alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: alert when Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location
Matching passage: Sigma rule: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location. Logsource: linux / process_creation. Rule: title: Potentially Suspicious Named Pipe Created Via Mkfifo id: 999c3b12-0a8c-40b6-8e13-dd7d62b75c7a related: - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4 type: derived status: test description: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location references: - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-16 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|endswith: /mkfifo CommandLine|contains: ' /tmp/' condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellS. Logsource: windows / registry_event. Rule: title: Run Once Task Configuration in Registry id: c74d7efc-8826-45d9-b8bb-f04fac9e4eff status: test description: Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup references: - https://twitter.com/pabraeken/status/990717080805789697 - https://lolbas-project.github.io/lolbas/Binaries/Runonce/ author: Avneet Singh @v3t0_, oscd.community date: 2020-11-15 modified: 2024-03-25 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_event detection: selection: TargetObject|contains: \Microsoft\Active Setup\Installed Components TargetObject|endswith: \StubPath filter_optional_chrome: Details|contains|all: - C:\Program Files\Google\Chrome\Application\ - \Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level filter_optional_edge: Details|contains: - C:\Program Files (x86)\Microsoft\Edge\Application\ - C:\Program Files\Microsoft\Edge\Application\ Details|endswith: \Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate modification of the registry key by legitimate program level: medium
Query: exploit The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858.
Matching passage: CVE-2015-0661. CWE: CWE-20. CVSS: 4.0. The SNMPv2 implementation in Cisco IOS XR allows remote authenticated users to cause a denial of service (snmpd daemon reload) via a malformed SNMP packet, aka Bug ID CSCur25858.
Near-miss passage: CVE-2015-9069. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, the Secure File System can become corrupted.
Query: secure coding against Cleartext Storage of Sensitive Information
Matching passage: CWE-312 Cleartext Storage of Sensitive Information. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Near-miss passage: CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges. The product allows address regions to overlap, which can result in the bypassing of intended memory protection.
Query: CWE for Inconsistent Naming Conventions for Identifiers
Matching passage: CWE-1099 Inconsistent Naming Conventions for Identifiers. The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of related callables, I/O capabilities, data types, file names, or similar types of elements.
Near-miss passage: CWE-1393 Use of Default Password. The product uses default passwords for potentially critical functionality.
Query: write Sigma for Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which
Matching passage: Sigma rule: Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which. Logsource: windows / process_creation. Rule: title: Import LDAP Data Interchange Format File Via Ldifde.EXE id: 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f status: test description: 'Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server. ' references: - https://twitter.com/0gtweet/status/1564968845726580736 - https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11) author: '@gott_cyber' date: 2022-09-02 modified: 2023-03-14 tags: - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ldifde.exe - OriginalFileName: ldifde.exe selection_cli: CommandLine|contains|all: - -i - -f condition: all of selection_* falsepositives: - Since the content of the files are unknown, false positives are expected level: medium
Near-miss passage: Sigma rule: Detects suspicious encoded payloads in WMI Event Consumers. Logsource: windows / wmi_event. Rule: title: Suspicious Encoded Scripts in a WMI Consumer id: 83844185-1c5b-45bc-bcf3-b5bf3084ca5b status: test description: Detects suspicious encoded payloads in WMI Event Consumers references: - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems) date: 2021-09-01 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.execution - attack.t1047 - attack.persistence - attack.t1546.003 logsource: product: windows category: wmi_event detection: selection_destination: Destination|base64offset|contains: - WriteProcessMemory - This program cannot be run in DOS mode - This program must be run under Win32 condition: selection_destination falsepositives: - Unknown level: high
Query: detection rule: Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.
Matching passage: Sigma rule: Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - AnyDesk Piped Password Via CLI id: b1377339-fda6-477a-b455-ac0923f9ec2c status: test description: Detects piping the password to an anydesk instance via CMD and the '--set-password' flag. references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-28 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '/c ' - 'echo ' - .exe --set-password condition: selection falsepositives: - Legitimate piping of the password to anydesk - Some FP could occur with similar tools that uses the same command line '--set-password' level: medium
Near-miss passage: Sigma rule: Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from. Logsource: windows / process_access. Rule: title: Lsass Memory Dump via Comsvcs DLL id: a49fa4d5-11db-418c-8473-1e014a8dd462 status: test description: Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. references: - https://twitter.com/shantanukhande/status/1229348874298388484 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: \rundll32.exe CallTrace|contains: comsvcs.dll condition: selection falsepositives: - Unknown level: high
Query: rule covering Indicates that a password spray attack has been successfully performed.
Matching passage: Sigma rule: Indicates that a password spray attack has been successfully performed.. Logsource: azure / riskdetection. Rule: title: Password Spray Activity id: 28ecba0a-c743-4690-ad29-9a8f6f25a6f9 status: test description: Indicates that a password spray attack has been successfully performed. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1110 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: passwordSpray condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Near-miss passage: Sigma rule: Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command li. Logsource: windows / ps_script. Rule: title: DMSA Link Attributes Modified id: 9b111d8e-92e0-4153-88bc-daefc1333aba related: - id: 6c9eb492-e477-4df9-b0f4-571fc9db29cd type: similar status: experimental description: 'Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts. This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025. ' references: - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-24 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.002 - attack.t1098 logsource: category: ps_script product: windows detection: selection: ScriptBlockText|contains|all: - .Put("msDS-ManagedAccountPrecededByLink - CN= condition: selection falsepositives: - Legitimate administrative tasks modifying these attributes. level: low
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the HTML help system on Cisco Wireless LAN Controller (WLC) devices before 8.0 allows remote attackers to inject arbitrary web script or
Matching passage: CVE-2015-0690. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the HTML help system on Cisco Wireless LAN Controller (WLC) devices before 8.0 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCun95178.
Near-miss passage: CVE-2015-2941. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
Query: patch priority for CVE-2015-1967
Matching passage: CVE-2015-1967. CWE: CWE-200. CVSS: 4.300000190734863. MQ Explorer in IBM WebSphere MQ before 8.0.0.3 does not recognize the absence of the compatibility-mode option, which allows remote attackers to obtain sensitive information by sniffing the network for a session in which TLS is not used.
Near-miss passage: CVE-2015-7935. CWE: CWE-200. CVSS: 7.5. Motorola Solutions MOSCAD IP Gateway allows remote attackers to read arbitrary files via unspecified vectors.
Query: secure coding against Security Version Number Mutable to Older Versions
Matching passage: CWE-1328 Security Version Number Mutable to Older Versions. Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.
Near-miss passage: CWE-1069 Empty Exception Block. An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
Query: exploit The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensiti
Matching passage: CVE-2015-8253. CWE: CWE-200. CVSS: 3.700000047683716. The Frontel protocol before 3 on RSI Video Technologies Videofied devices sets up AES encryption but sends all traffic in cleartext, which allows remote attackers to obtain sensitive (1) message or (2) MJPEG video data by sniffing the network.
Near-miss passage: CVE-2015-7680. CWE: CWE-200. CVSS: 5.300000190734863. Ipswitch MOVEit DMZ before 8.2 provides different error messages for authentication attempts depending on whether the user account exists, which allows remote attackers to enumerate usernames via a series of SOAP requests to machine.aspx.
Query: CVE similar to CVE-2015-2727
Matching passage: CVE-2015-2727. CWE: CWE-20. CVSS: 6.800000190734863. Mozilla Firefox 38.0 and Firefox ESR 38.0 allow user-assisted remote attackers to read arbitrary files or execute arbitrary JavaScript code with chrome privileges via a crafted web site that is accessed with unspecified mouse and keyboard actions. NOTE: this vulnerability exists because of a CVE-2015-0821 regression.
Near-miss passage: CVE-2015-6407. CWE: CWE-20. CVSS: 4.0. Cisco Emergency Responder 10.5(3.10000.9) allows remote attackers to upload files to arbitrary locations via a crafted parameter, aka Bug ID CSCuv25501.
Query: detection rule: Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow un
Matching passage: Sigma rule: Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow un. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Updated id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f status: experimental description: 'Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: UpdateGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail updates by authorized identities. level: medium
Near-miss passage: Sigma rule: Detects disabling Windows Defender Exploit Guard Network Protection. Logsource: windows / registry_set. Rule: title: Disable Exploit Guard Network Protection on Windows Defender id: bf9e1387-b040-4393-9851-1598f8ecfae9 status: test description: Detects disabling Windows Defender Exploit Guard Network Protection references: - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection\DisallowExploitProtectionOverride Details: DWORD (00000001) condition: selection falsepositives: - Unknown level: medium
Query: weakness Improper Verification of Source of a Communication Channel
Matching passage: CWE-940 Improper Verification of Source of a Communication Channel. The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
Near-miss passage: CWE-109 Struts: Validator Turned Off. Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the application to other weaknesses related to insufficient input validation.
Query: rule covering Detects NetNTLM downgrade attack
Matching passage: Sigma rule: Detects NetNTLM downgrade attack. Logsource: windows / security. Rule: title: NetNTLM Downgrade Attack id: d3abac66-f11c-4ed0-8acb-50cc29c97eed related: - id: d67572a0-e2ec-45d6-b8db-c100d14b8ef2 type: derived status: test description: Detects NetNTLM downgrade attack references: - https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks author: Florian Roth (Nextron Systems), wagga date: 2018-03-20 modified: 2022-10-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685 - attack.t1112 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Object Access > Audit Registry (Success)' detection: selection: EventID: 4657 ObjectName|contains|all: - \REGISTRY\MACHINE\SYSTEM - ControlSet - \Control\Lsa ObjectValueName: - LmCompatibilityLevel - NtlmMinClientSec - RestrictSendingNTLMTraffic condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP OS Scan id: e8a677fd-248c-4eab-94df-de2f6f645884 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5002 condition: selection falsepositives: - Unlikely level: high
Query: alert when The OpenWith.exe executes other binary
Matching passage: Sigma rule: The OpenWith.exe executes other binary. Logsource: windows / process_creation. Rule: title: OpenWith.exe Executes Specified Binary id: cec8e918-30f7-4e2d-9bfa-a59cc97ae60f status: test description: The OpenWith.exe executes other binary references: - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Openwith.yml - https://twitter.com/harr0ey/status/991670870384021504 author: Beyu Denis, oscd.community (rule), @harr0ey (idea) date: 2019-10-12 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \OpenWith.exe CommandLine|contains: /c condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: CurrentControlSet Autorun Keys Modification id: f674e36a-4b91-431e-8aef-f8a96c2aca35 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: system_control_base: TargetObject|contains: \SYSTEM\CurrentControlSet\Control system_control_keys: TargetObject|contains: - \Terminal Server\WinStations\RDP-Tcp\InitialProgram - \Terminal Server\Wds\rdpwd\StartupPrograms - \SecurityProviders\SecurityProviders - \SafeBoot\AlternateShell - \Print\Providers - \Print\Monitors - \NetworkProvider\Order - \Lsa\Notification Packages - \Lsa\Authentication Packages - \BootVerificationProgram\ImagePath filter_empty: Details: (Empty) filter_cutepdf: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: \Print\Monitors\CutePDF Writer Monitor Details: - cpwmon64_v40.dll - CutePDF Writer filter_onenote: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: Print\Monitors\Appmon\Ports\Microsoft.Office.OneNote_ User|contains: - AUTHORI - AUTORI filter_poqexec: Image: C:\Windows\System32\poqexec.exe TargetObject|endswith: \NetworkProvider\Order\ProviderOrder filter_realvnc: Image: C:\Windows\System32\spoolsv.exe TargetObject|endswith: \Print\Monitors\MONVNC\Driver Details: VNCpm.dll condition: all of system_control_* and not 1 of filter_* falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Query: secure coding against Improper Interaction Between Multiple Correctly-Behaving Entities
Matching passage: CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities. An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
Near-miss passage: CWE-1328 Security Version Number Mutable to Older Versions. Security-version number in hardware is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.