alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: load malicious registered COM objects. Logsource: windows / process_creation. Rule: title: Rundll32 Registered COM Objects id: f1edd233-30b5-4823-9e6a-c4171b24d316 status: test description: load malicious registered COM objects references: - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-02-13 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: - '-sta ' - '-localserver ' CommandLine|contains|all: - '{' - '}' condition: all of selection_* falsepositives: - Legitimate use level: high
Near-miss passage: Sigma rule: Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. Logsource: windows / image_load. Rule: title: Abusable DLL Potential Sideloading From Suspicious Location id: 799a5f48-0ac1-4e0f-9152-71d137d48c2a status: test description: Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations references: - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-07-11 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection_dll: ImageLoaded|endswith: - \coreclr.dll - \facesdk.dll - \HPCustPartUI.dll - \libcef.dll - \ZIPDLL.dll selection_folders_1: ImageLoaded|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet - \Windows\Temp\ selection_folders_2: - ImageLoaded|contains|all: - :\Users\ - \Favorites\ - ImageLoaded|contains|all: - :\Users\ - \Favourites\ - ImageLoaded|contains|all: - :\Users\ - \Contacts\ - ImageLoaded|contains|all: - :\Users\ - \Pictures\ condition: selection_dll and 1 of selection_folders_* falsepositives: - Unknown level: high
Query: vulnerability: I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Matching passage: CVE-2015-2984. CWE: CWE-264. CVSS: 5.0. I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and NP-BBRS routers allow remote attackers to cause a denial of service (SSDP reflection) via UPnP requests.
Near-miss passage: CVE-2015-4331. CWE: CWE-264. CVSS: 3.5. Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA authentication is used, allows remote authenticated users to bypass intended access restrictions via a username with a modified composition of lowercase and uppercase characters, aka Bug ID CSum59958.
Query: describe CVE-2015-6708
Matching passage: CVE-2015-6708. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANStartApproval method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-0429. CWE: UNKNOWN. CVSS: 3.299999952316284. Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect integrity and availability via vectors related to RPC Utility.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260. Logsource: windows / process_creation. Rule: title: Suspicious LNK Command-Line Padding with Whitespace Characters id: dd8756e7-a3a0-4768-b47e-8f545d1a751c status: experimental description: 'Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks. ' references: - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415 - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-03-19 tags: - attack.initial-access - attack.execution - attack.t1204.002 logsource: category: process_creation product: windows detection: selection_img: - ParentImage|endswith: \explorer.exe - ParentCommandLine|contains: .lnk selection_cmd: - CommandLine|contains: - ' ' - \u0009 - \u000A - \u0011 - \u0012 - \u0013 - \u000B - \u000C - \u000D - CommandLine|re: \n\n\n\n\n\n condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via VAR++ LAUNCHER. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION id: e9f55347-2928-4c06-88e5-1a7f8169942e status: test description: Detects Obfuscated Powershell via VAR++ LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-13 modified: 2022-11-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '&&set' - cmd - /c - -f CommandLine|contains: - '{0}' - '{1}' - '{2}' - '{3}' - '{4}' - '{5}' condition: selection falsepositives: - Unknown level: high
Query: alert when Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Wind
Matching passage: Sigma rule: Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Wind. Logsource: windows / ps_script. Rule: title: Potential Invoke-Mimikatz PowerShell Script id: 189e3b02-82b2-4b90-9662-411eb64486d4 status: test description: Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords. references: - https://www.elastic.co/guide/en/security/current/potential-invoke-mimikatz-powershell-script.html#potential-invoke-mimikatz-powershell-script author: Tim Rauch, Elastic (idea) date: 2022-09-28 tags: - attack.credential-access - attack.t1003 logsource: category: ps_script product: windows detection: selection_1: ScriptBlockText|contains|all: - DumpCreds - DumpCerts selection_2: ScriptBlockText|contains: sekurlsa::logonpasswords selection_3: ScriptBlockText|contains|all: - crypto::certificates - CERT_SYSTEM_STORE_LOCAL_MACHINE condition: 1 of selection* falsepositives: - Mimikatz can be useful for testing the security of networks level: high
Near-miss passage: Sigma rule: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as. Logsource: windows / file_event. Rule: title: VsCode Powershell Profile Modification id: 3a9fa2ec-30bc-4ebd-b49e-7c9cff225502 related: - id: b5b78988-486d-4a80-b991-930eff3ff8bf type: similar status: test description: Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2023-01-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \Microsoft.VSCode_profile.ps1 condition: selection falsepositives: - Legitimate use of the profile by developers or administrators level: medium
Query: rule covering Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. S
Matching passage: Sigma rule: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. S. Logsource: linux / process_creation. Rule: title: ESXi VSAN Information Discovery Via ESXCLI id: d54c2f06-aca9-4e2b-81c9-5317858f4b79 status: test description: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide. references: - https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html - https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /esxcli CommandLine|contains: vsan selection_cli: CommandLine|contains: - ' get' - ' list' condition: all of selection_* falsepositives: - Legitimate administration activities level: medium
Near-miss passage: Sigma rule: Detects process activity patterns as seen being used by Sliver C2 framework implants. Logsource: windows / process_creation. Rule: title: HackTool - Sliver C2 Implant Activity Pattern id: 42333b2c-b425-441c-b70e-99404a17170f status: test description: Detects process activity patterns as seen being used by Sliver C2 framework implants references: - https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/implant/sliver/shell/shell_windows.go#L36 - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/ author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-08-25 modified: 2023-03-05 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8 condition: selection falsepositives: - Unlikely level: critical
Query: Sigma rule for Detects when a all the rules have been deleted from the Windows Defender Firewall configuration
Matching passage: Sigma rule: Detects when a all the rules have been deleted from the Windows Defender Firewall configuration. Logsource: windows / firewall-as. Rule: title: All Rules Have Been Deleted From The Windows Firewall Configuration id: 79609c82-a488-426e-abcf-9f341a39365d status: test description: Detects when a all the rules have been deleted from the Windows Defender Firewall configuration references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-01-17 modified: 2024-01-22 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2033 - 2059 filter_main_svchost: ModifyingApplication|endswith: :\Windows\System32\svchost.exe filter_optional_msmpeng: ModifyingApplication|contains|all: - :\ProgramData\Microsoft\Windows Defender\Platform\ - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* level: high
Near-miss passage: Sigma rule: Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Logsource: aws / cloudtrail. Rule: title: AWS VPC Flow Logs Deleted id: e386b9b5-af12-450e-afff-761730fb8a98 status: experimental description: 'Detects the deletion of one or more VPC Flow Logs in AWS Elastic Compute Cloud (EC2) through the DeleteFlowLogs API call. Adversaries may delete flow logs to evade detection or remove evidence of network activity, hindering forensic investigations and visibility into malicious operations. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion author: Ivan Saakov date: 2025-10-19 tags: - attack.stealth logsource: product: aws service: cloudtrail detection: selection_event_name: eventName: DeleteFlowLogs selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_name and 1 of selection_status_* falsepositives: - During maintenance operations or testing, authorized administrators may delete VPC Flow Logs as part of routine network management or cleanup activities. level: high
Query: vulnerability: The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to caus
Matching passage: CVE-2015-4484. CWE: CWE-119. CVSS: 5.0. The js::jit::AssemblerX86Shared::lock_addl function in the JavaScript implementation in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 allows remote attackers to cause a denial of service (application crash) by leveraging the use of shared memory and accessing (1) an Atomics object or (2) a SharedArrayBuffer object.
Near-miss passage: CVE-2015-5810. CWE: CWE-119. CVSS: 6.800000190734863. WebKit, as used in Apple iOS before 9 and iTunes before 12.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-09-16-1 and APPLE-SA-2015-09-16-3.
Query: risk of FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font fil
Matching passage: CVE-2015-7010. CWE: CWE-119. CVSS: 6.800000190734863. FontParser in Apple iOS before 9.1 and OS X before 10.11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font file, a different vulnerability than CVE-2015-6976, CVE-2015-6977, CVE-2015-6978, CVE-2015-6990, CVE-2015-6991, CVE-2015-6993, CVE-2015-7008, CVE-2015-7009, and CVE-2015-7018.
Near-miss passage: CVE-2015-5094. CWE: CWE-119. CVSS: 10.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2015-3095, CVE-2015-5087, CVE-2015-5100, CVE-2015-5102, CVE-2015-5103, CVE-2015-5104, and CVE-2015-5115.
Query: vulnerability: The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof 
Matching passage: CVE-2015-6303. CWE: CWE-200. CVSS: 4.300000190734863. The Cisco Spark application 2015-07-04 for mobile operating systems does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate, aka Bug IDs CSCut36742 and CSCut36844.
Near-miss passage: CVE-2015-2935. CWE: CWE-200. CVSS: 5.0. MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT."
Query: CVE similar to CVE-2015-0416
Matching passage: CVE-2015-0416. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in the Oracle Agile PLM component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Roles & Privileges.
Near-miss passage: CVE-2015-6015. CWE: UNKNOWN. CVSS: 10.0. Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4808, CVE-2015-6013, CVE-2015-6014, and CVE-2016-0432. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is a stack-based buffer overflow in Oracle Outside In 8.5.2 and earlier, which allows remote attackers to execute arbitrary code via a crafted Paradox DB file.
Query: vulnerability: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, SD 410/12, SD 617, SD 650/52, SD 800, and SD 810, if Widevine App TZ_WV_CMD_DECRY
Matching passage: CVE-2015-9133. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, SD 410/12, SD 617, SD 650/52, SD 800, and SD 810, if Widevine App TZ_WV_CMD_DECRYPT_VIDEO is called with a size too large, an integer overflow may occur.
Near-miss passage: CVE-2015-9201. CWE: CWE-190. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, and SDX20, integer overflow in tzbsp can lead to privilege escalation.
Query: describe CVE-2015-0721
Matching passage: CVE-2015-0721. CWE: CWE-264. CVSS: 8.0. Cisco NX-OS 4.0 through 7.3 on Multilayer Director and Nexus 1000V, 2000, 3000, 3500, 4000, 5000, 5500, 5600, 6000, 7000, 7700, and 9000 devices allows remote authenticated users to bypass intended AAA restrictions and obtain privileged CLI access via crafted parameters in an SSH connection negotiation, aka Bug IDs CSCum35502, CSCuw78669, CSCuw79754, and CSCux88492.
Near-miss passage: CVE-2015-0611. CWE: CWE-264. CVSS: 6.5. The administrative web-management portal in Cisco IX 8 (.0.1) and earlier on Cisco TelePresence IX5000 devices does not properly restrict the device-recovery account's access, which allows remote authenticated users to obtain HelpDesk-equivalent privileges by leveraging device-recovery authentication, aka Bug ID CSCus74174.
Query: CVE similar to CVE-2015-7612
Matching passage: CVE-2015-7612. CWE: CWE-352. CVSS: 6.800000190734863. Multiple cross-site request forgery (CSRF) vulnerabilities in the Organizations page in Enterprise Manager in McAfee Vulnerability Manager (MVM) 7.5.9 and earlier allow remote attackers to hijack the authentication of administrators for requests that have unspecified impact via unknown vectors.
Near-miss passage: CVE-2015-6827. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in Auto-Exchanger 5.1.0 allows remote attackers to hijack the authentication of users for requests that change a password via a request to signup.php.
Query: detect Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool in logs
Matching passage: Sigma rule: Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool. Logsource: windows / process_creation. Rule: title: HackTool - Inveigh Execution id: b99a1518-1ad5-4f65-bc95-1ffff97a8fd0 status: test description: Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool references: - https://github.com/Kevin-Robertson/Inveigh - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 modified: 2023-02-04 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \Inveigh.exe - OriginalFileName: - \Inveigh.exe - \Inveigh.dll - Description: Inveigh - CommandLine|contains: - ' -SpooferIP' - ' -ReplyToIPs ' - ' -ReplyToDomains ' - ' -ReplyToMACs ' - ' -SnifferIP' condition: selection falsepositives: - Very unlikely level: critical
Near-miss passage: Sigma rule: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat. Logsource: windows / process_creation. Rule: title: Suspicious IIS URL GlobalRules Rewrite Via AppCmd id: 7c8af9b2-dcae-41a2-a9db-b28c288b5f08 status: test description: Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells. references: - https://twitter.com/malmoeb/status/1616702107242971144 - https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_cli: CommandLine|contains|all: - set - config - section:system.webServer/rewrite/globalRules - 'commit:' condition: all of selection_* falsepositives: - Legitimate usage of appcmd to add new URL rewrite rules level: medium