alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command li
Matching passage: Sigma rule: Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command li. Logsource: windows / ps_script. Rule: title: DMSA Link Attributes Modified id: 9b111d8e-92e0-4153-88bc-daefc1333aba related: - id: 6c9eb492-e477-4df9-b0f4-571fc9db29cd type: similar status: experimental description: 'Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. ' references: - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.002 - attack.t1098 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|contains|all: - .Put("msDS-ManagedAccountPrecededByLink - CN= condition: selection falsepositives: - Legitimate administrative tasks modifying these attributes. level: low
Near-miss passage: Sigma rule: Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Events Deleted id: 225d8b09-e714-479c-a0e4-55e6f29adf35 status: test description: Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-08-23 tags: - attack.defense-impairment - attack.t1685 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EVENTS.K8S.IO/EVENTS/DELETE condition: selection falsepositives: - Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: vulnerability: The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obt
Matching passage: CVE-2015-1541. CWE: CWE-284. CVSS: 4.300000190734863. The AppWidgetServiceImpl implementation in com/android/server/appwidget/AppWidgetServiceImpl.java in the Settings application in Android before 5.1.1 LMY48I allows attackers to obtain a URI permission via an application that sends an Intent with a (1) FLAG_GRANT_READ_URI_PERMISSION or (2) FLAG_GRANT_WRITE_URI_PERMISSION flag, as demonstrated by bypassing intended restrictions on reading contacts, aka internal bug 19618745.
Near-miss passage: CVE-2015-7895. CWE: CWE-284. CVSS: 5.5. Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash).
Query: patch priority for CVE-2015-7061
Matching passage: CVE-2015-7061. CWE: CWE-119. CVSS: 6.800000190734863. The ASN.1 decoder in Apple OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted certificate, a different vulnerability than CVE-2015-7059 and CVE-2015-7060.
Near-miss passage: CVE-2015-6676. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6678.
Query: patch priority for CVE-2015-1319
Matching passage: CVE-2015-1319. CWE: CWE-20. CVSS: 2.0999999046325684. The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 15.04.x before 15.04.1+15.04.20150408-0ubuntu1.2 does not properly detect if the screen is locked, which allows physically proximate attackers to mount removable media while the screen is locked as demonstrated by inserting a USB thumb drive.
Near-miss passage: CVE-2015-5230. CWE: CWE-20. CVSS: 7.5. The DNS packet parsing/generation code in PowerDNS (aka pdns) Authoritative Server 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via crafted query packets.
Query: exploit Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Silverlight Information Disclosur
Matching passage: CVE-2015-6165. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Microsoft Silverlight Information Disclosure Vulnerability," a different vulnerability than CVE-2015-6114.
Near-miss passage: CVE-2015-6086. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of a specific OneLiner to download and execute powershell modules in memory.. Logsource: windows / process_creation. Rule: title: Obfuscated PowerShell OneLiner Execution id: 44e24481-6202-4c62-9127-5a0ae8e3fe3d status: test description: Detects the execution of a specific OneLiner to download and execute powershell modules in memory. references: - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://gist.github.com/mgeeky/3b11169ab77a7de354f4111aa2f0df38 author: '@Kostastsale, TheDFIRReport' date: 2022-05-09 modified: 2025-04-16 tags: - attack.execution - attack.defense-impairment - attack.t1059.001 - attack.t1685 logsource: product: windows category: process_creation detection: selection: Image|endswith: \powershell.exe CommandLine|contains|all: - http://127.0.0.1 - '%{(IRM $_)}' - Invoke condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing referen. Logsource: windows / system. Rule: title: Uncommon Service Installation Image Path id: 26481afe-db26-4228-b264-25a29fe6efc7 related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b type: derived status: test description: 'Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc. ' references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2024-02-09 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 suspicious_paths: ImagePath|contains: - \\\\.\\pipe - \Users\Public\ - \Windows\Temp\ suspicious_encoded_flag: ImagePath|contains: ' -e' suspicious_encoded_keywords: ImagePath|contains: - ' aQBlAHgA' - ' aWV4I' - ' IAB' - ' JAB' - ' PAA' - ' SQBFAFgA' - ' SUVYI' filter_optional_thor_remote: ImagePath|startswith: C:\WINDOWS\TEMP\thor10-remote\thor64.exe filter_main_defender_def_updates: ImagePath|startswith: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ condition: selection and ( suspicious_paths or all of suspicious_encoded_* ) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords. Logsource: windows / registry_set. Rule: title: Potential Ransomware Activity Using LegalNotice Message id: 8b9606c9-28be-4a38-b146-0e313cc232c1 status: test description: Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages references: - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1491.001/T1491.001.md author: frack113 date: 2022-12-11 modified: 2023-08-17 tags: - attack.impact - attack.t1491.001 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption - \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText Details|contains: - encrypted - Unlock-Password - paying condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the load. Logsource: windows / registry_set. Rule: title: Windows Vulnerable Driver Blocklist Disabled id: d526c60a-e236-4011-b165-831ffa52ab70 related: - id: 22154f0e-5132-4a54-aa78-cc62f6def531 type: similar status: experimental description: 'Detects when the Windows Vulnerable Driver Blocklist is set to disabled. This setting is crucial for preventing the loading of known vulnerable drivers, and its modification may indicate an attempt to bypass security controls. It is often targeted by threat actors to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response (EDR) bypass techniques. This rule applies to systems that support the Vulnerable Driver Blocklist feature, including Windows 10 version 1903 and later, and Windows Server 2022 and later. Note that this change will require a reboot to take effect, and this rule only detects the registry modification action. ' references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\CI\Config\VulnerableDriverBlocklistEnable Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely and should be investigated immediately. level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable/info.yml
Query: alert when Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.
Matching passage: Sigma rule: Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.. Logsource: windows / process_creation. Rule: title: Regsvr32 DLL Execution With Uncommon Extension id: 50919691-7302-437f-8e10-1fe088afa145 status: test description: Detects a "regsvr32" execution where the DLL doesn't contain a common file extension. references: - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems) date: 2019-07-17 modified: 2023-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1574 - attack.execution logsource: category: process_creation product: windows detection: selection: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE filter_main_legit_ext: CommandLine|contains: - .ax - .cpl - .dll - .ocx filter_optional_pascal: CommandLine|contains: .ppl filter_optional_avg: CommandLine|contains: .bav filter_main_null_4688: CommandLine: null filter_main_empty_4688: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate extensions currently not in the list either from third party or specific Windows components. level: medium
Near-miss passage: Sigma rule: Detects blocked load attempts of revoked drivers. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Driver Load With Revoked Certificate id: 9b72b82d-f1c5-4632-b589-187159bc6ec1 status: test description: Detects blocked load attempts of revoked drivers references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3023 condition: selection falsepositives: - Unknown level: high
Query: exploit An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using pr
Matching passage: CVE-2015-9253. CWE: CWE-400. CVSS: 6.5. An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
Near-miss passage: CVE-2015-3248. CWE: CWE-400. CVSS: 4.699999809265137. openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption).
Query: alert when Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP FIN Scan id: eae8c0c8-e5da-450a-9d7d-66aa56cd26b6 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5005 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects changes to the bitbucket audit log configuration.. Logsource: bitbucket / audit. Rule: title: Bitbucket Audit Log Configuration Updated id: 6aa12161-235a-4dfb-9c74-fe08df8d8da1 status: test description: Detects changes to the bitbucket audit log configuration. references: - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Auditing auditType.action: Audit log configuration updated condition: selection falsepositives: - Legitimate user activity. level: medium
Query: CVE similar to CVE-2015-5767
Matching passage: CVE-2015-5767. CWE: CWE-20. CVSS: 4.300000190734863. The user interface in Safari in Apple iOS before 9 allows remote attackers to spoof URLs via unspecified vectors, a different vulnerability than CVE-2015-5764 and CVE-2015-5765.
Near-miss passage: CVE-2015-8019. CWE: CWE-20. CVSS: 7.800000190734863. The skb_copy_and_csum_datagram_iovec function in net/core/datagram.c in the Linux kernel 3.14.54 and 3.18.22 does not accept a length argument, which allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a write system call followed by a recvmsg system call.
Query: explain CWE-1253
Matching passage: CWE-1253 Incorrect Selection of Fuse Values. The logic level used to set a system to a secure state relies on a fuse being unblown.
Near-miss passage: CWE-83 Improper Neutralization of Script in Attributes in a Web Page. The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Query: describe CVE-2015-8027
Matching passage: CVE-2015-8027. CWE: CWE-17. CVSS: 7.5. Node.js 0.12.x before 0.12.9, 4.x before 4.2.3, and 5.x before 5.1.1 does not ensure the availability of a parser for each HTTP socket, which allows remote attackers to cause a denial of service (uncaughtException and service outage) via a pipelined HTTP request.
Near-miss passage: CVE-2015-3177. CWE: CWE-17. CVSS: 3.5. Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor rules, which allows remote authenticated users to obtain sensitive information via a subscription request.
Query: describe CVE-2015-8627
Matching passage: CVE-2015-8627. CWE: CWE-284. CVSS: 5.300000190734863. MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed.
Near-miss passage: CVE-2015-8838. CWE: CWE-284. CVSS: 5.900000095367432. ext/mysqlnd/mysqlnd.c in PHP before 5.4.43, 5.5.x before 5.5.27, and 5.6.x before 5.6.11 uses a client SSL option to mean that SSL is optional, which allows man-in-the-middle attackers to spoof servers via a cleartext-downgrade attack, a related issue to CVE-2015-3152.
Query: describe CVE-2015-3258
Matching passage: CVE-2015-3258. CWE: CWE-119. CVSS: 7.5. Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in texttopdf in cups-filters before 1.0.70 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a small line size in a print job.
Near-miss passage: CVE-2015-3144. CWE: CWE-119. CVSS: 9.0. The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe". Logsource: windows / image_load. Rule: title: Potential Libvlc.DLL Sideloading id: bf9808c4-d24f-44a2-8398-b65227d406b6 status: test description: Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe" references: - https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html - https://hijacklibs.net/entries/3rd_party/vlc/libvlc.html author: X__Junior date: 2023-04-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \libvlc.dll filter_main_vlc: ImageLoaded|startswith: - C:\Program Files (x86)\VideoLAN\VLC\ - C:\Program Files\VideoLAN\VLC\ condition: selection and not 1 of filter_main_* falsepositives: - False positives are expected if VLC is installed in non-default locations level: medium
Near-miss passage: Sigma rule: Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Using Coregen.exe id: 0fa66f66-e3f6-4a9c-93f8-4f2610b00171 status: test description: Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Coregen/ author: frack113 date: 2022-12-31 tags: - attack.privilege-escalation - attack.stealth - attack.t1218 - attack.t1055 logsource: category: image_load product: windows detection: selection: Image|endswith: \coregen.exe filter_main_legit_paths: ImageLoaded|startswith: - C:\Program Files (x86)\Microsoft Silverlight\ - C:\Program Files\Microsoft Silverlight\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: detect Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspber in logs
Matching passage: Sigma rule: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspber. Logsource: windows / process_creation. Rule: title: Rundll32 Spawned Via Explorer.EXE id: 1723e720-616d-4ddc-ab02-f7e3685a4713 status: test description: Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary. references: - https://redcanary.com/blog/raspberry-robin/ - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: CD_ROM_ date: 2022-05-21 modified: 2023-08-31 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \explorer.exe selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_generic: - CommandLine|contains: ' C:\Windows\System32\' - CommandLine|endswith: ' -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects Bitbucket global secret scanning rule deletion activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket Global Secret Scanning Rule Deleted id: e16cf0f0-ee88-4901-bd0b-4c8d13d9ee05 status: test description: Detects Bitbucket global secret scanning rule deletion activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Global administration auditType.action: Global secret scanning rule deleted condition: selection falsepositives: - Legitimate user activity. level: medium