alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: rule covering Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet
Matching passage: Sigma rule: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet. Logsource: windows / process_creation. Rule: title: Tamper Windows Defender Remove-MpPreference id: 07e3cb2c-0608-410d-be4b-1511cb1a0448 related: - id: ae2bdd58-0681-48ac-be7f-58ab4e593458 type: similar status: test description: Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet references: - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: process_creation detection: selection_remove: CommandLine|contains: Remove-MpPreference selection_tamper: CommandLine|contains: - '-ControlledFolderAccessProtectedFolders ' - '-AttackSurfaceReductionRules_Ids ' - '-AttackSurfaceReductionRules_Actions ' - '-CheckForSignaturesBeforeRunningScan ' condition: all of selection_* falsepositives: - Legitimate PowerShell scripts level: high
Near-miss passage: Sigma rule: Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe. Logsource: windows / process_creation. Rule: title: Suspicious File Characteristics Due to Missing Fields id: 9637e8a5-7131-4f7f-bdc7-2b05d8670c43 status: test description: Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe references: - https://securelist.com/muddywater/88059/ - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection author: Markus Neis, Sander Wiebing date: 2018-11-22 modified: 2022-10-09 tags: - attack.execution - attack.t1059.006 logsource: product: windows category: process_creation detection: selection1: Description: \? FileVersion: \? selection2: Description: \? Product: \? selection3: Description: \? Company: \? folder: Image|contains: \Downloads\ condition: (selection1 or selection2 or selection3) and folder falsepositives: - Unknown level: medium
Query: secure coding against Path Equivalence: ' filename' (Leading Space)
Matching passage: CWE-47 Path Equivalence: ' filename' (Leading Space). The product accepts path input in the form of leading space (' filedir') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Near-miss passage: CWE-288 Authentication Bypass Using an Alternate Path or Channel. The product requires authentication, but the product has an alternate path or channel that does not require authentication.
Query: patch priority for CVE-2015-3302
Matching passage: CVE-2015-3302. CWE: CWE-284. CVSS: 7.5. The TheCartPress eCommerce Shopping Cart (aka The Professional WordPress eCommerce Plugin) plugin for WordPress before 1.3.9.3 allows remote attackers to obtain sensitive order detail information by leveraging a "broken authentication mechanism."
Near-miss passage: CVE-2015-3672. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.
Query: exploit QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of servi
Matching passage: CVE-2015-3666. CWE: CWE-119. CVSS: 6.800000190734863. QT Media Foundation in Apple QuickTime before 7.7.7, as used in OS X before 10.10.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file, a different vulnerability than CVE-2015-3661, CVE-2015-3662, CVE-2015-3663, CVE-2015-3667, and CVE-2015-3668.
Near-miss passage: CVE-2015-6976. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, CVE-2015-7010, and CVE-2015-7018.
Query: patch priority for CVE-2015-4765
Matching passage: CVE-2015-4765. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 12.1.3, 12.2.3, and 12.2.4 allows remote authenticated users to affect integrity via vectors related to OAM Dashboard.
Near-miss passage: CVE-2015-6832. CWE: UNKNOWN. CVSS: 7.300000190734863. Use-after-free vulnerability in the SPL unserialize implementation in ext/spl/spl_array.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 allows remote attackers to execute arbitrary code via crafted serialized data that triggers misuse of an array field.
Query: intelligence brief on T1584.004
Matching passage: T1584.004 Server. Tactics: resource development. Description: Adversaries may compromise third-party servers that can be used during targeting. Use of servers allows an adversary to stage, launch, and execute an operation. During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.(Citation: TrendMicro EarthLusca 2022) Instead of purchasing a [Server](https://attack.mitre.org/techniques/T1583/004) or [Virtual Private Server](https://attack.mitre.org/techniques/T1583/003), adversaries may compromise third-party servers in support of operations. Adversaries may also compromise web servers to support watering hole operations, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), or email servers to support [Phishing](https://attack.mitre.org/techniques/T1566) operations.
Near-miss passage: T1584.001 Domains. Tactics: resource development. Description: Adversaries may hijack domains and/or subdomains that can be used during targeting. Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.(Citation: ICANNDomainNameHijacking) Adversaries may gain access to an email account for the person listed as the owner of the domain. The adversary can then claim that they forgot their password in order to make changes to the domain registration. Other possibilities include social engineering a domain registration help desk to gain access to an account, taking advantage of renewal process gaps, or compromising a cloud service that enables managing domains (e.g., AWS Route53).(Citation: Krebs DNS Hijack 2019) Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources. In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.(Citation: Microsoft Sub Takeover 2020) Adversaries who compromise a domain may also engage in domain shadowing by creating malicious subdomains under their control while keeping any existing DNS records. As service will not be disrupted, the malicious subdomains may go unnoticed for long periods of time.(Citation: Palo Alto Unit 42 Domain Shadowing 2022)
Query: patch priority for CVE-2015-1345
Matching passage: CVE-2015-1345. CWE: CWE-119. CVSS: 2.0999999046325684. The bmexec_trans function in kwset.c in grep 2.19 through 2.21 allows local users to cause a denial of service (out-of-bounds heap read and crash) via crafted input when using the -F option.
Near-miss passage: CVE-2015-5578. CWE: CWE-119. CVSS: 10.0. Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-5575, CVE-2015-5577, CVE-2015-5580, CVE-2015-5582, CVE-2015-5588, and CVE-2015-6677.
Query: detection rule: Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability
Matching passage: Sigma rule: Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability. Logsource: windows / diagnosis-scripted. Rule: title: Loading Diagcab Package From Remote Path id: 50cb47b8-2c33-4b23-a2e9-4600657d9746 status: test description: Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability references: - https://twitter.com/nas_bench/status/1539679555908141061 - https://twitter.com/j00sean/status/1537750439701225472 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 tags: - attack.execution logsource: product: windows service: diagnosis-scripted detection: selection: EventID: 101 PackagePath|contains: \\\\ condition: selection falsepositives: - Legitimate package hosted on a known and authorized remote location level: high
Near-miss passage: Sigma rule: Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over. Logsource: windows / ps_script. Rule: title: Testing Usage of Uncommonly Used Port id: adf876b3-f1f8-4aa9-a4e4-a64106feec06 status: test description: 'Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell - https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps author: frack113 date: 2022-01-23 tags: - attack.command-and-control - attack.t1571 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Test-NetConnection - '-ComputerName ' - '-port ' filter: ScriptBlockText|contains: - ' 443 ' - ' 80 ' condition: selection and not filter falsepositives: - Legitimate administrative script level: medium
Query: rule covering Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential pers
Matching passage: Sigma rule: Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential pers. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Netsh Helper DLL - Registry id: c90362e0-2df3-4e61-94fe-b37615814cb1 related: - id: 56321594-9087-49d9-bf10-524fe8479452 type: similar - id: e7b18879-676e-4a0e-ae18-27039185a8e7 type: similar status: test description: 'Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper ' references: - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/ author: Anish Bogati date: 2023-11-28 modified: 2025-10-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.007 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\NetSh Details|contains: .dll filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe Details: - ipmontr.dll - iasmontr.dll - ippromon.dll condition: selection and not 1 of filter_main_* falsepositives: - Legitimate helper added by different programs and the OS level: medium
Near-miss passage: Sigma rule: Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is. Logsource: windows / registry_delete. Rule: title: Removal Of SD Value to Hide Schedule Task - Registry id: acd74772-5f88-45c7-956b-6a7b36c294d2 related: - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec type: similar status: test description: Remove SD (Security Descriptor) value in \Schedule\TaskCache\Tree registry hive to hide schedule task. This technique is used by Tarrask malware references: - https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/ author: Sittikorn S date: 2022-04-15 modified: 2025-10-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_delete detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - SD condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal/info.yml
Query: write Sigma for Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw
Matching passage: Sigma rule: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw. Logsource: windows / process_creation. Rule: title: Suspicious Scan Loop Network id: f8ad2e2c-40b6-4117-84d7-20b89896ab23 status: test description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://ss64.com/nt/for.html - https://ss64.com/ps/foreach-object.html author: frack113 date: 2022-03-12 tags: - attack.execution - attack.t1059 - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_loop: CommandLine|contains: - 'for ' - 'foreach ' selection_tools: CommandLine|contains: - nslookup - ping condition: all of selection_* falsepositives: - Legitimate script level: medium
Near-miss passage: Sigma rule: Detects suspicious process patterns found in logs when CrackMapExec is used. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Process Patterns id: f26307d8-14cd-47e3-a26b-4b4769f24af6 status: test description: Detects suspicious process patterns found in logs when CrackMapExec is used references: - https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass author: Florian Roth (Nextron Systems) date: 2022-03-12 modified: 2023-02-13 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_lsass_dump1: CommandLine|contains|all: - 'tasklist /fi ' - Imagename eq lsass.exe CommandLine|contains: - 'cmd.exe /c ' - 'cmd.exe /r ' - 'cmd.exe /k ' - 'cmd /c ' - 'cmd /r ' - 'cmd /k ' User|contains: - AUTHORI - AUTORI selection_lsass_dump2: CommandLine|contains|all: - do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump - \Windows\Temp\ - ' full' - '%%B' selection_procdump: CommandLine|contains|all: - tasklist /v /fo csv - findstr /i "lsass" condition: 1 of selection* falsepositives: - Unknown level: high
Query: how to detect Clear Windows Event Logs
Matching passage: T1685.005 Clear Windows Event Logs. Tactics: defense impairment. Description: Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit. With administrator privileges, the event logs can be cleared with the following utility commands: * `wevtutil cl system` * `wevtutil cl application` * `wevtutil cl security` These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command `Remove-EventLog -LogName Security` to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging) Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.
Near-miss passage: T1685 Disable or Modify Tools. Tactics: defense impairment. Description: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.(Citation: SCADAfence_ransomware) In addition to directly targeting tools, adversaries may block or manipulate indicators and telemetry used for detection. This includes maliciously disabling or redirecting sensors such as Event Tracing for Windows (ETW), modifying event log configurations (e.g., redirecting Security logs), or interfering with logging pipelines and forwarding mechanisms (e.g., SIEM ingestion).(Citation: Microsoft Lamin Sept 2017)(Citation: ETW Palantir) More advanced techniques include leveraging legitimate drivers or debugging mechanisms to render tools non-functional, bypassing anti-tampering protections, and targeting specific defenses such as Sysmon or cloud monitoring agents. Adversaries may also disrupt broader defensive operations, including update mechanisms, logging infrastructure (e.g., syslog), or event aggregation, further degrading an organization’s ability to detect and respond to malicious activity.(Citation: Cocomazzi FIN7 Reboot)
Query: exploit NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.
Matching passage: CVE-2015-2214. CWE: CWE-200. CVSS: 5.0. NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirect_url parameter to netshop/post.php.
Near-miss passage: CVE-2015-2445. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 10 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "ASLR Bypass."
Query: patch priority for CVE-2015-4116
Matching passage: CVE-2015-4116. CWE: UNKNOWN. CVSS: 9.800000190734863. Use-after-free vulnerability in the spl_ptr_heap_insert function in ext/spl/spl_heap.c in PHP before 5.5.27 and 5.6.x before 5.6.11 allows remote attackers to execute arbitrary code by triggering a failed SplMinHeap::compare operation.
Near-miss passage: CVE-2015-2605. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Endeca Information Discovery Studio component in Oracle Fusion Middleware 2.2.2, 2.3, 2.4, 3.0, and 3.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Integrator, a different vulnerability than CVE-2015-2602, CVE-2015-2603, CVE-2015-2604, CVE-2015-2606, and CVE-2015-4745.
Query: alert when Detects instances where an OpenCanary node has been targeted by a SYN port scan.
Matching passage: Sigma rule: Detects instances where an OpenCanary node has been targeted by a SYN port scan.. Logsource: opencanary / application. Rule: title: OpenCanary - Host Port Scan (SYN Scan) id: 974be8d2-283e-4033-ab08-7505b84204d0 status: experimental description: Detects instances where an OpenCanary node has been targeted by a SYN port scan. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5001 condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening. Logsource: windows / file_event. Rule: title: Suspicious File Created in Outlook Temporary Directory id: fabb0e80-030c-4e3e-a104-d09676991ac3 related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: obsolete status: experimental description: 'Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code. ' references: - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/ - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/ author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-22 tags: - attack.initial-access - attack.t1566.001 logsource: product: windows category: file_event detection: selection_extension: TargetFilename|endswith: - .cpl - .hta - .iso - .rdp - .svg - .vba - .vbe - .vbs selection_location: - TargetFilename|contains: - \AppData\Local\Packages\Microsoft.Outlook_ - \AppData\Local\Microsoft\Olk\Attachments\ - TargetFilename|contains|all: - \AppData\Local\Microsoft\Windows\ - \Content.Outlook\ condition: all of selection_* falsepositives: - Opening of headers or footers in email signatures that include SVG images or legitimate SVG attachments level: high
Query: vulnerability: Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird be
Matching passage: CVE-2015-2731. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in the CSPService::ShouldLoad function in the microtask implementation in Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 allows remote attackers to execute arbitrary code by leveraging client-side JavaScript that triggers removal of a DOM object on the basis of a Content Policy.
Near-miss passage: CVE-2015-2593. CWE: UNKNOWN. CVSS: 7.099999904632568. Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Configuration Service.