alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typ
Matching passage: Sigma rule: When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typ. Logsource: windows / file_event. Rule: title: Dynamic CSharp Compile Artefact id: e4a74e34-ecde-4aab-b2fb-9112dd01aed0 status: test description: 'When C# is compiled dynamically, a .cmdline file will be created as a part of the process. Certain processes are not typically observed compiling C# code, but can do so without touching disk. This can be used to unpack a payload for execution ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.004/T1027.004.md#atomic-test-2---dynamic-c-compile author: frack113 date: 2022-01-09 modified: 2023-02-17 tags: - attack.stealth - attack.t1027.004 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .cmdline condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accou. Logsource: windows / ps_script. Rule: title: Get-ADUser Enumeration Using UserAccountControl Flags id: 96c982fe-3d08-4df4-bed2-eb14e02f21c8 status: test description: Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md#atomic-test-11---get-aduser-enumeration-using-useraccountcontrol-flags-as-rep-roasting - https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/ author: frack113 date: 2022-03-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ADUser - -Filter - useraccountcontrol - -band - '4194304' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Query: vulnerability: The dissect_ber_GeneralizedTime function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly checks an sscanf r
Matching passage: CVE-2015-8720. CWE: CWE-20. CVSS: 5.5. The dissect_ber_GeneralizedTime function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly checks an sscanf return value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-8476. CWE: CWE-20. CVSS: 5.0. Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in an (1) email address to the validateAddress function in class.phpmailer.php or (2) SMTP command to the sendCommand function in class.smtp.php, a different vulnerability than CVE-2012-0796.
Query: secure coding against Permissive Cross-domain Security Policy with Untrusted Domains
Matching passage: CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains. The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
Near-miss passage: CWE-675 Multiple Operations on Resource in Single-Operation Context. The product performs the same operation on a resource two or more times, when the operation should only be applied once.
Query: risk of SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
Matching passage: CVE-2015-5893. CWE: CWE-200. CVSS: 2.0999999046325684. SMBClient in SMB in Apple OS X before 10.11 allows local users to obtain sensitive kernel memory-layout information via unspecified vectors.
Near-miss passage: CVE-2015-4980. CWE: CWE-200. CVSS: 4.0. Unspecified vulnerability in IBM WebSphere Commerce 7.0.0.6 through 7.0.0.9 allows remote authenticated users to obtain sensitive personal information via unknown vectors.
Query: write Sigma for Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be
Matching passage: Sigma rule: Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be. Logsource: windows / process_creation. Rule: title: Findstr GPP Passwords id: 91a2c315-9ee6-4052-a853-6f6a8238f90d status: test description: Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.006/T1552.006.md#atomic-test-1---gpp-passwords-findstr author: frack113 date: 2021-12-27 modified: 2023-11-11 tags: - attack.credential-access - attack.t1552.006 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_cli: CommandLine|contains|all: - cpassword - \sysvol\ - .xml condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_gpp_passwords/info.yml simulation: - type: atomic-red-team name: GPP Passwords (findstr) technique: T1552.006 atomic_guid: 870fe8fb-5e23-4f5f-b89d-dd7fe26f3b5f
Near-miss passage: Sigma rule: Detects the addition of the 'MiniNt' key to the registry. Upon a reboot, Windows Event Log service will stop writing eve. Logsource: windows / registry_set. Rule: title: Security Event Logging Disabled via MiniNt Registry Key - Registry Set id: 8839e550-52d7-4958-9f2f-e13c1e736838 related: - id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 type: similar status: experimental description: 'Detects the addition of the ''MiniNt'' key to the registry. Upon a reboot, Windows Event Log service will stop writing events. Windows Event Log is a service that collects and stores event logs from the operating system and applications. It is an important component of Windows security and auditing. Adversary may want to disable this service to disable logging of security events which could be used to detect their activities. ' references: - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: registry_set product: windows detection: selection: TargetObject: HKLM\System\CurrentControlSet\Control\MiniNt\(Default) condition: selection falsepositives: - Highly Unlikely level: high
Query: vulnerability: The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or 
Matching passage: CVE-2015-9466. CWE: CWE-89. CVSS: 9.800000190734863. The wti-like-post plugin before 1.4.3 for WordPress has WtiLikePostProcessVote SQL injection via the HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, HTTP_X_FORWARDED, HTTP_FORWARDED_FOR, or HTTP_FORWARDED variable.
Near-miss passage: CVE-2015-1518. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the search_post function in includes/search.php in Redaxscript before 2.3.0 allows remote attackers to execute arbitrary SQL commands via the search_terms parameter.
Query: describe CVE-2015-5675
Matching passage: CVE-2015-5675. CWE: CWE-264. CVSS: 7.800000190734863. The sys_amd64 IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic).
Near-miss passage: CVE-2015-0006. CWE: CWE-264. CVSS: 6.099999904632568. The Network Location Awareness (NLA) service in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not perform mutual authentication to determine a domain connection, which allows remote attackers to trigger an unintended permissive configuration by spoofing DNS and LDAP responses on a local network, aka "NLA Security Feature Bypass Vulnerability."
Query: exploit Webservice-DIC yoyaku_v41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors.
Matching passage: CVE-2015-2977. CWE: CWE-20. CVSS: 7.5. Webservice-DIC yoyaku_v41 allows remote attackers to create arbitrary files, and consequently execute arbitrary code, via unspecified vectors.
Near-miss passage: CVE-2015-0751. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800.
Query: CVE similar to CVE-2015-5989
Matching passage: CVE-2015-5989. CWE: CWE-264. CVSS: 9.800000190734863. Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtain administrative privileges via certain changes to LockStatus and Login_Success values.
Near-miss passage: CVE-2015-3865. CWE: CWE-264. CVSS: 9.300000190734863. The Runtime subsystem in Android before 5.1.1 LMY48T allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23050463.
Query: detection rule: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence
Matching passage: Sigma rule: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: IIS WebServer Access Logs Deleted id: 3eb8c339-a765-48cc-a150-4364c04652bf related: - id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 type: similar status: test description: Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence references: - https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-09-16 modified: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|contains: \inetpub\logs\LogFiles\ TargetFilename|endswith: .log condition: selection falsepositives: - During uninstallation of the IIS service - During log rotation level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / security. Rule: title: Invoke-Obfuscation Via Use Rundll32 - Security id: cd0f7229-d16f-42de-8fe3-fba365fbcb3a related: - id: 641a4bfb-c017-44f7-800c-2aee0184ce9b type: derived status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll ServiceFileName|contains: - value - invoke - comspec - iex condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for linux / guacamole
Matching passage: Sigma rule: Detects suspicious session with two users present. Logsource: linux / guacamole. Rule: title: Guacamole Two Users Sharing Session Anomaly id: 1edd77db-0669-4fef-9598-165bda82826d status: test description: Detects suspicious session with two users present references: - https://research.checkpoint.com/2020/apache-guacamole-rce/ author: Florian Roth (Nextron Systems) date: 2020-07-03 modified: 2021-11-27 tags: - attack.credential-access - attack.t1212 logsource: product: linux service: guacamole detection: selection: - (2 users now present) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blo. Logsource: windows / security. Rule: title: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 related: - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar - id: 5588576c-5898-4fac-bcdd-7475a60e8f43 type: similar - id: 0ed99dda-6a35-11ef-8c99-0242ac120002 type: similar status: experimental description: 'Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure, commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,. where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised. ' references: - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.t1557.003 - attack.persistence - attack.privilege-escalation logsource: product: windows service: security definition: 'By default these events are not logged by default for MicrosoftDNS objects in Active Directory. To enable detection, configure an AuditRule on the DNS object container with the "CreateChild" permission for the "Everyone" principal. This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule). ' detection: selection_directory_service_changes: EventID: - 5136 - 5137 ObjectClass: dnsNode ObjectDN|contains|all: - UWhRCA - BAAAA - CN=MicrosoftDNS selection_directory_service_access: EventID: 4662 AdditionalInfo|contains|all: - UWhRCA - BAAAA - CN=MicrosoftDNS condition: 1 of selection_* falsepositives: - Unknown level: high
Query: explain CWE-289
Matching passage: CWE-289 Authentication Bypass by Alternate Name. The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
Near-miss passage: CWE-500 Public Static Field Not Marked Final. An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
Query: vulnerability: The web-based user interface in Cisco Jabber through 9.6(3) and 9.7 through 9.7(5) on Windows allows remote attackers to obtain sensitive information via a crafted value in a GET r
Matching passage: CVE-2015-4218. CWE: CWE-200. CVSS: 5.0. The web-based user interface in Cisco Jabber through 9.6(3) and 9.7 through 9.7(5) on Windows allows remote attackers to obtain sensitive information via a crafted value in a GET request, aka Bug IDs CSCuu65622 and CSCuu70858.
Near-miss passage: CVE-2015-4375. CWE: CWE-200. CVSS: 4.300000190734863. The Chaos tool suite (ctools) module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via (1) an autocomplete search on custom entities without an access query tag or (2) leveraging knowledge of the ID of an entity.
Query: exploit Cross-site scripting (XSS) vulnerability in Mailbird 2.0.16.0 and earlier allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted U
Matching passage: CVE-2015-4657. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Mailbird 2.0.16.0 and earlier allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted URL.
Near-miss passage: CVE-2015-2207. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selection, (3) _scroll, (4) tableName, (5) parent, (6) circuit, (7) return, (8) xname, or (9) mpTransactionId parameter.
Query: indicators of Hide Artifacts
Matching passage: T1564 Hide Artifacts. Tactics: stealth. Description: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015) Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
Near-miss passage: T1564.004 NTFS File Attributes. Tactics: stealth. Description: Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014) Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)
Query: rule covering Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
Matching passage: Sigma rule: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells. Logsource: windows / process_creation. Rule: title: Chopper Webshell Process Pattern id: fa3c117a-bc0d-416e-a31b-0c0e80653efb status: test description: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells references: - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/ author: Florian Roth (Nextron Systems), MSTI (query) date: 2022-10-01 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_origin: - Image|endswith: \w3wp.exe - ParentImage|endswith: \w3wp.exe selection_cmdline: CommandLine|contains: - '&ipconfig&echo' - '&quser&echo' - '&whoami&echo' - '&c:&echo' - '&cd&echo' - '&dir&echo' - '&echo [E]' - '&echo [S]' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of certutil with certain flags that allow the utility to download files.. Logsource: windows / process_creation. Rule: title: Suspicious Download Via Certutil.EXE id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b related: - id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829 type: similar status: test description: Detects the execution of certutil with certain flags that allow the utility to download files. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/egre55/status/1087685529016193025 - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 modified: 2025-12-01 tags: - attack.stealth - attack.t1027 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_flags: CommandLine|contains: - 'urlcache ' - 'verifyctl ' - 'URL ' selection_http: CommandLine|contains: http condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download/info.yml
Query: exploit EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM
Matching passage: CVE-2015-6851. CWE: CWE-284. CVSS: 6.699999809265137. EMC RSA SecurID Web Agent before 8.0 allows physically proximate attackers to bypass the privacy-screen protection mechanism by leveraging an unattended workstation and running DOM Inspector.
Near-miss passage: CVE-2015-3116. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3125, and CVE-2015-5116.
Query: exploit The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
Matching passage: CVE-2015-1814. CWE: CWE-264. CVSS: 7.5. The API token-issuing service in Jenkins before 1.606 and LTS before 1.596.2 allows remote attackers to gain privileges via a "forced API token change" involving anonymous users.
Near-miss passage: CVE-2015-6100. CWE: CWE-264. CVSS: 6.900000095367432. The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-6101.