alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts
Matching passage: Sigma rule: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts. Logsource: windows / ps_script. Rule: title: AMSI Bypass Pattern Assembly GetType id: e0d6c087-2d1c-47fd-8799-3904103c5a98 status: test description: Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts references: - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/ - https://twitter.com/cyb3rops/status/1588574518057979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA author: Florian Roth (Nextron Systems) date: 2022-11-09 tags: - attack.defense-impairment - attack.t1685 - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - '[Ref].Assembly.GetType' - SetValue($null,$true) - NonPublic,Static condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In Po. Logsource: windows / process_creation. Rule: title: RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class id: 4b8f6d3a-9c5e-4f2a-a7d8-6b9c3e5f2a8d related: - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b type: similar status: experimental description: 'Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell. In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP. In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose. ' references: - https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html - https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall - https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468 author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-15 tags: - attack.lateral-movement - attack.t1021.001 - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \wmic.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - wmic.exe - PowerShell.EXE - pwsh.dll selection_cli_method: CommandLine|contains: - rdtoggle - Win32_TerminalServiceSetting selection_cli_property: CommandLine|contains: SetAllowTSConnections condition: all of selection_* falsepositives: - Legitimate system administrators enabling RDP for remote support - System configuration scripts during deployment level: medium
Query: patch priority for CVE-2015-0295
Matching passage: CVE-2015-0295. CWE: CWE-189. CVSS: 5.0. The BMP decoder in QtGui in QT before 5.5 does not properly calculate the masks used to extract the color components, which allows remote attackers to cause a denial of service (divide-by-zero and crash) via a crafted BMP file.
Near-miss passage: CVE-2015-4626. CWE: CWE-189. CVSS: 7.5. B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, which allows remote attackers to "corrupt the business logic" via a negative value in an overdraft.
Query: write Sigma for Detects the WMI Event Consumer service scrcons.exe creating a named pipe
Matching passage: Sigma rule: Detects the WMI Event Consumer service scrcons.exe creating a named pipe. Logsource: windows / pipe_created. Rule: title: WMI Event Consumer Created Named Pipe id: 493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb status: test description: Detects the WMI Event Consumer service scrcons.exe creating a named pipe references: - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems) date: 2021-09-01 modified: 2023-11-30 tags: - attack.t1047 - attack.execution logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: Image|endswith: \scrcons.exe condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .N. Logsource: windows / ps_script. Rule: title: Registry-Free Process Scope COR_PROFILER id: 23590215-4702-4a70-8805-8dc9e58314a2 status: test description: 'Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR. The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR). These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR. (Citation: Microsoft Profiling Mar 2017) (Citation: Microsoft COR_PROFILER Feb 2013) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.012/T1574.012.md#atomic-test-3---registry-free-process-scope-cor_profiler author: frack113 date: 2021-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.012 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - $env:COR_ENABLE_PROFILING - $env:COR_PROFILER - $env:COR_PROFILER_PATH condition: selection falsepositives: - Legitimate administrative script level: medium
Query: patch priority for CVE-2015-5123
Matching passage: CVE-2015-5123. CWE: CWE-416. CVSS: 9.800000190734863. Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
Near-miss passage: CVE-2015-5113. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, and CVE-2015-5114.
Query: describe CVE-2015-3214
Matching passage: CVE-2015-3214. CWE: CWE-119. CVSS: 6.900000095367432. The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
Near-miss passage: CVE-2015-2477. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Office 2007 SP3, Office for Mac 2011, Office for Mac 2016, and Word Viewer allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: exploit Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php.
Matching passage: CVE-2015-1435. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in my little forum before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the back parameter to index.php.
Near-miss passage: CVE-2015-2420. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft System Center 2012 Operations Manager Gold before Rollup 8, SP1 before Rollup 10, and R2 before Rollup 7 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "System Center Operations Manager Web Console XSS Vulnerability."
Query: patch priority for CVE-2015-0393
Matching passage: CVE-2015-0393. CWE: UNKNOWN. CVSS: 6.0. Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.2, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to DB Privileges. NOTE: the previous information is from the January 2015 CPU. Oracle has not commented on the researcher's claim that the PUBLIC role is granted the INDEX privilege for the DUAL table during a "seeded install," which allows remote authenticated users to gain SYSDBA privileges and execute arbitrary code.
Near-miss passage: CVE-2015-7924. CWE: UNKNOWN. CVSS: 8.800000190734863. eWON devices with firmware before 10.1s0 do not trigger the discarding of browser session data in response to a log-off action, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation.
Query: vulnerability: Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to write t
Matching passage: CVE-2015-0171. CWE: CWE-22. CVSS: 5.5. Directory traversal vulnerability in IBM Security SiteProtector System 3.0 before 3.0.0.7, 3.1 before 3.1.0.4, and 3.1.1 before 3.1.1.2 allows remote authenticated users to write to arbitrary files via unspecified vectors.
Near-miss passage: CVE-2015-5531. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
Query: CVE similar to CVE-2015-4303
Matching passage: CVE-2015-4303. CWE: CWE-264. CVSS: 6.5. Cisco TelePresence Video Communication Server (VCS) X8.5.2 allows remote authenticated users to execute arbitrary commands in the context of the nobody user account via an unspecified web-page parameter, aka Bug ID CSCuv12333.
Near-miss passage: CVE-2015-3290. CWE: CWE-264. CVSS: 7.199999809265137. arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
Query: describe CVE-2015-5920
Matching passage: CVE-2015-5920. CWE: UNKNOWN. CVSS: 4.300000190734863. The Software Update component in Apple iTunes before 12.3 does not properly handle redirection, which allows man-in-the-middle attackers to discover encrypted SMB credentials via unspecified vectors.
Near-miss passage: CVE-2015-2565. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Installed Base component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Create Item Instance.
Query: exploit Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafte
Matching passage: CVE-2015-3308. CWE: UNKNOWN. CVSS: 7.5. Double free vulnerability in lib/x509/x509_ext.c in GnuTLS before 3.3.14 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted CRL distribution point.
Near-miss passage: CVE-2015-4749. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45; JRockit R28.3.6; and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect availability via vectors related to JNDI.
Query: exploit mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.
Matching passage: CVE-2015-3862. CWE: UNKNOWN. CVSS: 5.0. mediaserver in Android before 5.1.1 LMY48T allows attackers to cause a denial of service (process crash) via unspecified vectors, aka internal bug 22954006.
Near-miss passage: CVE-2015-3159. CWE: UNKNOWN. CVSS: 7.800000190734863. The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) does not properly handle the process environment before invoking abrt-action-install-debuginfo, which allows local users to gain privileges.
Query: impact using Data Encrypted for Impact
Matching passage: T1486 Data Encrypted for Impact. Tactics: impact. Description: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.(Citation: US-CERT Ransomware 2016)(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017)(Citation: US-CERT SamSam 2018) In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers). Adversaries may need to first employ other behaviors, such as [File and Directory Permissions Modification](https://attack.mitre.org/techniques/T1222) or [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529), in order to unlock and/or gain access to manipulate these files.(Citation: CarbonBlack Conti July 2020) In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.(Citation: US-CERT NotPetya 2017) Adversaries may also encrypt virtual machines hosted on ESXi or other hypervisors.(Citation: Crowdstrike Hypervisor Jackpotting Pt 2 2021) To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like [Valid Accounts](https://attack.mitre.org/techniques/T1078), [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), and [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002).(Citation: FireEye WannaCry 2017)(Citation: US-CERT NotPetya 2017) Encryption malware may also leverage [Internal Defacement](https:
Near-miss passage: T1491.001 Internal Defacement. Tactics: impact. Description: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems. This may take the form of modifications to internal websites or server login messages, or directly to user systems with the replacement of the desktop wallpaper.(Citation: Novetta Blockbuster)(Citation: Varonis) Disturbing or offensive images may be used as a part of [Internal Defacement](https://attack.mitre.org/techniques/T1491/001) in order to cause user discomfort, or to pressure compliance with accompanying messages. Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.(Citation: Novetta Blockbuster Destructive Malware)
Query: Sigma rule for Detects calls to hidden files or files located in hidden directories in NIX systems.
Matching passage: Sigma rule: Detects calls to hidden files or files located in hidden directories in NIX systems.. Logsource: linux / auditd. Rule: title: Use Of Hidden Paths Or Files id: 9e1bef8d-0fff-46f6-8465-9aa54e128c1e related: - id: d08722cd-3d09-449a-80b4-83ea2d9d4616 type: similar status: test description: Detects calls to hidden files or files located in hidden directories in NIX systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md author: David Burkett, @signalblur date: 2022-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: linux service: auditd detection: selection: type: PATH name|contains: /. filter: name|contains: - /.cache/ - /.config/ - /.pyenv/ - /.rustup/toolchains condition: selection and not filter falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detectio. Logsource: linux / auditd. Rule: title: Steganography Hide Files with Steghide id: ce446a9e-30b9-4483-8e38-d2c9ad0a2280 status: test description: Detects embedding of files with usage of steghide binary, the adversaries may use this technique to prevent the detection of hidden information. references: - https://vitux.com/how-to-hide-confidential-files-in-images-on-debian-using-steganography/ author: Pawel Mazur date: 2021-09-11 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: steghide a1: embed a2: - -cf - -ef a4: - -cf - -ef condition: selection falsepositives: - Unknown level: low
Query: Sigma YAML for windows / windefend
Matching passage: Sigma rule: Detects issues with Windows Defender Real-Time Protection features. Logsource: windows / windefend. Rule: title: Windows Defender Real-Time Protection Failure/Restart id: dd80db93-6ec2-4f4c-a017-ad40da6ffe81 status: stable description: Detects issues with Windows Defender Real-Time Protection features references: - Internal Research - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ - https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346 author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update) date: 2023-03-28 modified: 2023-05-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: - 3002 - 3007 filter_optional_network_inspection: Feature_Name: '%%886' Reason: - '%%892' - '%%858' condition: selection and not 1 of filter_optional_* falsepositives: - Some crashes can occur sometimes and the event doesn't provide enough information to tune out these cases. Manual exception is required level: medium
Near-miss passage: Sigma rule: Execution of ssh.exe to perform data exfiltration and tunneling through RDP. Logsource: windows / process_creation. Rule: title: Potential RDP Tunneling Via SSH id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d related: - id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da type: similar status: test description: Execution of ssh.exe to perform data exfiltration and tunneling through RDP references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-12 modified: 2023-01-25 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ssh.exe CommandLine|contains: :3389 condition: selection falsepositives: - Unknown level: high
Query: Sigma rule for Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new fil
Matching passage: Sigma rule: Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new fil. Logsource: macos / process_creation. Rule: title: Potential Base64 Decoded From Images id: 09a910bf-f71f-4737-9c40-88880ba5913d status: test description: 'Detects the use of tail to extract bytes at an offset from an image and then decode the base64 value to create a new file with the decoded content. The detected execution is a bash one-liner. ' references: - https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior - https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 tags: - attack.stealth - attack.t1140 logsource: product: macos category: process_creation detection: selection_image: Image|endswith: /bash selection_view: CommandLine|contains|all: - tail - -c selection_b64: CommandLine|contains|all: - base64 - -d - '>' selection_files: CommandLine|contains: - .avif - .gif - .jfif - .jpeg - .jpg - .pjp - .pjpeg - .png - .svg - .webp condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets. Logsource: windows / process_creation. Rule: title: Powershell Defender Exclusion id: 17769c90-230e-488b-a463-e05c08e9d48f related: - id: c1344fa2-323b-4d2e-9176-84b4d4821c88 type: similar status: test description: Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets references: - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://twitter.com/AdamTheAnalyst/status/1483497517119590403 author: Florian Roth (Nextron Systems) date: 2021-04-29 modified: 2022-05-12 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - 'Add-MpPreference ' - 'Set-MpPreference ' selection2: CommandLine|contains: - ' -ExclusionPath ' - ' -ExclusionExtension ' - ' -ExclusionProcess ' - ' -ExclusionIpAddress ' condition: all of selection* falsepositives: - Possible Admin Activity - Other Cmdlets that may use the same parameters level: medium
Query: CVE similar to CVE-2015-0803
Matching passage: CVE-2015-0803. CWE: CWE-264. CVSS: 7.5. The HTMLSourceElement::AfterSetAttr function in Mozilla Firefox before 37.0 does not properly constrain the original data type of a casted value during the setting of a SOURCE element's attributes, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via a crafted HTML document.
Near-miss passage: CVE-2015-8577. CWE: CWE-264. CVSS: 2.5999999046325684. The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses on 32-bit platforms when protecting another application, which allows attackers to bypass the DEP and ASLR protection mechanisms via unspecified vectors.