alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses Parent PID Spoofing
Matching passage: T1134.004 Parent PID Spoofing. Tactics: stealth, privilege escalation. Description: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges. New processes are typically spawned directly from their parent, or calling, process unless explicitly specified. One way of explicitly assigning the PPID of a new process is via the <code>CreateProcess</code> API call, which supports a parameter that defines the PPID to use.(Citation: DidierStevens SelectMyParent Nov 2009) This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via <code>svchost.exe</code> or <code>consent.exe</code>) rather than the current user context.(Citation: Microsoft UAC Nov 2018) Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of [PowerShell](https://attack.mitre.org/techniques/T1059/001)/[Rundll32](https://attack.mitre.org/techniques/T1218/011) to be <code>explorer.exe</code> rather than an Office document delivered as part of [Spearphishing Attachment](https://attack.mitre.org/techniques/T1566/001).(Citation: CounterCept PPID Spoofing Dec 2018) This spoofing could be executed via [Visual Basic](https://attack.mitre.org/techniques/T1059/005) within a malicious Office document or any code that can perform [Native API](https://attack.mitre.org/techniques/T1106).(Citation: CTD PPID Spoofing Macro Mar 2019)(Citation: CounterCept PPID Spoofing Dec 2018) Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process. For example, an adversary in a privileged user context (i.e. administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as <code>lsass.exe</code>), causing the new process to be elevated vi
Near-miss passage: T1134.003 Make and Impersonate Token. Tactics: stealth, privilege escalation. Description: Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls. For example, if an adversary has a username and password but the user is not logged onto the system the adversary can then create a logon session for the user using the `LogonUser` function.(Citation: LogonUserW function) The function will return a copy of the new session's access token and the adversary can use `SetThreadToken` to assign the token to a thread. This behavior is distinct from [Token Impersonation/Theft](https://attack.mitre.org/techniques/T1134/001) in that this refers to creating a new user token instead of stealing or duplicating an existing one.
Query: vulnerability: Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors.
Matching passage: CVE-2015-2135. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in HP Intelligent Provisioning 1.00 through 1.62(a), 2.00, and 2.10 allows remote attackers to execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-0353. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, CVE-2015-3042, and CVE-2015-3043.
Query: alert when Detects usage of base64 utility to decode arbitrary base64-encoded text
Matching passage: Sigma rule: Detects usage of base64 utility to decode arbitrary base64-encoded text. Logsource: macos / process_creation. Rule: title: Decode Base64 Encoded Text -MacOs id: 719c22d7-c11a-4f2c-93a6-2cfdd5412f68 status: test description: Detects usage of base64 utility to decode arbitrary base64-encoded text references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: macos detection: selection: Image: /usr/bin/base64 CommandLine|contains: -d condition: selection falsepositives: - Legitimate activities level: low
Near-miss passage: Sigma rule: Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phish. Logsource: windows / registry_set. Rule: title: Suspicious Space Characters in TypedPaths Registry Path - FileFix id: 8f2a5c3d-9e4b-4a7c-8d1f-2e5a6b9c3d7e related: - id: 3ae9974a-eb09-4044-8e70-8980a50c12c8 type: similar status: experimental description: 'Detects the occurrence of numerous space characters in TypedPaths registry paths, which may indicate execution via phishing lures using file-fix techniques to hide malicious commands. ' references: - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ - https://mrd0x.com/filefix-clickfix-alternative/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-04 tags: - attack.execution - attack.stealth - attack.t1204.004 - attack.t1027.010 logsource: category: registry_set product: windows detection: selection_key: TargetObject|endswith: \Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\url1 Details|contains: '#' selection_space_variation: Details|contains: - - - - - - - - - - - - - ' ' condition: all of selection_* falsepositives: - Unlikely level: high
Query: vulnerability: The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 
Matching passage: CVE-2015-4217. CWE: CWE-200. CVSS: 4.300000190734863. The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management Virtual Appliance (SMAv) devices before 2015-06-25 uses the same default SSH host keys across different customers' installations, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of a private key from another installation, aka Bug IDs CSCus29681, CSCuu95676, and CSCuu96601.
Near-miss passage: CVE-2015-5827. CWE: CWE-200. CVSS: 5.0. WebKit in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain an object reference via vectors involving a (1) custom event, (2) message event, or (3) pop state event.
Query: alert when Detects tampering with attachment manager settings policies associations to lower the default file type risks (See refer
Matching passage: Sigma rule: Detects tampering with attachment manager settings policies associations to lower the default file type risks (See refer. Logsource: windows / registry_set. Rule: title: Potential Attachment Manager Settings Associations Tamper id: a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47 status: test description: Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information) references: - https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738 - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-08-17 tags: - attack.defense-impairment logsource: category: registry_set product: windows detection: selection_main: TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\ selection_value_default_file_type_rsik: TargetObject|endswith: \DefaultFileTypeRisk Details: DWORD (0x00006152) selection_value_low_risk_filetypes: TargetObject|endswith: \LowRiskFileTypes Details|contains: - .zip; - .rar; - .exe; - .bat; - .com; - .cmd; - .reg; - .msi; - .htm; - .html; condition: selection_main and 1 of selection_value_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects remote PowerShell sessions. Logsource: windows / ps_module. Rule: title: Remote PowerShell Session (PS Module) id: 96b9f619-aa91-478f-bacb-c3e50f8df575 status: test description: Detects remote PowerShell sessions references: - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-08-10 modified: 2023-01-20 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains|all: - ' = ServerRemoteHost ' - wsmprovhost.exe filter_pwsh_archive: ContextInfo|contains: \Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psm1 condition: selection and not 1 of filter_* falsepositives: - Legitimate use remote PowerShell sessions level: high
Query: CVE similar to CVE-2015-0321
Matching passage: CVE-2015-0321. CWE: UNKNOWN. CVSS: 10.0. Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before 11.2.202.442 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-0314, CVE-2015-0316, CVE-2015-0318, CVE-2015-0329, and CVE-2015-0330.
Near-miss passage: CVE-2015-2573. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.5.41 and earlier, and 5.6.22 and earlier, allows remote authenticated users to affect availability via vectors related to DDL.
Query: CVE similar to CVE-2015-2083
Matching passage: CVE-2015-2083. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Ilch CMS allows remote attackers to hijack the authentication of administrators for requests that add a value to a profile field via a profilefields request to admin.php.
Near-miss passage: CVE-2015-5050. CWE: CWE-352. CVSS: 8.800000190734863. Cross-site request forgery (CSRF) vulnerability in IBM Emptoris Contract Management 9.5.0.x before 9.5.0.6 iFix15, 10.0.0.x and 10.0.1.x before 10.0.1.5 iFix5, 10.0.2.x before 10.0.2.7 iFix4, and 10.0.4.x before 10.0.4.0 iFix3 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS sequences.
Query: describe CVE-2015-0765
Matching passage: CVE-2015-0765. CWE: CWE-399. CVSS: 5.0. Cisco ONS 15454 System Software 10.30 and 10.301 allows remote attackers to cause a denial of service (tNetTask CPU consumption or card reset) via a flood of (1) IP or (2) Ethernet traffic, aka Bug ID CSCus57263.
Near-miss passage: CVE-2015-1943. CWE: CWE-399. CVSS: 7.800000190734863. IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x through 6.1.5.3 CF27, 7.0.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF17, and 8.5.0 before CF06 allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
Query: detection rule: Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey,
Matching passage: Sigma rule: Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey,. Logsource: windows / process_creation. Rule: title: Registry Enumeration via WMI Stdregprov id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191 related: - id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a type: similar status: experimental description: 'Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software. The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands. ' references: - https://trustedsec.com/blog/command-line-underdog-wmic-in-action - https://trustedsec.com/blog/wmi-for-script-kiddies - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-30 modified: 2026-06-19 tags: - attack.execution - attack.t1047 - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - stdregprov - call CommandLine|contains: - CheckAccess - EnumKey - EnumValues - GetBinaryValue - GetDWORDValue - GetExpandedStringValue - GetMultiStringValue - GetQWORDValue - GetSecurityDescriptor - GetStringValue condition: all of selection_* falsepositives: - Legitimate administrative activity level: medium
Near-miss passage: Sigma rule: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are leg. Logsource: zeek / dns. Rule: title: New Kind of Network (NKN) Detection id: fa7703d6-0ee8-4949-889c-48c84bc15b6f status: test description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma> references: - https://github.com/nknorg/nkn-sdk-go - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/ - https://github.com/Maka8ka/NGLite author: Michael Portera (@mportatoes) date: 2022-04-21 tags: - attack.command-and-control logsource: product: zeek service: dns detection: selection: query|contains|all: - seed - .nkn.org condition: selection falsepositives: - Unknown level: low
Query: CWE for Function Call With Incorrect Argument Type
Matching passage: CWE-686 Function Call With Incorrect Argument Type. The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.
Near-miss passage: CWE-1289 Improper Validation of Unsafe Equivalence in Input. The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Query: vulnerability: WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corru
Matching passage: CVE-2015-5930. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9.1, Safari before 9.0.1, and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-1, APPLE-SA-2015-10-21-3, and APPLE-SA-2015-10-21-5.
Near-miss passage: CVE-2015-7221. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a deque size change.
Query: detect Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon c in logs
Matching passage: Sigma rule: Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon c. Logsource: windows / process_creation. Rule: title: Security Tools Keyword Lookup Via Findstr.EXE id: 4fe074b4-b833-4081-8f24-7dcfeca72b42 related: - id: fe63010f-8823-4864-a96b-a7b4a0f7b929 type: derived status: test description: 'Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/ - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2023-10-20 modified: 2023-11-14 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_cli: CommandLine|endswith: - ' avira' - ' avira"' - ' cb' - ' cb"' - ' cylance' - ' cylance"' - ' defender' - ' defender"' - ' kaspersky' - ' kaspersky"' - ' kes' - ' kes"' - ' mc' - ' mc"' - ' sec' - ' sec"' - ' sentinel' - ' sentinel"' - ' symantec' - ' symantec"' - ' virus' - ' virus"' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/info.yml simulation: - type: atomic-red-team name: Security Software Discovery technique: T1518.001 atomic_guid: f92a380f-ced9-491f-b338-95a991418ce2
Near-miss passage: Sigma rule: Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contai. Logsource: windows / file_event. Rule: title: Suspicious File Created In PerfLogs id: bbb7e38c-0b41-4a11-b306-d2a457b7ac2b status: test description: Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files references: - Internal Research - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.execution - attack.t1059 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\PerfLogs\ TargetFilename|endswith: - .7z - .bat - .bin - .chm - .dll - .exe - .hta - .lnk - .ps1 - .psm1 - .py - .scr - .sys - .vbe - .vbs - .zip condition: selection falsepositives: - Unlikely level: medium
Query: patch priority for CVE-2015-8864
Matching passage: CVE-2015-8864. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2016-4068.
Near-miss passage: CVE-2015-0345. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 16 and 11 before Update 5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: detect Detect remote login by Administrator user (depending on internal pattern). in logs
Matching passage: Sigma rule: Detect remote login by Administrator user (depending on internal pattern).. Logsource: windows / security. Rule: title: Admin User Remote Logon id: 0f63e1ef-1eb9-4226-9d54-8927ca08520a status: test description: Detect remote login by Administrator user (depending on internal pattern). references: - https://car.mitre.org/wiki/CAR-2016-04-005 author: juju4 date: 2017-10-29 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.persistence - attack.lateral-movement - attack.initial-access - attack.stealth - attack.t1078.001 - attack.t1078.002 - attack.t1078.003 - car.2016-04-005 logsource: product: windows service: security definition: 'Requirements: Identifiable administrators usernames (pattern or special unique character. ex: "Admin-*"), internal policy mandating use only as secondary account' detection: selection: EventID: 4624 LogonType: 10 AuthenticationPackageName: Negotiate TargetUserName|startswith: Admin condition: selection falsepositives: - Legitimate administrative activity. level: low
Near-miss passage: Sigma rule: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ". Logsource: windows / file_event. Rule: title: SCR File Write Event id: c048f047-7e2a-4888-b302-55f509d4a91d status: test description: Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example. references: - https://lolbas-project.github.io/lolbas/Libraries/Desk/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2022-04-27 modified: 2023-08-23 tags: - attack.stealth - attack.t1218.011 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .scr filter: TargetFilename|contains: - :\$WINDOWS.~BT\NewOS\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ - :\WUDownloadCache\ condition: selection and not filter falsepositives: - The installation of new screen savers by third party software level: medium