alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct da
Matching passage: Sigma rule: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct da. Logsource: windows / process_creation. Rule: title: Disable Important Scheduled Task id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 related: - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar status: test description: Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task - https://twitter.com/MichalKoczwara/status/1553634816016498688 - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior date: 2021-12-26 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_disable: CommandLine|contains|windash: /disable selection_cli_task: CommandLine|contains: - \Windows\BitLocker - \Windows\ExploitGuard - \Windows\ExploitGuard\ExploitGuard MDM policy Refresh - \Windows\SystemRestore\SR - \Windows\UpdateOrchestrator\ - \Windows\Windows Defender\ - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Near-miss passage: Sigma rule: Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for f. Logsource: windows / file_event. Rule: title: Suspicious Executable File Creation id: 74babdd6-a758-4549-9632-26535279e654 status: test description: 'Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths. ' references: - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/ author: frack113 date: 2022-09-05 modified: 2023-12-11 tags: - attack.stealth - attack.t1564 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - :\$Recycle.Bin.exe - :\Documents and Settings.exe - :\MSOCache.exe - :\PerfLogs.exe - :\Recovery.exe - .bat.exe - .sys.exe condition: selection falsepositives: - Unknown level: high
Query: risk of The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00
Matching passage: CVE-2015-8678. CWE: CWE-20. CVSS: 5.5. The ION driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10 before GRA-CL10C92B230, GRA-UL00 before GRA-UL00C00B230, and GRA-UL10 before GRA-UL10C00B230 and Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before CRR-UL00C00B160, and CRR-CL00 before CRR-CL00C92B161 allows remote attackers to cause a denial of service (crash) via a crafted application.
Near-miss passage: CVE-2015-8946. CWE: CWE-20. CVSS: 3.299999952316284. ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd, which allows local users to obtain sensitive information via unspecified vectors.
Query: patch priority for CVE-2015-7089
Matching passage: CVE-2015-7089. CWE: CWE-119. CVSS: 6.599999904632568. Apple QuickTime before 7.7.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file, a different vulnerability than CVE-2015-7085, CVE-2015-7086, CVE-2015-7087, CVE-2015-7088, CVE-2015-7090, CVE-2015-7091, CVE-2015-7092, and CVE-2015-7117.
Near-miss passage: CVE-2015-9262. CWE: CWE-119. CVSS: 9.800000190734863. _XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of service or potentially code execution via a one-byte heap overflow.
Query: CVE similar to CVE-2015-8445
Matching passage: CVE-2015-8445. CWE: CWE-189. CVSS: 9.300000190734863. Integer overflow in the Shader filter implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a large BitmapData source object.
Near-miss passage: CVE-2015-4003. CWE: CWE-189. CVSS: 7.800000190734863. The oz_usb_handle_ep_data function in drivers/staging/ozwpan/ozusbsvc1.c in the OZWPAN driver in the Linux kernel through 4.0.5 allows remote attackers to cause a denial of service (divide-by-zero error and system crash) via a crafted packet.
Query: Sigma rule for Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.
Matching passage: Sigma rule: Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.. Logsource: zeek / rdp. Rule: title: Publicly Accessible RDP Service id: 1fc0809e-06bf-4de3-ad52-25e5263b7623 status: test description: 'Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service. ' author: Josh Brower @DefensiveDepth date: 2020-08-22 modified: 2024-03-13 tags: - attack.lateral-movement - attack.t1021.001 logsource: product: zeek service: rdp detection: selection: id.orig_h|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - 2620:83:8000::/48 - fc00::/7 - fe80::/10 condition: not selection falsepositives: - Although it is recommended to NOT have RDP exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. Work to secure the server if you are unable to remove it from being exposed to the internet. level: high
Near-miss passage: Sigma rule: Shadow Copies storage symbolic link creation using operating systems utilities. Logsource: windows / process_creation. Rule: title: VolumeShadowCopy Symlink Creation Via Mklink id: 40b19fa6-d835-400c-b301-41f3a2baacaf status: stable description: Shadow Copies storage symbolic link creation using operating systems utilities references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2023-03-06 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - mklink - HarddiskVolumeShadowCopy condition: selection falsepositives: - Legitimate administrator working with shadow copies, access for backup purposes level: high
Query: secure coding against Missing Immutable Root of Trust in Hardware
Matching passage: CWE-1326 Missing Immutable Root of Trust in Hardware. A missing immutable root of trust in the hardware results in the ability to bypass secure boot or execute untrusted or adversarial boot code.
Near-miss passage: CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection'). The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
Query: patch priority for CVE-2015-2389
Matching passage: CVE-2015-2389. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1733 and CVE-2015-2411.
Near-miss passage: CVE-2015-3683. CWE: CWE-119. CVSS: 9.300000190734863. The Bluetooth HCI interface implementation in Apple OS X before 10.10.4 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.
Query: alert when Detects the execution of AdvancedRun utility
Matching passage: Sigma rule: Detects the execution of AdvancedRun utility. Logsource: windows / process_creation. Rule: title: PUA - AdvancedRun Execution id: d2b749ee-4225-417e-b20e-a8d2193cbb84 related: - id: fa00b701-44c6-4679-994d-5a18afa8a707 type: similar status: test description: Detects the execution of AdvancedRun utility references: - https://twitter.com/splinter_code/status/1483815103279603714 - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3 - https://www.elastic.co/security-labs/operation-bleeding-bear - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems) date: 2022-01-20 modified: 2023-02-21 tags: - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1564.003 - attack.t1134.002 - attack.t1059.003 logsource: product: windows category: process_creation detection: selection: - OriginalFileName: AdvancedRun.exe - CommandLine|contains|all: - ' /EXEFilename ' - ' /Run' - CommandLine|contains|all: - ' /WindowState 0' - ' /RunAs ' - ' /CommandLine ' condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml
Near-miss passage: Sigma rule: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw. Logsource: windows / process_creation. Rule: title: Suspicious Scan Loop Network id: f8ad2e2c-40b6-4117-84d7-20b89896ab23 status: test description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://ss64.com/nt/for.html - https://ss64.com/ps/foreach-object.html author: frack113 date: 2022-03-12 tags: - attack.execution - attack.t1059 - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_loop: CommandLine|contains: - 'for ' - 'foreach ' selection_tools: CommandLine|contains: - nslookup - ping condition: all of selection_* falsepositives: - Legitimate script level: medium
Query: rule covering Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)
Matching passage: Sigma rule: Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53). Logsource: windows / registry_set. Rule: title: UAC Bypass via Sdclt id: 5b872a46-3b90-45c1-8419-f675db8053aa status: test description: Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53) references: - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/ - https://github.com/hfiref0x/UACME author: Omer Yampel, Christian Burkard (Nextron Systems) date: 2017-03-17 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: registry_set product: windows detection: selection1: TargetObject|endswith: Software\Classes\exefile\shell\runas\command\isolatedCommand selection2: TargetObject|endswith: Software\Classes\Folder\shell\open\command\SymbolicLinkValue Details|re: -1[0-9]{3}\\Software\\Classes\\ condition: 1 of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a local hidden user account which should not happen for event ID 4720.. Logsource: windows / security. Rule: title: Hidden Local User Creation id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538 status: test description: Detects the creation of a local hidden user account which should not happen for event ID 4720. references: - https://twitter.com/SBousseaden/status/1387743867663958021 author: Christian Burkard (Nextron Systems) date: 2021-05-03 modified: 2024-01-16 tags: - attack.persistence - attack.t1136.001 logsource: product: windows service: security detection: selection: EventID: 4720 TargetUserName|endswith: $ filter_main_homegroup: TargetUserName: HomeGroupUser$ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: what is T1207
Matching passage: T1207 Rogue Domain Controller. Tactics: defense impairment. Description: Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC). DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC. (Citation: DCShadow Blog) Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys. Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash. (Citation: Adsecurity Mimikatz Guide) This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors). (Citation: DCShadow Blog) The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis. Adversaries may also utilize this technique to perform [SID-History Injection](https://attack.mitre.org/techniques/T1134/005) and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence. (Citation: DCShadow Blog)
Near-miss passage: T1686 Disable or Modify System Firewall. Tactics: defense impairment. Description: Adversaries may disable or modify host-based or network firewalls to impair defensive mechanisms and enable further action. Once an adversary has gathered sufficient privileges, they can tamper with firewall services, policies, or rule sets to remove restrictions on inbound or outbound traffic. For example, this may include turning off firewall profiles, altering existing rules to permit previously blocked ports or protocols, or adding new rules that create covert communication paths (e.g., adding a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port.(Citation: change_rdp_port_conti) Adversaries may disable or modify firewalls using different behaviors, depending on the platform. For example, in ESXi, firewall rules may be modified directly via the esxcli (e.g., via esxcli network firewall set) or via the vCenter user interface.(Citation: Broadcom ESXi Firewall)(Citation: Trellix Rnasomhouse 2024)
Query: describe CVE-2015-8728
Matching passage: CVE-2015-8728. CWE: CWE-20. CVSS: 5.5. The Mobile Identity parser in (1) epan/dissectors/packet-ansi_a.c in the ANSI A dissector and (2) epan/dissectors/packet-gsm_a_common.c in the GSM A dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 improperly uses the tvb_bcd_dig_to_wmem_packet_str function, which allows remote attackers to cause a denial of service (buffer overflow and application crash) via a crafted packet.
Near-miss passage: CVE-2015-5254. CWE: CWE-20. CVSS: 9.800000190734863. Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Query: secure coding against Missing Support for Security Features in On-chip Fabrics or Buses
Matching passage: CWE-1318 Missing Support for Security Features in On-chip Fabrics or Buses. On-chip fabrics or buses either do not support or are not configured to support privilege separation or other security features, such as access control.
Near-miss passage: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection'). The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Query: vulnerability: The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file 
Matching passage: CVE-2015-1815. CWE: CWE-77. CVSS: 10.0. The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.
Near-miss passage: CVE-2015-9059. CWE: CWE-77. CVSS: 9.800000190734863. picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.
Query: patch priority for CVE-2015-5317
Matching passage: CVE-2015-5317. CWE: CWE-200. CVSS: 7.5. The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
Near-miss passage: CVE-2015-9288. CWE: CWE-200. CVSS: 6.5. The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim's credentials
Query: detection rule: Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent
Matching passage: Sigma rule: Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent. Logsource: proxy. Rule: title: Potential Hello-World Scraper Botnet Activity id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5 status: experimental description: 'Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string. ' references: - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30 author: Joseph A. M. date: 2025-08-02 tags: - attack.reconnaissance - attack.t1595 logsource: category: proxy detection: selection: c-useragent: Hello-World/1.0 cs-method: GET condition: selection falsepositives: - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent. - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems. level: medium
Near-miss passage: Sigma rule: Detects usage of "MSOHTMED" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSOHTMED.EXE id: 459f2f98-397b-4a4a-9f47-6a5ec2f1c69d status: test description: Detects usage of "MSOHTMED" to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MSOHTMED.exe - OriginalFileName: MsoHtmEd.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Query: exploit Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming the malware.
Matching passage: CVE-2015-8990. CWE: CWE-254. CVSS: 7.5. Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming the malware.
Near-miss passage: CVE-2015-0599. CWE: CWE-254. CVSS: 4.300000190734863. The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System (UCS) on C-Series Rack Servers does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf50138.
Query: write Sigma for Detects potential DLL sideloading of "edputil.dll"
Matching passage: Sigma rule: Detects potential DLL sideloading of "edputil.dll". Logsource: windows / image_load. Rule: title: Potential Edputil.DLL Sideloading id: e4903324-1a10-4ed3-981b-f6fe3be3a2c2 status: test description: Detects potential DLL sideloading of "edputil.dll" references: - https://alternativeto.net/news/2023/5/cybercriminals-use-wordpad-vulnerability-to-spread-qbot-malware/ author: X__Junior (Nextron Systems) date: 2023-06-09 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \edputil.dll filter_main_generic: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools. Logsource: windows / process_creation. Rule: title: Suspicious Program Names id: efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6 status: test description: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: Florian Roth (Nextron Systems) date: 2022-02-11 modified: 2023-03-22 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_image: - Image|contains: - \CVE-202 - \CVE202 - Image|endswith: - \poc.exe - \artifact.exe - \artifact64.exe - \artifact_protected.exe - \artifact32.exe - \artifact32big.exe - obfuscated.exe - obfusc.exe - \meterpreter selection_commandline: CommandLine|contains: - inject.ps1 - Invoke-CVE - pupy.ps1 - payload.ps1 - beacon.ps1 - PowerView.ps1 - bypass.ps1 - obfuscated.ps1 - obfusc.ps1 - obfus.ps1 - obfs.ps1 - evil.ps1 - MiniDogz.ps1 - _enc.ps1 - \shell.ps1 - \rshell.ps1 - revshell.ps1 - \av.ps1 - \av_test.ps1 - adrecon.ps1 - mimikatz.ps1 - \PowerUp_ - powerup.ps1 - \Temp\a.ps1 - \Temp\p.ps1 - \Temp\1.ps1 - Hound.ps1 - encode.ps1 - powercat.ps1 condition: 1 of selection* falsepositives: - Legitimate tools that accidentally match on the searched patterns level: high