alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / registry_event
Matching passage: Sigma rule: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure functi. Logsource: windows / registry_event. Rule: title: HybridConnectionManager Service Installation - Registry id: ac8866c7-ce44-46fd-8c17-b24acff96ca8 status: test description: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function. references: - https://twitter.com/Cyb3rWard0g/status/1381642789369286662 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2021-04-12 modified: 2022-11-27 tags: - attack.resource-development - attack.t1608 logsource: category: registry_event product: windows detection: selection1: TargetObject|contains: \Services\HybridConnectionManager selection2: EventType: SetValue Details|contains: Microsoft.HybridConnectionManager.Listener.exe condition: selection1 or selection2 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Monitor and alert on conditional access changes.. Logsource: azure / auditlogs. Rule: title: New CA Policy by Non-approved Actor id: 0922467f-db53-4348-b7bf-dee8d0d348c6 status: test description: Monitor and alert on conditional access changes. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure author: Corissa Koopmans, '@corissalea' date: 2022-07-18 tags: - attack.privilege-escalation - attack.t1548 logsource: product: azure service: auditlogs detection: selection: properties.message: Add conditional access policy condition: selection falsepositives: - Misconfigured role permissions - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. level: medium
Query: detect Detects that a powershell code is written to the registry as a service. in logs
Matching passage: Sigma rule: Detects that a powershell code is written to the registry as a service.. Logsource: windows / registry_set. Rule: title: PowerShell as a Service in Registry id: 4a5f5a5e-ac01-474b-9b4e-d61298c9df1d status: test description: Detects that a powershell code is written to the registry as a service. references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse author: oscd.community, Natalia Shornikova date: 2020-10-06 modified: 2023-08-17 tags: - attack.execution - attack.t1569.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\ TargetObject|endswith: \ImagePath Details|contains: - powershell - pwsh condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the pattern of a pipe name as used by the hack tool EfsPotato. Logsource: windows / pipe_created. Rule: title: HackTool - EfsPotato Named Pipe Creation id: 637f689e-b4a5-4a86-be0e-0100a0a33ba2 status: test description: Detects the pattern of a pipe name as used by the hack tool EfsPotato references: - https://twitter.com/SBousseaden/status/1429530155291193354?s=20 - https://github.com/zcgonvh/EfsPotato author: Florian Roth (Nextron Systems) date: 2021-08-23 modified: 2023-12-21 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: - \pipe\ - \pipe\srvsvc filter_optional_ctx: PipeName|contains: \CtxShare filter_optional_default: PipeName|startswith: \pipe\ condition: selection and not 1 of filter_optional_* falsepositives: - \pipe\LOCAL\Monitorian level: high
Query: patch priority for CVE-2015-1945
Matching passage: CVE-2015-1945. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Reference Data Management component in IBM InfoSphere Master Data Management 10.1, 11.0, 11.3 before FP3, and 11.4 allows remote authenticated users to gain privileges via unknown vectors.
Near-miss passage: CVE-2015-5669. CWE: UNKNOWN. CVSS: 6.5. Techno Project Japan Enisys Gw before 1.4.1 allows remote authenticated users to write to arbitrary files and consequently execute arbitrary code via unspecified vectors.
Query: CVE similar to CVE-2015-3612
Matching passage: CVE-2015-3612. CWE: CWE-79. CVSS: 5.400000095367432. A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page.
Near-miss passage: CVE-2015-4656. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Synology Photo Station before 6.3-2945 allow remote attackers to inject arbitrary web script or HTML via the (1) success parameter to login.php or (2) crafted URL parameters to index.php, as demonstrated by the t parameter to photo/.
Query: describe CVE-2015-4892
Matching passage: CVE-2015-4892. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2015-4917.
Near-miss passage: CVE-2015-1118. CWE: UNKNOWN. CVSS: 5.0. libnetcore in Apple iOS before 8.3, Apple OS X before 10.10.3, and Apple TV before 7.2 allows attackers to cause a denial of service (memory corruption and application crash) via a crafted configuration profile.
Query: threat report mentioning Local Accounts
Matching passage: T1078.003 Local Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through [OS Credential Dumping](https://attack.mitre.org/techniques/T1003). Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.
Near-miss passage: T1078 Valid Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.(Citation: volexity_0day_sophos_FW) Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence. In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.(Citation: CISA MFA PrintNightmare) The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.(Citation: TechNet Credential Theft)
Query: patch priority for CVE-2015-8659
Matching passage: CVE-2015-8659. CWE: CWE-119. CVSS: 10.0. The idle stream handling in nghttp2 before 1.6.0 allows attackers to have unspecified impact via unknown vectors, aka a heap-use-after-free bug.
Near-miss passage: CVE-2015-7939. CWE: CWE-119. CVSS: 9.600000381469727. Heap-based buffer overflow in Unitronics VisiLogic OPLC IDE before 9.8.09 allows remote attackers to execute arbitrary code via a long vlp filename.
Query: vulnerability: Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote atta
Matching passage: CVE-2015-7599. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a username and password.
Near-miss passage: CVE-2015-1527. CWE: CWE-190. CVSS: 7.800000190734863. Integer overflow in IAudioPolicyService.cpp in Android allows local users to gain privileges via a crafted application, aka Android Bug ID 19261727.
Query: Sigma rule for Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence
Matching passage: Sigma rule: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence. Logsource: okta / okta. Rule: title: Okta Admin Role Assignment Created id: 139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c status: test description: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Nikita Khalimonenkov date: 2023-01-19 modified: 2026-04-27 tags: - attack.persistence logsource: product: okta service: okta detection: selection: eventType: iam.resourceset.bindings.add condition: selection falsepositives: - Legitimate creation of a new admin role assignment level: medium
Near-miss passage: Sigma rule: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Regsvr32 HTTP IP Pattern id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8 status: test description: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address. references: - https://twitter.com/mrd0x/status/1461041276514623491 - https://twitter.com/tccontre18/status/1480950986650832903 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-05-24 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_ip: CommandLine|contains: - ' /i:http://1' - ' /i:http://2' - ' /i:http://3' - ' /i:http://4' - ' /i:http://5' - ' /i:http://6' - ' /i:http://7' - ' /i:http://8' - ' /i:http://9' - ' /i:https://1' - ' /i:https://2' - ' /i:https://3' - ' /i:https://4' - ' /i:https://5' - ' /i:https://6' - ' /i:https://7' - ' /i:https://8' - ' /i:https://9' - ' -i:http://1' - ' -i:http://2' - ' -i:http://3' - ' -i:http://4' - ' -i:http://5' - ' -i:http://6' - ' -i:http://7' - ' -i:http://8' - ' -i:http://9' - ' -i:https://1' - ' -i:https://2' - ' -i:https://3' - ' -i:https://4' - ' -i:https://5' - ' -i:https://6' - ' -i:https://7' - ' -i:https://8' - ' -i:https://9' condition: all of selection_* falsepositives: - FQDNs that start with a number such as "7-Zip" level: high
Query: exploit IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and 7.6.0
Matching passage: CVE-2015-4966. CWE: CWE-255. CVSS: 6.5. IBM Maximo Asset Management 7.1 through 7.1.1.13, 7.5.0 before 7.5.0.9 FP009, and 7.6.0 before 7.6.0.2 IFIX001; Maximo Asset Management 7.5.0 before 7.5.0.9 FP009, 7.5.1, and 7.6.0 before 7.6.0.2 IFIX001 for SmartCloud Control Desk; and Maximo Asset Management 7.1 through 7.1.1.13 and 7.2 for Tivoli IT Asset Management for IT and certain other products have a default administrator account, which makes it easier for remote authenticated users to obtain access via unspecified vectors.
Near-miss passage: CVE-2015-8611. CWE: CWE-255. CVSS: 9.800000190734863. BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, and PEM 12.0.0 before HF1 on the 2000, 4000, 5000, 7000, and 10000 platforms do not properly sync passwords with the Always-On Management (AOM) subsystem, which might allow remote attackers to obtain login access to AOM via an (1) expired or (2) default password.
Query: SIEM correlation: stealth activity consistent with System Script Proxy Execution
Matching passage: T1216 System Script Proxy Execution. Tactics: stealth. Description: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)
Near-miss passage: T1216.002 SyncAppvPublishingServer. Tactics: stealth. Description: Adversaries may abuse SyncAppvPublishingServer.vbs to proxy execution of malicious [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands. SyncAppvPublishingServer.vbs is a Visual Basic script associated with how Windows virtualizes applications (Microsoft Application Virtualization, or App-V).(Citation: 1 - appv) For example, Windows may render Win32 applications to users as virtual applications, allowing users to launch and interact with them as if they were installed locally.(Citation: 2 - appv)(Citation: 3 - appv) The SyncAppvPublishingServer.vbs script is legitimate, may be signed by Microsoft, and is commonly executed from `\System32` through the command line via `wscript.exe`.(Citation: 4 - appv)(Citation: 5 - appv) Adversaries may abuse SyncAppvPublishingServer.vbs to bypass [PowerShell](https://attack.mitre.org/techniques/T1059/001) execution restrictions and evade defensive counter measures by "living off the land."(Citation: 6 - appv)(Citation: 4 - appv) Proxying execution may function as a trusted/signed alternative to directly invoking `powershell.exe`.(Citation: 7 - appv) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands may be invoked using:(Citation: 5 - appv) `SyncAppvPublishingServer.vbs "n; {PowerShell}"`
Query: exploit Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified 
Matching passage: CVE-2015-3054. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-3053, CVE-2015-3055, CVE-2015-3059, and CVE-2015-3075.
Near-miss passage: CVE-2015-8288. CWE: UNKNOWN. CVSS: 5.900000095367432. NETGEAR D3600 devices with firmware 1.0.0.49 and D6000 devices with firmware 1.0.0.49 and earlier use the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Query: rule covering Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection session
Matching passage: Sigma rule: Detects when the 'AllowMultipleTSSessions' value is enabled. Which allows for multiple Remote Desktop connection session. Logsource: windows / registry_set. Rule: title: Winlogon AllowMultipleTSSessions Enable id: f7997770-92c3-4ec9-b112-774c4ef96f96 status: test description: 'Detects when the ''AllowMultipleTSSessions'' value is enabled. Which allows for multiple Remote Desktop connection sessions to be opened at once. This is often used by attacker as a way to connect to an RDP session without disconnecting the other users ' references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions Details|endswith: DWORD (0x00000001) condition: selection falsepositives: - Legitimate use of the multi session functionality level: medium
Near-miss passage: Sigma rule: Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern ". Logsource: zeek / dns. Rule: title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network id: 5588576c-5898-4fac-bcdd-7475a60e8f43 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar status: experimental description: 'Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: product: zeek service: dns detection: selection: query|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Query: detect Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instan in logs
Matching passage: Sigma rule: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instan. Logsource: windows / process_creation. Rule: title: Suspicious Chromium Browser Instance Executed With Custom Extension id: 27ba3207-dd30-4812-abbf-5d20c57d474e related: - id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 type: similar status: test description: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/info.yml
Near-miss passage: Sigma rule: Detect a system being shutdown or put into different boot mode. Logsource: cisco / aaa. Rule: title: Cisco Denial of Service id: d94a35f0-7a29-45f6-90a0-80df6159967c status: test description: Detect a system being shutdown or put into different boot mode author: Austin Clark date: 2019-08-15 modified: 2023-01-04 tags: - attack.impact - attack.t1495 - attack.t1529 - attack.t1565.001 logsource: product: cisco service: aaa detection: keywords: - shutdown - config-register 0x2100 - config-register 0x2142 condition: keywords falsepositives: - Legitimate administrators may run these commands, though rarely. level: medium
Query: common weakness: Integer Coercion Error
Matching passage: CWE-192 Integer Coercion Error. Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
Near-miss passage: CWE-226 Sensitive Information in Resource Not Removed Before Reuse. The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or zeroize the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
Query: write Sigma for Detects system information discovery commands
Matching passage: Sigma rule: Detects system information discovery commands. Logsource: linux / auditd. Rule: title: System and Hardware Information Discovery id: 1f358e2e-cb63-43c3-b575-dfb072a6814f related: - id: 42df45e7-e6e9-43b5-8f26-bec5b39cc239 type: derived status: stable description: Detects system information discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-4---linux-vm-check-via-hardware author: Ömer Günal, oscd.community date: 2020-10-08 modified: 2022-11-26 tags: - attack.discovery - attack.t1082 logsource: product: linux service: auditd detection: selection: type: PATH name: - /sys/class/dmi/id/bios_version - /sys/class/dmi/id/product_name - /sys/class/dmi/id/chassis_vendor - /proc/scsi/scsi - /proc/ide/hd0/model - /proc/version - /etc/*version - /etc/*release - /etc/issue condition: selection falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.. Logsource: windows / process_access. Rule: title: Uncommon Process Access Rights For Target Image id: a24e5861-c6ca-4fde-a93c-ba9256feddf0 status: test description: 'Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask. ' references: - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-27 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.011 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: - \calc.exe - \calculator.exe - \mspaint.exe - \notepad.exe - \ping.exe - \wordpad.exe - \write.exe GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Unknown level: low