alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the in logs
Matching passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / registry_set. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - REG id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 related: - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider filter: TargetObject|contains: - \System\CurrentControlSet\Services\WebClient\NetworkProvider - \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider - \System\CurrentControlSet\Services\RDPNP\NetworkProvider filter_valid_procs: Image: C:\Windows\System32\poqexec.exe condition: selection and not 1 of filter* falsepositives: - Other legitimate network providers used and not filtred in this rule level: medium
Near-miss passage: Sigma rule: Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute. Logsource: windows / process_creation. Rule: title: Potential Arbitrary Code Execution Via Node.EXE id: 6640f31c-01ad-49b5-beb5-83498a5cd8bd status: test description: Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return - https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/ - https://nodejs.org/api/cli.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-02-03 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection_main: Image|endswith: \node.exe CommandLine|contains: - ' -e ' - ' --eval ' selection_action_reverse_shell: CommandLine|contains|all: - .exec( - net.socket - .connect - child_process condition: selection_main and 1 of selection_action_* falsepositives: - Unlikely level: high
Query: CVE similar to CVE-2015-10047
Matching passage: CVE-2015-10047. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in KYUUBl school-register. It has been classified as critical. This affects an unknown part of the file src/DBManager.java. The manipulation leads to sql injection. The patch is named 1cf7e01b878aee923f2b22cc2535c71a680e4c30. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218355.
Near-miss passage: CVE-2015-2242. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in Webshop hun 1.062S allow remote attackers to execute arbitrary SQL commands via the (1) termid or (2) nyelv_id parameter to index.php.
Query: actor TTPs: Browser Information Discovery
Matching passage: T1217 Browser Information Discovery. Tactics: discovery. Description: Adversaries may enumerate information about browsers to learn more about compromised environments. Data saved by browsers (such as bookmarks, accounts, and browsing history) may reveal a variety of personal information about users (e.g., banking sites, relationships/interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.(Citation: Kaspersky Autofill) Browser information may also highlight additional targets after an adversary has access to valid credentials, especially [Credentials In Files](https://attack.mitre.org/techniques/T1552/001) associated with logins cached by a browser. Specific storage locations vary based on platform and/or application, but browser information is typically stored in local files and databases (e.g., `%APPDATA%/Google/Chrome`).(Citation: Chrome Roaming Profiles)
Near-miss passage: T1007 System Service Discovery. Tactics: discovery. Description: Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.(Citation: Elastic Security Labs GOSAR 2024)(Citation: SentinelLabs macOS Malware 2021)(Citation: Splunk Linux Gormir 2024)(Citation: Aquasec Kinsing 2020) Adversaries may use the information from [System Service Discovery](https://attack.mitre.org/techniques/T1007) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Query: common weakness: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Matching passage: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as <, >, and & that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Near-miss passage: CWE-691 Insufficient Control Flow Management. The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
Query: detect An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver in logs
Matching passage: Sigma rule: An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver. Logsource: windows / process_creation. Rule: title: Rundll32 InstallScreenSaver Execution id: 15bd98ea-55f4-4d37-b09a-e7caa0fa2221 status: test description: An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver references: - https://lolbas-project.github.io/lolbas/Libraries/Desk/ - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1218.011/T1218.011.md#atomic-test-13---rundll32-with-deskcpl author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec date: 2022-04-28 modified: 2023-02-09 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: InstallScreenSaver condition: all of selection_* falsepositives: - Legitimate installation of a new screensaver level: medium
Near-miss passage: Sigma rule: Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have be. Logsource: windows / process_creation. Rule: title: Registry Export of Third-Party Credentials id: cc1abf27-78a3-4ac5-a51c-f3070b1d8e40 related: - id: 87a476dc-0079-4583-a985-dee7a20a03de type: similar status: experimental description: 'Detects the use of reg.exe to export registry paths associated with third-party credentials. Credential stealers have been known to use this technique to extract sensitive information from the registry. ' references: - https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-05-22 tags: - attack.credential-access - attack.t1552.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli_save: CommandLine|contains: - save - export selection_cli_path: CommandLine|contains: - \Software\Aerofox\Foxmail\V3.1 - \Software\Aerofox\FoxmailPreview - \Software\DownloadManager\Passwords - \Software\FTPWare\COREFTP\Sites - \Software\IncrediMail\Identities - \Software\Martin Prikryl\WinSCP 2\Sessions - \Software\Mobatek\MobaXterm - \Software\OpenSSH\Agent\Keys - \Software\OpenVPN-GUI\configs - \Software\ORL\WinVNC3\Password - \Software\Qualcomm\Eudora\CommandLine - \Software\RealVNC\WinVNC4 - \Software\RimArts\B2\Settings - \Software\SimonTatham\PuTTY\Sessions - \Software\SimonTatham\PuTTY\SshHostKeys - \Software\Sota\FFFTP - \Software\TightVNC\Server - \Software\WOW6432Node\Radmin\v3.0\Server\Parameters\Radmin condition: all of selection_* falsepositives: - Unknown level: high
Query: rule covering Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, a
Matching passage: Sigma rule: Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, a. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Admission Controller id: a61a3c56-4ce2-4351-a079-88ae4cbd2b58 status: test description: 'Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes author: Austin Songer @austinsonger date: 2021-11-25 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.credential-access - attack.t1552 - attack.t1552.007 logsource: product: azure service: activitylogs detection: selection: operationName|startswith: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO - MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO operationName|endswith: - /MUTATINGWEBHOOKCONFIGURATIONS/WRITE - /VALIDATINGWEBHOOKCONFIGURATIONS/WRITE condition: selection falsepositives: - Azure Kubernetes Admissions Controller may be done by a system administrator. - If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which mig. Logsource: azure / signinlogs. Rule: title: User Access Blocked by Azure Conditional Access id: 9a60e676-26ac-44c3-814b-0c2a8b977adf status: test description: 'Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.credential-access - attack.initial-access - attack.stealth - attack.t1110 - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 53003 condition: selection falsepositives: - Unknown level: medium
Query: detection rule: Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for securit
Matching passage: Sigma rule: Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for securit. Logsource: aws / cloudtrail. Rule: title: AWS Bucket Deleted id: 39c9f26d-6e3b-4dbb-9c7a-4154b0281112 status: experimental description: 'Detects the deletion of S3 buckets in AWS CloudTrail logs. Monitoring the deletion of S3 buckets is critical for security and data integrity, as it may indicate potential data loss or unauthorized access attempts. ' references: - https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html author: Ivan Saakov, Nasreddine Bencherchali date: 2025-10-19 tags: - attack.stealth logsource: product: aws service: cloudtrail detection: selection_event_name: eventName: DeleteBucket selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_name and 1 of selection_status_* falsepositives: - During maintenance operations or testing, authorized administrators may delete S3 buckets as part of routine data management or cleanup activities. level: medium
Near-miss passage: Sigma rule: Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary co. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook Today Page id: 487bb375-12ef-41f6-baae-c6a1572b4dd1 related: - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76 type: similar status: test description: 'Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl". ' references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74 - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand date: 2021-06-10 modified: 2024-08-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains|all: - Software\Microsoft\Office\ - \Outlook\Today\ selection_value_stamp: TargetObject|endswith: \Stamp Details: DWORD (0x00000001) selection_value_url: TargetObject|endswith: - \URL - \UserDefinedUrl filter_main_office: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\ Image|endswith: \OfficeClickToRun.exe condition: selection_main and 1 of selection_value_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: CWE for Use of Web Browser Cache Containing Sensitive Information
Matching passage: CWE-525 Use of Web Browser Cache Containing Sensitive Information. The web application does not use an appropriate caching policy that specifies the extent to which each web page and associated form fields should be cached.
Near-miss passage: CWE-1243 Sensitive Non-Volatile Information Not Protected During Debug. Access to security-sensitive information stored in fuses is not limited during debug.
Query: exploit The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outa
Matching passage: CVE-2015-5917. CWE: CWE-119. CVSS: 5.0. The glob implementation in tnftpd (formerly lukemftpd), as used in Apple OS X before 10.11, allows remote attackers to cause a denial of service (memory consumption and daemon outage) via a STAT command containing a crafted pattern, as demonstrated by multiple instances of the {..,..,..}/* substring.
Near-miss passage: CVE-2015-7064. CWE: CWE-119. CVSS: 6.800000190734863. OpenGL in Apple iOS before 9.2, OS X before 10.11.2, tvOS before 9.1, and watchOS before 2.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2015-7066.
Query: describe CVE-2015-3983
Matching passage: CVE-2015-3983. CWE: CWE-310. CVSS: 4.300000190734863. The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. NOTE: this issue was SPLIT from CVE-2015-1848 per ADT2 due to different vulnerability types.
Near-miss passage: CVE-2015-1848. CWE: CWE-310. CVSS: 6.800000190734863. The pcs daemon (pcsd) in PCS 0.9.137 and earlier does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session. NOTE: this issue was SPLIT per ADT2 due to different vulnerability types. CVE-2015-3983 is for the issue with not setting the HTTPOnly flag.
Query: exploit Cross-site scripting (XSS) vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-5492. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-9405. CWE: CWE-79. CVSS: 6.099999904632568. The wp-piwik plugin before 1.0.5 for WordPress has XSS.
Query: detect Detects a dump file written by QuarksPwDump password dumper in logs
Matching passage: Sigma rule: Detects a dump file written by QuarksPwDump password dumper. Logsource: windows / file_event. Rule: title: HackTool - QuarksPwDump Dump File id: 847def9e-924d-4e90-b7c4-5f581395a2b4 status: test description: Detects a dump file written by QuarksPwDump password dumper references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm author: Florian Roth (Nextron Systems) date: 2018-02-10 modified: 2024-06-27 tags: - attack.credential-access - attack.t1003.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains|all: - \AppData\Local\Temp\SAM- - .dmp condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers. Logsource: windows / process_creation. Rule: title: Python One-Liners with Base64 Decoding id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b related: - id: 55e862a8-dd9c-4651-807a-f21fcad56716 type: similar status: experimental description: 'Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion. ' references: - https://docs.python.org/3/library/base64.html - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-03-09 tags: - attack.execution - attack.stealth - attack.t1059.006 - attack.t1027.010 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \python - OriginalFileName|contains: python selection_cli: CommandLine|contains|all: - import - base64 - ' -c' CommandLine|contains: - .decode - b16decode - b32decode - b32hexdecode - b64decode - b85decode - z85decode condition: all of selection_* falsepositives: - Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml
Query: exploit Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and A
Matching passage: CVE-2015-5114. CWE: CWE-416. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-4448, CVE-2015-5095, CVE-2015-5099, CVE-2015-5101, CVE-2015-5111, and CVE-2015-5113.
Near-miss passage: CVE-2015-7621. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617.
Query: patch priority for CVE-2015-3408
Matching passage: CVE-2015-3408. CWE: CWE-77. CVSS: 10.0. Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
Near-miss passage: CVE-2015-0778. CWE: CWE-77. CVSS: 7.5. osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.