alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load
Matching passage: Sigma rule: Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load. Logsource: linux / auditd. Rule: title: System Info Discovery via Sysinfo Syscall id: b207d563-a1d9-4275-b349-77d1eb55aa6d status: experimental description: 'Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it''s a viable target. ' references: - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md - https://man7.org/linux/man-pages/man2/sysinfo.2.html author: Milad Cheraghi date: 2025-05-30 modified: 2025-12-05 tags: - attack.discovery - attack.t1057 - attack.t1082 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b64 -S sysinfo -k discovery_sysinfo_syscall -a always,exit -F arch=b32 -S sysinfo -k discovery_sysinfo_syscall ' detection: selection: type: SYSCALL SYSCALL: sysinfo filter_optional_splunk: exe|endswith: /bin/splunkd condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate administrative activity level: low
Near-miss passage: Sigma rule: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout. Logsource: windows / registry_set. Rule: title: Suspicious Keyboard Layout Load id: 34aa0252-6039-40ff-951f-939fd6ce47d8 status: test description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only references: - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files author: Florian Roth (Nextron Systems) date: 2019-10-12 modified: 2023-08-17 tags: - attack.resource-development - attack.t1588.002 logsource: category: registry_set product: windows definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files' detection: selection_registry: TargetObject|contains: - \Keyboard Layout\Preload\ - \Keyboard Layout\Substitutes\ Details|contains: - 00000429 - 00050429 - 0000042a condition: selection_registry falsepositives: - Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base) level: medium
Query: describe CVE-2015-0782
Matching passage: CVE-2015-0782. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in the ScheduleQuery method of the schedule class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-2237. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Betster (aka PHP Betoffice) 1.0.4 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) showprofile.php or (2) categoryedit.php or (3) username parameter in a login to index.php.
Query: detection rule: Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.
Matching passage: Sigma rule: Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Inline JavaScript Execution via NodeJS Binary id: 8537c866-072e-460d-bfff-aaf39cbd73d3 status: experimental description: Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line. references: - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/ author: Microsoft (idea), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-21 tags: - attack.execution - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \node.exe - OriginalFileName: node.exe - Product: Node.js selection_cmd: CommandLine|contains|all: - http - execSync - spawn - fs - path - zlib condition: all of selection_* falsepositives: - Legitimate scripts using Node.js with these modules level: medium
Near-miss passage: Sigma rule: Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing. Logsource: windows / registry_set. Rule: title: Suspicious Space Characters in RunMRU Registry Path - ClickFix id: 7a1b4c5e-8f3d-4b9a-7c2e-1f4a5b8c6d9e related: - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8 type: similar status: experimental description: 'Detects the occurrence of numerous space characters in RunMRU registry paths, which may indicate execution via phishing lures using clickfix techniques to hide malicious commands in the Windows Run dialog box from naked eyes. ' references: - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://github.com/JohnHammond/recaptcha-phish author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-04 tags: - attack.execution - attack.stealth - attack.t1204.004 - attack.t1027.010 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\ Details|contains: '#' selection_space_variation: Details|contains: - - - - - - - - - - - - - ' ' condition: all of selection_* falsepositives: - Unlikely level: high
Query: detection rule: Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands
Matching passage: Sigma rule: Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands. Logsource: windows / application. Rule: title: MSSQL XPCmdshell Suspicious Execution id: 7f103213-a04e-4d59-8261-213dddf22314 status: test description: Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands references: - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2024-06-26 tags: - attack.execution logsource: product: windows service: application definition: 'Requirements: MSSQL audit policy to monitor for "xp_cmdshell" must be enabled in order to receive this event in the application log (Follow this tutorial https://dba.stackexchange.com/questions/103183/is-there-any-way-to-monitor-execution-of-xp-cmdshell-in-sql-server-2012)' detection: selection: Provider_Name|contains: MSSQL EventID: 33205 Data|contains|all: - object_name:xp_cmdshell - statement:EXEC condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PowerShell calling a credential prompt. Logsource: windows / ps_script. Rule: title: PowerShell Credential Prompt id: ca8b77a9-d499-4095-b793-5d5f330d450e status: test description: Detects PowerShell calling a credential prompt references: - https://twitter.com/JohnLaTwC/status/850381440629981184 - https://t.co/ezOTGy1a1G author: John Lambert (idea), Florian Roth (Nextron Systems) date: 2017-04-09 modified: 2022-12-25 tags: - attack.credential-access - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: PromptForCredential condition: selection falsepositives: - Unknown level: high
Query: exploit The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.
Matching passage: CVE-2015-8900. CWE: CWE-835. CVSS: 5.5. The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) via a crafted HDR file.
Near-miss passage: CVE-2015-8558. CWE: CWE-835. CVSS: 5.5. The ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop and CPU consumption) via a circular isochronous transfer descriptor (iTD) list.
Query: Sigma YAML for windows / file_delete
Matching passage: Sigma rule: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operati. Logsource: windows / file_delete. Rule: title: Backup Files Deleted id: 06125661-3814-4e03-bfa2-1e4411c60ac3 status: test description: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files author: frack113 date: 2022-01-02 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: product: windows category: file_delete detection: selection: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wt.exe - \rundll32.exe - \regsvr32.exe TargetFilename|endswith: - .VHD - .bac - .bak - .wbcat - .bkf - .set - .win - .dsk condition: selection falsepositives: - Legitimate usage level: medium
Near-miss passage: Sigma rule: Detects when a new credential is added to an existing application. Any additional credentials added outside of expected. Logsource: azure / auditlogs. Rule: title: Added Credentials to Existing Application id: cbb67ecc-fb70-4467-9350-c910bdf7c628 status: test description: Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-05-26 modified: 2025-07-18 tags: - attack.privilege-escalation - attack.t1098.001 - attack.persistence logsource: product: azure service: auditlogs detection: selection: properties.message: - Update application – Certificates and secrets management - Update Service principal/Update Application condition: selection falsepositives: - When credentials are added/removed as part of the normal working hours/workflows level: high
Query: describe CVE-2015-8314
Matching passage: CVE-2015-8314. CWE: CWE-312. CVSS: 7.5. The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
Near-miss passage: CVE-2015-1012. CWE: CWE-312. CVSS: 7.5. Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access.
Query: write Sigma for Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.
Matching passage: Sigma rule: Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.. Logsource: windows / process_creation. Rule: title: HackTool - RemoteKrbRelay Execution id: a7664b14-75fb-4a50-a223-cb9bc0afbacf status: test description: 'Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata. ' references: - https://github.com/CICADA8-Research/RemoteKrbRelay author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-27 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \RemoteKrbRelay.exe - OriginalFileName: RemoteKrbRelay.exe selection_cli_required: CommandLine|contains|all: - ' -clsid ' - ' -target ' - ' -victim ' selection_cli_attack_smb: CommandLine|contains|all: - '-smb ' - '--smbkeyword ' CommandLine|contains: - interactive - secrets - service-add selection_cli_attack_rbcd_main: CommandLine|contains: '-rbcd ' selection_cli_attack_rbcd_options: CommandLine|contains: - '-cn ' - '--computername ' selection_cli_attack_changepass: CommandLine|contains: '-chp ' CommandLine|contains|all: - '-chpPass ' - '-chpUser ' selection_cli_attack_addgrpname: CommandLine|contains|all: - '-addgroupmember ' - '-group ' - '-groupuser ' condition: selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting at. Logsource: linux / vsftpd. Rule: title: Suspicious VSFTPD Error Messages id: 377f33a1-4b36-4ee1-acee-1dbe4b43cfbe status: test description: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/dagwieers/vsftpd/ author: Florian Roth (Nextron Systems) date: 2017-07-05 modified: 2021-11-27 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: vsftpd detection: keywords: - 'Connection refused: too many sessions for this address.' - 'Connection refused: tcp_wrappers denial.' - Bad HTTP verb. - port and pasv both active - pasv and port both active - Transfer done (but failed to open directory). - Could not set file modification time. - 'bug: pid active in ptrace_sandbox_free' - PTRACE_SETOPTIONS failure - 'weird status:' - couldn't handle sandbox event - syscall * out of bounds - 'syscall not permitted:' - 'syscall validate failed:' - Input line too long. - poor buffer accounting in str_netfd_alloc - vsf_sysutil_read_loop condition: keywords falsepositives: - Unknown level: medium
Query: vulnerability: Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 and 12.2.4 allows remote authenticated users to affect confidentiality via unkn
Matching passage: CVE-2015-4762. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Applications DBA component in Oracle E-Business Suite 12.2.3 and 12.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Online patching.
Near-miss passage: CVE-2015-1414. CWE: UNKNOWN. CVSS: 7.800000190734863. Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.
Query: describe CVE-2015-2202
Matching passage: CVE-2015-2202. CWE: CWE-20. CVSS: 7.199999809265137. Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
Near-miss passage: CVE-2015-2081. CWE: CWE-20. CVSS: 9.800000190734863. Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.
Query: playbook for alert: Multiple failed authentications followed by Local Storage Discovery
Matching passage: Playbook for T1680 Local Storage Discovery. 1) Validate alert telemetry against T1680. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: discovery. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number. This can be done to prepare for ransomware-related encryption, to perform [Lateral Movement](https://attack.mitre.org/tactics/TA0109), or as a precursor to [Direct Volume Access](https://attack.mitre.org/techniques/T1006). On ESXi systems, adversaries may use [Hyper
Near-miss passage: Playbook for T1069 Permission Groups Discovery. Different response path focused on discovery.
Query: SOC alert related to Publish/Subscribe Protocols
Matching passage: T1071.005 Publish/Subscribe Protocols. Tactics: command and control. Description: Adversaries may communicate using publish/subscribe (pub/sub) application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Protocols such as <code>MQTT</code>, <code>XMPP</code>, <code>AMQP</code>, and <code>STOMP</code> use a publish/subscribe design, with message distribution managed by a centralized broker.(Citation: wailing crab sub/pub)(Citation: Mandiant APT1 Appendix) Publishers categorize their messages by topics, while subscribers receive messages according to their subscribed topics.(Citation: wailing crab sub/pub) An adversary may abuse publish/subscribe protocols to communicate with systems under their control from behind a message broker while also mimicking normal, expected traffic.
Near-miss passage: T1071 Application Layer Protocol. Tactics: command and control. Description: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, DNS, or publishing/subscribing. For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Query: patch priority for CVE-2015-4283
Matching passage: CVE-2015-4283. CWE: CWE-399. CVSS: 7.800000190734863. Cisco Videoscape Policy Resource Manager (PRM) 3.5.4 allows remote attackers to cause a denial of service (CPU and memory consumption, and TCP service outage) via (1) a SYN flood or (2) another type of TCP traffic flood, aka Bug IDs CSCuu35104 and CSCuu35128.
Near-miss passage: CVE-2015-4200. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (memory consumption) by triggering an error during CPE negotiation, aka Bug ID CSCug00885.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / registry_set. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - REG id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 related: - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider filter: TargetObject|contains: - \System\CurrentControlSet\Services\WebClient\NetworkProvider - \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider - \System\CurrentControlSet\Services\RDPNP\NetworkProvider filter_valid_procs: Image: C:\Windows\System32\poqexec.exe condition: selection and not 1 of filter* falsepositives: - Other legitimate network providers used and not filtred in this rule level: medium
Near-miss passage: Sigma rule: Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to lo. Logsource: windows / registry_set. Rule: title: Default RDP Port Changed to Non Standard Port id: 509e84b9-a71a-40e0-834f-05470369bd1e status: test description: 'Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md author: frack113 date: 2022-01-01 modified: 2024-03-25 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Terminal Server\WinStations\RDP-Tcp\PortNumber filter_main_port: Details: DWORD (0x00000d3d) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml simulation: - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Powershell technique: T1021.001 atomic_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771 - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Command_Prompt technique: T1021.001 atomic_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73
Query: CVE similar to CVE-2015-7882
Matching passage: CVE-2015-7882. CWE: CWE-287. CVSS: 8.100000381469727. Improper handling of LDAP authentication in MongoDB Server versions 3.0.0 to 3.0.6 allows an unauthenticated client to gain unauthorized access.
Near-miss passage: CVE-2015-2033. CWE: CWE-287. CVSS: 10.0. Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.