alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
Matching passage: Sigma rule: Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass). Logsource: windows / process_creation. Rule: title: HackTool - Htran/NATBypass Execution id: f5e3b62f-e577-4e59-931e-0a15b2b94e1e status: test description: Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass) references: - https://github.com/HiwinCN/HTran - https://github.com/cw1997/NATBypass author: Florian Roth (Nextron Systems) date: 2022-12-27 modified: 2023-02-04 tags: - attack.command-and-control - attack.t1090 - attack.s0040 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \htran.exe - \lcx.exe selection_cli: CommandLine|contains: - '.exe -tran ' - '.exe -slave ' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotif. Logsource: windows / registry_set. Rule: title: UAC Notification Disabled id: c5f6a85d-b647-40f7-bbad-c10b66bab038 related: - id: 0d7ceeef-3539-4392-8953-3dc664912714 type: similar - id: 48437c39-9e5f-47fb-af95-3d663c3f2919 type: similar status: test description: 'Detects when an attacker tries to disable User Account Control (UAC) notification by tampering with the "UACDisableNotify" value. UAC is a critical security feature in Windows that prevents unauthorized changes to the operating system. It prompts the user for permission or an administrator password before allowing actions that could affect the system''s operation or change settings that affect other users. When "UACDisableNotify" is set to 1, UAC prompts are suppressed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/7e11e9b79583545f208a6dc3fa062f2ed443d999/atomics/T1548.002/T1548.002.md - https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-10 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Security Center\UACDisableNotify Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: medium
Query: vulnerability: OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows
Matching passage: CVE-2015-2417. CWE: CWE-20. CVSS: 5.0. OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via crafted input, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "OLE Elevation of Privilege Vulnerability," a different vulnerability than CVE-2015-2416.
Near-miss passage: CVE-2015-8735. CWE: CWE-20. CVSS: 5.5. The get_value function in epan/dissectors/packet-btatt.c in the Bluetooth Attribute (aka BT ATT) dissector in Wireshark 2.0.x before 2.0.1 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (invalid write operation and application crash) via a crafted packet.
Query: vulnerability: Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when __debug_trace__ is configur
Matching passage: CVE-2015-4535. CWE: CWE-264. CVSS: 7.5. Java Method Server (JMS) in EMC Documentum Content Server before 6.7SP1 P32, 6.7SP2 before P25, 7.0 before P19, 7.1 before P16, and 7.2 before P02, when __debug_trace__ is configured, allows remote authenticated users to gain super-user privileges by leveraging the ability to read a log file containing a login ticket.
Near-miss passage: CVE-2015-7051. CWE: CWE-264. CVSS: 9.300000190734863. MobileStorageMounter in Apple iOS before 9.2 and tvOS before 9.1 mishandles the timing of trust-cache loading, which allows attackers to execute arbitrary code in a privileged context via a crafted app.
Query: alert when Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
Matching passage: Sigma rule: Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary. Logsource: windows / registry_set. Rule: title: Persistence Via Hhctrl.ocx id: f10ed525-97fe-4fed-be7c-2feecca941b1 status: test description: Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary references: - https://persistence-info.github.io/Data/hhctrl.html - https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32\(Default) filter: Details: C:\Windows\System32\hhctrl.ocx condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Identifies when a service account is disabled or deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Service Account Disabled or Deleted id: 13f81a90-a69c-4fab-8f07-b5bb55416a9f status: test description: Identifies when a service account is disabled or deleted in Google Cloud. references: - https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts author: Austin Songer @austinsonger date: 2021-08-14 modified: 2022-10-09 tags: - attack.impact - attack.t1531 logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name|endswith: - .serviceAccounts.disable - .serviceAccounts.delete condition: selection falsepositives: - Service Account being disabled or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Service Account disabled or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: patch priority for CVE-2015-4034
Matching passage: CVE-2015-4034. CWE: CWE-284. CVSS: 7.900000095367432. The createFromParcel method in the com.absolute.android.persistence.MethodSpec class in Samsung Galaxy S5s allows remote attackers to execute arbitrary files via a crafted Parcelable object in a serialized MethodSpec object.
Near-miss passage: CVE-2015-9337. CWE: CWE-284. CVSS: 7.5. The profile-builder plugin before 2.1.4 for WordPress has no access control for activating or deactivating addons via AJAX.
Query: vulnerability: The debug-logging (aka debug cns) feature in Cisco Networking Services (CNS) for IOS 15.2(2)E3 allows local users to obtain sensitive information by reading an unspecified file, ak
Matching passage: CVE-2015-6375. CWE: CWE-200. CVSS: 2.0999999046325684. The debug-logging (aka debug cns) feature in Cisco Networking Services (CNS) for IOS 15.2(2)E3 allows local users to obtain sensitive information by reading an unspecified file, aka Bug ID CSCux18010.
Near-miss passage: CVE-2015-5340. CWE: CWE-200. CVSS: 4.300000190734863. Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/overview.php or (2) badges/view.php.
Query: risk of Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary 
Matching passage: CVE-2015-0264. CWE: UNKNOWN. CVSS: 5.0. Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.
Near-miss passage: CVE-2015-4241. CWE: UNKNOWN. CVSS: 6.099999904632568. Cisco Adaptive Security Appliance (ASA) Software 9.3(2) allows remote attackers to cause a denial of service (system reload) by sending crafted OSPFv2 packets on the local network, aka Bug ID CSCut52679.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag. Logsource: windows / process_creation. Rule: title: Mavinject Inject DLL Into Running Process id: 4f73421b-5a0b-4bbf-a892-5a7fb99bea66 related: - id: 17eb8e57-9983-420d-ad8a-2c4976c22eb8 type: obsolete status: test description: Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://twitter.com/gN3mes1s/status/941315826107510784 - https://reaqta.com/2017/12/mavinject-microsoft-injector/ - https://twitter.com/Hexacorn/status/776122138063409152 - https://github.com/SigmaHQ/sigma/issues/3742 - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection author: frack113, Florian Roth date: 2021-07-12 modified: 2022-12-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 - attack.t1218.013 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' /INJECTRUNNING ' filter: ParentImage: C:\Windows\System32\AppVClient.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell. Logsource: windows / process_creation. Rule: title: Potential Lateral Movement via Windows Remote Shell id: 79df3f68-dccb-48e9-9171-b75cbc37c51d status: experimental description: 'Detects a child process spawned by ''winrshost.exe'', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity. ' references: - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/ - https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement author: Liran Ravich date: 2025-10-22 tags: - attack.lateral-movement - attack.t1021.006 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \winrshost.exe filter_main_conhost: Image: C:\Windows\System32\conhost.exe condition: selection and not 1 of filter_main_* falsepositives: - Legitimate use of WinRM within the organization level: medium
Query: Sigma rule for Detects handles requested to SAM registry hive
Matching passage: Sigma rule: Detects handles requested to SAM registry hive. Logsource: windows / security. Rule: title: SAM Registry Hive Handle Request id: f8748f2c-89dc-4d95-afb0-5a2dfdbad332 status: test description: Detects handles requested to SAM registry hive references: - https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-12 modified: 2021-11-27 tags: - attack.discovery - attack.t1012 - attack.credential-access - attack.t1552.002 logsource: product: windows service: security detection: selection: EventID: 4656 ObjectType: Key ObjectName|endswith: \SAM condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) t. Logsource: windows / image_load. Rule: title: Suspicious Volume Shadow Copy VSS_PS.dll Load id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 related: - id: 48bfd177-7cf2-412b-ad77-baf923489e82 type: similar - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 type: similar status: test description: 'Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity. ' references: - https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add - https://twitter.com/am0nsec/status/1412232114980982787 author: Markus Neis, @markus_neis date: 2021-07-07 modified: 2025-07-11 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vss_ps.dll filter_main_legit: Image|startswith: C:\Windows\ Image|endswith: - \clussvc.exe - \dismhost.exe - \dllhost.exe - \inetsrv\appcmd.exe - \inetsrv\iissetup.exe - \msiexec.exe - \rundll32.exe - \searchindexer.exe - \srtasks.exe - \svchost.exe - \System32\SystemPropertiesAdvanced.exe - \taskhostw.exe - \thor.exe - \thor64.exe - \tiworker.exe - \vssvc.exe - \vssadmin.exe - \WmiPrvSE.exe - \wsmprovhost.exe filter_main_update: CommandLine|startswith: C:\$WinREAgent\Scratch\ CommandLine|contains: \dismhost.exe { filter_main_image_null: Image: null filter_optional_programfiles: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: how to detect Credentials in Registry
Matching passage: T1552.002 Credentials in Registry. Tactics: credential access. Description: Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons. Example commands to find Registry keys related to password information: (Citation: Pentestlab Stored Credentials) * Local Machine Hive: <code>reg query HKLM /f password /t REG_SZ /s</code> * Current User Hive: <code>reg query HKCU /f password /t REG_SZ /s</code>
Near-miss passage: T1552.008 Chat Messages. Tactics: credential access. Description: Adversaries may directly collect unsecured credentials stored or passed through user communication services. Credentials may be sent and stored in user chat communication applications such as email, chat services like Slack or Teams, collaboration tools like Jira or Trello, and any other services that support user communication. Users may share various forms of credentials (such as usernames and passwords, API keys, or authentication tokens) on private or public corporate internal communications channels. Rather than accessing the stored chat logs (i.e., [Credentials In Files](https://attack.mitre.org/techniques/T1552/001)), adversaries may directly access credentials within these services on the user endpoint, through servers hosting the services, or through administrator portals for cloud hosted services. Adversaries may also compromise integration tools like Slack Workflows to automatically search through messages to extract user credentials. These credentials may then be abused to perform follow-on activities such as lateral movement or privilege escalation (Citation: Slack Security Risks).
Query: rule covering Detects non-system users failing to get a handle of the SCM database.
Matching passage: Sigma rule: Detects non-system users failing to get a handle of the SCM database.. Logsource: windows / security. Rule: title: SCM Database Handle Failure id: 13addce7-47b2-4ca0-a98f-1de964d1d669 status: test description: Detects non-system users failing to get a handle of the SCM database. references: - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-12 modified: 2022-07-11 tags: - attack.discovery - attack.t1010 logsource: product: windows service: security detection: selection: EventID: 4656 ObjectType: SC_MANAGER OBJECT ObjectName: ServicesActive AccessMask: '0xf003f' filter: SubjectLogonId: '0x3e4' condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects activity when the settings of the Windows firewall have been changed. Logsource: windows / firewall-as. Rule: title: Windows Firewall Settings Have Been Changed id: 00bb5bd5-1379-4fcf-a965-a5b6f7478064 status: test description: Detects activity when the settings of the Windows firewall have been changed references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-02-19 modified: 2023-04-21 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2002 - 2083 - 2003 - 2082 - 2008 condition: selection level: low
Query: CVE similar to CVE-2015-7287
Matching passage: CVE-2015-7287. CWE: CWE-255. CVSS: 7.5. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 use the same 001984 default PIN across different customers' installations, which allows remote attackers to execute commands by leveraging knowledge of this PIN and including it in an SMS message.
Near-miss passage: CVE-2015-3957. CWE: CWE-255. CVSS: 4.599999904632568. Hospira LifeCare PCA Infusion System before 7.0 stores private keys and certificates, which has unspecified impact and attack vectors.
Query: Encoded PowerShell / command-line abuse matching Messaging Applications
Matching passage: T1213.005 Messaging Applications. Tactics: collection. Description: Adversaries may leverage chat and messaging applications, such as Microsoft Teams, Google Chat, and Slack, to mine valuable information. The following is a brief list of example information that may hold potential value to an adversary and may also be found on messaging applications: * Testing / development credentials (i.e., [Chat Messages](https://attack.mitre.org/techniques/T1552/008)) * Source code snippets * Links to network shares and other internal resources * Proprietary data(Citation: Guardian Grand Theft Auto Leak 2022) * Discussions about ongoing incident response efforts(Citation: SC Magazine Ragnar Locker 2021)(Citation: Microsoft DEV-0537) In addition to exfiltrating data from messaging applications, adversaries may leverage data from chat messages in order to improve their targeting - for example, by learning more about an environment or evading ongoing incident response efforts.(Citation: Sentinel Labs NullBulge 2024)(Citation: Permiso Scattered Spider 2023)
Near-miss passage: T1213.004 Customer Relationship Management Software. Tactics: collection. Description: Adversaries may leverage Customer Relationship Management (CRM) software to mine valuable information. CRM software is used to assist organizations in tracking and managing customer interactions, as well as storing customer data. Once adversaries gain access to a victim organization, they may mine CRM software for customer data. This may include personally identifiable information (PII) such as full names, emails, phone numbers, and addresses, as well as additional details such as purchase histories and IT support interactions. By collecting this data, an adversary may be able to send personalized [Phishing](https://attack.mitre.org/techniques/T1566) emails, engage in SIM swapping, or otherwise target the organization’s customers in ways that enable financial gain or the compromise of additional organizations.(Citation: Bleeping Computer US Cellular Hack 2022)(Citation: Bleeping Computer Mint Mobile Hack 2021)(Citation: Bleeping Computer Bank Hack 2020) CRM software may be hosted on-premises or in the cloud. Information stored in these solutions may vary based on the specific instance or environment. Examples of CRM software include Microsoft Dynamics 365, Salesforce, Zoho, Zendesk, and HubSpot.
Query: write Sigma for Detects the removal of a port or application rule in the Windows Firewall configuration using netsh
Matching passage: Sigma rule: Detects the removal of a port or application rule in the Windows Firewall configuration using netsh. Logsource: windows / process_creation. Rule: title: Firewall Rule Deleted Via Netsh.EXE id: 1a5fefe6-734f-452e-a07d-fc1c35bce4b2 status: test description: Detects the removal of a port or application rule in the Windows Firewall configuration using netsh references: - https://app.any.run/tasks/8bbd5b4c-b82d-4e6d-a3ea-d454594a37cc/ author: frack113 date: 2022-08-14 modified: 2025-10-07 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - firewall - 'delete ' filter_optional_dropbox: ParentImage|endswith: \Dropbox.exe CommandLine|contains: name=Dropbox filter_optional_avast: ParentImage|endswith: \instup.exe CommandLine|contains: advfirewall firewall delete rule name="Avast Antivirus Admin Client" condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activity - Software installations and removal level: medium
Near-miss passage: Sigma rule: Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation). Logsource: windows / process_creation. Rule: title: Suspicious Shells Spawn by Java Utility Keytool id: 90fb5e62-ca1f-4e22-b42e-cc521874c938 status: test description: Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation) references: - https://redcanary.com/blog/intelligence-insights-december-2021 - https://www.synacktiv.com/en/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html author: Andreas Hunkeler (@Karneades) date: 2021-12-22 modified: 2023-01-21 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \keytool.exe Image|endswith: - \cmd.exe - \sh.exe - \bash.exe - \powershell.exe - \pwsh.exe - \schtasks.exe - \certutil.exe - \whoami.exe - \bitsadmin.exe - \wscript.exe - \cscript.exe - \scrcons.exe - \regsvr32.exe - \hh.exe - \wmic.exe - \mshta.exe - \rundll32.exe - \forfiles.exe - \scriptrunner.exe - \mftrace.exe - \AppVLP.exe - \systeminfo.exe - \reg.exe - \query.exe condition: selection falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-1817
Matching passage: CVE-2015-1817. CWE: CWE-119. CVSS: 9.800000190734863. Stack-based buffer overflow in the inet_pton function in network/inet_pton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-4590. CWE: CWE-119. CVSS: 5.0. The extractFrom function in Internals/QuotedString.cpp in Arduino JSON before 4.5 allows remote attackers to cause a denial of service (crash) via a JSON string with a \ (backslash) followed by a terminator, as demonstrated by "\\\0", which triggers a buffer overflow and over-read.