alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Multiple failed authentications followed by AppInit DLLs
Matching passage: T1546.010 AppInit DLLs. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes. Dynamic-link libraries (DLLs) that are specified in the <code>AppInit_DLLs</code> value in the Registry keys <code>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows</code> or <code>HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows</code> are loaded by user32.dll into every process that loads user32.dll. In practice this is nearly every program, since user32.dll is a very common library. (Citation: Elastic Process Injection July 2017) Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer. (Citation: AppInit Registry) Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity. The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled. (Citation: AppInit Secure Boot)
Near-miss passage: T1546.017 Udev Rules. Tactics: persistence, privilege escalation. Description: Adversaries may maintain persistence through executing malicious content triggered using udev rules. Udev is the Linux kernel device manager that dynamically manages device nodes, handles access to pseudo-device files in the `/dev` directory, and responds to hardware events, such as when external devices like hard drives or keyboards are plugged in or removed. Udev uses rule files with `match keys` to specify the conditions a hardware event must meet and `action keys` to define the actions that should follow. Root permissions are required to create, modify, or delete rule files located in `/etc/udev/rules.d/`, `/run/udev/rules.d/`, `/usr/lib/udev/rules.d/`, `/usr/local/lib/udev/rules.d/`, and `/lib/udev/rules.d/`. Rule priority is determined by both directory and by the digit prefix in the rule filename.(Citation: Ignacio Udev research 2024)(Citation: Elastic Linux Persistence 2024) Adversaries may abuse the udev subsystem by adding or modifying rules in udev rule files to execute malicious content. For example, an adversary may configure a rule to execute their binary each time the pseudo-device file, such as `/dev/random`, is accessed by an application. Although udev is limited to running short tasks and is restricted by systemd-udevd's sandbox (blocking network and filesystem access), attackers may use scripting commands under the action key `RUN+=` to detach and run the malicious content’s process in the background to bypass these controls.(Citation: Reichert aon sedexp 2024)
Query: patch priority for CVE-2015-2286
Matching passage: CVE-2015-2286. CWE: CWE-200. CVSS: 6.5. lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.
Near-miss passage: CVE-2015-4077. CWE: CWE-200. CVSS: 2.0999999046325684. The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel memory via a 0x22608C ioctl call.
Query: detect Detects encoded base64 MZ header in the commandline in logs
Matching passage: Sigma rule: Detects encoded base64 MZ header in the commandline. Logsource: windows / process_creation. Rule: title: Base64 MZ Header In CommandLine id: 22e58743-4ac8-4a9f-bf19-00a0428d8c5f status: test description: Detects encoded base64 MZ header in the commandline references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - TVqQAAMAAAAEAAAA - TVpQAAIAAAAEAA8A - TVqAAAEAAAAEABAA - TVoAAAAAAAAAAAAA - TVpTAQEAAAAEAAAA condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t. Logsource: windows / powershell-classic. Rule: title: Zip A Folder With PowerShell For Staging In Temp - PowerShell id: 71ff406e-b633-4989-96ec-bc49d825a412 related: - id: daf7eb81-35fd-410d-9d7a-657837e602bb type: similar - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 type: similar - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 type: similar status: test description: 'Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-20 modified: 2023-12-18 tags: - attack.collection - attack.t1074.001 logsource: product: windows service: powershell-classic detection: selection: Data|contains: - Compress-Archive -Path*-DestinationPath $env:TEMP - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\ - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\ condition: selection falsepositives: - Unknown level: medium
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for securit. Logsource: aws / cloudtrail. Rule: title: AWS Bucket Deleted id: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112 status: experimental description: 'Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts. ' references: - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html author: Ivan Saakov, Nasreddine Bencherchali date: 2025-10-19 tags: - attack.stealth logsource: product: aws service: cloudtrail detection: selection_event_name: eventName: DeleteBucket selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_name and 1 of selection_status_* falsepositives: - During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities. level: medium
Near-miss passage: Sigma rule: An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and othe. Logsource: windows / process_creation. Rule: title: System Disk And Volume Reconnaissance Via Wmic.EXE id: c79da740-5030-45ec-a2e0-479e824a562c related: - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e type: similar status: test description: 'An adversary might use WMI to discover information about the system, such as the volume name, size, free space, and other disk information. This can be done using the ''wmic'' command-line utility and has been observed being used by threat actors such as Volt Typhoon. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic author: Stephen Lincoln '@slincoln-aiq' (AttackIQ) date: 2024-02-02 modified: 2025-10-20 tags: - attack.execution - attack.discovery - attack.t1047 - attack.t1082 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: - CommandLine|contains: - ' volumename' - ' logicaldisk' - CommandLine|contains|all: - path - win32_logicaldisk - CommandLine|contains|all: - ' volume' - ' list ' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_volume/info.yml
Query: CVE similar to CVE-2015-8386
Matching passage: CVE-2015-8386. CWE: CWE-119. CVSS: 9.800000190734863. PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror.
Near-miss passage: CVE-2015-3795. CWE: CWE-119. CVSS: 9.300000190734863. libxpc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app that sends a malformed XPC message.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allow
Matching passage: CVE-2015-7467. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in Report Builder in IBM Jazz Reporting Service (JRS) 5.x before 5.0.2-Rational-CLM-ifix011 and 6.0 before 6.0.0-Rational-CLM-ifix005 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-2926. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Php/stats/statsRecent.inc.php in phpTrafficA 2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP User-Agent header to index.php.
Query: CVE similar to CVE-2015-2013
Matching passage: CVE-2015-2013. CWE: CWE-399. CVSS: 5.0. IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers to cause a denial of service (channel-agent abend and process outage) via a crafted selection string in an MQI call.
Near-miss passage: CVE-2015-5145. CWE: CWE-399. CVSS: 7.800000190734863. validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Query: detection rule: Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script
Matching passage: Sigma rule: Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script. Logsource: windows / registry_set. Rule: title: PowerShell Logging Disabled Via Registry Key Tampering id: fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7 status: test description: Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled author: frack113 date: 2022-04-02 modified: 2023-08-17 tags: - attack.stealth - attack.defense-impairment - attack.t1564.001 - attack.t1112 - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows\PowerShell\ - \Microsoft\PowerShellCore\ TargetObject|endswith: - \ModuleLogging\EnableModuleLogging - \ScriptBlockLogging\EnableScriptBlockLogging - \ScriptBlockLogging\EnableScriptBlockInvocationLogging - \Transcription\EnableTranscripting - \Transcription\EnableInvocationHeader - \EnableScripts Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled/info.yml simulation: - type: atomic-red-team name: Disable PowerShell Logging via Registry technique: T1112 atomic_guid: 95b25212-91a7-42ff-9613-124aca6845a8
Near-miss passage: Sigma rule: Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a p. Logsource: linux / process_creation. Rule: title: Potential Ruby Reverse Shell id: b8bdac18-c06e-4016-ac30-221553e74f59 status: test description: Detects execution of ruby with the "-e" flag and calls to "socket" related functions. This could be an indication of a potential attempt to setup a reverse shell references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ author: '@d4ns4n_' date: 2023-04-07 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|contains: ruby CommandLine|contains|all: - ' -e' - rsocket - TCPSocket CommandLine|contains: - ' ash' - ' bash' - ' bsh' - ' csh' - ' ksh' - ' pdksh' - ' sh' - ' tcsh' condition: selection falsepositives: - Unknown level: medium
Query: detect Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer in logs
Matching passage: Sigma rule: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numer. Logsource: windows / process_creation. Rule: title: Deletion of Volume Shadow Copies via WMI with PowerShell id: 21ff4ca9-f13a-41ad-b828-0077b2af2e40 related: - id: e17121b4-ef2a-4418-8a59-12fb1631fa9e type: derived - id: c1337eb8-921a-4b59-855b-4ba188ddcc42 type: similar status: test description: Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-20 modified: 2022-12-30 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_get: CommandLine|contains: - Get-WmiObject - gwmi - Get-CimInstance - gcim selection_shadowcopy: CommandLine|contains: Win32_ShadowCopy selection_delete: CommandLine|contains: - .Delete() - Remove-WmiObject - rwmi - Remove-CimInstance - rcim condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detect when System Manager successfully executes commands against an instance.. Logsource: aws / cloudtrail. Rule: title: Potential Malicious Usage of CloudTrail System Manager id: 38e7f511-3f74-41d4-836e-f57dfa18eead status: test description: 'Detect when System Manager successfully executes commands against an instance. ' references: - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml author: jamesc-grafana date: 2024-07-11 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.initial-access - attack.t1566 - attack.t1566.002 logsource: product: aws service: cloudtrail detection: selection_event: eventName: SendCommand eventSource: ssm.amazonaws.com selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event and 1 of selection_status_* falsepositives: - There are legitimate uses of SSM to send commands to EC2 instances - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them level: high
Query: detect Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellS in logs
Matching passage: Sigma rule: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellS. Logsource: windows / registry_event. Rule: title: Run Once Task Configuration in Registry id: c74d7efc-8826-45d9-b8bb-f04fac9e4eff status: test description: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ author: Avneet Singh @v3t0_, oscd.community date: 2020-11-15 modified: 2024-03-25 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \Microsoft\Active Setup\Installed Components TargetObject|endswith: \StubPath filter_optional_chrome: Details|contains|all: - C:\Program Files\Google\Chrome\Application\ - \Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level filter_optional_edge: Details|contains: - C:\Program Files (x86)\Microsoft\Edge\Application\ - C:\Program Files\Microsoft\Edge\Application\ Details|endswith: \Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate modification of the registry key by legitimate program level: medium
Near-miss passage: Sigma rule: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC tech. Logsource: windows / process_creation. Rule: title: Sdclt Child Processes id: da2738f2-fadb-4394-afa7-0a0674885afa status: test description: A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques. references: - https://github.com/OTRF/detection-hackathon-apt29/issues/6 - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-05-02 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdclt.exe condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS be
Matching passage: CVE-2015-5962. CWE: CWE-189. CVSS: 5.0. Integer signedness error in the SharedBufferManagerParent::RecvAllocateGrallocBuffer function in the buffer-management implementation in the graphics layer in Mozilla Firefox OS before 2.2 might allow attackers to cause a denial of service (memory corruption) via a negative value of a size parameter.
Near-miss passage: CVE-2015-2189. CWE: CWE-189. CVSS: 5.0. Off-by-one error in the pcapng_read function in wiretap/pcapng.c in the pcapng file parser in Wireshark 1.10.x before 1.10.13 and 1.12.x before 1.12.4 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via an invalid Interface Statistics Block (ISB) interface ID in a crafted packet.
Query: detection rule: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64). Logsource: windows / process_creation. Rule: title: UAC Bypass Using IEInstal - Process id: 80fc36aa-945e-4181-89f2-2f907ab6775d status: test description: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - High - System - S-1-16-16384 - S-1-16-12288 ParentImage|endswith: \ieinstal.exe Image|contains: \AppData\Local\Temp\ Image|endswith: consent.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a secret scanning allowlist rule is added for projects.. Logsource: bitbucket / audit. Rule: title: Bitbucket Project Secret Scanning Allowlist Added id: 42ccce6d-7bd3-4930-95cd-e4d83fa94a30 status: test description: Detects when a secret scanning allowlist rule is added for projects. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Projects auditType.action: Project secret scanning allowlist rule added condition: selection falsepositives: - Legitimate user activity. level: low
Query: vulnerability: WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application cras
Matching passage: CVE-2015-5804. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-2521. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3, Excel 2010 SP2, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Query: risk of epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows remote attackers to c
Matching passage: CVE-2015-8722. CWE: CWE-20. CVSS: 5.5. epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate the frame pointer, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.
Near-miss passage: CVE-2015-7808. CWE: CWE-20. CVSS: 7.5. The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.
Query: Outbound C2 pattern associated with Exfiltration over USB
Matching passage: T1052.001 Exfiltration over USB. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data over a USB connected physical device. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user. The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.
Near-miss passage: T1052 Exfiltration Over Physical Medium. Tactics: exfiltration. Description: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive. In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user. Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device. The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.