alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Show when private keys are being exported from the device, or when new certificates are installed
Matching passage: Sigma rule: Show when private keys are being exported from the device, or when new certificates are installed. Logsource: cisco / aaa. Rule: title: Cisco Crypto Commands id: 1f978c6a-4415-47fb-aca5-736a44d7ca3d status: test description: Show when private keys are being exported from the device, or when new certificates are installed references: - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-book_chapter_0111.html author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.credential-access - attack.defense-impairment - attack.t1553.004 - attack.t1552.004 logsource: product: cisco service: aaa detection: keywords: - crypto pki export - crypto pki import - crypto pki trustpoint condition: keywords falsepositives: - Not commonly run by administrators. Also whitelist your known good certificates level: high
Near-miss passage: Sigma rule: Detects usage of the Sharp Chisel via the commandline arguments. Logsource: windows / process_creation. Rule: title: HackTool - SharpChisel Execution id: cf93e05e-d798-4d9e-b522-b0248dc61eaf related: - id: 8b0e12da-d3c3-49db-bb4f-256703f380e5 type: similar status: test description: Detects usage of the Sharp Chisel via the commandline arguments references: - https://github.com/shantanu561993/SharpChisel - https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-05 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1090.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SharpChisel.exe - Product: SharpChisel condition: selection falsepositives: - Unlikely level: high
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indic. Logsource: windows / image_load. Rule: title: MMC Loading Script Engines DLLs id: a9c73e8b-3b2d-4c45-8ef2-5f9a9c9998ad status: experimental description: 'Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion. ' references: - https://tria.ge/241015-l98snsyeje/behavioral2 - https://www.elastic.co/security-labs/grimresource author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1218.014 logsource: category: image_load product: windows detection: selection: Image|endswith: \mmc.exe ImageLoaded|endswith: - \vbscript.dll - \jscript.dll - \jscript9.dll condition: selection falsepositives: - Legitimate MMC operations or extensions loading these libraries level: medium
Near-miss passage: Sigma rule: Detects PowerShell scripts to set the ACL to a file in the Windows folder. Logsource: windows / process_creation. Rule: title: PowerShell Set-Acl On Windows Folder id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 related: - id: cae80281-ef23-44c5-873b-fd48d2666f49 type: derived - id: bdeb2cff-af74-4094-8426-724dc937f20a type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell scripts to set the ACL to a file in the Windows folder references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1 - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - PowerShell.EXE - pwsh.dll - Image|endswith: - \powershell.exe - \pwsh.exe selection_cmdlet: CommandLine|contains|all: - 'Set-Acl ' - '-AclObject ' selection_paths: CommandLine|contains: - -Path "C:\Windows - -Path 'C:\Windows - -Path %windir% - -Path $env:windir selection_permissions: CommandLine|contains: - FullControl - Allow condition: all of selection_* falsepositives: - Unknown level: high
Query: adversary uses Data from Local System
Matching passage: T1005 Data from Local System. Tactics: collection. Description: Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration. Adversaries may do this using a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), such as [cmd](https://attack.mitre.org/software/S0106) as well as a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008), which have functionality to interact with the file system to gather information.(Citation: show_run_config_cmd_cisco) Adversaries may also use [Automated Collection](https://attack.mitre.org/techniques/T1119) on the local system.
Near-miss passage: T1119 Automated Collection. Tactics: collection. Description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Methods for performing this technique could include use of a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059) to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals. In cloud-based environments, adversaries may also use cloud APIs, data pipelines, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.(Citation: Mandiant UNC3944 SMS Phishing 2023) This functionality could also be built into remote access tools. This technique may incorporate use of other techniques such as [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) and [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570) to identify and move files, as well as [Cloud Service Dashboard](https://attack.mitre.org/techniques/T1538) and [Cloud Storage Object Discovery](https://attack.mitre.org/techniques/T1619) to identify resources in cloud environments.
Query: CVE similar to CVE-2015-2861
Matching passage: CVE-2015-2861. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the authentication of arbitrary users.
Near-miss passage: CVE-2015-2701. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in CS-Cart 4.2.4 allows remote attackers to hijack the authentication of users for requests that change a user password via a request to profiles-update/.
Query: risk of The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold
Matching passage: CVE-2015-1679. CWE: CWE-200. CVSS: 2.0999999046325684. The kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow local users to bypass the ASLR protection mechanism via a crafted function call, aka "Microsoft Windows Kernel Memory Disclosure Vulnerability," a different vulnerability than CVE-2015-1676, CVE-2015-1677, CVE-2015-1678, and CVE-2015-1680.
Near-miss passage: CVE-2015-6303. CWE: CWE-200. CVSS: 4.300000190734863. The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCut36742 and CSCut36844.
Query: common weakness: Buffer Under-read
Matching passage: CWE-127 Buffer Under-read. The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
Near-miss passage: CWE-415 Double Free. The product calls free() twice on the same memory address.
Query: exploit IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and
Matching passage: CVE-2015-4929. CWE: CWE-200. CVSS: 4.0. IBM License Metric Tool 9 before 9.2.1.0 and Endpoint Manager for Software Use Analysis 9 before 9.2.1.0 allow remote authenticated users to bypass intended access restrictions and obtain sensitive information via a REST API request.
Near-miss passage: CVE-2015-5711. CWE: CWE-200. CVSS: 4.0. TIBCO Managed File Transfer Internet Server before 7.2.5, Managed File Transfer Command Center before 7.2.5, Slingshot before 1.9.4, and Vault before 2.0.1 allow remote authenticated users to obtain sensitive information via a crafted HTTP request.
Query: Sigma rule for Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Matching passage: Sigma rule: Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added To Highly Privileged Group id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 type: similar status: test description: Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember". references: - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - Group Policy Creator Owners - Schema Admins condition: all of selection_* falsepositives: - Administrative activity that must be investigated level: high
Near-miss passage: Sigma rule: Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade pare. Logsource: windows / process_creation. Rule: title: WSL Child Process Anomaly id: 2267fe65-0681-42ad-9a6d-46553d3f3480 related: - id: dec44ca7-61ad-493c-bfd7-8819c5faa09b type: derived status: test description: Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/ - https://twitter.com/nas_bench/status/1535431474429808642 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-23 modified: 2023-08-15 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \wsl.exe - \wslhost.exe selection_children_images: Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_children_paths: Image|contains: - \AppData\Local\Temp\ - C:\Users\Public\ - C:\Windows\Temp\ - C:\Temp\ - \Downloads\ - \Desktop\ condition: selection_parent and 1 of selection_children_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-8796
Matching passage: CVE-2015-8796. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/schema-browser.js in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.
Near-miss passage: CVE-2015-8834. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a long comment that is improperly stored because of limitations on the MySQL TEXT data type. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3440.
Query: risk of system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object
Matching passage: CVE-2015-5687. CWE: CWE-94. CVSS: 7.5. system/session/drivers/cookie.php in Anchor CMS 0.9.x allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in a cookie.
Near-miss passage: CVE-2015-3640. CWE: CWE-94. CVSS: 7.5. phpMyBackupPro 2.5 and earlier does not properly escape the "." character in request parameters, which allows remote authenticated users with knowledge of a web-accessible and web-writeable directory on the target system to inject and execute arbitrary PHP scripts by injecting scripts via the path, filename, and dirs parameters to scheduled.php, and making requests to injected scripts.
Query: vulnerability: Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors re
Matching passage: CVE-2015-2576. CWE: UNKNOWN. CVSS: 2.0999999046325684. Unspecified vulnerability in the MySQL Utilities component in Oracle MySQL 1.5.1 and earlier, when running on Windows, allows local users to affect integrity via unknown vectors related to Installation.
Near-miss passage: CVE-2015-2853. CWE: UNKNOWN. CVSS: 6.800000190734863. Session fixation vulnerability in the WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 allows remote attackers to hijack web sessions by providing a session ID.
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Exfiltration Over Physical Medium
Matching passage: Playbook for T1052 Exfiltration Over Physical Medium. 1) Validate alert telemetry against T1052. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: exfiltration. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or devi
Near-miss passage: Playbook for T1052.001 Exfiltration over USB. Different response path focused on exfiltration.
Query: secure coding against Hardware Logic Contains Race Conditions
Matching passage: CWE-1298 Hardware Logic Contains Race Conditions. A race condition in the hardware logic results in undermining security guarantees of the system.
Near-miss passage: CWE-573 Improper Following of Specification by Caller. The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
Query: detection rule: Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260
Matching passage: Sigma rule: Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260. Logsource: windows / process_creation. Rule: title: Suspicious LNK Command-Line Padding with Whitespace Characters id: dd8756e7-a3a0-4768-b47e-8f545d1a751c status: experimental description: 'Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks. ' references: - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415 - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-03-19 tags: - attack.initial-access - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection_img: - ParentImage|endswith: \explorer.exe - ParentCommandLine|contains: .lnk selection_cmd: - CommandLine|contains: - ' ' - \u0009 - \u000A - \u0011 - \u0012 - \u0013 - \u000B - \u000C - \u000D - CommandLine|re: \n\n\n\n\n\n condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to t. Logsource: kubernetes / application / audit. Rule: title: Container With A hostPath Mount Created id: 402b955c-8fe0-4a8c-b635-622b4ac5f902 status: test description: 'Detects creation of a container with a hostPath mount. A hostPath volume mounts a directory or a file from the node to the container. Attackers who have permissions to create a new pod in the cluster may create one with a writable hostPath volume and chroot to escape to the underlying node. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/ - https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216 author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1611 - attack.privilege-escalation logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods hostPath: '*' condition: selection falsepositives: - The DaemonSet controller creates pods with hostPath volumes within the kube-system namespace. level: low
Query: describe CVE-2015-2197
Matching passage: CVE-2015-2197. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Entity API module before 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API.
Near-miss passage: CVE-2015-7878. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Taxonomy Find module 6.x-2.x through 6.x-1.2 and 7.x-2.x through 7.x-1.0 in Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via taxonomy vocabulary and term names.
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET o
Matching passage: CVE-2015-4310. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Cisco Finesse 10.5(1) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug IDs CSCuq82322, CSCut95853, and CSCuq73975.
Near-miss passage: CVE-2015-2973. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the Welcart plugin before 1.4.18 for WordPress allow remote attackers to inject arbitrary web script or HTML via the usces_referer parameter to (1) classes/usceshop.class.php, (2) includes/edit-form-advanced.php, (3) includes/edit-form-advanced30.php, (4) includes/edit-form-advanced34.php, (5) includes/member_edit_form.php, (6) includes/order_edit_form.php, (7) includes/order_list.php, or (8) includes/usces_item_master_list.php, related to admin.php.
Query: CVE similar to CVE-2015-8024
Matching passage: CVE-2015-8024. CWE: CWE-78. CVSS: 9.300000190734863. McAfee Enterprise Security Manager (ESM), Enterprise Security Manager/Log Manager (ESMLM), and Enterprise Security Manager/Receiver (ESMREC) 9.3.x before 9.3.2MR19, 9.4.x before 9.4.2MR9, and 9.5.x before 9.5.0MR8, when configured to use Active Directory or LDAP authentication sources, allow remote attackers to bypass authentication by logging in with the username "NGCP|NGCP|NGCP;" and any password.
Near-miss passage: CVE-2015-6396. CWE: CWE-78. CVSS: 7.800000190734863. The CLI command parser on Cisco RV110W, RV130W, and RV215W devices allows local users to execute arbitrary shell commands as an administrator via crafted parameters, aka Bug IDs CSCuv90134, CSCux58161, and CSCux73567.
Query: detect Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing event in logs
Matching passage: Sigma rule: Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing event. Logsource: windows / registry_event. Rule: title: Disable Security Events Logging Adding Reg Key MiniNt id: 919f2ef0-be2d-4a7a-b635-eb2b41fde044 status: test description: Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events. references: - https://twitter.com/0gtweet/status/1182516740955226112 - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Ilyas Ochkov, oscd.community date: 2019-10-25 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: registry_event product: windows detection: selection: - TargetObject: HKLM\SYSTEM\CurrentControlSet\Control\MiniNt EventType: CreateKey - NewName: HKLM\SYSTEM\CurrentControlSet\Control\MiniNt condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when full data export is attempted an unauthorized user.. Logsource: bitbucket / audit. Rule: title: Bitbucket Unauthorized Full Data Export Triggered id: 34d81081-03c9-4a7f-91c9-5e46af625cde status: test description: Detects when full data export is attempted an unauthorized user. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.collection - attack.resource-development - attack.t1213.003 - attack.t1586 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Data pipeline auditType.action: Unauthorized full data export triggered condition: selection falsepositives: - Unlikely level: critical
Query: CVE similar to CVE-2015-5357
Matching passage: CVE-2015-5357. CWE: CWE-399. CVSS: 5.0. The Juniper EX4600, QFX3500, QFX3600, and QFX5100 switches with Junos 13.2X51-D15 through 13.2X51-D25, 13.2X51 before 13.2X51-D30, and 14.1X53 before 14.1X53-D10 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Near-miss passage: CVE-2015-5058. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11.5.1 HF10, 11.5.3 before HF1, and 11.6.0 before HF5, BIG-IQ Cloud, Device, and Security 4.4.0 through 4.5.0, and BIG-IQ ADC 4.5.0 allows remote attackers to cause a denial of service (memory consumption) via a large number of crafted ICMP packets.