alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution
Matching passage: Sigma rule: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution. Logsource: windows / process_creation. Rule: title: Potential Manage-bde.wsf Abuse To Proxy Execution id: c363385c-f75d-4753-a108-c1a8e28bdbda status: test description: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution references: - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/ - https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712 - https://twitter.com/bohops/status/980659399495741441 - https://twitter.com/JohnLaTwC/status/1223292479270600706 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-13 modified: 2023-02-03 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_wscript_img: - Image|endswith: \wscript.exe - OriginalFileName: wscript.exe selection_wscript_cli: CommandLine|contains: manage-bde.wsf selection_parent: ParentImage|endswith: - \cscript.exe - \wscript.exe ParentCommandLine|contains: manage-bde.wsf selection_filter_cmd: Image|endswith: \cmd.exe condition: all of selection_wscript_* or (selection_parent and not selection_filter_cmd) falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: RDP login with localhost source address may be a tunnelled login. Logsource: windows / security. Rule: title: RDP Login from Localhost id: 51e33403-2a37-4d66-a574-1fda1782cc31 status: test description: RDP login with localhost source address may be a tunnelled login references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html author: Thomas Patzke date: 2019-01-28 modified: 2022-10-09 tags: - attack.lateral-movement - car.2013-07-002 - attack.t1021.001 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 10 IpAddress: - ::1 - 127.0.0.1 condition: selection falsepositives: - Unknown level: high
Query: detect Detect standard users login that are part of high privileged groups such as the Administrator group in logs
Matching passage: Sigma rule: Detect standard users login that are part of high privileged groups such as the Administrator group. Logsource: windows / lsa-server. Rule: title: Standard User In High Privileged Group id: 7ac407cc-0f48-4328-aede-de1d2e6fef41 status: test description: Detect standard users login that are part of high privileged groups such as the Administrator group references: - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers - https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml author: frack113 date: 2023-01-13 modified: 2023-05-05 tags: - attack.credential-access - attack.privilege-escalation logsource: product: windows service: lsa-server definition: 'Requirements: Microsoft-Windows-LSA/Operational (199FE037-2B82-40A9-82AC-E1D46C792B99) Event Log must be enabled and collected in order to use this rule.' detection: selection: EventID: 300 TargetUserSid|startswith: S-1-5-21- SidList|contains: - S-1-5-32-544 - -500} - -518} - -519} filter_main_admin: TargetUserSid|endswith: - '-500' - '-518' - '-519' condition: selection and not 1 of filter_main_* falsepositives: - Standard domain users who are part of the administrator group. These users shouldn't have these right. But in the case where it's necessary. They should be filtered out using the "TargetUserName" field level: medium
Near-miss passage: Sigma rule: Detect the harvesting of wifi credentials using netsh.exe. Logsource: windows / process_creation. Rule: title: Harvesting Of Wifi Credentials Via Netsh.EXE id: 42b1a5b8-353f-4f10-b256-39de4467faff status: test description: Detect the harvesting of wifi credentials using netsh.exe references: - https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/ author: Andreas Hunkeler (@Karneades), oscd.community date: 2020-04-20 modified: 2023-02-13 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - wlan - ' s' - ' p' - ' k' - =clear condition: all of selection_* falsepositives: - Unknown level: medium
Query: patch priority for CVE-2015-3854
Matching passage: CVE-2015-3854. CWE: CWE-284. CVSS: 7.5. packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement via a broadcast intent with the PNW.stopSaver action, aka internal bug 20918350.
Near-miss passage: CVE-2015-3067. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3072, CVE-2015-3073, and CVE-2015-3074.
Query: detect Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand in logs
Matching passage: Sigma rule: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand. Logsource: windows / process_creation. Rule: title: Possible Privilege Escalation via Weak Service Permissions id: d937b75f-a665-4480-88a5-2f20e9f9b22a status: test description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://pentestlab.blog/2017/03/30/weak-service-permissions/ author: Teymur Kheirkhabarov date: 2019-10-26 modified: 2024-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: scbynonadmin: Image|endswith: \sc.exe IntegrityLevel: - Medium - S-1-16-8192 selection_binpath: CommandLine|contains|all: - config - binPath selection_failure: CommandLine|contains|all: - failure - command condition: scbynonadmin and 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato). Logsource: windows / process_creation. Rule: title: WhoAmI as Parameter id: e9142d84-fbe0-401d-ac50-3e519fb00c89 status: test description: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato) references: - https://twitter.com/blackarrowsec/status/1463805700602224645?s=12 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2022-12-25 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .exe whoami condition: selection falsepositives: - Unknown level: high
Query: exploit IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to obtain sensitive information via a craf
Matching passage: CVE-2015-1982. CWE: CWE-200. CVSS: 4.0. IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to obtain sensitive information via a crafted request, which reveals the full path in an error message.
Near-miss passage: CVE-2015-0997. CWE: CWE-200. CVSS: 5.0. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.
Query: detect Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be h in logs
Matching passage: Sigma rule: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be h. Logsource: windows / ps_script. Rule: title: Abuse of Service Permissions to Hide Services Via Set-Service - PS id: 953945c5-22fe-4a92-9f8a-a9edc1e522da related: - id: 514e4c3a-c77d-4cde-a00f-046425e2301e type: similar status: test description: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7) references: - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-17 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Set-Service ' - DCLCWPDTSD ScriptBlockText|contains: - '-SecurityDescriptorSddl ' - '-sd ' condition: selection falsepositives: - Rare intended use of hidden services - Rare FP could occur due to the non linearity of the ScriptBlockText log level: high
Near-miss passage: Sigma rule: Detects the execution of 'sudo' command with '--chroot' option, which is used to change the root directory for command e. Logsource: linux / process_creation. Rule: title: Linux Sudo Chroot Execution id: f2bed782-994e-4f40-9cd5-518198cb3fba status: experimental description: 'Detects the execution of ''sudo'' command with ''--chroot'' option, which is used to change the root directory for command execution. Attackers may use this technique to evade detection and execute commands in a modified environment. This can be part of a privilege escalation strategy, as it allows the execution of commands with elevated privileges in a controlled environment as seen in CVE-2025-32463. While investigating, look out for unusual or unexpected use of ''sudo --chroot'' in conjunction with other commands or scripts such as execution from temporary directories or unusual user accounts. ' references: - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh author: Swachchhanda Shrawn Poudel (Nextron Systems) date: 2025-10-02 tags: - attack.privilege-escalation - attack.t1068 logsource: category: process_creation product: linux detection: selection: Image|endswith: /sudo CommandLine|contains: - ' --chroot ' - 'sudo -R ' condition: selection falsepositives: - Legitimate administrative tasks or scripts that use 'sudo --chroot' for containerization, testing, or system management. level: low
Query: risk of Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.
Matching passage: CVE-2015-6644. CWE: CWE-200. CVSS: 3.299999952316284. Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.
Near-miss passage: CVE-2015-0087. CWE: CWE-200. CVSS: 5.0. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to obtain sensitive information from kernel memory, and possibly bypass the KASLR protection mechanism, via a crafted font, aka "Adobe Font Driver Information Disclosure Vulnerability," a different vulnerability than CVE-2015-0089.
Query: risk of The Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3 before 6.3.6 and 7.1 before 7.1.3 on Linux and AIX uses world-writable permissions for
Matching passage: CVE-2015-4927. CWE: CWE-264. CVSS: 7.199999809265137. The Reporting and Monitoring component in Tivoli Monitoring in IBM Tivoli Storage Manager 6.3 before 6.3.6 and 7.1 before 7.1.3 on Linux and AIX uses world-writable permissions for unspecified files, which allows local users to gain privileges by writing to a file.
Near-miss passage: CVE-2015-7919. CWE: CWE-264. CVSS: 10.0. SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of service (application crash), via unspecified vectors.
Query: CVE similar to CVE-2015-9385
Matching passage: CVE-2015-9385. CWE: CWE-79. CVSS: 6.099999904632568. The quotes-and-tips plugin before 1.20 for WordPress has XSS.
Near-miss passage: CVE-2015-9366. CWE: CWE-79. CVSS: 6.099999904632568. Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().
Query: CVE similar to CVE-2015-1014
Matching passage: CVE-2015-1014. CWE: CWE-427. CVSS: 7.300000190734863. A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3.5 with version v7.20 of Vijeo Citect/CitectSCADA.. If the application attempts to open that file, the application could crash or allow the attacker to execute arbitrary code. Schneider Electric recommends vulnerable users upgrade the OFS to V3.5 and install the latest service pack (SP 6 or newer) for their associated version.
Near-miss passage: CVE-2015-0415. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Session Management.
Query: rule covering Detects usage of the 'chattr' utility to remove immutable file attribute.
Matching passage: Sigma rule: Detects usage of the 'chattr' utility to remove immutable file attribute.. Logsource: linux / process_creation. Rule: title: Remove Immutable File Attribute id: 34979410-e4b5-4e5d-8cfb-389fdff05c12 related: - id: a5b977d6-8a81-4475-91b9-49dbfcd941f7 type: derived status: test description: Detects usage of the 'chattr' utility to remove immutable file attribute. references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: /chattr CommandLine|contains: ' -i ' condition: selection falsepositives: - Administrator interacting with immutable files (e.g. for instance backups). level: medium
Near-miss passage: Sigma rule: Detect when users are authenticating without MFA being required.. Logsource: azure / signinlogs. Rule: title: Azure AD Only Single Factor Authentication Required id: 28eea407-28d7-4e42-b0be-575d5ba60b2c status: test description: Detect when users are authenticating without MFA being required. references: - https://learn.microsoft.com/en-gb/entra/architecture/security-operations-user-accounts author: MikeDuddington, '@dudders1' date: 2022-07-27 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.defense-impairment - attack.t1078.004 - attack.t1556.006 logsource: product: azure service: signinlogs detection: selection: Status: Success AuthenticationRequirement: singleFactorAuthentication condition: selection falsepositives: - If this was approved by System Administrator. level: low
Query: risk of A vulnerability was found in tynx wuersch and classified as critical. Affected by this issue is the function packValue/getByCustomQuery of the file backend/base/Store.class.php. Th
Matching passage: CVE-2015-10066. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in tynx wuersch and classified as critical. Affected by this issue is the function packValue/getByCustomQuery of the file backend/base/Store.class.php. The manipulation leads to sql injection. The patch is identified as 66d4718750a741d1053d327a79e285fd50372519. It is recommended to apply a patch to fix this issue. VDB-218462 is the identifier assigned to this vulnerability.
Near-miss passage: CVE-2015-10039. CWE: CWE-89. CVSS: 8.0. A vulnerability was found in dobos domino. It has been rated as critical. Affected by this issue is some unknown functionality in the library src/Complex.Domino.Lib/Lib/EntityFactory.cs. The manipulation leads to sql injection. Upgrading to version 0.1.5524.38553 is able to address this issue. The name of the patch is 16f039073709a21a76526110d773a6cce0ce753a. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218024.
Query: Suspicious Password Cracking execution detected on endpoint
Matching passage: T1110.002 Password Cracking. Tactics: credential access. Description: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained. [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) can be used to obtain password hashes, this may only get an adversary so far when [Pass the Hash](https://attack.mitre.org/techniques/T1550/002) is not an option. Further, adversaries may leverage [Data from Configuration Repository](https://attack.mitre.org/techniques/T1602) in order to obtain hashed credentials for network devices.(Citation: US-CERT-TA18-106A) Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes. Cracking hashes is usually done on adversary-controlled systems outside of the target network.(Citation: Wikipedia Password cracking) The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.
Near-miss passage: T1110 Brute Force. Tactics: credential access. Description: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.(Citation: TrendMicro Pawn Storm Dec 2020) Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.(Citation: Dragos Crashoverride 2018) Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes. Brute forcing credentials may take place at various points during a breach. For example, adversaries may attempt to brute force access to [Valid Accounts](https://attack.mitre.org/techniques/T1078) within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003), [Account Discovery](https://attack.mitre.org/techniques/T1087), or [Password Policy Discovery](https://attack.mitre.org/techniques/T1201). Adversaries may also combine brute forcing activity with behaviors such as [External Remote Services](https://attack.mitre.org/techniques/T1133) as part of Initial Access. If an adversary guesses the correct password but fails to login to a compromised account due to location-based conditional access policies, they may change their infrastructure until they match the victim’s location and therefore bypass those policies.(Citation: ReliaQuest Health Care Social Engineering Campaign 2024)
Query: write Sigma for Detects potential use of Rubeus via registered new trusted logon process
Matching passage: Sigma rule: Detects potential use of Rubeus via registered new trusted logon process. Logsource: windows / security. Rule: title: Register new Logon Process by Rubeus id: 12e6d621-194f-4f59-90cc-1959e21e69f7 status: test description: Detects potential use of Rubeus via registered new trusted logon process references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community date: 2019-10-24 modified: 2022-10-09 tags: - attack.lateral-movement - attack.privilege-escalation - attack.credential-access - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4611 LogonProcessName: User32LogonProcesss condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-ex. Logsource: macos / process_creation. Rule: title: System Integrity Protection (SIP) Disabled id: 3603f18a-ec15-43a1-9af2-d196c8a7fec6 status: test description: 'Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios. ' references: - https://ss64.com/osx/csrutil.html - https://objective-see.org/blog/blog_0x6D.html - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-02 tags: - attack.discovery - attack.t1518.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /csrutil CommandLine|contains: disable condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-5865
Matching passage: CVE-2015-5865. CWE: CWE-200. CVSS: 4.300000190734863. IOGraphics in Apple OS X before 10.11 allows attackers to obtain sensitive kernel memory-layout information via a crafted app.
Near-miss passage: CVE-2015-2884. CWE: CWE-200. CVSS: 7.5. Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi.
Query: patch priority for CVE-2015-4957
Matching passage: CVE-2015-4957. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-3942. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Priv
Matching passage: CVE-2015-4791. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-0990. CWE: UNKNOWN. CVSS: 4.400000095367432. Untrusted search path vulnerability in Ecava IntegraXor SCADA Server before 4.2.4488 allows local users to gain privileges via a renamed DLL in the default install directory.