alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potential DLL sideloading using comctl32.dll to obtain system privileges. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via comctl32.dll id: 6360757a-d460-456c-8b13-74cf0e60cceb status: test description: Detects potential DLL sideloading using comctl32.dll to obtain system privileges references: - https://github.com/binderlabs/DirCreate2System - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt author: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash) date: 2022-12-16 modified: 2022-12-19 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|startswith: - C:\Windows\System32\logonUI.exe.local\ - C:\Windows\System32\werFault.exe.local\ - C:\Windows\System32\consent.exe.local\ - C:\Windows\System32\narrator.exe.local\ - C:\windows\system32\wermgr.exe.local\ ImageLoaded|endswith: \comctl32.dll condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects disabling Windows Defender Tamper Protection. Logsource: windows / registry_set. Rule: title: Disable Tamper Protection on Windows Defender id: 93d298a1-d28f-47f1-a468-d971e7796679 status: test description: Detects disabling Windows Defender Tamper Protection references: - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows Defender\Features\TamperProtection Details: DWORD (0x00000000) filter_msmpeng_client: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe filter_msmpeng_domain_controller: Image: C:\Program Files\Windows Defender\MsMpEng.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Query: risk of The LZVN compression feature in AppleFSCompression in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Matching passage: CVE-2015-3677. CWE: CWE-200. CVSS: 4.300000190734863. The LZVN compression feature in AppleFSCompression in Apple OS X before 10.10.4 allows attackers to obtain sensitive memory-layout information for the kernel via a crafted app.
Near-miss passage: CVE-2015-2157. CWE: CWE-200. CVSS: 2.0999999046325684. The (1) ssh2_load_userkey and (2) ssh2_save_userkey functions in PuTTY 0.51 through 0.63 do not properly wipe SSH-2 private keys from memory, which allows local users to obtain sensitive information by reading the memory.
Query: Sigma rule for Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Matching passage: Sigma rule: Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'. Logsource: windows / registry_event. Rule: title: Atbroker Registry Change id: 9577edbb-851f-4243-8c91-1d5b50c1a39b status: test description: Detects creation/modification of Assistive Technology applications and persistence with usage of 'at' references: - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/ - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/ author: Mateusz Wydra, oscd.community date: 2020-10-13 modified: 2023-01-19 tags: - attack.privilege-escalation - attack.stealth - attack.t1218 - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs - Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration filter_atbroker: Image: C:\Windows\system32\atbroker.exe TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration Details: (Empty) filter_uninstallers: Image|startswith: C:\Windows\Installer\MSI TargetObject|contains: Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs condition: selection and not 1 of filter_* falsepositives: - Creation of non-default, legitimate at usage level: medium
Near-miss passage: Sigma rule: Detects any GAC DLL being loaded by an Office Product. Logsource: windows / image_load. Rule: title: GAC DLL Loaded Via Office Applications id: 90217a70-13fc-48e4-b3db-0d836c5824ac status: test description: Detects any GAC DLL being loaded by an Office Product references: - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16 author: Antonlovesdnb date: 2020-02-19 modified: 2023-02-10 tags: - attack.execution - attack.t1204.002 logsource: category: image_load product: windows detection: selection: Image|endswith: - \excel.exe - \mspub.exe - \onenote.exe - \onenoteim.exe - \outlook.exe - \powerpnt.exe - \winword.exe ImageLoaded|startswith: C:\Windows\Microsoft.NET\assembly\GAC_MSIL condition: selection falsepositives: - Legitimate macro usage. Add the appropriate filter according to your environment level: high
Query: exploit Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-4093. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Elasticsearch Kibana 4.x before 4.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-10092. CWE: CWE-79. CVSS: 6.099999904632568. A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function add_slug_meta_box of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.1.17 is able to address this issue. The name of the patch is 74b3932696f9868e14563e51b7d0bb68c53bf5e4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-222324.
Query: alert when Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack
Matching passage: Sigma rule: Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack. Logsource: windows / process_creation. Rule: title: Loaded Module Enumeration Via Tasklist.EXE id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f status: test description: 'Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 modified: 2024-03-13 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tasklist.exe - OriginalFileName: tasklist.exe selection_flags: CommandLine|contains|windash: -m selection_module: CommandLine|contains: rdpcorets.dll condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system admi. Logsource: windows / registry_set. Rule: title: Disable Administrative Share Creation at Startup id: c7dcacd0-cc59-4004-b0a4-1d6cdebe6f3e status: test description: Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md#atomic-test-4---disable-administrative-share-creation-at-startup author: frack113 date: 2022-01-16 modified: 2024-03-25 tags: - attack.stealth - attack.t1070.005 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\LanmanServer\Parameters\ TargetObject|endswith: - \AutoShareWks - \AutoShareServer Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_administrative_share/info.yml simulation: - type: atomic-red-team name: Disable Administrative Share Creation at Startup technique: T1070.005 atomic_guid: 99c657aa-ebeb-4179-a665-69288fdd12b8
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microso. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Appvlp.EXE id: 9c7e131a-0f2c-4ae0-9d43-b04f4e266d43 status: test description: 'Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/ author: Sreeman date: 2020-03-13 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \appvlp.exe filter_main_generic: Image|endswith: - :\Windows\SysWOW64\rundll32.exe - :\Windows\System32\rundll32.exe filter_optional_office_msoasb: Image|contains: :\Program Files\Microsoft Office Image|endswith: \msoasb.exe filter_optional_office_skype: Image|contains|all: - :\Program Files\Microsoft Office - \SkypeSrv\ Image|endswith: \SKYPESERVER.EXE filter_optional_office_msouc: Image|contains: :\Program Files\Microsoft Office Image|endswith: \MSOUC.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accou. Logsource: windows / ps_script. Rule: title: Get-ADUser Enumeration Using UserAccountControl Flags id: 96c982fe-3d08-4df4-bed2-eb14e02f21c8 status: test description: Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md#atomic-test-11---get-aduser-enumeration-using-useraccountcontrol-flags-as-rep-roasting - https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/ author: frack113 date: 2022-03-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ADUser - -Filter - useraccountcontrol - -band - '4194304' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Query: detect Shortcut Modification
Matching passage: T1547.009 Shortcut Modification. Tactics: persistence, privilege escalation. Description: Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process. Adversaries may abuse shortcuts in the startup folder to execute their tools and achieve persistence.(Citation: Shortcut for Persistence ) Although often used as payloads in an infection chain (e.g. [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001)), adversaries may also create a new shortcut as a means of indirection, while also abusing [Masquerading](https://attack.mitre.org/techniques/T1036) to make the malicious shortcut appear as a legitimate program. Adversaries can also edit the target path or entirely replace an existing shortcut so their malware will be executed instead of the intended legitimate program. Shortcuts can also be abused to establish persistence by implementing other methods. For example, LNK browser extensions may be modified (e.g. [Browser Extensions](https://attack.mitre.org/techniques/T1176/001)) to persistently launch malware.
Near-miss passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Query: vulnerability: Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of ad
Matching passage: CVE-2015-2039. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Acobot Live Chat & Contact Form plugin 2.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or (2) conduct cross-site scripting (XSS) attacks via the acobot_token parameter in the acobot page to wp-admin/options-general.php.
Near-miss passage: CVE-2015-9233. CWE: CWE-352. CVSS: 8.800000190734863. The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a when net.exe is called with a password in the command line. Logsource: windows / process_creation. Rule: title: Password Provided In Command Line Of Net.EXE id: d4498716-1d52-438f-8084-4a603157d131 status: test description: Detects a when net.exe is called with a password in the command line references: - Internal Research author: Tim Shelton (HAWK.IO) date: 2021-12-09 modified: 2023-02-21 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.lateral-movement - attack.stealth - attack.t1021.002 - attack.t1078 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - :*\\ - /USER:* * filter_main_empty: CommandLine|endswith: ' ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a suspicious curl process start on linux with set useragent options. Logsource: linux / process_creation. Rule: title: Suspicious Curl Change User Agents - Linux id: b86d356d-6093-443d-971c-9b07db583c68 related: - id: 3286d37a-00fd-41c2-a624-a672dcd34e60 type: derived status: test description: Detects a suspicious curl process start on linux with set useragent options references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: linux detection: selection: Image|endswith: /curl CommandLine|contains: - ' -A ' - ' --user-agent ' condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: medium
Query: vulnerability: Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect integrity via
Matching passage: CVE-2015-0370. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, and 12.1.0.1 allows remote authenticated users to affect integrity via unknown vectors, a different vulnerability than CVE-2013-5858.
Near-miss passage: CVE-2015-0308. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.260 and 14.x through 16.x before 16.0.0.257 on Windows and OS X and before 11.2.202.429 on Linux, Adobe AIR before 16.0.0.245 on Windows and OS X and before 16.0.0.272 on Android, Adobe AIR SDK before 16.0.0.272, and Adobe AIR SDK & Compiler before 16.0.0.272 allows attackers to execute arbitrary code via unspecified vectors.
Query: alert when Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog,
Matching passage: Sigma rule: Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog,. Logsource: linux / process_creation. Rule: title: Script Interpreter Spawning Credential Scanner - Linux id: f0025a69-e1b7-4dda-a53c-db21fa2d4071 related: - id: 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6 type: similar status: experimental description: 'Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign. ' references: - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js - https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised - https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-25 tags: - attack.credential-access - attack.t1552 - attack.execution - attack.collection - attack.t1005 - attack.t1059.004 logsource: category: process_creation product: linux detection: selection_parent: ParentImage|endswith: - /node - /bun selection_child: - Image|endswith: - /trufflehog - /gitleaks - CommandLine|contains: - trufflehog - gitleaks condition: all of selection_* falsepositives: - Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check. level: high
Near-miss passage: Sigma rule: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe. Logsource: windows / file_event. Rule: title: WScript or CScript Dropper - File id: 002bdb95-0cf1-46a6-9e08-d38c128a6127 related: - id: cea72823-df4d-4567-950c-0b579eaf0846 type: derived status: test description: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe references: - WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846) author: Tim Shelton date: 2022-01-10 modified: 2026-02-17 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: file_event product: windows detection: selection: Image|endswith: - \wscript.exe - \cscript.exe TargetFilename|contains: - :\Perflogs\ - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\ - :\Windows\Temp\ - \AppData\Local\Temp - \AppData\Roaming\Temp - \Start Menu\Programs\Startup\ - \Temporary Internet TargetFilename|endswith: - .js - .jse - .vba - .vbe - .vbs - .wsf - .wsh condition: selection falsepositives: - Unknown level: high
Query: describe CVE-2015-4085
Matching passage: CVE-2015-4085. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in node/hooks/express/tests.js in Etherpad frontend tests before 1.6.1.
Near-miss passage: CVE-2015-4666. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in opm/read_sessionlog.php in Xceedium Xsuite 2.4.4.5 and earlier allows remote attackers to read arbitrary files via a ....// (quadruple dot double slash) in the logFile parameter.