alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects when the file "passwd" or "shadow" is copied from tmp path
Matching passage: Sigma rule: Detects when the file "passwd" or "shadow" is copied from tmp path. Logsource: linux / process_creation. Rule: title: Copy Passwd Or Shadow From TMP Path id: fa4aaed5-4fe0-498d-bbc0-08e3346387ba status: test description: Detects when the file "passwd" or "shadow" is copied from tmp path references: - https://blogs.blackberry.com/ - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144 author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-01-31 tags: - attack.credential-access - attack.t1552.001 logsource: product: linux category: process_creation detection: selection_img: Image|endswith: /cp selection_path: CommandLine|contains: /tmp/ selection_file: CommandLine|contains: - passwd - shadow condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry. Logsource: windows / registry_set. Rule: title: Windows Defender Service Disabled - Registry id: e1aa95de-610a-427d-b9e7-9b46cfafbe6a status: test description: Detects when an attacker or tool disables the Windows Defender service (WinDefend) via the registry references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105 author: Ján Trenčanský, frack113, AlertIQ, Nasreddine Bencherchali date: 2022-08-01 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Services\WinDefend\Start Details: DWORD (0x00000004) condition: selection falsepositives: - Administrator actions level: high
Query: risk of The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (
Matching passage: CVE-2015-8340. CWE: CWE-17. CVSS: 4.699999809265137. The memory_exchange function in common/memory.c in Xen 3.2.x through 4.6.x does not properly release locks, which might allow guest OS administrators to cause a denial of service (deadlock or host crash) via unspecified vectors, related to XENMEM_exchange error handling.
Near-miss passage: CVE-2015-4037. CWE: CWE-17. CVSS: 1.899999976158142. The slirp_smb function in net/slirp.c in QEMU 2.3.0 and earlier creates temporary files with predictable names, which allows local users to cause a denial of service (instantiation failure) by creating /tmp/qemu-smb.*-* files before the program.
Query: patch priority for CVE-2015-3737
Matching passage: CVE-2015-3737. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 8.4.1 and Safari before 6.2.8, 7.x before 7.1.8, and 8.x before 8.0.8, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-08-13-1 and APPLE-SA-2015-08-13-3.
Near-miss passage: CVE-2015-7272. CWE: CWE-119. CVSS: 9.800000190734863. Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input.
Query: write Sigma for Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for executi
Matching passage: Sigma rule: Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for executi. Logsource: windows / network_connection. Rule: title: Network Connection Initiated via Finger.EXE id: 2fdaf50b-9fd5-449f-ba69-f17248119af6 related: - id: c082c2b0-525b-4dbc-9a26-a57dc4692074 type: similar - id: af491bca-e752-4b44-9c86-df5680533dbc type: similar status: experimental description: 'Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential malicious infrastructure used by threat actors ' references: - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-19 tags: - attack.command-and-control - attack.t1071.004 - attack.execution - attack.t1059.003 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \finger.exe condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects scripts or commands that disabled the Powershell command history by removing psreadline module. Logsource: windows / ps_script. Rule: title: Disable Powershell Command History id: 602f5669-6927-4688-84db-0d4b7afb2150 status: test description: Detects scripts or commands that disabled the Powershell command history by removing psreadline module references: - https://twitter.com/DissectMalware/status/1062879286749773824 author: Ali Alwashali date: 2022-08-21 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Remove-Module - psreadline condition: selection falsepositives: - Legitimate script that disables the command history level: high
Query: risk of Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML.
Matching passage: CVE-2015-4862. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to DML.
Near-miss passage: CVE-2015-7566. CWE: UNKNOWN. CVSS: 4.599999904632568. The clie_5_attach function in drivers/usb/serial/visor.c in the Linux kernel through 4.4.1 allows physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a bulk-out endpoint.
Query: patch priority for CVE-2015-8315
Matching passage: CVE-2015-8315. CWE: CWE-1333. CVSS: 7.5. The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a "regular expression denial of service (ReDoS)."
Near-miss passage: CVE-2015-10005. CWE: CWE-1333. CVSS: 7.5. A vulnerability was found in markdown-it up to 2.x. It has been classified as problematic. Affected is an unknown function of the file lib/common/html_re.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 3.0.0 is able to address this issue. The name of the patch is 89c8620157d6e38f9872811620d25138fc9d1b0d. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216852.
Query: risk of Heap-based buffer overflow in the License Server (LicenseServer.exe) in Wavelink Terminal Emulation (TE) allows remote attackers to execute arbitrary code via a large HTTP header.
Matching passage: CVE-2015-4059. CWE: CWE-119. CVSS: 10.0. Heap-based buffer overflow in the License Server (LicenseServer.exe) in Wavelink Terminal Emulation (TE) allows remote attackers to execute arbitrary code via a large HTTP header.
Near-miss passage: CVE-2015-4493. CWE: CWE-119. CVSS: 9.300000190734863. Heap-based buffer overflow in the stagefright::ESDS::parseESDescriptor function in libstagefright in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data, a related issue to CVE-2015-1539.
Query: Sigma rule for Detects system information discovery commands
Matching passage: Sigma rule: Detects system information discovery commands. Logsource: linux / process_creation. Rule: title: System Information Discovery id: 42df45e7-e6e9-43b5-8f26-bec5b39cc239 status: stable description: Detects system information discovery commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md author: Ömer Günal, oscd.community date: 2020-10-08 modified: 2021-09-14 tags: - attack.discovery - attack.t1082 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /uname - /hostname - /uptime - /lspci - /dmidecode - /lscpu - /lsmod condition: selection falsepositives: - Legitimate administration activities level: informational
Near-miss passage: Sigma rule: Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll. Logsource: windows / registry_set. Rule: title: ETW Logging Disabled For rpcrt4.dll id: 90f342e1-1aaa-4e43-b092-39fda57ed11e status: test description: Detects changes to the "ExtErrorInformation" key in order to disable ETW logging for rpcrt4.dll references: - http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-09 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: \Microsoft\Windows NT\Rpc\ExtErrorInformation Details: - DWORD (0x00000000) - DWORD (0x00000002) condition: selection falsepositives: - Unknown level: low
Query: collection using Input Capture
Matching passage: T1056 Input Capture. Tactics: collection, credential access. Description: Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004)) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. [Web Portal Capture](https://attack.mitre.org/techniques/T1056/003)).
Near-miss passage: T1056.003 Web Portal Capture. Tactics: collection, credential access. Description: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service. For example, a compromised login page may log provided user credentials before logging the user in to the service. This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through [External Remote Services](https://attack.mitre.org/techniques/T1133) and [Valid Accounts](https://attack.mitre.org/techniques/T1078) or as part of the initial compromise by exploitation of the externally facing web service.(Citation: Volexity Virtual Private Keylogging)
Query: CVE similar to CVE-2015-1828
Matching passage: CVE-2015-1828. CWE: CWE-200. CVSS: 5.900000095367432. The Ruby http gem before 0.7.3 does not verify hostnames in SSL connections, which might allow remote attackers to obtain sensitive information via a man-in-the-middle-attack.
Near-miss passage: CVE-2015-3400. CWE: CWE-200. CVSS: 4.300000190734863. sharenfs 0.6.4, when built with commits bcdd594 and 7d08880 from the zfs repository, provides world readable access to the shared zfs file system, which might allow remote authenticated users to obtain sensitive information by reading shared files.
Query: Sigma rule for Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is oft
Matching passage: Sigma rule: Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is oft. Logsource: windows / process_creation. Rule: title: Suspicious Autorun Registry Modified via WMI id: c80e66d8-1780-48a9-b412-46663fd21ac0 status: experimental description: 'Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware. ' references: - Internal Research - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-17 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1547.001 - attack.t1047 logsource: category: process_creation product: windows detection: selection_execution_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe - ParentImage|endswith: \wmiprvse.exe selection_execution_cmd: CommandLine|contains|all: - reg - ' add ' CommandLine|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run selection_suspicious_paths_1: CommandLine|contains: - :\Perflogs - :\ProgramData' - :\Windows\Temp - :\Temp - \AppData\Local\Temp - \AppData\Roaming - :\$Recycle.bin - :\Users\Default - :\Users\public - '%temp%' - '%tmp%' - '%Public%' - '%AppData%' selection_suspicious_paths_user_1: CommandLine|contains: :\Users\ selection_suspicious_paths_user_2: CommandLine|contains: - \Favorites - \Favourites - \Contacts - \Music - \Pictures - \Documents - \Photos condition: all of selection_execution_* and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_*)) falsepositives: - Legitimate administrative activity or software installations level: high
Near-miss passage: Sigma rule: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller. Logsource: windows / process_creation. Rule: title: HackTool - SharpLdapWhoami Execution id: d9367cbb-c2e0-47ce-bdc0-128cb6da898d status: test description: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller references: - https://github.com/bugch3ck/SharpLdapWhoami author: Florian Roth (Nextron Systems) date: 2022-08-29 modified: 2023-02-04 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection_name: Image|endswith: \SharpLdapWhoami.exe selection_pe: - OriginalFileName|contains: SharpLdapWhoami - Product: SharpLdapWhoami selection_flags1: CommandLine|endswith: - ' /method:ntlm' - ' /method:kerb' - ' /method:nego' - ' /m:nego' - ' /m:ntlm' - ' /m:kerb' condition: 1 of selection* falsepositives: - Programs that use the same command line flags level: high
Query: mitigate SID-History Injection
Matching passage: T1134.005 SID-History Injection. Tactics: stealth, privilege escalation. Description: Adversaries may use SID-History Injection to escalate privileges and bypass access controls. The Windows security identifier (SID) is a unique value that identifies a user or group account. SIDs are used by Windows security in both security descriptors and access tokens. (Citation: Microsoft SID) An account can hold additional SIDs in the SID-History Active Directory attribute (Citation: Microsoft SID-History Attribute), allowing inter-operable account migration between domains (e.g., all values in SID-History are included in access tokens). With Domain Administrator (or equivalent) rights, harvested or well-known SID values (Citation: Microsoft Well Known SIDs Jun 2017) may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators. This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as [Remote Services](https://attack.mitre.org/techniques/T1021), [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002), or [Windows Remote Management](https://attack.mitre.org/techniques/T1021/006).
Near-miss passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Query: Persistence mechanism resembling Modify System Image
Matching passage: T1601 Modify System Image. Tactics: defense impairment. Description: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves. On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file. To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it. This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.
Near-miss passage: T1601.001 Patch System Image. Tactics: defense impairment. Description: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.(Citation: Killing the myth of Cisco IOS rootkits) (Citation: Killing IOS diversity myth) (Citation: Cisco IOS Shellcode) (Citation: Cisco IOS Forensics Developments) (Citation: Juniper Netscreen of the Dead) Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file. Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime. To change the operating system in storage, the adversary will typically use the standard procedures available to device operators. This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection. The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image. To change the operating system in memory, the adversary typically can use one of two methods. In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system. This method typically requires administrative level access to the device. In the second method for changing the operating system in memory, the adversary would make use of the boot loader. The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system. Adversaries may use malicious code previously implanted in the boot loader, such as through the [ROMMONkit](https://attack.mitre.org/techniques/T1542/004) method, to directly manipulate running operating system code in memory. This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary,
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not p
Matching passage: CVE-2015-2939. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Scribunto extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via a function name, which is not properly handled in a Lua error backtrace.
Near-miss passage: CVE-2015-1944. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in IBM WebSphere Portal 8.0.0 before 8.0.0.1 CF17 and 8.5.0 before CF06 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Query: describe CVE-2015-6480
Matching passage: CVE-2015-6480. CWE: CWE-287. CVSS: 8.300000190734863. The MessageBrokerServlet servlet in Moxa OnCell Central Manager before 2.2 does not require authentication, which allows remote attackers to obtain administrative access via a command, as demonstrated by the addUserAndGroup action.
Near-miss passage: CVE-2015-2033. CWE: CWE-287. CVSS: 10.0. Anyterm Daemon in Infoblox Network Automation NetMRI before NETMRI-23483 allows remote attackers to execute arbitrary commands with root privileges via a crafted terminal/anyterm-module request.
Query: CVE similar to CVE-2015-2389
Matching passage: CVE-2015-2389. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1733 and CVE-2015-2411.
Near-miss passage: CVE-2015-3683. CWE: CWE-119. CVSS: 9.300000190734863. The Bluetooth HCI interface implementation in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: detection engineering for Clear Linux or Mac System Logs
Matching passage: T1685.006 Clear Linux or Mac System Logs. Tactics: defense impairment. Description: Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:(Citation: Linux Logs) * `/var/log/messages:`: General and system-related messages * `/var/log/secure or /var/log/auth.log`: Authentication logs * `/var/log/utmp or /var/log/wtmp`: Login records * `/var/log/kern.log`: Kernel logs * `/var/log/cron.log`: Crond logs * `/var/log/maillog`: Mail server logs * `/var/log/httpd/`: Web server access and error logs
Near-miss passage: T1685.003 Modify or Spoof Tool UI. Tactics: defense impairment. Description: Adversaries may spoof or manipulate security tool user interfaces (UIs) to falsely indicate tools are functioning normally and delay detection and response. Adversaries may present misleading or falsified security tool interfaces (UIs) that display normal or healthy status indicators, even when underlying security tools have been disabled, degraded, or otherwise tampered with. Security tools typically provide visibility into system health, alerting, and operational status; by misrepresenting this information, adversaries can undermine defender trust in these signals and obscure the true security posture of the system. This behavior is often used in conjunction with efforts to disable or modify tools, where adversaries first impair the functionality of defenses (e.g., EDR, logging agents) and then replace or mimic their interfaces to conceal the loss of visibility. By maintaining the appearance of normal operations, such as showing active protection, successful updates, or absence of threats, adversaries can delay investigation and response, enabling continued malicious activity. For example, adversaries may display a fake Windows Security interface or system tray icon indicating a “protected” or “healthy” state after disabling Windows Defender or related services.(Citation: BlackBasta)