alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-4033
Matching passage: CVE-2015-4033. CWE: CWE-200. CVSS: 3.299999952316284. Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000.
Near-miss passage: CVE-2015-1901. CWE: CWE-200. CVSS: 1.899999976158142. The installer in IBM InfoSphere Information Server 8.5 through 11.3 before 11.3.1.2 allows local users to obtain sensitive information via unspecified commands.
Query: alert when Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled
Matching passage: Sigma rule: Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled. Logsource: aws / cloudtrail. Rule: title: AWS EnableRegion Command Monitoring id: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab status: experimental description: 'Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment. ' references: - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html author: Ivan Saakov, Sergey Zelenskiy date: 2025-10-19 tags: - attack.persistence logsource: product: aws service: cloudtrail detection: selection: eventName: EnableRegion eventSource: account.amazonaws.com condition: selection falsepositives: - Legitimate use of the EnableRegion command by authorized administrators. level: medium
Near-miss passage: Sigma rule: Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than t. Logsource: windows / process_creation. Rule: title: Ie4uinit Lolbin Use From Invalid Path id: d3bf399f-b0cf-4250-8bb4-dfc192ab81dc status: test description: Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories references: - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/ - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/ author: frack113 date: 2022-05-07 modified: 2022-05-16 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: lolbin: - Image|endswith: \ie4uinit.exe - OriginalFileName: IE4UINIT.EXE filter_correct: CurrentDirectory: - c:\windows\system32\ - c:\windows\sysWOW64\ filter_missing: CurrentDirectory: null condition: lolbin and not 1 of filter_* falsepositives: - ViberPC updater calls this binary with the following commandline "ie4uinit.exe -ClearIconCache" level: medium
Query: rule covering Detects attempts to enable the guest account using the sysadminctl utility
Matching passage: Sigma rule: Detects attempts to enable the guest account using the sysadminctl utility. Logsource: macos / process_creation. Rule: title: Guest Account Enabled Via Sysadminctl id: d7329412-13bd-44ba-a072-3387f804a106 status: test description: Detects attempts to enable the guest account using the sysadminctl utility references: - https://ss64.com/osx/sysadminctl.html author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 - attack.t1078.001 logsource: category: process_creation product: macos detection: selection: Image|endswith: /sysadminctl CommandLine|contains|all: - ' -guestAccount' - ' on' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate mal. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Processes Spawned by ConHost id: dfa03a09-8b92-4d83-8e74-f72839b1c407 related: - id: 7dc2dedd-7603-461a-bc13-15803d132355 type: similar status: experimental description: Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components. references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.stealth - attack.t1202 - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \conhost.exe selection_child: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \wscript.exe - OriginalFileName: - cmd.exe - cscript.exe - mshta.exe - powershell_ise.exe - powershell.exe - pwsh.dll - regsvr32.exe - wscript.exe condition: all of selection_* falsepositives: - Legitimate administrative tasks using `conhost.exe` to spawn child processes such as `cmd.exe`, `powershell.exe`, or `regsvr32.exe`. level: high
Query: write Sigma for Detects when Kubernetes Secrets are Modified or Deleted.
Matching passage: Sigma rule: Detects when Kubernetes Secrets are Modified or Deleted.. Logsource: kubernetes / audit. Rule: title: Kubernetes Secrets Modified or Deleted id: 58d31a75-a4f8-4c40-985b-373d58162ca2 related: - id: 2f0bae2d-bf20-4465-be86-1311addebaa3 type: similar status: test description: 'Detects when Kubernetes Secrets are Modified or Deleted. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/ author: kelnage date: 2024-07-11 tags: - attack.credential-access logsource: product: kubernetes service: audit detection: selection: objectRef.resource: secrets verb: - create - delete - patch - replace - update condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Automated processes may need to take these actions and may need to be filtered. level: medium
Near-miss passage: Sigma rule: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool). Logsource: windows / process_creation. Rule: title: Wab/Wabmig Unusual Parent Or Child Processes id: 63d1ccc0-2a43-4f4b-9289-361b308991ff status: test description: Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \WmiPrvSE.exe - \svchost.exe - \dllhost.exe Image|endswith: - \wab.exe - \wabmig.exe selection_child: ParentImage|endswith: - \wab.exe - \wabmig.exe condition: 1 of selection_* falsepositives: - Unknown level: high
Query: weakness Singleton Class Instance Creation without Proper Locking or Synchronization
Matching passage: CWE-1096 Singleton Class Instance Creation without Proper Locking or Synchronization. The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleton class is only instantiated once.
Near-miss passage: CWE-1286 Improper Validation of Syntactic Correctness of Input. The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
Query: vulnerability: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site
Matching passage: CVE-2015-6078. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6065.
Near-miss passage: CVE-2015-1360. CWE: CWE-119. CVSS: 7.5. Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via crafted data that is improperly handled during text drawing, related to gpu/GrBitmapTextContext.cpp and gpu/GrDistanceFieldTextContext.cpp, a different vulnerability than CVE-2015-1205.
Query: detection rule: Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file
Matching passage: Sigma rule: Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. Logsource: windows / ps_script. Rule: title: User Discovery And Export Via Get-ADUser Cmdlet - PowerShell id: c2993223-6da8-4b1a-88ee-668b8bf315e9 related: - id: 1114e048-b69c-4f41-bc20-657245ae6e3f type: similar status: test description: Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-ADUser ' - ' -Filter \*' ScriptBlockText|contains: - ' > ' - ' | Select ' - Out-File - Set-Content - Add-Content condition: selection falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium
Near-miss passage: Sigma rule: Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation. Logsource: windows / ps_script. Rule: title: Potential PowerShell Obfuscation Using Character Join id: e8314f79-564d-4f79-bc13-fbc0bf2660d8 related: - id: 96cd126d-f970-49c4-848a-da3a09f55c55 type: derived status: test description: Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-09 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - -Alias - ' -Value (-join(' condition: selection falsepositives: - Unknown level: low
Query: write Sigma for Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55). Logsource: windows / file_event. Rule: title: UAC Bypass Using MSConfig Token Modification - File id: 41bb431f-56d8-4691-bb56-ed34e390906f status: test description: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Users\ TargetFilename|endswith: \AppData\Local\Temp\pkgmgr.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.. Logsource: windows / process_creation. Rule: title: Proxy Execution Via Wuauclt.EXE id: af77cf95-c469-471c-b6a0-946c685c4798 related: - id: ba1bb0cb-73da-42de-ad3a-de10c643a5d0 type: obsolete - id: d7825193-b70a-48a4-b992-8b5b3015cc11 type: obsolete status: test description: Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution. references: - https://dtm.uk/wuauclt/ - https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team date: 2020-10-12 modified: 2023-11-11 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wuauclt.exe - OriginalFileName: wuauclt.exe selection_cli: CommandLine|contains|all: - UpdateDeploymentProvider - RunHandlerComServer filter_main_generic: CommandLine|contains: ' /UpdateDeploymentProvider UpdateDeploymentProvider.dll ' filter_main_wuaueng: CommandLine|contains: ' wuaueng.dll ' filter_main_uus: CommandLine|contains: - :\Windows\UUS\Packages\Preview\amd64\updatedeploy.dll /ClassId - :\Windows\UUS\amd64\UpdateDeploy.dll /ClassId filter_main_winsxs: CommandLine|contains|all: - :\Windows\WinSxS\ - '\UpdateDeploy.dll /ClassId ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: Lateral movement indicators for Malicious File
Matching passage: T1204.002 Malicious File. Tactics: execution. Description: An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001). Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.(Citation: Mandiant Trojanized Windows 10) Adversaries may employ various forms of [Masquerading](https://attack.mitre.org/techniques/T1036) and [Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027) to increase the likelihood that a user will open and successfully execute a malicious file. These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.(Citation: Password Protected Word Docs) While [Malicious File](https://attack.mitre.org/techniques/T1204/002) frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after [Internal Spearphishing](https://attack.mitre.org/techniques/T1534).
Near-miss passage: T1204.001 Malicious Link. Tactics: execution. Description: An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002). Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via [Exploitation for Client Execution](https://attack.mitre.org/techniques/T1203). Links may also lead users to download files that require execution via [Malicious File](https://attack.mitre.org/techniques/T1204/002).
Query: write Sigma for Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in
Matching passage: Sigma rule: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Cabinet File Expansion id: 9f107a84-532c-41af-b005-8d12a607639f status: test description: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks references: - https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll - https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/ author: Bhabesh Raj, X__Junior (Nextron Systems) date: 2021-07-30 modified: 2024-11-13 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_cmd: Image|endswith: \expand.exe CommandLine|contains|windash: '-F:' selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\ProgramData - :\Users\Public\ - :\Windows\Temp\ - \Admin$\ - \AppData\Local\Temp\ - \AppData\Roaming\ - \C$\ - \Temporary Internet selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ filter_optional_dell: ParentImage: C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe CommandLine|contains: C:\ProgramData\Dell\UpdateService\Temp\ condition: selection_cmd and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - System administrator Usage level: medium
Near-miss passage: Sigma rule: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, w. Logsource: windows / registry_set. Rule: title: Office Macros Warning Disabled id: 91239011-fe3c-4b54-9f24-15c86bb65913 related: - id: 9b894e57-033f-46cf-b7fa-a52804181973 type: obsolete status: test description: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned. references: - https://twitter.com/inversecos/status/1494174785621819397 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/ - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/ author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) date: 2020-05-22 modified: 2024-03-19 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Security\VBAWarnings Details: DWORD (0x00000001) condition: selection falsepositives: - Unlikely level: high
Query: explain CWE-39
Matching passage: CWE-39 Path Traversal: 'C:dirname'. The product accepts input that contains a drive letter or Windows volume letter ('C:dirname') that potentially redirects access to an unintended location or arbitrary file.
Near-miss passage: CWE-649 Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking. The product uses obfuscation or encryption of inputs that should not be mutable by an external actor, but the product does not use integrity checks to detect if those inputs have been modified.
Query: CVE similar to CVE-2015-2615
Matching passage: CVE-2015-2615. CWE: UNKNOWN. CVSS: 5.0. Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 12.0.6, 12.1.3, and 12.2.3 allows remote attackers to affect confidentiality via unknown vectors related to Portal.
Near-miss passage: CVE-2015-2595. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 12.1.0.1 and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Query: vulnerability: Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Matching passage: CVE-2015-7871. CWE: CWE-287. CVSS: 9.800000190734863. Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
Near-miss passage: CVE-2015-6816. CWE: CWE-287. CVSS: 9.800000190734863. ganglia-web before 3.7.1 allows remote attackers to bypass authentication.
Query: describe CVE-2015-8035
Matching passage: CVE-2015-8035. CWE: CWE-399. CVSS: 2.5999999046325684. The xz_decomp function in xzlib.c in libxml2 2.9.1 does not properly detect compression errors, which allows context-dependent attackers to cause a denial of service (process hang) via crafted XML data.
Near-miss passage: CVE-2015-3725. CWE: CWE-399. CVSS: 4.300000190734863. MobileInstallation in Apple iOS before 8.4 does not ensure the uniqueness of Watch bundle IDs, which allows attackers to cause a denial of service (ID collision and Watch launch outage) via a crafted universal provisioning profile app.
Query: describe CVE-2015-4837
Matching passage: CVE-2015-4837. CWE: UNKNOWN. CVSS: 6.599999904632568. Unspecified vulnerability in Oracle Sun Solaris 11.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Security.
Near-miss passage: CVE-2015-2629. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-0457.
Query: exploit The wp-rollback plugin before 1.2.3 for WordPress has XSS.
Matching passage: CVE-2015-9342. CWE: CWE-79. CVSS: 6.099999904632568. The wp-rollback plugin before 1.2.3 for WordPress has XSS.
Near-miss passage: CVE-2015-4541. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.5.3 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.