alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects suspicious command sequence that JexBoss in logs
Matching passage: Sigma rule: Detects suspicious command sequence that JexBoss. Logsource: linux. Rule: title: JexBoss Command Sequence id: 8ec2c8b4-557a-4121-b87c-5dfb3a602fae status: test description: Detects suspicious command sequence that JexBoss references: - https://www.us-cert.gov/ncas/analysis-reports/AR18-312A author: Florian Roth (Nextron Systems) date: 2017-08-24 modified: 2025-11-22 tags: - attack.execution - attack.t1059.004 logsource: product: linux detection: keywords: '|all': - bash -c /bin/bash - '&/dev/tcp/' condition: keywords falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several. Logsource: windows / ps_script. Rule: title: Enumerate Credentials from Windows Credential Manager With PowerShell id: 603c6630-5225-49c1-8047-26c964553e0e status: test description: 'Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1555 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - vaultcmd - '/listcreds:' selection_option: ScriptBlockText|contains: - Windows Credentials - Web Credentials condition: all of selection_* falsepositives: - Unknown level: medium
Query: Sigma YAML for aws / cloudtrail
Matching passage: Sigma rule: Detects disabling, deleting and updating of a Trail. Logsource: aws / cloudtrail. Rule: title: AWS CloudTrail Important Change id: 4db60cc0-36fb-42b7-9b58-a5b53019fb74 status: test description: Detects disabling, deleting and updating of a Trail references: - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: cloudtrail.amazonaws.com eventName: - StopLogging - UpdateTrail - DeleteTrail condition: selection_source falsepositives: - Valid change in a Trail level: medium
Near-miss passage: Sigma rule: Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption. Logsource: windows / system. Rule: title: NTLMv1 Logon Between Client and Server id: e9d4ab66-a532-4ef7-a502-66a9e4a34f5d status: test description: Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware. references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/22H2/W10_22H2_Pro_20230321_19045.2728/WEPExplorer/LsaSrv.xml author: Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2022-04-26 modified: 2023-06-06 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: system detection: selection: Provider_Name: LsaSrv EventID: - 6038 - 6039 condition: selection falsepositives: - Environments that use NTLMv1 level: medium
Query: vulnerability: The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.
Matching passage: CVE-2015-8559. CWE: CWE-200. CVSS: 7.5. The knife bootstrap command in chef Infra client before version 15.4.45 leaks the validator.pem private RSA key to /var/log/messages.
Near-miss passage: CVE-2015-7776. CWE: CWE-200. CVSS: 4.300000190734863. Cybozu Garoon 3.x and 4.x before 4.2.0 does not properly restrict loading of IMG elements, which makes it easier for remote attackers to track users via a crafted HTML e-mail message, a different vulnerability than CVE-2016-1196.
Query: vulnerability: The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap met
Matching passage: CVE-2015-3307. CWE: CWE-119. CVSS: 7.5. The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.
Near-miss passage: CVE-2015-6080. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6073, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, and CVE-2015-6082.
Query: ATT&CK technique for Internal Spearphishing
Matching passage: T1534 Internal Spearphishing. Tactics: lateral movement. Description: After they already have access to accounts or systems within the environment, adversaries may use internal spearphishing to gain access to additional information or compromise other users within the same organization. Internal spearphishing is multi-staged campaign where a legitimate account is initially compromised either by controlling the user's device or by compromising the account credentials of the user. Adversaries may then attempt to take advantage of the trusted internal account to increase the likelihood of tricking more victims into falling for phish attempts, often incorporating [Impersonation](https://attack.mitre.org/techniques/T1684/001).(Citation: Trend Micro - Int SP) For example, adversaries may leverage [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001) or [Spearphishing Link](https://attack.mitre.org/techniques/T1566/002) as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through [Input Capture](https://attack.mitre.org/techniques/T1056) on sites that mimic login interfaces. Adversaries may also leverage internal chat apps, such as Microsoft Teams, to spread malicious content or engage users in attempts to capture sensitive information and/or credentials.(Citation: Int SP - chat apps)
Near-miss passage: T1563 Remote Service Session Hijacking. Tactics: lateral movement. Description: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment. Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP. When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service. Adversaries may commandeer these sessions to carry out actions on remote systems. [Remote Service Session Hijacking](https://attack.mitre.org/techniques/T1563) differs from use of [Remote Services](https://attack.mitre.org/techniques/T1021) because it hijacks an existing session rather than creating a new session using [Valid Accounts](https://attack.mitre.org/techniques/T1078).(Citation: RDP Hijacking Medium)(Citation: Breach Post-mortem SSH Hijack)
Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by ad. Logsource: windows / file_event. Rule: title: WinRAR Creating Files in Startup Locations id: 74a2b37d-fea4-41e0-9ac7-c9fbcf1f60cc status: experimental description: 'Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088. ' references: - https://github.com/mulwareX/CVE-2025-6218-POC - https://x.com/0x534c/status/1944694507787710685 - https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \WinRAR.exe - \Rar.exe TargetFilename|contains: \Start Menu\Programs\Startup\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / registry_set. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - REG id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 related: - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider filter: TargetObject|contains: - \System\CurrentControlSet\Services\WebClient\NetworkProvider - \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider - \System\CurrentControlSet\Services\RDPNP\NetworkProvider filter_valid_procs: Image: C:\Windows\System32\poqexec.exe condition: selection and not 1 of filter* falsepositives: - Other legitimate network providers used and not filtred in this rule level: medium
Query: CVE similar to CVE-2015-4200
Matching passage: CVE-2015-4200. CWE: CWE-399. CVSS: 7.800000190734863. Memory leak in the IPv6-to-IPv4 functionality in Cisco IOS 15.3S in the Performance Routing Engine (PRE) module on UBR devices allows remote attackers to cause a denial of service (memory consumption) by triggering an error during CPE negotiation, aka Bug ID CSCug00885.
Near-miss passage: CVE-2015-8877. CWE: CWE-399. CVSS: 7.5. The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in PHP before 5.6.12, uses inconsistent allocate and free approaches, which allows remote attackers to cause a denial of service (memory consumption) via a crafted call, as demonstrated by a call to the PHP imagescale function.
Query: weakness Absolute Path Traversal
Matching passage: CWE-36 Absolute Path Traversal. The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.
Near-miss passage: CWE-276 Incorrect Default Permissions. During installation, installed file permissions are set to allow anyone to modify those files.
Query: patch priority for CVE-2015-7237
Matching passage: CVE-2015-7237. CWE: CWE-22. CVSS: 5.0. Directory traversal vulnerability in the remote log viewing functionality in McAfee Agent (MA) 5.x before 5.0.2 allows remote attackers to obtain sensitive information via unspecified vectors.
Near-miss passage: CVE-2015-9275. CWE: CWE-22. CVSS: 5.300000190734863. ARC 5.21q allows directory traversal via a full pathname in an archive file.
Query: vulnerability: WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
Matching passage: CVE-2015-2826. CWE: CWE-200. CVSS: 5.300000190734863. WordPress Simple Ads Manager plugin 2.5.94 and 2.5.96 allows remote attackers to obtain sensitive information.
Near-miss passage: CVE-2015-3391. CWE: CWE-200. CVSS: 5.0. The Path Breadcrumbs module before 7.x-3.2 for Drupal allows remote attackers to bypass intended access restrictions and obtain sensitive node titles by reading a 403 Not Found page.
Query: CVE similar to CVE-2015-8613
Matching passage: CVE-2015-8613. CWE: CWE-787. CVSS: 6.5. Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command.
Near-miss passage: CVE-2015-4041. CWE: CWE-787. CVSS: 7.800000190734863. The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.
Query: describe CVE-2015-5721
Matching passage: CVE-2015-5721. CWE: CWE-94. CVSS: 9.800000190734863. Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data, related to TemplatesController.php and populate_event_from_template_attributes.ctp.
Near-miss passage: CVE-2015-5643. CWE: CWE-94. CVSS: 6.800000190734863. The installer in ICZ MATCHA INVOICE before 2.5.7 does not properly configure the database, which allows remote attackers to execute arbitrary PHP code via unspecified vectors.
Query: alert when Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capabili
Matching passage: Sigma rule: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capabili. Logsource: windows / process_creation. Rule: title: Potential Register_App.Vbs LOLScript Abuse id: 28c8f68b-098d-45af-8d43-8089f3e35403 status: test description: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 - https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs author: Austin Songer @austinsonger date: 2021-11-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: '.vbs -register ' condition: all of selection* falsepositives: - Other VB scripts that leverage the same starting command line flags level: medium
Near-miss passage: Sigma rule: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has. Logsource: windows / security. Rule: title: Password Protected ZIP File Opened id: 00ba9da1-b510-4f6b-b258-8d338836180f status: test description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened. references: - https://twitter.com/sbousseaden/status/1523383197513379841 author: Florian Roth (Nextron Systems) date: 2022-05-09 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security detection: selection: EventID: 5379 TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename filter: TargetName|contains: \Temporary Internet Files\Content.Outlook condition: selection and not filter falsepositives: - Legitimate used of encrypted ZIP files level: medium
Query: vulnerability: Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages 
Matching passage: CVE-2015-3989. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in concrete5 before 5.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to private messages or other unspecified vectors.
Near-miss passage: CVE-2015-2244. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in Webshop hun 1.062S allow remote attackers to inject arbitrary web script or HTML via the (1) param, (2) center, (3) lap, (4) termid, or (5) nyelv_id parameter to index.php.
Query: write Sigma for Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.
Matching passage: Sigma rule: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature.. Logsource: windows / registry_set. Rule: title: Microsoft Office Protected View Disabled id: a5c7a43f-6009-4a8c-80c5-32abf1c53ecc related: - id: 7c637634-c95d-4bbf-b26c-a82510874b34 type: obsolete status: test description: Detects changes to Microsoft Office protected view registry keys with which the attacker disables this feature. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/ - https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/ - https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-06-08 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection_path: TargetObject|contains|all: - \SOFTWARE\Microsoft\Office\ - \Security\ProtectedView\ selection_values_1: Details: DWORD (0x00000001) TargetObject|endswith: - \DisableAttachementsInPV - \DisableInternetFilesInPV - \DisableIntranetCheck - \DisableUnsafeLocationsInPV selection_values_0: Details: DWORD (0x00000000) TargetObject|endswith: - \enabledatabasefileprotectedview - \enableforeigntextfileprotectedview condition: selection_path and 1 of selection_values_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Identifies when a owner is was removed from a application or service principal in Azure.. Logsource: azure / auditlogs. Rule: title: Azure Owner Removed From Application or Service Principal id: 636e30d5-3736-42ea-96b1-e6e2f8429fd6 status: test description: Identifies when a owner is was removed from a application or service principal in Azure. references: - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory author: Austin Songer @austinsonger date: 2021-09-03 modified: 2026-04-30 tags: - attack.stealth logsource: product: azure service: auditlogs detection: selection: operationName: - Remove owner from service principal - Remove owner from application condition: selection falsepositives: - Owner being removed may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Owner removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: discovery using Domain Groups
Matching passage: T1069.002 Domain Groups. Tactics: discovery. Description: Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators. Commands such as <code>net group /domain</code> of the [Net](https://attack.mitre.org/software/S0039) utility, <code>dscacheutil -q group</code> on macOS, and <code>ldapsearch</code> on Linux can list domain-level groups.
Near-miss passage: T1069 Permission Groups Discovery. Tactics: discovery. Description: Adversaries may attempt to discover group and permission settings. This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions. Adversaries may attempt to discover group permission settings in many different ways. This data may provide the adversary with information about the compromised environment that can be used in follow-on activity and targeting.(Citation: CrowdStrike BloodHound April 2018)
Query: EDR alert: possible Container CLI/API (T1059.013)
Matching passage: T1059.013 Container CLI/API. Tactics: execution. Description: Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managing containers via an exposed API point from the `dockerd` daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application.(Citation: Docker Desktop CLI) Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105), [Build Image on Host](https://attack.mitre.org/techniques/T1612)), run containers (i.e., [Deploy Container](https://attack.mitre.org/techniques/T1610)), or execute commands inside running containers (i.e., [Container Administration Command](https://attack.mitre.org/techniques/T1609)). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the `curl` command to download payloads.(Citation: Intezer) Adversaries may also utilize `docker inspect` and `docker ps` to scan for cloud environment variables and other running containers (i.e., [Container and Resource Discovery](https://attack.mitre.org/techniques/T1613)).(Citation: Cisco Talos Blog)(Citation: aquasec) Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as `kubectl`. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via `curl` o
Near-miss passage: T1059.010 AutoHotKey & AutoIT. Tactics: execution. Description: Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.(Citation: AutoIT)(Citation: AutoHotKey) Adversaries may use AHK (`.ahk`) and AutoIT (`.au3`) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as [Phishing](https://attack.mitre.org/techniques/T1566) payloads.(Citation: Splunk DarkGate) These scripts may also be compiled into self-contained executable payloads (`.exe`).(Citation: AutoIT)(Citation: AutoHotKey)