alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: write Sigma for Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent
Matching passage: Sigma rule: Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent. Logsource: proxy. Rule: title: Potential Hello-World Scraper Botnet Activity id: 1712bafe-be05-4a0e-89d4-17a3ed151bf5 status: experimental description: 'Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string. ' references: - https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan - https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30 author: Joseph A. M. date: 2025-08-02 tags: - attack.reconnaissance - attack.t1595 logsource: category: proxy detection: selection: c-useragent: Hello-World/1.0 cs-method: GET condition: selection falsepositives: - Legitimate network monitoring or vulnerability scanning tools that may use this generic user agent. - Internal development or testing scripts. Consider filtering by source IP if this is expected from certain systems. level: medium
Near-miss passage: Sigma rule: Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sou. Logsource: windows / process_creation. Rule: title: Add Insecure Download Source To Winget id: 81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2 related: - id: 05ebafc8-7aa2-4bcd-a269-2aec93f9e842 type: similar - id: c15a46a0-07d4-4c87-b4b6-89207835a83b type: similar status: test description: 'Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos) ' references: - https://learn.microsoft.com/en-us/windows/package-manager/winget/source - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \winget.exe - OriginalFileName: winget.exe selection_cli: CommandLine|contains|all: - 'source ' - 'add ' - http:// condition: all of selection_* falsepositives: - False positives might occur if the users are unaware of such control checks level: high
Query: alert when Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Servi
Matching passage: Sigma rule: Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Servi. Logsource: windows / application. Rule: title: LSASS Process Crashed - Application id: a18e0862-127b-43ca-be12-1a542c75c7c5 status: experimental description: 'Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service). This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials. ' references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-07 modified: 2025-12-03 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: application detection: selection: Provider_Name: Application Error EventID: 1000 AppName: lsass.exe ExceptionCode: c0000001 condition: selection falsepositives: - Rare legitimate crashing of the lsass process level: high
Near-miss passage: Sigma rule: Detects execution of "dsquery.exe" for domain trust discovery. Logsource: windows / process_creation. Rule: title: Domain Trust Discovery Via Dsquery id: 3bad990e-4848-4a78-9530-b427d854aac0 related: - id: b23fcb74-b1cb-4ff7-a31d-bfe2a7ba453b type: similar - id: 77815820-246c-47b8-9741-e0def3f57308 type: obsolete status: test description: Detects execution of "dsquery.exe" for domain trust discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md - https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843 author: E.M. Anhaus, Tony Lambert, oscd.community, omkar72 date: 2019-10-24 modified: 2023-02-02 tags: - attack.discovery - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsquery.exe - OriginalFileName: dsquery.exe selection_cli: CommandLine|contains: trustedDomain condition: all of selection_* falsepositives: - Legitimate use of the utilities by legitimate user for legitimate reason level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery/info.yml simulation: - type: atomic-red-team name: Windows - Discover domain trusts with dsquery technique: T1482 atomic_guid: 4700a710-c821-4e17-a3ec-9e4c81d6845f
Query: risk of Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of servic
Matching passage: CVE-2015-9242. CWE: CWE-400. CVSS: 7.5. Certain input strings when passed to new Date() or Date.parse() in ecstatic node module before 1.4.0 will cause v8 to raise an exception. This leads to a crash and denial of service in ecstatic when this input is passed into the server via the If-Modified-Since header.
Near-miss passage: CVE-2015-7978. CWE: CWE-400. CVSS: 7.5. NTP before 4.2.8p6 and 4.3.0 before 4.3.90 allows a remote attackers to cause a denial of service (stack exhaustion) via an ntpdc relist command, which triggers recursive traversal of the restriction list.
Query: detect Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned D in logs
Matching passage: Sigma rule: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned D. Logsource: windows / security-mitigations. Rule: title: Microsoft Defender Blocked from Loading Unsigned DLL id: 0b0ea3cc-99c8-4730-9c53-45deee2a4c86 status: test description: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool author: Bhabesh Raj date: 2022-08-02 modified: 2022-09-28 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows service: security-mitigations detection: selection: EventID: - 11 - 12 ProcessPath|endswith: - \MpCmdRun.exe - \NisSrv.exe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: load malicious registered COM objects. Logsource: windows / process_creation. Rule: title: Rundll32 Registered COM Objects id: f1edd233-30b5-4823-9e6a-c4171b24d316 status: test description: load malicious registered COM objects references: - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-02-13 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: - '-sta ' - '-localserver ' CommandLine|contains|all: - '{' - '}' condition: all of selection_* falsepositives: - Legitimate use level: high
Query: Encoded PowerShell / command-line abuse matching NTFS File Attributes
Matching passage: T1564.004 NTFS File Attributes. Tactics: stealth. Description: Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition. (Citation: SpectorOps Host-Based Jul 2017) Within MFT entries are file attributes, (Citation: Microsoft NTFS File Attributes Aug 2010) such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files). (Citation: SpectorOps Host-Based Jul 2017) (Citation: Microsoft File Streams) (Citation: MalwareBytes ADS July 2015) (Citation: Microsoft ADS Mar 2014) Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files. This may be done to evade some defenses, such as static indicator scanning tools and anti-virus. (Citation: Journey into IR ZeroAccess NTFS EA) (Citation: MalwareBytes ADS July 2015)
Near-miss passage: T1564.001 Hidden Files and Directories. Tactics: stealth. Description: Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (<code>dir /a</code> for Windows and <code>ls –a</code> for Linux and macOS). On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys. Additionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a “space” character. Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.
Query: Sigma YAML for cisco / aaa
Matching passage: Sigma rule: Modifications to a config that will serve an adversary's impacts or persistence. Logsource: cisco / aaa. Rule: title: Cisco Modify Configuration id: 671ffc77-50a7-464f-9e3d-9ea2b493b26b status: test description: Modifications to a config that will serve an adversary's impacts or persistence author: Austin Clark date: 2019-08-12 modified: 2025-04-28 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.impact - attack.t1490 - attack.t1505 - attack.t1565.002 - attack.t1053 logsource: product: cisco service: aaa detection: keywords: - ip http server - ip https server - kron policy-list - kron occurrence - policy-list - access-list - ip access-group - archive maximum - ntp server condition: keywords falsepositives: - Legitimate administrators may run these commands level: medium
Near-miss passage: Sigma rule: Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercin. Logsource: windows / process_creation. Rule: title: HackTool - ADCSPwn Execution id: cd8c163e-a19b-402e-bdd5-419ff5859f12 status: test description: Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service references: - https://github.com/bats3c/ADCSPwn author: Florian Roth (Nextron Systems) date: 2021-07-31 modified: 2023-02-04 tags: - attack.collection - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' --adcs ' - ' --port ' condition: selection falsepositives: - Unlikely level: high
Query: patch priority for CVE-2015-5169
Matching passage: CVE-2015-5169. CWE: CWE-79. CVSS: 6.099999904632568. Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
Near-miss passage: CVE-2015-0551. CWE: CWE-79. CVSS: 3.5. Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop 6.7SP1 before P31, 6.7SP2 before P23, and 6.8 before P01; Documentum Administrator 6.7SP1 before P31, 6.7SP2 before P23, 7.0 before P18, 7.1 before P15, and 7.2 before P01; Documentum Digital Assets Manager 6.5SP6 before P25; Documentum Web Publishers 6.5 SP7 before P25; and Documentum Task Space 6.7SP1 before P31 and 6.7SP2 before P23 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Query: risk of The File Bookmark component in Apple OS X before 10.11.1 allows local users to cause a denial of service (application crash) via crafted bookmark metadata in a folder.
Matching passage: CVE-2015-6987. CWE: CWE-20. CVSS: 2.0999999046325684. The File Bookmark component in Apple OS X before 10.11.1 allows local users to cause a denial of service (application crash) via crafted bookmark metadata in a folder.
Near-miss passage: CVE-2015-2924. CWE: CWE-20. CVSS: 3.299999952316284. The receive_ra function in rdisc/nm-lndp-rdisc.c in the Neighbor Discovery (ND) protocol implementation in the IPv6 stack in NetworkManager 1.x allows remote attackers to reconfigure a hop-limit setting via a small hop_limit value in a Router Advertisement (RA) message, a similar issue to CVE-2015-2922.
Query: CVE similar to CVE-2015-9431
Matching passage: CVE-2015-9431. CWE: CWE-352. CVSS: 6.5. The qtranslate-x plugin before 3.4.4 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=qtranslate-x json_config_files or json_custom_i18n_config parameter.
Near-miss passage: CVE-2015-4397. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors.
Query: patch priority for CVE-2015-1568
Matching passage: CVE-2015-1568. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the "edit gd infinite scroll settings" permission for requests that delete settings via unspecified vectors.
Near-miss passage: CVE-2015-4355. CWE: CWE-352. CVSS: 6.800000190734863. Cross-site request forgery (CSRF) vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors.