, aka "Microsoft Edge XSS Filter Bypass Vulnerability."
Near-miss passage: CVE-2015-2690. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in views/add-license-form.php in the Digium Addons module (digiumaddoninstaller) before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the (1) add_license_key, (2) add_license_first_name, (3) add_license_last_name, (4) add_license_company, (5) add_license_address1, (6) add_license_address2, (7) add_license_city, (8) add_license_state, (9) add_license_post_code, (10) add_license_country, (11) add_license_phone, or (12) add_license_email parameter in an add-license-form page to admin/config.php.
Query: describe CVE-2015-5835
Matching passage: CVE-2015-5835. CWE: CWE-200. CVSS: 4.300000190734863. Apple iOS before 9 allows attackers to obtain sensitive information about inter-app communication via a crafted app that conducts an interception attack involving an unspecified URL scheme.
Near-miss passage: CVE-2015-7421. CWE: CWE-200. CVSS: 3.700000047683716. Unspecified vulnerability in GSKit on IBM MQ M2000 appliances before 8.0.0.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2015-7420.
Query: incident response steps for Encoded PowerShell / command-line abuse matching Component Object Model
Matching passage: Playbook for T1559.001 Component Object Model. 1) Validate alert telemetry against T1559.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: execution. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may use the Windows Component Object Model (COM) for local code execution. COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.(Citation: Fireeye Hunting COM June 2019) Through COM, a client object can call methods
Near-miss passage: Playbook for T1559.003 XPC Services. Different response path focused on execution.
Query: alert when Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections
Matching passage: Sigma rule: Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections. Logsource: windows / registry_set. Rule: title: Disabled Windows Defender Eventlog id: fcddca7c-b9c0-4ddf-98da-e1e2d18b0157 status: test description: Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections references: - https://twitter.com/WhichbufferArda/status/1543900539280293889/photo/2 author: Florian Roth (Nextron Systems) date: 2022-07-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled Details: DWORD (0x00000000) condition: selection falsepositives: - Other Antivirus software installations could cause Windows to disable that eventlog (unknown) level: high
Near-miss passage: Sigma rule: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: Tomcat WebServer Logs Deleted id: 270185ff-5f50-4d6d-a27f-24c3b8c9fef8 status: test description: Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence references: - Internal Research - https://linuxhint.com/view-tomcat-logs-windows/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-16 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains|all: - \Tomcat - \logs\ TargetFilename|contains: - catalina. - _access_log. - localhost. condition: selection falsepositives: - During uninstallation of the tomcat server - During log rotation level: medium
Query: describe CVE-2015-6982
Matching passage: CVE-2015-6982. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1.
Near-miss passage: CVE-2015-1100. CWE: CWE-119. CVSS: 5.400000095367432. The kernel in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (out-of-bounds memory access) or obtain sensitive memory-content information via a crafted app.
Query: exploit The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of 
Matching passage: CVE-2015-6792. CWE: UNKNOWN. CVSS: 9.800000190734863. The MIDI subsystem in Google Chrome before 47.0.2526.106 does not properly handle the sending of data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors, related to midi_manager.cc, midi_manager_alsa.cc, and midi_manager_mac.cc, a different vulnerability than CVE-2015-8664.
Near-miss passage: CVE-2015-2641. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
Query: Lateral movement indicators for Domain Controller Authentication
Matching passage: T1556.001 Domain Controller Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)
Near-miss passage: T1556.004 Network Device Authentication. Tactics: defense impairment, persistence, credential access. Description: Adversaries may use [Patch System Image](https://attack.mitre.org/techniques/T1601/001) to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices. [Modify System Image](https://attack.mitre.org/techniques/T1601) may include implanted code to the operating system for network devices to provide access for adversaries using a specific password. The modification includes a specific password which is implanted in the operating system image via the patch. Upon authentication attempts, the inserted code will first check to see if the user input is the password. If so, access is granted. Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.(Citation: Mandiant - Synful Knock)
Query: patch priority for CVE-2015-1208
Matching passage: CVE-2015-1208. CWE: CWE-191. CVSS: 5.5. Integer underflow in the mov_read_default function in libavformat/mov.c in FFmpeg before 2.4.6 allows remote attackers to obtain sensitive information from heap and/or stack memory via a crafted MP4 file.
Near-miss passage: CVE-2015-0537. CWE: CWE-191. CVSS: 9.800000190734863. Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAFE Crypto-C Micro Edition (Crypto-C ME) before 4.0.4 and 4.1, and RSA BSAFE SSL-C 2.8.9 and earlier allows remote attackers to cause a denial of service (memory corruption or segmentation fault) or possibly have unspecified other impact via crafted base64 data, a similar issue to CVE-2015-0292.
Query: exploit In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an Inter-RAT procedure.
Matching passage: CVE-2015-9066. CWE: CWE-119. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in an Inter-RAT procedure.
Near-miss passage: CVE-2015-5950. CWE: CWE-119. CVSS: 6.900000095367432. The NVIDIA display driver R352 before 353.82 and R340 before 341.81 on Windows; R304 before 304.128, R340 before 340.93, and R352 before 352.41 on Linux; and R352 before 352.46 on GRID vGPU and vSGA allows local users to write to an arbitrary kernel memory location and consequently gain privileges via a crafted ioctl call.
Query: patch priority for CVE-2015-1598
Matching passage: CVE-2015-1598. CWE: CWE-200. CVSS: 2.0999999046325684. The Siemens SPCanywhere application for Android does not properly store application passwords, which allows physically proximate attackers to obtain sensitive information by examining the device filesystem.
Near-miss passage: CVE-2015-5661. CWE: CWE-200. CVSS: 4.300000190734863. The SAND STUDIO AirDroid application 1.1.0 and earlier for Android mishandles implicit intents, which allows attackers to obtain sensitive information via a crafted application.
Query: rule covering Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Tim
Matching passage: Sigma rule: Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Tim. Logsource: windows / registry_set. Rule: title: New TimeProviders Registered With Uncommon DLL Name id: e88a6ddc-74f7-463b-9b26-f69fc0d2ce85 status: test description: 'Detects processes setting a new DLL in DllName in under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProvider. Adversaries may abuse time providers to execute DLLs when the system boots. The Windows Time service (W32Time) enables time synchronization across and within domains. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.003/T1547.003.md author: frack113 date: 2022-06-19 modified: 2024-03-26 tags: - attack.persistence - attack.privilege-escalation - attack.t1547.003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\W32Time\TimeProviders TargetObject|endswith: \DllName filter_main_w32time: Details: - '%SystemRoot%\System32\vmictimeprovider.dll' - '%systemroot%\system32\w32time.dll' - C:\Windows\SYSTEM32\w32time.DLL condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass au. Logsource: azure / auditlogs. Rule: title: Disabled MFA to Bypass Authentication Mechanisms id: 7ea78478-a4f9-42a6-9dcd-f861816122bf status: test description: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms. references: - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://research.splunk.com/cloud/482dd42a-acfa-486b-a0bb-d6fcda27318e/ - https://analyticsrules.exchange/analyticrules/65c78944-930b-4cae-bd79-c3664ae30ba7/ - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user author: '@ionsor' date: 2022-02-08 modified: 2026-04-30 tags: - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: operationName: Disable Strong Authentication properties.result: success condition: selection falsepositives: - Authorized modification by administrators level: medium
Query: Sigma YAML for linux
Matching passage: Sigma rule: Detects the ld.so preload persistence file. See `man ld.so` for more information.. Logsource: linux. Rule: title: Code Injection by ld.so Preload id: 7e3c4651-c347-40c4-b1d4-d48590fdf684 status: test description: Detects the ld.so preload persistence file. See `man ld.so` for more information. references: - https://man7.org/linux/man-pages/man8/ld.so.8.html author: Christian Burkard (Nextron Systems) date: 2021-05-05 modified: 2022-10-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.006 logsource: product: linux detection: keywords: - /etc/ld.so.preload condition: keywords falsepositives: - Rare temporary workaround for library misconfiguration level: high
Near-miss passage: Sigma rule: Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files wr. Logsource: windows / process_creation. Rule: title: Malicious Windows Script Components File Execution by TAEF Detection id: 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b status: test description: 'Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/ - https://twitter.com/pabraeken/status/993298228840992768 - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/ author: Agro (@agro_sev) oscd.community date: 2020-10-13 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \te.exe - ParentImage|endswith: \te.exe - OriginalFileName: \te.exe condition: selection falsepositives: - It's not an uncommon to use te.exe directly to execute legal TAEF tests level: low
Query: CVE similar to CVE-2015-4811
Matching passage: CVE-2015-4811. CWE: UNKNOWN. CVSS: 1.5. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via vectors related to Outside In PDF Export SDKutside In PDF Export SDK, a different vulnerability than CVE-2015-4809.
Near-miss passage: CVE-2015-3276. CWE: UNKNOWN. CVSS: 7.5. The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.