alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects Obfuscated Powershell via Stdin in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Stdin - PowerShell Module id: c72aca44-8d52-45ad-8f81-f96c4d3c755e related: - id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 type: derived status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: (?i)(set).*&&\s?set.*(environment|invoke|\$?\{?input).*&&.*" condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs. The fact that the Cmdlet. Logsource: windows / process_creation. Rule: title: New DMSA Service Account Created in Specific OUs id: 0ea8db81-2ff6-4525-9448-33bbe7effc13 related: - id: e15bc294-ae2a-45ad-b7d6-637b33868bde type: similar - id: 02122374-b74e-495c-b285-9e4da973f3d6 type: similar status: experimental description: 'Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs. The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious. It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions, it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment. ' references: - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-24 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.002 - attack.t1098 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - powershell.exe - pwsh.dll - powershell_ise.exe selection_cli: CommandLine|contains|all: - New-ADServiceAccount - -CreateDelegatedServiceAccount - -path condition: all of selection_* falsepositives: - Unknown level: medium
Query: risk of idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.
Matching passage: CVE-2015-8948. CWE: CWE-125. CVSS: 7.5. idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds read.
Near-miss passage: CVE-2015-8608. CWE: CWE-125. CVSS: 9.800000190734863. The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.
Query: CVE similar to CVE-2015-0406
Matching passage: CVE-2015-0406. CWE: UNKNOWN. CVSS: 5.800000190734863. Unspecified vulnerability in Oracle Java SE 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality and availability via unknown vectors related to Deployment.
Near-miss passage: CVE-2015-1120. CWE: UNKNOWN. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.3, Apple TV before 7.2, and Apple Safari before 6.2.5, 7.x before 7.1.5, and 8.x before 8.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-04-08-1, APPLE-SA-2015-04-08-3, and APPLE-SA-2015-04-08-4.
Query: patch priority for CVE-2015-1490
Matching passage: CVE-2015-1490. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1 before 12.1-RU6-MP1 allows remote authenticated users to read arbitrary files via a relative pathname in a client installation package.
Near-miss passage: CVE-2015-4988. CWE: CWE-22. CVSS: 8.600000381469727. Directory traversal vulnerability in the replay server in IBM Tealeaf Customer Experience before 8.7.1.8818, 8.8 before 8.8.0.9026, 9.0.0, 9.0.0A, 9.0.1 before 9.0.1.1083, 9.0.1A before 9.0.1.5073, 9.0.2 before 9.0.2.1095, and 9.0.2A before 9.0.2.5144 allows remote attackers to read arbitrary files via unspecified vectors.
Query: detect Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary in logs
Matching passage: Sigma rule: Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary. Logsource: windows / registry_set. Rule: title: Persistence Via Hhctrl.ocx id: f10ed525-97fe-4fed-be7c-2feecca941b1 status: test description: Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary references: - https://persistence-info.github.io/Data/hhctrl.html - https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32\(Default) filter: Details: C:\Windows\System32\hhctrl.ocx condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to. Logsource: windows / ps_script. Rule: title: Suspicious Get Information for SMB Share id: 95f0643a-ed40-467c-806b-aac9542ec5ab status: test description: 'Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md author: frack113 date: 2021-12-15 modified: 2022-12-25 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: get-smbshare condition: selection falsepositives: - Unknown level: low
Query: risk of Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0
Matching passage: CVE-2015-8438. CWE: CWE-119. CVSS: 9.300000190734863. Heap-based buffer overflow in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted XML object that is mishandled during a toString call, a different vulnerability than CVE-2015-8446.
Near-miss passage: CVE-2015-6075. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.
Query: vulnerability: The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local us
Matching passage: CVE-2015-4177. CWE: UNKNOWN. CVSS: 5.5. The collect_mounts function in fs/namespace.c in the Linux kernel before 4.0.5 does not properly consider that it may execute after a path has been unmounted, which allows local users to cause a denial of service (system crash) by leveraging user-namespace root access for an MNT_DETACH umount2 system call.
Near-miss passage: CVE-2015-6463. CWE: UNKNOWN. CVSS: 5.800000190734863. CodeWrights HART Comm DTM components, as used with Endress+Hauser FieldCare, allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a longtag XML schema containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Query: explain CWE-483
Matching passage: CWE-483 Incorrect Block Delimitation. The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
Near-miss passage: CWE-1234 Hardware Internal or Debug Modes Allow Override of Locks. System configuration protection may be bypassed during debug mode.
Query: vulnerability: The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers
Matching passage: CVE-2015-6418. CWE: CWE-200. CVSS: 4.300000190734863. The random-number generator on Cisco Small Business RV routers 4.x and SA500 security appliances 2.2.07 does not have sufficient entropy, which makes it easier for remote attackers to determine a TLS key pair via unspecified computations upon handshake key-exchange data, aka Bug ID CSCus15224.
Near-miss passage: CVE-2015-5070. CWE: CWE-200. CVSS: 3.0999999046325684. The (1) filesystem::get_wml_location function in filesystem.cpp and (2) is_legal_file function in filesystem_boost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5069.
Query: incident response steps for SIEM correlation: reconnaissance activity consistent with Threat Intel Vendors
Matching passage: Playbook for T1597.001 Threat Intel Vendors. 1) Validate alert telemetry against T1597.001. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: reconnaissance. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting. Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported. Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target indust
Near-miss passage: Playbook for T1597 Search Closed Sources. Different response path focused on reconnaissance.
Query: rule covering Detects when an Policy Rule is Modified or Deleted.
Matching passage: Sigma rule: Detects when an Policy Rule is Modified or Deleted.. Logsource: okta / okta. Rule: title: Okta Policy Rule Modified or Deleted id: 0c97c1d3-4057-45c9-b148-1de94b631931 status: test description: Detects when an Policy Rule is Modified or Deleted. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: - policy.rule.update - policy.rule.delete condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capabili. Logsource: windows / process_creation. Rule: title: Potential Register_App.Vbs LOLScript Abuse id: 28c8f68b-098d-45af-8d43-8089f3e35403 status: test description: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 - https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs author: Austin Songer @austinsonger date: 2021-11-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: '.vbs -register ' condition: all of selection* falsepositives: - Other VB scripts that leverage the same starting command line flags level: medium
Query: vulnerability: Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application execution by an invalid task, aka "Task Sch
Matching passage: CVE-2015-0098. CWE: CWE-264. CVSS: 7.199999809265137. Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application execution by an invalid task, aka "Task Scheduler Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-7227. CWE: CWE-264. CVSS: 3.5. The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels.
Query: patch priority for CVE-2015-6676
Matching passage: CVE-2015-6676. CWE: CWE-119. CVSS: 10.0. Buffer overflow in Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-6678.
Near-miss passage: CVE-2015-6094. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Excel for Mac 2011, Excel 2016 for Mac, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: Sigma rule for Detects the export of the target Registry key to a file.
Matching passage: Sigma rule: Detects the export of the target Registry key to a file.. Logsource: windows / process_creation. Rule: title: Exports Registry Key To a File id: f0e53e89-8d22-46ea-9db5-9d4796ee2f8a related: - id: 82880171-b475-4201-b811-e9c826cd5eaa type: similar status: test description: Detects the export of the target Registry key to a file. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-07 modified: 2024-03-13 tags: - attack.exfiltration - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regedit.exe - OriginalFileName: REGEDIT.EXE selection_cli: CommandLine|contains|windash: ' -E ' filter_1: CommandLine|contains: - hklm - hkey_local_machine filter_2: CommandLine|endswith: - \system - \sam - \security condition: all of selection_* and not all of filter_* falsepositives: - Legitimate export of keys level: low
Near-miss passage: Sigma rule: Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.. Logsource: windows / process_creation. Rule: title: Code Execution via Pcwutl.dll id: 9386d78a-7207-4048-9c9f-a93a7c2d1c05 status: test description: Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library. references: - https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/ - https://twitter.com/harr0ey/status/989617817849876488 author: Julia Fomina, oscd.community date: 2020-10-05 modified: 2023-02-09 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - pcwutl - LaunchApplication condition: all of selection_* falsepositives: - Use of Program Compatibility Troubleshooter Helper level: medium
Query: CVE similar to CVE-2015-6009
Matching passage: CVE-2015-6009. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Web Reference Database (aka refbase) through 0.9.6 allow remote attackers to execute arbitrary SQL commands via (1) the where parameter to rss.php or (2) the sqlQuery parameter to search.php, a different issue than CVE-2015-7382.
Near-miss passage: CVE-2015-5023. CWE: CWE-89. CVSS: 5.400000095367432. SQL injection vulnerability in IBM Curam Social Program Management 6.1 before 6.1.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Query: CWE for Creation of Emergent Resource
Matching passage: CWE-1229 Creation of Emergent Resource. The product manages resources or behaves in a way that indirectly creates a new, distinct resource that can be used by attackers in violation of the intended policy.
Near-miss passage: CWE-414 Missing Lock Check. A product does not check to see if a lock is present before performing sensitive operations on a resource.
Query: alert when Detects a flashplayer update from an unofficial location
Matching passage: Sigma rule: Detects a flashplayer update from an unofficial location. Logsource: proxy. Rule: title: Flash Player Update from Suspicious Location id: 4922a5dd-6743-4fc2-8e81-144374280997 status: test description: Detects a flashplayer update from an unofficial location references: - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb author: Florian Roth (Nextron Systems) date: 2017-10-25 modified: 2022-08-08 tags: - attack.initial-access - attack.stealth - attack.t1189 - attack.execution - attack.t1204.002 - attack.t1036.005 logsource: category: proxy detection: selection: - c-uri|contains: /flash_install.php - c-uri|endswith: /install_flash_player.exe filter: cs-host|endswith: .adobe.com condition: selection and not filter falsepositives: - Unknown flash download locations level: high
Near-miss passage: Sigma rule: Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an applica. Logsource: windows / process_creation. Rule: title: Potential DLL Injection Via AccCheckConsole id: 0f6da907-5854-4be6-859a-e9958747b0aa status: test description: 'Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application''s UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility. ' references: - https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340 - https://twitter.com/bohops/status/1477717351017680899?s=12 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/ author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2024-08-29 tags: - attack.execution - detection.threat-hunting logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AccCheckConsole.exe - OriginalFileName: AccCheckConsole.exe selection_cli: CommandLine|contains: - ' -hwnd' - ' -process ' - ' -window ' condition: all of selection_* falsepositives: - Legitimate use of the UI Accessibility Checker level: medium
Query: CWE for Incomplete Denylist to Cross-Site Scripting
Matching passage: CWE-692 Incomplete Denylist to Cross-Site Scripting. The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
Near-miss passage: CWE-527 Exposure of Version-Control Repository to an Unauthorized Control Sphere. The product stores a CVS, git, or other repository in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Defaultpack.EXE id: b2309017-4235-44fe-b5af-b15363011957 status: test description: Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/ - https://www.echotrail.io/insights/search/defaultpack.exe author: frack113 date: 2022-12-31 modified: 2024-04-22 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \DefaultPack.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS. Logsource: windows / registry_set. Rule: title: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724 related: - id: 10344bb3-7f65-46c2-b915-2d00d47be5b0 type: similar status: test description: 'Detects changes to Internet Explorer''s (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally. ' references: - https://twitter.com/M_haggis/status/1699056847154725107 - https://twitter.com/JAMESWT_MHT/status/1699042827261391247 - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea) date: 2023-09-05 tags: - attack.stealth logsource: product: windows category: registry_set detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults TargetObject|endswith: - \http - \https Details|contains: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high