alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
Matching passage: Sigma rule: Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.. Logsource: azure / riskdetection. Rule: title: Sign-In From Malware Infected IP id: 821b4dc3-1295-41e7-b157-39ab212dd6bd status: test description: Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1090 - attack.command-and-control logsource: product: azure service: riskdetection detection: selection: riskEventType: malwareInfectedIPAddress condition: selection falsepositives: - Using an IP address that is shared by many users level: high
Near-miss passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the f. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation id: 4bf943c6-5146-4273-98dd-e958fd1e3abf status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2026-03-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - CommandLine|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - CommandLine|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - CommandLine|re: \$env:ComSpec\[(?:\s*\d{1,3}\s*,){2} - CommandLine|re: \*mdr\*\W\s*\)\.Name - CommandLine|re: \$VerbosePreference\.ToString\( - CommandLine|re: \[String\]\s*\$VerbosePreference condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-4761
Matching passage: CVE-2015-4761. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.24 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Memcached.
Near-miss passage: CVE-2015-5068. CWE: UNKNOWN. CVSS: 7.5. XML external entity (XXE) vulnerability in SAP Mobile Platform 3 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request, aka SAP Security Note 2159601.
Query: rule covering Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make i
Matching passage: Sigma rule: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make i. Logsource: windows / registry_delete. Rule: title: Delete Defender Scan ShellEx Context Menu Registry Key id: 72a0369a-2576-4aaf-bfc9-6bb24a574ac6 related: - id: b9e8c7d6-a5f4-4e3d-8b1a-9f0c8d7e6a5b type: similar status: experimental description: Detects deletion of registry key that adds 'Scan with Defender' option in context menu. Attackers may use this to make it harder for users to scan files that are suspicious. references: - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/ - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/ - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ author: Matt Anderson (Huntress) date: 2025-07-11 modified: 2025-10-07 tags: - attack.defense-impairment logsource: category: registry_delete product: windows detection: selection: TargetObject|contains: shellex\ContextMenuHandlers\EPP filter_main_defender: Image|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ - C:\Program Files (x86)\Windows Defender\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely as this weakens defenses and normally would not be done even if using another AV. level: medium
Near-miss passage: Sigma rule: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such a. Logsource: windows / process_creation. Rule: title: Computer System Reconnaissance Via Wmic.EXE id: 9d7ca793-f6bd-471c-8d0f-11e68b2f0d2f status: test description: Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-08 modified: 2023-02-14 tags: - attack.discovery - attack.execution - attack.t1047 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: computersystem condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_computersystem/info.yml
Query: patch priority for CVE-2015-3865
Matching passage: CVE-2015-3865. CWE: CWE-264. CVSS: 9.300000190734863. The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
Near-miss passage: CVE-2015-7051. CWE: CWE-264. CVSS: 9.300000190734863. MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Query: risk of Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, and Office Compatibility Pack S
Matching passage: CVE-2015-0064. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Automation Services in SharePoint Server 2010, Web Applications 2010 SP2, Word Viewer, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Office Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-1747. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1732, CVE-2015-1742, CVE-2015-1750, and CVE-2015-1753.
Query: detection rule: Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Si
Matching passage: Sigma rule: Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Si. Logsource: windows / security. Rule: title: Local User Creation id: 66b6be3d-55d0-4f47-9855-d69df21740ea status: test description: 'Detects local user creation on Windows servers, which shouldn''t happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs. ' references: - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/ author: Patrick Bareiss date: 2019-04-18 modified: 2021-01-17 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 condition: selection falsepositives: - Domain Controller Logs - Local accounts managed by privileged account management tools level: low
Near-miss passage: Sigma rule: Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat. Logsource: windows / process_creation. Rule: title: CodePage Modification Via MODE.COM To Russian Language id: 12fbff88-16b5-4b42-9754-cd001a789fb3 related: - id: d48c5ffa-3b02-4c0f-9a9e-3c275650dd0e type: derived status: test description: 'Detects a CodePage modification using the "mode.com" utility to Russian language. This behavior has been used by threat actors behind Dharma ransomware. ' references: - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode - https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html - https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-17 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mode.com - OriginalFileName: MODE.COM selection_cli: CommandLine|contains|all: - ' con ' - ' cp ' - ' select=' CommandLine|endswith: - =1251 - =866 condition: all of selection_* falsepositives: - Russian speaking people changing the CodePage level: medium
Query: exploit The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, B
Matching passage: CVE-2015-7394. CWE: CWE-264. CVSS: 9.0. The datastor kernel module in F5 BIG-IP Analytics, APM, ASM, Link Controller, and LTM 11.1.0 before 12.0.0, BIG-IP AAM 11.4.0 before 12.0.0, BIG-IP AFM, PEM 11.3.0 before 12.0.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.1.0 through 11.3.0, BIG-IP GTM 11.1.0 through 11.6.0, BIG-IP PSM 11.1.0 through 11.4.1, BIG-IQ Cloud and Security 4.0.0 through 4.5.0, BIG-IQ Device 4.2.0 through 4.5.0, BIG-IQ ADC 4.5.0, and Enterprise Manager 3.0.0 through 3.1.1 allows remote authenticated users to cause a denial of service or gain privileges by leveraging permission to upload and execute code.
Near-miss passage: CVE-2015-5637. CWE: CWE-264. CVSS: 6.800000190734863. The Newphoria Photon application before 1.2 for Android allows attackers to bypass a URL whitelist protection mechanism and obtain API access via unspecified vectors.
Query: detect Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file v in logs
Matching passage: Sigma rule: Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file v. Logsource: windows / file_event. Rule: title: Potential RipZip Attack on Startup Folder id: a6976974-ea6f-4e97-818e-ea08625c52cb status: test description: 'Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation. ' references: - https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19 author: Greg (rule) date: 2022-07-21 modified: 2023-01-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: file_event product: windows detection: selection: TargetFilename|contains|all: - \Microsoft\Windows\Start Menu\Programs\Startup - .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D} Image|endswith: \explorer.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / system. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - System id: 175997c5-803c-4b08-8bb0-70b099f47595 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - new-object - text.encoding]::ascii - readtoend ImagePath|contains: - :system.io.compression.deflatestream - system.io.streamreader condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-8338
Matching passage: CVE-2015-8338. CWE: CWE-254. CVSS: 7.199999809265137. Xen 4.6.x and earlier does not properly enforce limits on page order inputs for the (1) XENMEM_increase_reservation, (2) XENMEM_populate_physmap, (3) XENMEM_exchange, and possibly other HYPERVISOR_memory_op suboperations, which allows ARM guest OS administrators to cause a denial of service (CPU consumption, guest reboot, or watchdog timeout and host reboot) and possibly have unspecified other impact via unknown vectors.
Near-miss passage: CVE-2015-3750. CWE: CWE-254. CVSS: 6.400000095367432. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not enforce the HTTP Strict Transport Security (HSTS) protection mechanism for Content Security Policy (CSP) report requests, which allows man-in-the-middle attackers to obtain sensitive information by sniffing the network or spoof a report by modifying the client-server data stream.
Query: risk of validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Matching passage: CVE-2015-5145. CWE: CWE-399. CVSS: 7.800000190734863. validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Near-miss passage: CVE-2015-0688. CWE: CWE-399. CVSS: 7.099999904632568. Cisco IOS XE 3.10.2S on an ASR 1000 device with an Embedded Services Processor (ESP) module, when NAT is enabled, allows remote attackers to cause a denial of service (module crash) via malformed H.323 packets, aka Bug ID CSCup21070.
Query: risk of SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via
Matching passage: CVE-2015-4062. CWE: CWE-89. CVSS: 6.5. SQL injection vulnerability in includes/nsp_search.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the where1 parameter in the nsp_search page to wp-admin/admin.php.
Near-miss passage: CVE-2015-2146. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before 1.7.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter to project.php, the (2) group_id parameter to group.php, the (3) status_id parameter to status.php, the (4) resolution_id parameter to resolution.php, the (5) severity_id parameter to severity.php, the (6) priority_id parameter to priority.php, the (7) os_id parameter to os.php, or the (8) site_id parameter to site.php.
Query: patch priority for CVE-2015-3649
Matching passage: CVE-2015-3649. CWE: CWE-20. CVSS: 7.800000190734863. The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a meta file is created.
Near-miss passage: CVE-2015-3876. CWE: CWE-20. CVSS: 9.300000190734863. libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
Query: describe CVE-2015-8683
Matching passage: CVE-2015-8683. CWE: CWE-119. CVSS: 5.5. The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a packed TIFF image.
Near-miss passage: CVE-2015-4695. CWE: CWE-119. CVSS: 5.0. meta.h in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WMF file.
Query: CVE similar to CVE-2015-1283
Matching passage: CVE-2015-1283. CWE: CWE-190. CVSS: 6.800000190734863. Multiple integer overflows in the XML_GetBuffer function in Expat through 2.1.0, as used in Google Chrome before 44.0.2403.89 and other products, allow remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via crafted XML data, a related issue to CVE-2015-2716.
Near-miss passage: CVE-2015-1529. CWE: CWE-190. CVSS: 7.5. Integer overflow in soundtrigger/ISoundTriggerHwService.cpp in Android allows attacks to cause a denial of service via unspecified vectors.
Query: vulnerability: Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Internet Explorer Clipboard Information D
Matching passage: CVE-2015-1692. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 7 through 11 allows user-assisted remote attackers to read the clipboard contents via crafted web script, aka "Internet Explorer Clipboard Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-5730. CWE: CWE-200. CVSS: 5.0. The sanitize_widget_instance function in wp-includes/class-wp-customize-widgets.php in WordPress before 4.2.4 does not use a constant-time comparison for widgets, which allows remote attackers to conduct a timing side-channel attack by measuring the delay before inequality is calculated.
Query: risk of The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which mak
Matching passage: CVE-2015-5352. CWE: CWE-264. CVSS: 4.300000190734863. The x11_open_helper function in channels.c in ssh in OpenSSH before 6.9, when ForwardX11Trusted mode is not used, lacks a check of the refusal deadline for X connections, which makes it easier for remote attackers to bypass intended access restrictions via a connection outside of the permitted time window.
Near-miss passage: CVE-2015-3029. CWE: CWE-264. CVSS: 4.0. The web interface in McAfee Advanced Threat Defense (MATD) before 3.4.4.63 does not properly restrict access, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: what is T1127
Matching passage: T1127 Trusted Developer Utilities Proxy Execution. Tactics: stealth, execution. Description: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads. There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.(Citation: engima0x3 DNX Bypass)(Citation: engima0x3 RCSI Bypass)(Citation: Exploit Monday WinDbg)(Citation: LOLBAS Tracker) These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions. Smart App Control is a feature of Windows that blocks applications it considers potentially malicious from running by verifying unsigned applications against a known safe list from a Microsoft cloud service before executing them.(Citation: Microsoft Smart App Control) However, adversaries may leverage "reputation hijacking" to abuse an operating system’s trust of safe, signed applications that support the execution of arbitrary code. By leveraging [Trusted Developer Utilities Proxy Execution](https://attack.mitre.org/techniques/T1127) to run their malicious code, adversaries may bypass Smart App Control protections.(Citation: Elastic Security Labs)
Near-miss passage: T1127.001 MSBuild. Tactics: stealth, execution. Description: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility. MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio. It handles XML formatted project files that define requirements for loading and building various platforms and configurations.(Citation: MSDN MSBuild) Adversaries can abuse MSBuild to proxy execution of malicious code. The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.(Citation: MSDN MSBuild)(Citation: Microsoft MSBuild Inline Tasks 2017) MSBuild will compile and execute the inline task. MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.(Citation: LOLBAS Msbuild)
Query: CVE similar to CVE-2015-8390
Matching passage: CVE-2015-8390. CWE: CWE-908. CVSS: 9.800000190734863. PCRE before 8.38 mishandles the [: and \\ substrings in character classes, which allows remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Near-miss passage: CVE-2015-3414. CWE: CWE-908. CVSS: 7.5. SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
Query: secure coding against Untrusted Pointer Dereference
Matching passage: CWE-822 Untrusted Pointer Dereference. The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the resulting pointer.
Near-miss passage: CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory. The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Query: CVE similar to CVE-2015-1072
Matching passage: CVE-2015-1072. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-5727. CWE: CWE-399. CVSS: 7.5. The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors, related to a length field.