alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-7825
Matching passage: CVE-2015-7825. CWE: UNKNOWN. CVSS: 7.5. botan before 1.11.22 improperly validates certificate paths, which allows remote attackers to cause a denial of service (infinite loop and memory consumption) via a certificate with a loop in the certificate chain.
Near-miss passage: CVE-2015-4849. CWE: UNKNOWN. CVSS: 6.800000190734863. Unspecified vulnerability in the Oracle Payments component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Punch-in. NOTE: the previous information is from the October 2015 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to cause a denial of service or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/IspPunchInServlet.
Query: Sigma YAML for kubernetes / application / audit
Matching passage: Sigma rule: Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container. Logsource: kubernetes / application / audit. Rule: title: Potential Sidecar Injection Into Running Deployment id: ad9012a6-e518-4432-9890-f3b82b8fc71f status: test description: 'Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster. ' references: - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1609 - attack.execution logsource: category: application product: kubernetes service: audit detection: selection: verb: patch apiGroup: apps objectRef.resource: deployments condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Download and compress a remote file and store it in a cab file on local machine.. Logsource: windows / process_creation. Rule: title: Suspicious Diantz Download and Compress Into a CAB File id: 185d7418-f250-42d0-b72e-0c8b70661e93 status: test description: Download and compress a remote file and store it in a cab file on local machine. references: - https://lolbas-project.github.io/lolbas/Binaries/Diantz/ author: frack113 date: 2021-11-26 modified: 2022-08-13 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - diantz.exe - ' \\\\' - .cab condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-2363
Matching passage: CVE-2015-2363. CWE: CWE-264. CVSS: 7.199999809265137. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-4185. CWE: CWE-264. CVSS: 6.900000095367432. The TCL interpreter in Cisco IOS 15.2 does not properly maintain the vty state, which allows local users to gain privileges by starting a session very soon after a TCL script execution, aka Bug ID CSCuq24202.
Query: rule covering Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor
Matching passage: Sigma rule: Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via JsSchHlp id: 68654bf0-4412-43d5-bfe8-5eaa393cd939 status: test description: Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor references: - https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/ - http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp author: frack113 date: 2022-12-14 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \JSESPR.dll filter: ImageLoaded|startswith: C:\Program Files\Common Files\Justsystem\JsSchHlp\ condition: selection and not filter falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. T. Logsource: windows / process_creation. Rule: title: File Decoded From Base64/Hex Via Certutil.EXE id: cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7 status: test description: Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/JohnLaTwC/status/835149808817991680 - https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2023-02-15 modified: 2025-06-04 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|windash: - '-decode ' - '-decodehex ' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_decode/info.yml
Query: Sigma rule for Detects Obfuscated Powershell via Stdin in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / system. Rule: title: Invoke-Obfuscation Via Stdin - System id: 487c7524-f892-4054-b263-8a0ace63fc25 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - set - '&&' ImagePath|contains: - environment - invoke - input condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistenc. Logsource: windows / registry_set. Rule: title: Potential Persistence Via DLLPathOverride id: a1b1fd53-9c4a-444c-bae0-34a330fc7aa8 status: test description: Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process references: - https://persistence-info.github.io/Data/naturallanguage6.html - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection_root: TargetObject|contains: \SYSTEM\CurrentControlSet\Control\ContentIndex\Language\ selection_values: TargetObject|contains: - \StemmerDLLPathOverride - \WBDLLPathOverride - \StemmerClass - \WBreakerClass condition: all of selection_* falsepositives: - Unknown level: high
Query: exploit The LDAP Server in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corrupt
Matching passage: CVE-2015-0117. CWE: UNKNOWN. CVSS: 10.0. The LDAP Server in IBM Domino 8.5.x before 8.5.3 FP6 IF6 and 9.x before 9.0.1 FP3 IF1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, aka SPR KLYH9SLRGM.
Near-miss passage: CVE-2015-0423. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to Optimizer.
Query: patch priority for CVE-2015-6844
Matching passage: CVE-2015-6844. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Reviewer in EMC SourceOne Email Supervisor before 7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0668. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the administration portal in Cisco WebEx Meetings Server 2.5 and 2.5.99.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCuq66737.
Query: describe CVE-2015-9352
Matching passage: CVE-2015-9352. CWE: CWE-89. CVSS: 9.800000190734863. The wp-polls plugin before 2.72 for WordPress has SQL injection.
Near-miss passage: CVE-2015-9449. CWE: CWE-89. CVSS: 7.199999809265137. The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php account_id parameter.
Query: CVE similar to CVE-2015-4596
Matching passage: CVE-2015-4596. CWE: CWE-264. CVSS: 7.800000190734863. Lenovo Mouse Suite before 6.73 allows local users to run arbitrary code with administrator privileges.
Near-miss passage: CVE-2015-1292. CWE: CWE-264. CVSS: 5.0. The NavigatorServiceWorker::serviceWorker function in modules/serviceworkers/NavigatorServiceWorker.cpp in Blink, as used in Google Chrome before 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy by accessing a Service Worker.
Query: exploit Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
Matching passage: CVE-2015-5409. CWE: CWE-119. CVSS: 7.5. Buffer overflow in HP Version Control Repository Manager (VCRM) before 7.5.0 allows remote authenticated users to modify data or cause a denial of service via unspecified vectors.
Near-miss passage: CVE-2015-3664. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3665 and CVE-2015-3669.
Query: patch priority for CVE-2015-4348
Matching passage: CVE-2015-4348. CWE: CWE-89. CVSS: 6.0. SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to execute arbitrary SQL commands via unspecified vectors.
Near-miss passage: CVE-2015-5504. CWE: CWE-89. CVSS: 7.5. SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Query: detection rule: Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely
Matching passage: Sigma rule: Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely. Logsource: windows / process_creation. Rule: title: HackTool - SharpImpersonation Execution id: f89b08d0-77ad-4728-817b-9b16c5a69c7a related: - id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 type: similar status: test description: Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/ - https://github.com/S3cur3Th1sSh1t/SharpImpersonation author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems) date: 2022-12-27 modified: 2023-02-13 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \SharpImpersonation.exe - OriginalFileName: SharpImpersonation.exe selection_cli: - CommandLine|contains|all: - ' user:' - ' binary:' - CommandLine|contains|all: - ' user:' - ' shellcode:' - CommandLine|contains: - ' technique:CreateProcessAsUserW' - ' technique:ImpersonateLoggedOnuser' condition: 1 of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use Rundll32 - PowerShell id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2019-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll ScriptBlockText|contains: - value - invoke - comspec - iex condition: selection_4104 falsepositives: - Unknown level: high
Query: detect Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an applica in logs
Matching passage: Sigma rule: Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an applica. Logsource: windows / process_creation. Rule: title: Potential DLL Injection Via AccCheckConsole id: 0f6da907-5854-4be6-859a-e9958747b0aa status: test description: 'Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application''s UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility. ' references: - https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340 - https://twitter.com/bohops/status/1477717351017680899?s=12 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/ author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2024-08-29 tags: - attack.execution - detection.threat-hunting logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AccCheckConsole.exe - OriginalFileName: AccCheckConsole.exe selection_cli: CommandLine|contains: - ' -hwnd' - ' -process ' - ' -window ' condition: all of selection_* falsepositives: - Legitimate use of the UI Accessibility Checker level: medium
Near-miss passage: Sigma rule: Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attack. Logsource: windows / security. Rule: title: Windows Defender Exclusion Registry Key - Write Access Requested id: e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d related: - id: 46a68649-f218-4f86-aea1-16a759d81820 type: derived - id: a33f8808-2812-4373-ae95-8cfb82134978 type: derived status: test description: 'Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security. ' references: - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/ author: '@BarryShooshooga, Nasreddine Bencherchali (Nextron Systems)' date: 2019-10-26 modified: 2023-11-11 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Security Settings/Local Policies/Audit Policy, Registry System Access Control (SACL): Auditing/User' detection: selection: AccessList|contains: - '%%4417' - '%%4418' EventID: - 4656 - 4663 ObjectName|contains: \Microsoft\Windows Defender\Exclusions\ condition: selection falsepositives: - Unknown level: medium
Query: exploit Apple OS X before 10.11 does not ensure that the keychain's lock state is displayed correctly, which has unspecified impact and attack vectors.
Matching passage: CVE-2015-5915. CWE: CWE-17. CVSS: 5.0. Apple OS X before 10.11 does not ensure that the keychain's lock state is displayed correctly, which has unspecified impact and attack vectors.
Near-miss passage: CVE-2015-7192. CWE: CWE-17. CVSS: 7.5. The accessibility-tools feature in Mozilla Firefox before 42.0 on OS X improperly interacts with the implementation of the TABLE element, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by using an NSAccessibilityIndexAttribute value to reference a row index.
Query: detection rule: Detects RDP session hijacking by using MSTSC shadowing
Matching passage: Sigma rule: Detects RDP session hijacking by using MSTSC shadowing. Logsource: windows / process_creation. Rule: title: Potential MSTSC Shadowing Activity id: 6ba5a05f-b095-4f0a-8654-b825f4f16334 status: test description: Detects RDP session hijacking by using MSTSC shadowing references: - https://twitter.com/kmkz_security/status/1220694202301976576 - https://github.com/kmkz/Pentesting/blob/47592e5e160d3b86c2024f09ef04ceb87d204995/Post-Exploitation-Cheat-Sheet author: Florian Roth (Nextron Systems) date: 2020-01-24 modified: 2023-02-05 tags: - attack.lateral-movement - attack.t1563.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - noconsentprompt - 'shadow:' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encode. Logsource: windows / process_creation. Rule: title: Attempts of Kerberos Coercion Via DNS SPN Spoofing id: 0ed99dda-6a35-11ef-8c99-0242ac120002 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar status: experimental description: 'Detects the presence of "UWhRC....AAYBAAAA" pattern in command line. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073. If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records, or checking for the presence of such records through the `nslookup` command. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Query: Sigma YAML for opencanary / application
Matching passage: Sigma rule: Detects instances where an RDP service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - RDP New Connection Attempt id: 598290cf-5932-45cd-9123-be1e05ab4f2e status: experimental description: Detects instances where an RDP service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.initial-access - attack.lateral-movement - attack.persistence - attack.t1133 - attack.t1021.001 logsource: category: application product: opencanary detection: selection: logtype: 14001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Def. Logsource: windows / process_creation. Rule: title: Windows Defender Definition Files Removed id: 9719a8aa-401c-41af-8108-ced7ec9cd75c status: test description: Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ author: frack113 date: 2021-07-07 modified: 2023-07-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MpCmdRun.exe - OriginalFileName: MpCmdRun.exe selection_cli: CommandLine|contains|all: - ' -RemoveDefinitions' - ' -All' condition: all of selection_* falsepositives: - Unknown level: high