alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects registry modifications related to 'OracleOciLib' and 'OracleOciLibPath' under 'MSDTC' settings. Threat actors ma. Logsource: windows / registry_set. Rule: title: Registry Modification for OCI DLL Redirection id: c0e0bdec-3e3d-47aa-9974-05539c999c89 status: experimental description: 'Detects registry modifications related to ''OracleOciLib'' and ''OracleOciLibPath'' under ''MSDTC'' settings. Threat actors may modify these registry keys to redirect the loading of ''oci.dll'' to a malicious DLL, facilitating phantom DLL hijacking via the MSDTC service. ' references: - https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.defense-impairment - attack.t1112 - attack.t1574.001 logsource: category: registry_set product: windows detection: selection_ocilib: TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLib filter_main_ocilib_file: Details|contains: oci.dll selection_ocilibpath: TargetObject|endswith: \SOFTWARE\Microsoft\MSDTC\MTxOCI\OracleOciLibPath filter_main_ocilibpath: Details|contains: '%SystemRoot%\System32\' condition: (selection_ocilib and not filter_main_ocilib_file) or (selection_ocilibpath and not filter_main_ocilibpath) falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Find local accounts being created or modified as well as remote authentication configurations. Logsource: cisco / aaa. Rule: title: Cisco Local Accounts id: 6d844f0f-1c18-41af-8f19-33e7654edfc3 status: test description: Find local accounts being created or modified as well as remote authentication configurations author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.privilege-escalation - attack.persistence - attack.t1136.001 - attack.t1098 logsource: product: cisco service: aaa detection: keywords: - username - aaa condition: keywords falsepositives: - When remote authentication is in place, this should not change often level: high
Query: describe CVE-2015-0056
Matching passage: CVE-2015-0056. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1623 and CVE-2015-1626.
Near-miss passage: CVE-2015-1741. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1752.
Query: vulnerability: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a diff
Matching passage: CVE-2015-7248. CWE: CWE-200. CVSS: 7.5. ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE allow remote attackers to discover usernames and password hashes by reading the cgi-bin/webproc HTML source code, a different vulnerability than CVE-2015-8703.
Near-miss passage: CVE-2015-3193. CWE: CWE-200. CVSS: 7.5. The Montgomery squaring implementation in crypto/bn/asm/x86_64-mont5.pl in OpenSSL 1.0.2 before 1.0.2e on the x86_64 platform, as used by the BN_mod_exp function, mishandles carry propagation and produces incorrect output, which makes it easier for remote attackers to obtain sensitive private-key information via an attack against use of a (1) Diffie-Hellman (DH) or (2) Diffie-Hellman Ephemeral (DHE) ciphersuite.
Query: CVE similar to CVE-2015-1217
Matching passage: CVE-2015-1217. CWE: CWE-17. CVSS: 7.5. The V8LazyEventListener::prepareListenerObject function in bindings/core/v8/V8LazyEventListener.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, does not properly compile listeners, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that leverage "type confusion."
Near-miss passage: CVE-2015-7030. CWE: CWE-17. CVSS: 7.5. The Swift implementation in Apple Xcode before 7.1 mishandles type conversion, which has unspecified impact and attack vectors.
Query: detect Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet) in logs
Matching passage: Sigma rule: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet). Logsource: windows / process_creation. Rule: title: Suspicious Encoded PowerShell Command Line id: ca2092a1-c273-4878-9b4b-0d60115bf5ea status: test description: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet) references: - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community date: 2018-09-03 modified: 2023-04-06 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_enc: CommandLine|contains: ' -e' selection_cli_content: CommandLine|contains: - ' JAB' - ' SUVYI' - ' SQBFAFgA' - ' aQBlAHgA' - ' aWV4I' - ' IAA' - ' IAB' - ' UwB' - ' cwB' selection_standalone: CommandLine|contains: - '.exe -ENCOD ' - ' BA^J e-' filter_optional_remote_signed: CommandLine|contains: ' -ExecutionPolicy remotesigned ' condition: selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_* level: high
Near-miss passage: Sigma rule: Indicates user activity that is unusual for the user or consistent with known attack patterns.. Logsource: azure / riskdetection. Rule: title: Azure AD Threat Intelligence id: a2cb56ff-4f46-437a-a0fa-ffa4d1303cba status: test description: Indicates user activity that is unusual for the user or consistent with known attack patterns. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-sign-in - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: riskdetection detection: selection: riskEventType: investigationsThreatIntelligence condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Query: Sigma rule for Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. Th
Matching passage: Sigma rule: Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. Th. Logsource: windows / process_creation. Rule: title: Cmd.EXE Missing Space Characters Execution Anomaly id: a16980c2-0c56-4de0-9a79-17971979efdd status: test description: 'Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer). ' references: - https://twitter.com/cyb3rops/status/1562072617552678912 - https://ss64.com/nt/cmd.html author: Florian Roth (Nextron Systems) date: 2022-08-23 modified: 2026-05-13 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - cmd.exe/c - \cmd/c - '"cmd/c' - cmd.exe/k - \cmd/k - '"cmd/k' - cmd.exe/r - \cmd/r - '"cmd/r' selection2: CommandLine|contains: - /cwhoami - /cpowershell - /cschtasks - /cbitsadmin - /ccertutil - /kwhoami - /kpowershell - /kschtasks - /kbitsadmin - /kcertutil selection3: CommandLine|contains: - cmd.exe /c - cmd /c - cmd.exe /k - cmd /k - cmd.exe /r - cmd /r filter_generic: CommandLine|contains: - 'cmd.exe /c ' - 'cmd /c ' - 'cmd.exe /k ' - 'cmd /k ' - 'cmd.exe /r ' - 'cmd /r ' filter_fp: - CommandLine|contains: AppData\Local\Programs\Microsoft VS Code\resources\app\node_modules - CommandLine|endswith: cmd.exe/c . - CommandLine: cmd.exe /c - CommandLine: cmd /c condition: 1 of selection* and not 1 of filter_* falsepositives: - Legitimate use of cmd.exe with no arguments e.g. via system("") in C to enable ANSI escape codes level: high
Near-miss passage: Sigma rule: Adversaries may carry out malicious operations using a virtual instance to avoid detection. Logsource: windows / ps_script. Rule: title: Suspicious Hyper-V Cmdlets id: 42d36aa1-3240-4db0-8257-e0118dcdd9cd status: test description: Adversaries may carry out malicious operations using a virtual instance to avoid detection references: - https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.006/T1564.006.md#atomic-test-3---create-and-start-hyper-v-virtual-machine author: frack113 date: 2022-04-09 tags: - attack.stealth - attack.t1564.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - New-VM - Set-VMFirmware - Start-VM condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Query: detection rule: Detects when an security threat is detected in Okta.
Matching passage: Sigma rule: Detects when an security threat is detected in Okta.. Logsource: okta / okta. Rule: title: Okta Security Threat Detected id: 5c82f0b9-3c6d-477f-a318-0e14a1df73e0 status: test description: Detects when an security threat is detected in Okta. references: - https://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.command-and-control logsource: product: okta service: okta detection: selection: eventType: security.threat.detected condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script. Logsource: windows / registry_set. Rule: title: PowerShell Logging Disabled Via Registry Key Tampering id: fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7 status: test description: Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled author: frack113 date: 2022-04-02 modified: 2023-08-17 tags: - attack.stealth - attack.defense-impairment - attack.t1564.001 - attack.t1112 - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Microsoft\Windows\PowerShell\ - \Microsoft\PowerShellCore\ TargetObject|endswith: - \ModuleLogging\EnableModuleLogging - \ScriptBlockLogging\EnableScriptBlockLogging - \ScriptBlockLogging\EnableScriptBlockInvocationLogging - \Transcription\EnableTranscripting - \Transcription\EnableInvocationHeader - \EnableScripts Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_powershell_logging_disabled/info.yml simulation: - type: atomic-red-team name: Disable PowerShell Logging via Registry technique: T1112 atomic_guid: 95b25212-91a7-42ff-9613-124aca6845a8
Query: write Sigma for Detects remote task creation via at.exe or API interacting with ATSVC namedpipe
Matching passage: Sigma rule: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe. Logsource: zeek / smb_files. Rule: title: Remote Task Creation via ATSVC Named Pipe - Zeek id: dde85b37-40cd-4a94-b00c-0b8794f956b5 related: - id: f6de6525-4509-495a-8a82-1f8b0ed73a00 type: derived status: test description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe references: - https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html author: Samir Bousseaden, @neu5rn date: 2020-04-03 modified: 2022-12-27 tags: - attack.privilege-escalation - attack.execution - attack.lateral-movement - attack.persistence - car.2013-05-004 - car.2015-04-001 - attack.t1053.002 logsource: product: zeek service: smb_files detection: selection: path: \\\*\IPC$ name: atsvc condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects successful logon attempts performed with WMI. Logsource: windows / security. Rule: title: Successful Account Login Via WMI id: 5af54681-df95-4c26-854f-2565e13cfab0 status: stable description: Detects successful logon attempts performed with WMI references: - Internal Research author: Thomas Patzke date: 2019-12-04 modified: 2024-01-17 tags: - attack.execution - attack.t1047 logsource: product: windows service: security detection: selection: EventID: 4624 ProcessName|endswith: \WmiPrvSE.exe condition: selection falsepositives: - Monitoring tools - Legitimate system administration level: low
Query: Outbound C2 pattern associated with Create Snapshot
Matching passage: T1578.001 Create Snapshot. Tactics: defense impairment. Description: An adversary may create a snapshot or data backup within a cloud account to evade defenses. A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume. An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in [Revert Cloud Instance](https://attack.mitre.org/techniques/T1578/004) where an adversary may revert to a snapshot to evade detection and remove evidence of their presence. An adversary may [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002), mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Query: describe CVE-2015-7391
Matching passage: CVE-2015-7391. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.
Near-miss passage: CVE-2015-6731. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the SemanticForms extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via a (1) section_*, (2) template_*, (3) label_*, or (4) new_template parameter to Special:CreateForm or (5) target or (6) alt_form parameter to Special:FormEdit.
Query: containment actions for Suspicious Serverless execution detected on endpoint
Matching passage: Playbook for T1583.007 Serverless. 1) Validate alert telemetry against T1583.007. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: resource development. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may purchase and configure serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once acquired, the serverless runtime environment can be leveraged to eithe
Near-miss passage: Playbook for T1583.004 Server. Different response path focused on resource development.
Query: intelligence brief on T1619
Matching passage: T1619 Cloud Storage Object Discovery. Tactics: discovery. Description: Adversaries may enumerate objects in cloud storage infrastructure. Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage. Similar to [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) on a local host, after identifying available storage services (i.e. [Cloud Infrastructure Discovery](https://attack.mitre.org/techniques/T1580)) adversaries may access the contents/objects stored in cloud infrastructure. Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage. Examples include ListObjectsV2 in AWS (Citation: ListObjectsV2) and List Blobs in Azure(Citation: List Blobs) .
Near-miss passage: T1018 Remote System Discovery. Tactics: discovery. Description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as [Ping](https://attack.mitre.org/software/S0097), <code>net view</code> using [Net](https://attack.mitre.org/software/S0039), or, on ESXi servers, `esxcli network diag ping`. Adversaries may also analyze data from local host files (ex: <code>C:\Windows\System32\Drivers\etc\hosts</code> or <code>/etc/hosts</code>) or other passive means (such as local [Arp](https://attack.mitre.org/software/S0099) cache entries) in order to discover the presence of remote systems in an environment. Adversaries may also target discovery of network infrastructure as well as leverage [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands on network devices to gather detailed information about systems within a network (e.g. <code>show cdp neighbors</code>, <code>show arp</code>).(Citation: US-CERT-TA18-106A)(Citation: CISA AR21-126A FIVEHANDS May 2021)
Query: describe CVE-2015-6260
Matching passage: CVE-2015-6260. CWE: CWE-20. CVSS: 7.5. Cisco NX-OS 7.1(1)N1(1) on Nexus 5500, 5600, and 6000 devices does not properly validate PDUs in SNMP packets, which allows remote attackers to cause a denial of service (SNMP application restart) via a crafted packet, aka Bug ID CSCut84645.
Near-miss passage: CVE-2015-5144. CWE: CWE-20. CVSS: 4.300000190734863. Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Query: alert when Detects Obfuscated use of Clip.exe to execute PowerShell
Matching passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / system. Rule: title: Invoke-Obfuscation CLIP+ Launcher - System id: f7385ee2-0e0c-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2023-02-20 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - cmd - '&&' - 'clipboard]::' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (. Logsource: windows / process_creation. Rule: title: PowerShell MSI Install via WindowsInstaller COM From Remote Location id: 222720a7-047f-4054-baa5-bab9be757db0 status: experimental description: 'Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection. ' references: - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 author: Meroujan Antonyan (vx3r) date: 2025-06-05 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - -ComObject - InstallProduct( selection_remote: CommandLine|contains: - http - \\\\ filter_main_localhost: CommandLine|contains: - ://127.0.0.1 - ://localhost condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: secure coding against Double-Checked Locking
Matching passage: CWE-609 Double-Checked Locking. The product uses double-checked locking to access a resource without the overhead of explicit synchronization, but the locking is insufficient.
Near-miss passage: CWE-143 Improper Neutralization of Record Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
Query: patch priority for CVE-2015-6333
Matching passage: CVE-2015-6333. CWE: CWE-264. CVSS: 4.599999904632568. Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.
Near-miss passage: CVE-2015-3270. CWE: CWE-264. CVSS: 6.5. Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords.