alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can
Matching passage: Sigma rule: Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can. Logsource: windows / file_event. Rule: title: PowerShell Profile Modification id: b5b78988-486d-4a80-b991-930eff3ff8bf status: test description: Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence references: - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ - https://persistence-info.github.io/Data/powershellprofile.html author: HieuTT35, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-24 modified: 2023-10-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \Microsoft.PowerShell_profile.ps1 - \PowerShell\profile.ps1 - \Program Files\PowerShell\7-preview\profile.ps1 - \Program Files\PowerShell\7\profile.ps1 - \Windows\System32\WindowsPowerShell\v1.0\profile.ps1 - \WindowsPowerShell\profile.ps1 condition: selection falsepositives: - System administrator creating Powershell profile manually level: medium
Near-miss passage: Sigma rule: Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy. Logsource: windows / sysmon. Rule: title: Sysmon Blocked Executable id: 23b71bc5-953e-4971-be4c-c896cda73fc2 status: test description: Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy references: - https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-16 modified: 2023-09-16 tags: - attack.defense-impairment logsource: product: windows service: sysmon detection: selection: EventID: 27 condition: selection falsepositives: - Unlikely level: high
Query: detect Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often u in logs
Matching passage: Sigma rule: Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often u. Logsource: windows / process_creation. Rule: title: Suspicious Greedy Compression Using Rar.EXE id: afe52666-401e-4a02-b4ff-5d128990b8cb status: test description: Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes references: - https://decoded.avast.io/martinchlumecky/png-steganography author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-12-15 modified: 2024-01-02 tags: - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_opt_1: - Image|endswith: \rar.exe - Description: Command line RAR selection_opt_2: CommandLine|contains: - '.exe a ' - ' a -m' selection_cli_flags: CommandLine|contains|all: - ' -hp' - ' -r ' selection_cli_folders: CommandLine|contains: - ' ?:\\\*.' - ' ?:\\\\\*.' - ' ?:\$Recycle.bin\' - ' ?:\PerfLogs\' - ' ?:\Temp' - ' ?:\Users\Public\' - ' ?:\Windows\' - ' %public%' condition: 1 of selection_opt_* and all of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP OS Scan id: e8a677fd-248c-4eab-94df-de2f6f645884 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5002 condition: selection falsepositives: - Unlikely level: high
Query: rule covering Detects removing immutable file attribute.
Matching passage: Sigma rule: Detects removing immutable file attribute.. Logsource: linux / auditd. Rule: title: Remove Immutable File Attribute - Auditd id: a5b977d6-8a81-4475-91b9-49dbfcd941f7 status: test description: Detects removing immutable file attribute. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Jakob Weinzettl, oscd.community date: 2019-09-23 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: chattr a1|contains: -i condition: selection falsepositives: - Administrator interacting with immutable files (e.g. for instance backups). level: medium simulation: - type: atomic-red-team name: Remove immutable file attribute technique: T1222.002 atomic_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f
Near-miss passage: Sigma rule: Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbi. Logsource: windows / process_creation. Rule: title: Potential Arbitrary File Download Via Cmdl32.EXE id: f37aba28-a9e6-4045-882c-d5004043b337 status: test description: 'Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/ - https://twitter.com/SwiftOnSecurity/status/1455897435063074824 - https://github.com/LOLBAS-Project/LOLBAS/pull/151 author: frack113 date: 2021-11-03 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmdl32.exe - OriginalFileName: CMDL32.EXE selection_cli: CommandLine|contains|all: - /vpn - /lan condition: all of selection_* falsepositives: - Unknown level: medium
Query: discovery using Permission Groups Discovery
Matching passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Near-miss passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Query: describe CVE-2015-3745
Matching passage: CVE-2015-3745. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-6764. CWE: CWE-119. CVSS: 9.800000190734863. The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2526.73, improperly loads array elements, which allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.
Query: patch priority for CVE-2015-4639
Matching passage: CVE-2015-4639. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name.
Near-miss passage: CVE-2015-0970. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in SearchBlox before 8.2 allows remote attackers to hijack the authentication of arbitrary users.
Query: write Sigma for Detects usage of the Sharp Chisel via the commandline arguments
Matching passage: Sigma rule: Detects usage of the Sharp Chisel via the commandline arguments. Logsource: windows / process_creation. Rule: title: HackTool - SharpChisel Execution id: cf93e05e-d798-4d9e-b522-b0248dc61eaf related: - id: 8b0e12da-d3c3-49db-bb4f-256703f380e5 type: similar status: test description: Detects usage of the Sharp Chisel via the commandline arguments references: - https://github.com/shantanu561993/SharpChisel - https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-05 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1090.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SharpChisel.exe - Product: SharpChisel condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detect the creation of a service with a service binary located in a suspicious directory. Logsource: windows / registry_set. Rule: title: Service Binary in Suspicious Folder id: a07f0359-4c90-4dc4-a681-8ffea40b4f47 related: - id: c0abc838-36b0-47c9-b3b3-a90c39455382 type: obsolete status: test description: Detect the creation of a service with a service binary located in a suspicious directory references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: Florian Roth (Nextron Systems), frack113 date: 2022-05-02 modified: 2025-10-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_service_start: TargetObject|startswith: HKLM\System\CurrentControlSet\Services\ TargetObject|endswith: \Start Image|contains: - \Users\Public\ - \Perflogs\ - \ADMIN$\ - \Temp\ Details: - DWORD (0x00000000) - DWORD (0x00000001) - DWORD (0x00000002) selection_service_imagepath: TargetObject|startswith: HKLM\System\CurrentControlSet\Services\ TargetObject|endswith: \ImagePath Details|contains: - \Users\Public\ - \Perflogs\ - \ADMIN$\ - \Temp\ filter_optional_avast: Image|contains|all: - \Common Files\ - \Temp\ filter_optional_mbamservice: TargetObject|endswith: \CurrentControlSet\Services\MBAMInstallerService\ImagePath Details|endswith: \AppData\Local\Temp\MBAMInstallerService.exe" Image: C:\Windows\system32\services.exe condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0245
Matching passage: CVE-2015-0245. CWE: CWE-362. CVSS: 1.899999976158142. D-Bus 1.4.x through 1.6.x before 1.6.30, 1.8.x before 1.8.16, and 1.9.x before 1.9.10 does not validate the source of ActivationFailure signals, which allows local users to cause a denial of service (activation failure error returned) by leveraging a race condition involving sending an ActivationFailure signal before systemd responds.
Near-miss passage: CVE-2015-8839. CWE: CWE-362. CVSS: 5.099999904632568. Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.
Query: CVE similar to CVE-2015-7916
Matching passage: CVE-2015-7916. CWE: CWE-79. CVSS: 6.5. Cross-site scripting (XSS) vulnerability in Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted query.
Near-miss passage: CVE-2015-20105. CWE: CWE-79. CVSS: 9.600000381469727. The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues
Query: describe CVE-2015-2460
Matching passage: CVE-2015-2460. CWE: CWE-20. CVSS: 9.300000190734863. ATMFD.DLL in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, and 4.6 allows remote attackers to execute arbitrary code via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability."
Near-miss passage: CVE-2015-5175. CWE: CWE-20. CVSS: 7.5. Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
Query: detection rule: Detects registry modifications that disable Privacy Settings Experience
Matching passage: Sigma rule: Detects registry modifications that disable Privacy Settings Experience. Logsource: windows / registry_set. Rule: title: Disable Privacy Settings Experience in Registry id: 0372e1f9-0fd2-40f7-be1b-a7b2b848fa7b status: test description: Detects registry modifications that disable Privacy Settings Experience references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1562.001/T1562.001.md author: frack113 date: 2022-10-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Windows\OOBE\DisablePrivacyExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate admin script level: medium
Near-miss passage: Sigma rule: Detects suspicious application installed by looking at the added shortcut to the app resolver cache. Logsource: windows / shell-core. Rule: title: Suspicious Application Installed id: 83c161b6-ca67-4f33-8ad0-644a0737cf07 status: test description: Detects suspicious application installed by looking at the added shortcut to the app resolver cache references: - https://nasbench.medium.com/finding-forensic-goodness-in-obscure-windows-event-logs-60e978ea45a3 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 tags: - attack.execution logsource: product: windows service: shell-core detection: selection_name: EventID: 28115 Name|contains: - Zenmap - AnyDesk - wireshark - openvpn selection_packageid: EventID: 28115 AppID|contains: - zenmap.exe - prokzult ad - wireshark - openvpn condition: 1 of selection_* falsepositives: - Packages or applications being legitimately used by users or administrators level: medium
Query: explain CWE-641
Matching passage: CWE-641 Improper Restriction of Names for Files and Other Resources. The product constructs the name of a file or other resource using input from an upstream component, but it does not restrict or incorrectly restricts the resulting name.
Near-miss passage: CWE-288 Authentication Bypass Using an Alternate Path or Channel. The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Query: explain CWE-308
Matching passage: CWE-308 Use of Single-factor Authentication. The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.
Near-miss passage: CWE-770 Allocation of Resources Without Limits or Throttling. The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Query: patch priority for CVE-2015-2673
Matching passage: CVE-2015-2673. CWE: CWE-264. CVSS: 8.800000190734863. The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 through 3.0.20 for WordPress allow remote attackers to gain administrator privileges and execute arbitrary code via the option_name and option_value parameters.
Near-miss passage: CVE-2015-5323. CWE: CWE-264. CVSS: 6.5. Jenkins before 1.638 and LTS before 1.625.2 do not properly restrict access to API tokens which might allow remote administrators to gain privileges and run scripts by using an API token of another user.
Query: detect Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity in logs
Matching passage: Sigma rule: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Created In KeePass.EXE id: 77564cc2-7382-438b-a7f6-395c2ae53b9a status: test description: Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity references: - https://www.cisa.gov/uscert/ncas/alerts/aa20-259a - https://github.com/denandz/KeeFarce - https://github.com/GhostPack/KeeThief author: Timon Hackenjos date: 2022-04-22 modified: 2023-05-05 tags: - attack.credential-access - attack.t1555.005 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \KeePass.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects blocked load attempts of revoked drivers. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Driver Load With Revoked Certificate id: 9b72b82d-f1c5-4632-b589-187159bc6ec1 status: test description: Detects blocked load attempts of revoked drivers references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3023 condition: selection falsepositives: - Unknown level: high
Query: risk of Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment.
Matching passage: CVE-2015-4729. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle Java SE 7u80 and 8u45 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Deployment.
Near-miss passage: CVE-2015-2132. CWE: UNKNOWN. CVSS: 4.400000095367432. Unspecified vulnerability in the execve system-call implementation in HP HP-UX B.11.11, B.11.23, and B.11.31 allows local users to gain privileges via unknown vectors.
Query: CVE similar to CVE-2015-9022
Matching passage: CVE-2015-9022. CWE: CWE-362. CVSS: 7.0. In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use (TOCTOU) Race Conditions exist in several TZ APIs.
Near-miss passage: CVE-2015-4481. CWE: CWE-362. CVSS: 3.299999952316284. Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
Query: alert when Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, cre
Matching passage: Sigma rule: Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, cre. Logsource: windows / file_event. Rule: title: Suspicious File Created by ArcSOC.exe id: e890acee-d488-420e-8f20-d9b19b3c3d43 status: experimental description: 'Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS server, creates a file with suspicious file type, indicating that it may be an executable, script file, or otherwise unusual. ' references: - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm author: Micah Babinski date: 2025-11-25 tags: - attack.command-and-control - attack.persistence - attack.initial-access - attack.execution - attack.stealth - attack.t1127 - attack.t1105 - attack.t1133 logsource: category: file_event product: windows detection: selection: Image|endswith: \ArcSOC.exe TargetFilename|endswith: - .ahk - .aspx - .au3 - .bat - .cmd - .dll - .exe - .hta - .js - .ps1 - .py - .vbe - .vbs - .wsf condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish. Logsource: kubernetes / audit. Rule: title: Kubernetes CronJob/Job Modification id: 0c9b3bda-41a6-4442-9345-356ae86343dc related: - id: cd3a808c-c7b7-4c50-a2f3-f4cfcd436435 type: similar status: test description: 'Detects when a Kubernetes CronJob or Job is created or modified. A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule. An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob author: kelnage date: 2024-07-11 tags: - attack.persistence - attack.privilege-escalation - attack.execution logsource: product: kubernetes service: audit detection: selection: objectRef.apiGroup: batch objectRef.resource: - cronjobs - jobs verb: - create - delete - patch - replace - update condition: selection falsepositives: - Modifying a Kubernetes Job or CronJob may need to be done by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Query: describe CVE-2015-4219
Matching passage: CVE-2015-4219. CWE: CWE-200. CVSS: 4.0. Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly implement access control for support bundles, which allows remote authenticated users to obtain sensitive information via brute-force attempts to send valid credentials, aka Bug IDs CSCue00833 and CSCub40331.
Near-miss passage: CVE-2015-3251. CWE: CWE-200. CVSS: 4.900000095367432. Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified vectors related to API calls.