alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-5417
Matching passage: CVE-2015-5417. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2876.
Near-miss passage: CVE-2015-4845. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via vectors related to Java APIs - AOL/J. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue allows remote attackers to enumerate database users via a series of requests to Aoljtest.js.
Query: detection rule: Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed
Matching passage: Sigma rule: Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed. Logsource: windows / process_creation. Rule: title: Suspicious Group And Account Reconnaissance Activity Using Net.EXE id: d95de845-b83c-4a9a-8a6a-4fc802ebf6c0 status: test description: 'Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM) ' references: - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2023-03-02 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_group_root: CommandLine|contains: - ' group ' - ' localgroup ' selection_group_flags: CommandLine|contains: - domain admins - ' administrator' - ' administrateur' - enterprise admins - Exchange Trusted Subsystem - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto - ' /do' filter_group_add: CommandLine|contains: ' /add' selection_accounts_root: CommandLine|contains: ' accounts ' selection_accounts_flags: CommandLine|contains: ' /do' condition: selection_img and ((all of selection_group_* and not filter_group_add) or all of selection_accounts_*) falsepositives: - Inventory tool runs - Administrative activity level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via ClassicExplorer32.dll id: caa02837-f659-466f-bca6-48bde2826ab4 status: test description: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software references: - https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets - https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/ author: frack113 date: 2022-12-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_classicexplorer: ImageLoaded|endswith: \ClassicExplorer32.dll filter_classicexplorer: ImageLoaded|startswith: C:\Program Files\Classic Shell\ condition: selection_classicexplorer and not filter_classicexplorer falsepositives: - Unknown level: medium
Query: Sigma rule for Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as
Matching passage: Sigma rule: Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as. Logsource: windows / process_creation. Rule: title: Sysinternals PsSuspend Suspicious Execution id: 4beb6ae0-f85b-41e2-8f18-8668abc8af78 related: - id: 48bbc537-b652-4b4e-bd1d-281172df448f type: similar status: test description: Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses references: - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend - https://twitter.com/0gtweet/status/1638069413717975046 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-23 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: pssuspend.exe - Image|endswith: - \pssuspend.exe - \pssuspend64.exe - \pssuspend64a.exe selection_cli: CommandLine|contains: msmpeng.exe condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Clear command history in network OS which is used for defense evasion. Logsource: cisco / aaa. Rule: title: Cisco Clear Logs id: ceb407f6-8277-439b-951f-e4210e3ed956 status: test description: Clear command history in network OS which is used for defense evasion references: - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609 author: Austin Clark date: 2019-08-12 modified: 2023-05-26 tags: - attack.stealth - attack.t1070.003 logsource: product: cisco service: aaa detection: keywords: - clear logging - clear archive condition: keywords falsepositives: - Legitimate administrators may run these commands level: high
Query: detect Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump th in logs
Matching passage: Sigma rule: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump th. Logsource: windows / process_creation. Rule: title: Process Access via TrolleyExpress Exclusion id: 4c0aaedc-154c-4427-ada0-d80ef9c9deb6 status: test description: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.youtube.com/watch?v=Ie831jF0bb0 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2022-05-13 tags: - attack.stealth - attack.t1218.011 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \TrolleyExpress 7 - \TrolleyExpress 8 - \TrolleyExpress 9 - \TrolleyExpress.exe 7 - \TrolleyExpress.exe 8 - \TrolleyExpress.exe 9 - '\TrolleyExpress.exe -ma ' renamed: Image|endswith: \TrolleyExpress.exe filter_renamed: OriginalFileName|contains: CtxInstall filter_empty: OriginalFileName: null condition: selection or ( renamed and not 1 of filter* ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the rare use of the command line tool shutdown to logoff a user. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Shutdown to Log Out id: ec290c06-9b6b-4338-8b6b-095c0f284f10 status: test description: Detects the rare use of the command line tool shutdown to logoff a user references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1529/T1529.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown author: frack113 date: 2022-10-01 tags: - attack.impact - attack.t1529 logsource: category: process_creation product: windows detection: selection: Image|endswith: \shutdown.exe CommandLine|contains: /l condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-5797
Matching passage: CVE-2015-5797. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Near-miss passage: CVE-2015-8392. CWE: CWE-119. CVSS: 7.5. PCRE before 8.38 mishandles certain instances of the (?| substring, which allows remote attackers to cause a denial of service (unintended recursion and buffer overflow) or possibly have unspecified other impact via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, a related issue to CVE-2015-8384 and CVE-2015-8395.
Query: vulnerability: Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the
Matching passage: CVE-2015-6745. CWE: CWE-264. CVSS: 4.599999904632568. Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.
Near-miss passage: CVE-2015-7707. CWE: CWE-264. CVSS: 6.5. Ignite Realtime Openfire 3.10.2 allows remote authenticated users to gain administrator access via the isadmin parameter to user-edit-form.jsp.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.. Logsource: windows / process_creation. Rule: title: LOLBIN Execution From Abnormal Drive id: d4ca7c59-e9e4-42d8-bf57-91a776efcb87 related: - id: 5b80cf53-3a46-4adc-960b-05ec19348d74 type: similar status: test description: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO. references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.scythe.io/library/threat-emulation-qakbot - https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/ author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman date: 2022-01-25 modified: 2023-08-29 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \calc.exe - \certutil.exe - \cmstp.exe - \cscript.exe - \installutil.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - CALC.EXE - CertUtil.exe - CMSTP.EXE - cscript.exe - installutil.exe - MSHTA.EXE - REGSVR32.EXE - RUNDLL32.EXE - wscript.exe filter_main_currentdirectory: CurrentDirectory|contains: C:\ filter_main_empty: CurrentDirectory: '' filter_main_null: CurrentDirectory: null condition: selection and not 1 of filter_main_* falsepositives: - Rare false positives could occur on servers with multiple drives. level: medium
Near-miss passage: Sigma rule: Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.e. Logsource: windows / process_creation. Rule: title: Rundll32 UNC Path Execution id: 5cdb711b-5740-4fb2-ba88-f7945027afac status: test description: 'Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh. ' references: - https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-10 modified: 2026-07-20 tags: - attack.execution - attack.lateral-movement - attack.stealth - attack.t1021.002 - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli: CommandLine|contains: - ' \\\\' - ' ''\\\\' - ' "\\\\' filter_main_cli_pipe: CommandLine|contains: \\\\.\\pipe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_rundll32_unc_path/info.yml
Query: alert when Use of hostname to get information
Matching passage: Sigma rule: Use of hostname to get information. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Hostname id: 7be5fb68-f9ef-476d-8b51-0256ebece19e status: test description: Use of hostname to get information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname author: frack113 date: 2022-01-01 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: Image|endswith: \HOSTNAME.EXE condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in. Logsource: windows / process_creation. Rule: title: COM Object Execution via Xwizard.EXE id: 53d4bb30-3f36-4e8a-b078-69d36c4a79ff status: test description: 'Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument. This utility can be abused in order to run custom COM object created in the registry. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/ - https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html - https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/ author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-07 modified: 2024-08-15 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine: RunWizard CommandLine|re: \{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\} condition: selection falsepositives: - Unknown level: medium
Query: risk of Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid use
Matching passage: CVE-2015-0997. CWE: CWE-200. CVSS: 5.0. Schneider Electric InduSoft Web Studio before 7.1.3.4 SP3 Patch 4 and InTouch Machine Edition 2014 before 7.1.3.4 SP3 Patch 4 provide an HMI user interface that lists all valid usernames, which makes it easier for remote attackers to obtain access via a brute-force password-guessing attack.
Near-miss passage: CVE-2015-7946. CWE: CWE-200. CVSS: 4.599999904632568. Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.
Query: patch priority for CVE-2015-0369
Matching passage: CVE-2015-0369. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to AX/HI Web UI.
Near-miss passage: CVE-2015-8746. CWE: UNKNOWN. CVSS: 7.5. fs/nfs/nfs4proc.c in the NFS client in the Linux kernel before 4.2.2 does not properly initialize memory for migration recovery operations, which allows remote NFS servers to cause a denial of service (NULL pointer dereference and panic) via crafted network traffic.
Query: CVE similar to CVE-2015-4728
Matching passage: CVE-2015-4728. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the Oracle Sourcing component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect confidentiality via unknown vectors related to Bid/Quote creation.
Near-miss passage: CVE-2015-2767. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Websense TRITON AP-EMAIL before 8.0.0 has unknown impact and attack vectors, related to "Autocomplete Enabled."
Query: patch priority for CVE-2015-3753
Matching passage: CVE-2015-3753. CWE: CWE-200. CVSS: 5.0. WebKit in Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, as used in iOS before 8.4.1 and other products, does not properly perform taint checking for CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive image data by leveraging a redirect to a data:image resource.
Near-miss passage: CVE-2015-4033. CWE: CWE-200. CVSS: 3.299999952316284. Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000.
Query: risk of Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.
Matching passage: CVE-2015-1988. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 and Tivoli Storage FlashCopy Manager for VMware 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.3.0 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-0298. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the manager web interface in mod_cluster before 1.3.2.Alpha1 allows remote attackers to inject arbitrary web script or HTML via a crafted MCMP message.
Query: exploit Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and po
Matching passage: CVE-2015-7674. CWE: CWE-189. CVSS: 6.800000190734863. Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow.
Near-miss passage: CVE-2015-3864. CWE: CWE-189. CVSS: 10.0. Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.
Query: alert when Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more
Matching passage: Sigma rule: Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more. Logsource: windows / process_creation. Rule: title: Registry Modification Via Regini.EXE id: 5f60740a-f57b-4e76-82a1-15b6ff2cb134 related: - id: 77946e79-97f1-45a2-84b4-f37b5c0d8682 type: derived status: test description: Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files. references: - https://lolbas-project.github.io/lolbas/Binaries/Regini/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini author: Eli Salem, Sander Wiebing, oscd.community date: 2020-10-08 modified: 2023-02-08 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \regini.exe - OriginalFileName: REGINI.EXE filter: CommandLine|re: :[^ \\] condition: selection and not filter falsepositives: - Legitimate modification of keys level: low
Near-miss passage: Sigma rule: Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration.. Logsource: windows / process_creation. Rule: title: Curl File Upload To File Sharing Websites id: e328cc73-f92a-42fb-b3fa-7c2cffda981a related: - id: 00bca14a-df4e-4649-9054-3f2aa676bc04 type: derived - id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab type: similar status: experimental description: Detects usage of curl to upload files to known file sharing domains, which may indicate data exfiltration. author: Swachchhanda Shrawan Poudel (Nextron Systems) references: - https://unit42.paloaltonetworks.com/advanced-backdoor-squidoor/ date: 2026-03-29 tags: - attack.exfiltration - attack.t1567.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli_domain: CommandLine|contains: - 0x0.st - bashupload.com - chunk.io - file.io - filebin.net - pastebin - send.firefox.com - temp.sh - transfer.sh - ufile.io - uploadfiles.io - wetransfer.com - x0.at selection_cli_flags: - CommandLine|contains: - ' --form' - ' --upload-file' - ' --data' - ' -X POST' - ' --request POST ' - CommandLine|re: - \s-[FTd]\s - \s-sT\s condition: all of selection_* falsepositives: - Legitimate file uploads to these services by administrators or developers level: high
Query: Suspicious Asymmetric Cryptography execution detected on endpoint
Matching passage: T1573.002 Asymmetric Cryptography. Tactics: command and control. Description: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private. Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key. This ensures that only the intended recipient can read the encrypted data. Common public key encryption algorithms include RSA and ElGamal. For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key. As such, these protocols are classified as [Asymmetric Cryptography](https://attack.mitre.org/techniques/T1573/002).
Near-miss passage: T1573 Encrypted Channel. Tactics: command and control. Description: Adversaries may employ an encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.