alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which make
Matching passage: Sigma rule: Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which make. Logsource: windows / process_creation. Rule: title: Service DACL Abuse To Hide Services Via Sc.EXE id: a537cfc3-4297-4789-92b5-345bfd845ad0 related: - id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 type: similar - id: 98c5aeef-32d5-492f-b174-64a691896d25 type: similar status: test description: Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable. references: - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ author: Andreas Hunkeler (@Karneades) date: 2021-12-20 modified: 2022-08-08 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_cli: CommandLine|contains|all: - sdset - DCLCWPDTSD condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, w. Logsource: windows / registry_set. Rule: title: Office Macros Warning Disabled id: 91239011-fe3c-4b54-9f24-15c86bb65913 related: - id: 9b894e57-033f-46cf-b7fa-a52804181973 type: obsolete status: test description: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned. references: - https://twitter.com/inversecos/status/1494174785621819397 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/ - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/ author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) date: 2020-05-22 modified: 2024-03-19 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Security\VBAWarnings Details: DWORD (0x00000001) condition: selection falsepositives: - Unlikely level: high
Query: exploit Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application cra
Matching passage: CVE-2015-0835. CWE: UNKNOWN. CVSS: 7.5. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 36.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Near-miss passage: CVE-2015-1188. CWE: UNKNOWN. CVSS: 7.5. The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors.
Query: alert when Detects the creation of a new service using the "sc.exe" utility.
Matching passage: Sigma rule: Detects the creation of a new service using the "sc.exe" utility.. Logsource: windows / process_creation. Rule: title: New Service Creation Using Sc.EXE id: 85ff530b-261d-48c6-a441-facaa2e81e48 related: - id: c02e96b7-c63a-4c47-bd83-4a9f74afcfb2 type: similar status: test description: Detects the creation of a new service using the "sc.exe" utility. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community date: 2023-02-20 modified: 2025-09-01 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sc.exe CommandLine|contains|all: - create - binPath filter_optional_dropbox: ParentImage|startswith: - C:\Program Files (x86)\Dropbox\Client\ - C:\Program Files\Dropbox\Client\ ParentImage|endswith: \Dropbox.exe condition: selection and not 1 of filter_optional_* falsepositives: - Legitimate administrator or user creates a service for legitimate reasons. - Software installation level: low
Near-miss passage: Sigma rule: Detects suspicious command with /dev/tcp. Logsource: linux. Rule: title: Suspicious Use of /dev/tcp id: 6cc5fceb-9a71-4c23-aeeb-963abe0b279c status: test description: Detects suspicious command with /dev/tcp references: - https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/ - https://book.hacktricks.xyz/shells/shells/linux - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan author: frack113 date: 2021-12-10 modified: 2023-01-06 tags: - attack.reconnaissance logsource: product: linux detection: keywords: - cat </dev/tcp/ - exec 3<>/dev/tcp/ - echo >/dev/tcp/ - bash -i >& /dev/tcp/ - sh -i >& /dev/udp/ - 0<&196;exec 196<>/dev/tcp/ - exec 5<>/dev/tcp/ - (sh)0>/dev/tcp/ - bash -c 'bash -i >& /dev/tcp/ - echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ condition: keywords falsepositives: - Unknown level: medium
Query: describe CVE-2015-5788
Matching passage: CVE-2015-5788. CWE: CWE-200. CVSS: 4.300000190734863. The WebKit Canvas implementation in Apple iOS before 9 allows remote attackers to bypass the Same Origin Policy and obtain sensitive image information via vectors involving a CANVAS element.
Near-miss passage: CVE-2015-0070. CWE: CWE-200. CVSS: 4.300000190734863. Microsoft Internet Explorer 6 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
Query: CVE similar to CVE-2015-6387
Matching passage: CVE-2015-6387. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Cisco Unified Computing System (UCS) Central Software 1.3(0.1) allows remote attackers to inject arbitrary web script or HTML via a crafted value in a URL, aka Bug ID CSCux33573.
Near-miss passage: CVE-2015-4386. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing (1) comments, (2) taxonomy terms, or (3) nodes.
Query: Multiple failed authentications followed by Cloud Accounts
Matching passage: T1078.004 Cloud Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation) Service or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110), [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment. Federated or synced accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments - for example, by leveraging shared credentials to log onto [Remote Services](https://attack.mitre.org/techniques/T1021). High privileged cloud accounts, whether federated, synced, or cloud-only, may also allow pivoting to on-premises environments by leveraging SaaS-based [Software Deployment Tools](https://attack.mitre.org/techniques/T1072) to run commands on hybrid-joined devices. An adversary may create long lasting [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication. Cloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversar
Near-miss passage: T1078.002 Domain Accounts. Tactics: stealth, persistence, privilege escalation, initial access. Description: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.(Citation: TechNet Credential Theft) Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.(Citation: Microsoft AD Accounts) Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) or password reuse, allowing access to privileged resources of the domain.
Query: rule covering Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Matching passage: Sigma rule: Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'. Logsource: windows / registry_event. Rule: title: Atbroker Registry Change id: 9577edbb-851f-4243-8c91-1d5b50c1a39b status: test description: Detects creation/modification of Assistive Technology applications and persistence with usage of 'at' references: - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/ - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/ author: Mateusz Wydra, oscd.community date: 2020-10-13 modified: 2023-01-19 tags: - attack.privilege-escalation - attack.stealth - attack.t1218 - attack.persistence - attack.t1547 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs - Software\Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration filter_atbroker: Image: C:\Windows\system32\atbroker.exe TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Accessibility\Configuration Details: (Empty) filter_uninstallers: Image|startswith: C:\Windows\Installer\MSI TargetObject|contains: Software\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs condition: selection and not 1 of filter_* falsepositives: - Creation of non-default, legitimate at usage level: medium
Near-miss passage: Sigma rule: Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the M. Logsource: windows / image_load. Rule: title: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location id: 416bc4a2-7217-4519-8dc7-c3271817f1d5 related: - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd type: similar status: experimental description: 'Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes. ' references: - https://blog.axelarator.net/hunting-for-edr-freeze/ - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 modified: 2026-01-09 tags: - attack.credential-access - attack.defense-impairment - attack.t1003 - attack.t1685 logsource: category: image_load product: windows detection: selection_img: Image|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - \$Recycle.Bin\ - \Contacts\ - \Documents\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ selection_dll: ImageLoaded|endswith: - \dbgcore.dll - \dbghelp.dll condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml
Query: patch priority for CVE-2015-8917
Matching passage: CVE-2015-8917. CWE: CWE-476. CVSS: 7.5. bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid character in the name of a cab file.
Near-miss passage: CVE-2015-9215. CWE: CWE-476. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, and SD 810, improper input validation can cause a null pointer dereference in USB bootloader find_ep() function.
Query: vulnerability: Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from 
Matching passage: CVE-2015-3408. CWE: CWE-77. CVSS: 10.0. Module::Signature before 0.74 allows remote attackers to execute arbitrary shell commands via a crafted SIGNATURE file which is not properly handled when generating checksums from a signed manifest.
Near-miss passage: CVE-2015-0778. CWE: CWE-77. CVSS: 7.5. osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.
Query: patch priority for CVE-2015-3450
Matching passage: CVE-2015-3450. CWE: CWE-119. CVSS: 8.800000190734863. Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML document.
Near-miss passage: CVE-2015-3702. CWE: CWE-119. CVSS: 7.199999809265137. Buffer overflow in the Intel Graphics Driver in Apple OS X before 10.10.4 allows local users to gain privileges via unspecified vectors, a different vulnerability than CVE-2015-3695, CVE-2015-3696, CVE-2015-3697, CVE-2015-3698, CVE-2015-3699, CVE-2015-3700, and CVE-2015-3701.
Query: detect Multiband Communication
Matching passage: T1026 Multiband Communication. Tactics: command and control. Description: **This technique has been deprecated and should no longer be used.** Some adversaries may split communications between different protocols. There could be one protocol for inbound command and control and another for outbound data, allowing it to bypass certain firewall restrictions. The split could also be random to simply avoid data threshold alerts on any one communication.
Near-miss passage: T1090.002 External Proxy. Tactics: command and control. Description: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion. External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors. Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers. Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated. Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.
Query: CVE similar to CVE-2015-9003
Matching passage: CVE-2015-9003. CWE: CWE-310. CVSS: 7.800000190734863. In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel.
Near-miss passage: CVE-2015-4550. CWE: CWE-310. CVSS: 4.300000190734863. The Cavium cryptographic-module firmware on Cisco Adaptive Security Appliance (ASA) devices with software 9.3(3) and 9.4(1.1) does not verify the AES-GCM Integrity Check Value (ICV) octets, which makes it easier for man-in-the-middle attackers to spoof IPSec and IKEv2 traffic by modifying packet data, aka Bug ID CSCuu66218.
Query: vulnerability: The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to caus
Matching passage: CVE-2015-1790. CWE: UNKNOWN. CVSS: 5.0. The PKCS7_dataDecodefunction in crypto/pkcs7/pk7_doit.c in OpenSSL before 0.9.8zg, 1.0.0 before 1.0.0s, 1.0.1 before 1.0.1n, and 1.0.2 before 1.0.2b allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a PKCS#7 blob that uses ASN.1 encoding and lacks inner EncryptedContent data.
Near-miss passage: CVE-2015-4796. CWE: UNKNOWN. CVSS: 9.0. Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2, when running on Windows, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2015-4888.
Query: describe CVE-2015-1795
Matching passage: CVE-2015-1795. CWE: CWE-264. CVSS: 7.800000190734863. Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root.
Near-miss passage: CVE-2015-7496. CWE: CWE-264. CVSS: 7.199999809265137. GNOME Display Manager (gdm) before 3.18.2 allows physically proximate attackers to bypass the lock screen by holding the Escape key.
Query: write Sigma for Detects password change for the logged-on user's via "ksetup.exe"
Matching passage: Sigma rule: Detects password change for the logged-on user's via "ksetup.exe". Logsource: windows / process_creation. Rule: title: Logged-On User Password Change Via Ksetup.EXE id: c9783e20-4793-4164-ba96-d9ee483992c4 status: test description: Detects password change for the logged-on user's via "ksetup.exe" references: - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-06 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ksetup.exe - OriginalFileName: ksetup.exe selection_cli: CommandLine|contains: ' /ChangePassword ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects unauthorized access attempts to a resource.. Logsource: bitbucket / audit. Rule: title: Bitbucket Unauthorized Access To A Resource id: 7215374a-de4f-4b33-8ba5-70804c9251d3 status: test description: Detects unauthorized access attempts to a resource. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.resource-development - attack.t1586 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Security auditType.action: Unauthorized access to a resource condition: selection falsepositives: - Access attempts to non-existent repositories or due to outdated plugins. Usually "Anonymous" user is reported in the "author.name" field in most cases. level: critical
Query: Sigma rule for Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to
Matching passage: Sigma rule: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to. Logsource: windows / registry_set. Rule: title: Outlook EnableUnsafeClientMailRules Setting Enabled - Registry id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 related: - id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a type: similar - id: 55f0a3a1-846e-40eb-8273-677371b8d912 type: similar status: test description: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros references: - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048 - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-08 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\Security\EnableUnsafeClientMailRules Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.. Logsource: proxy. Rule: title: Potential Base64 Encoded User-Agent id: 894a8613-cf12-48b3-8e57-9085f54aa0c3 related: - id: d443095b-a221-4957-a2c4-cd1756c9b747 type: derived status: test description: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding. references: - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop author: Florian Roth (Nextron Systems), Brian Ingram (update) date: 2022-07-08 modified: 2023-05-04 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|endswith: '=' condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-4991
Matching passage: CVE-2015-4991. CWE: CWE-200. CVSS: 4.0. IBM SPSS Modeler 14.2 through FP3 IF027, 15 through FP3 IF015, 16 through FP2 IF012, 17 through FP1 IF018, and 17.1 through IF008 includes unspecified cleartext data in memory dumps, which allows local users to obtain sensitive information by reading a dump file.
Near-miss passage: CVE-2015-2896. CWE: CWE-200. CVSS: 5.300000190734863. The up.time client in Idera Uptime Infrastructure Monitor through 7.6 allows remote attackers to obtain potentially sensitive version, OS, process, and event-log information via a command.
Query: risk of Heap-based buffer overflow in SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code via a crafted Collada file.
Matching passage: CVE-2015-5772. CWE: CWE-119. CVSS: 6.800000190734863. Heap-based buffer overflow in SceneKit in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code via a crafted Collada file.
Near-miss passage: CVE-2015-0795. CWE: CWE-119. CVSS: 6.800000190734863. Multiple stack-based buffer overflows in the SafeShellExecute method in the NetIQExecObject.NetIQExec.1 ActiveX control in NetIQExec.dll in NetIQ Security Solutions for iSeries 8.1 allow remote attackers to execute arbitrary code via long arguments, aka ZDI-CAN-2699.