alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: detect Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker t in logs
Matching passage: Sigma rule: Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker t. Logsource: windows / ps_script. Rule: title: Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock id: da34e323-1e65-42db-83be-a6725ac2caa3 status: test description: 'Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session. Adversaries may attempt to capture network to gather information over the course of an operation. Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing - https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md - https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13 author: frack113 date: 2024-05-12 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Start-NetEventSession condition: selection falsepositives: - Legitimate network diagnostic scripts. level: medium
Near-miss passage: Sigma rule: Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl. Logsource: windows / registry_set. Rule: title: ScreenSaver Registry Key Set id: 40b6e656-4e11-4c0c-8772-c1cc6dae34ce status: test description: Detects registry key established after masqueraded .scr file execution using Rundll32 through desk.cpl references: - https://twitter.com/VakninHai/status/1517027824984547329 - https://twitter.com/pabraeken/status/998627081360695297 - https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk) date: 2022-05-04 modified: 2023-08-17 tags: - attack.stealth - attack.t1218.011 logsource: product: windows category: registry_set detection: selection: Image|endswith: \rundll32.exe registry: TargetObject|contains: \Control Panel\Desktop\SCRNSAVE.EXE Details|endswith: .scr filter: Details|contains: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and registry and not filter falsepositives: - Legitimate use of screen saver level: medium
Query: detection rule: Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UN
Matching passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UN. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Activity Invoking Sys File id: 731231b9-0b5d-4219-94dd-abb6959aa7ea status: test description: Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: rundll32.exe selection2: CommandLine|contains: - .sys, - '.sys ' condition: all of selection* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Access to LSASS Process. Logsource: windows / windefend. Rule: title: LSASS Access Detected via Attack Surface Reduction id: a0a278fe-2c0e-4de2-ac3c-c68b08a9ba98 status: test description: Detects Access to LSASS Process references: - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction author: Markus Neis date: 2018-08-26 modified: 2022-08-13 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: windefend definition: 'Requirements:Enabled Block credential stealing from the Windows local security authority subsystem (lsass.exe) from Attack Surface Reduction (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)' detection: selection: EventID: 1121 Path|endswith: \lsass.exe filter_thor: ProcessName|startswith: C:\Windows\Temp\asgard2-agent\ ProcessName|endswith: - \thor64.exe - \thor.exe filter_exact: ProcessName: - C:\Windows\System32\atiesrxx.exe - C:\Windows\System32\CompatTelRunner.exe - C:\Windows\System32\msiexec.exe - C:\Windows\System32\nvwmi64.exe - C:\Windows\System32\svchost.exe - C:\Windows\System32\Taskmgr.exe - C:\Windows\System32\wbem\WmiPrvSE.exe - C:\Windows\SysWOW64\msiexec.exe filter_begins: ProcessName|startswith: - C:\Windows\System32\DriverStore\ - C:\WINDOWS\Installer\ - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_* falsepositives: - Google Chrome GoogleUpdate.exe - Some Taskmgr.exe related activity level: high
Query: describe CVE-2015-0459
Matching passage: CVE-2015-0459. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in Oracle Java SE 5.0u81, 6u91, 7u76, and 8u40, and JavaFX 2.2.76, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2015-0491.
Near-miss passage: CVE-2015-6780. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the Infobars implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site, related to browser/ui/views/website_settings/website_settings_popup_view.cc.
Query: exploit The SSHv2 functionality in Cisco IOS 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.6E before 3.6.3E, 3.7E before 3.7.1E, 3.10S before 3.10.6S, 3.11S before 3.11.4S, 3.12S before 3.12.3S,
Matching passage: CVE-2015-6280. CWE: CWE-287. CVSS: 9.300000190734863. The SSHv2 functionality in Cisco IOS 15.2, 15.3, 15.4, and 15.5 and IOS XE 3.6E before 3.6.3E, 3.7E before 3.7.1E, 3.10S before 3.10.6S, 3.11S before 3.11.4S, 3.12S before 3.12.3S, 3.13S before 3.13.3S, and 3.14S before 3.14.1S does not properly implement RSA authentication, which allows remote attackers to obtain login access by leveraging knowledge of a username and the associated public key, aka Bug ID CSCus73013.
Near-miss passage: CVE-2015-5998. CWE: CWE-287. CVSS: 10.0. Impero Education Pro before 5105 relies on the -1|AUTHENTICATE\x02PASSWORD string for authentication, which allows remote attackers to execute arbitrary programs via an encrypted command.
Query: vulnerability: ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and d
Matching passage: CVE-2015-8703. CWE: CWE-200. CVSS: 6.5. ZTE ZXHN H108N R1A devices before ZTE.bhs.ZXHNH108NR1A.k_PE and ZXV10 W300 devices W300V1.0.0f_ER1_PE allow remote authenticated users to bypass intended access restrictions, and discover credentials and keys, by reading the configuration file, a different vulnerability than CVE-2015-7248.
Near-miss passage: CVE-2015-2997. CWE: CWE-200. CVSS: 5.0. SysAid Help Desk before 15.2 allows remote attackers to obtain sensitive information via an invalid value in the accountid parameter to getAgentLogFile, as demonstrated by a large directory traversal sequence, which reveals the installation path in an error message.
Query: alert when Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone o
Matching passage: Sigma rule: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone o. Logsource: windows / process_creation. Rule: title: Sysmon Configuration Update id: 87911521-7098-470b-a459-9a57fc80bdfd status: test description: Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-09 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: - \Sysmon64.exe - \Sysmon64a.exe - \Sysmon.exe - Description: System activity monitor selection_cli: CommandLine|contains|windash: -c condition: all of selection_* falsepositives: - Legitimate administrators might use this command to update Sysmon configuration. level: medium
Near-miss passage: Sigma rule: Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. Logsource: github / audit. Rule: title: GitHub Repository Archive Status Changed id: dca8991c-cb16-4128-abf8-6b11e5cd156f status: experimental description: 'Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status. ' references: - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events author: Ivan Saakov date: 2025-10-18 tags: - attack.persistence - attack.impact - attack.defense-impairment logsource: product: github service: audit detection: selection: action: - repo.archived - repo.unarchived condition: selection falsepositives: - Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized. level: low
Query: exploit lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structur
Matching passage: CVE-2015-3180. CWE: CWE-200. CVSS: 4.0. lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment.
Near-miss passage: CVE-2015-1308. CWE: CWE-200. CVSS: 4.300000190734863. kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects WmiPrvSE spawning a process. Logsource: windows / process_creation. Rule: title: WmiPrvSE Spawned A Process id: d21374ff-f574-44a7-9998-4a8c8bf33d7d related: - id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 type: similar - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar status: stable description: Detects WmiPrvSE spawning a process references: - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-15 modified: 2023-03-23 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \WmiPrvSe.exe filter_logonid: LogonId: - '0x3e7' - 'null' filter_system_user: User|contains: - AUTHORI - AUTORI filter_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_werfault: Image|endswith: \WerFault.exe filter_null: LogonId: null condition: selection and not 1 of filter_* falsepositives: - False positives are expected (e.g. in environments where WinRM is used legitimately) level: medium
Near-miss passage: Sigma rule: Monitor and alert on group membership additions of groups that have CA policy modification access. Logsource: azure / auditlogs. Rule: title: User Added To Group With CA Policy Modification Access id: 91c95675-1f27-46d0-bead-d1ae96b97cd3 status: test description: Monitor and alert on group membership additions of groups that have CA policy modification access references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' date: 2022-08-04 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Add member from group condition: selection falsepositives: - User removed from the group is approved level: medium
Query: CVE similar to CVE-2015-10131
Matching passage: CVE-2015-10131. CWE: CWE-79. CVSS: 3.5. A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620.
Near-miss passage: CVE-2015-7391. CWE: CWE-79. CVSS: 6.099999904632568. Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.9.14 allow remote attackers to inject arbitrary web script or HTML via the (1) selected_end_date or (2) selected_start_date parameter to lib/results/tcCreatedPerUserOnTestProject.php; the (3) containerType parameter to lib/testcases/containerEdit.php; the (4) filter_tc_id or (5) filter_testcase_name parameter to lib/testcases/listTestCases.php; the (6) useRecursion parameter to lib/testcases/tcImport.php; the (7) targetTestCase or (8) created_by parameter to lib/testcases/tcSearch.php; or the (9) HTTP Referer header to third_party/user_contribution/fakeRemoteExecServer/client4fakeXMLRPCTestRunner.php.
Query: patch priority for CVE-2015-6638
Matching passage: CVE-2015-6638. CWE: CWE-264. CVSS: 7.800000190734863. The Imagination Technologies driver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 24673908.
Near-miss passage: CVE-2015-7408. CWE: CWE-264. CVSS: 3.700000047683716. The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority.
Query: detect Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw in logs
Matching passage: Sigma rule: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw. Logsource: windows / process_creation. Rule: title: Suspicious Scan Loop Network id: f8ad2e2c-40b6-4117-84d7-20b89896ab23 status: test description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://ss64.com/nt/for.html - https://ss64.com/ps/foreach-object.html author: frack113 date: 2022-03-12 tags: - attack.execution - attack.t1059 - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_loop: CommandLine|contains: - 'for ' - 'foreach ' selection_tools: CommandLine|contains: - nslookup - ping condition: all of selection_* falsepositives: - Legitimate script level: medium
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION id: 7eedcc9d-9fdb-4d94-9c54-474e8affc0c7 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-12-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - new-object - text.encoding]::ascii CommandLine|contains: - system.io.compression.deflatestream - system.io.streamreader - readtoend( condition: selection falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-1759
Matching passage: CVE-2015-1759. CWE: CWE-19. CVSS: 9.300000190734863. Microsoft Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-1270. CWE: CWE-19. CVSS: 6.800000190734863. The ucnv_io_getConverterName function in common/ucnv_io.cpp in International Components for Unicode (ICU), as used in Google Chrome before 44.0.2403.89, mishandles converter names with initial x- substrings, which allows remote attackers to cause a denial of service (read of uninitialized memory) or possibly have unspecified other impact via a crafted file.
Query: impact using Compute Hijacking
Matching passage: T1496.001 Compute Hijacking. Tactics: impact. Description: Adversaries may leverage the compute resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. One common purpose for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for [Compute Hijacking](https://attack.mitre.org/techniques/T1496/001) and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs) Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)
Near-miss passage: T1496.002 Bandwidth Hijacking. Tactics: impact. Description: Adversaries may leverage the network bandwidth resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking) Finally, they may engage in internet-wide scanning in order to identify additional targets for compromise.(Citation: Unit 42 Leaked Environment Variables 2024) In addition to incurring potential financial costs or availability disruptions, this technique may cause reputational damage if a victim’s bandwidth is used for illegal activities.(Citation: Sysdig Proxyjacking)
Query: risk of The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote att
Matching passage: CVE-2015-0635. CWE: CWE-20. CVSS: 9.0. The Autonomic Networking Infrastructure (ANI) implementation in Cisco IOS 12.2, 12.4, 15.0, 15.2, 15.3, and 15.4 and IOS XE 3.10.xS through 3.13.xS before 3.13.1S allows remote attackers to spoof Autonomic Networking Registration Authority (ANRA) responses, and consequently bypass intended device and node access restrictions or cause a denial of service (disrupted domain access), via crafted AN messages, aka Bug ID CSCup62191.
Near-miss passage: CVE-2015-9068. CWE: CWE-20. CVSS: 9.800000190734863. In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechR. Logsource: windows / process_creation. Rule: title: Suspicious Speech Runtime Binary Child Process id: 78f10490-f2f4-4d19-a75b-4e0683bf3b8d status: experimental description: 'Detects suspicious Speech Runtime Binary Execution by monitoring its child processes. Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking. ' references: - https://github.com/rtecCyberSec/SpeechRuntimeMove author: andrewdanis date: 2025-10-23 logsource: category: process_creation product: windows tags: - attack.lateral-movement - attack.stealth - attack.t1021.003 - attack.t1218 detection: selection: ParentImage|endswith: \SpeechRuntime.exe condition: selection falsepositives: - Unlikely. level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / file_event. Rule: title: ScreenConnect Temporary Installation Artefact id: fec96f39-988b-4586-b746-b93d59fd1922 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows author: frack113 date: 2022-02-13 tags: - attack.command-and-control - attack.t1219.002 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: \Bin\ScreenConnect. condition: selection falsepositives: - Legitimate use level: medium