alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: Suspicious AgentExecutor PowerShell Execution id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab related: - id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_pwsh: CommandLine|contains: - C:\Windows\System32\WindowsPowerShell\v1.0\ - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects the modification of the registry to disable a system restore on the computer. Logsource: windows / registry_set. Rule: title: Registry Disable System Restore id: 5de03871-5d46-4539-a82d-3aa992a69a83 related: - id: 7c06ab9b-b1d2-4ba9-b06e-09491ded20d9 type: similar status: test description: Detects the modification of the registry to disable a system restore on the computer references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry author: frack113 date: 2022-04-04 modified: 2023-08-17 tags: - attack.impact - attack.t1490 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Policies\Microsoft\Windows NT\SystemRestore - \Microsoft\Windows NT\CurrentVersion\SystemRestore TargetObject|endswith: - DisableConfig - DisableSR Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_system_restore/info.yml simulation: - type: atomic-red-team name: Disable System Restore Through Registry technique: T1490 atomic_guid: 66e647d1-8741-4e43-b7c1-334760c2047f
Sigma rule: Detects the creation of files that look like exports of the local SAM (Security Account Manager). Logsource: windows / file_event. Rule: title: Potential SAM Database Dump id: 4e87b8e2-2ee9-4b2a-a715-4727d297ece0 status: test description: Detects the creation of files that look like exports of the local SAM (Security Account Manager) references: - https://github.com/search?q=CVE-2021-36934 - https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934 - https://www.google.com/search?q=%22reg.exe+save%22+sam - https://github.com/HuskyHacks/ShadowSteal - https://github.com/FireFart/hivenightmare author: Florian Roth (Nextron Systems) date: 2022-02-11 modified: 2023-01-05 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows category: file_event detection: selection: - TargetFilename|endswith: - \Temp\sam - \sam.sav - \Intel\sam - \sam.hive - \Perflogs\sam - \ProgramData\sam - \Users\Public\sam - \AppData\Local\sam - \AppData\Roaming\sam - _ShadowSteal.zip - \Documents\SAM.export - :\sam - TargetFilename|contains: - \hive_sam_ - \sam.save - \sam.export - \~reg_sam.save - \sam_backup - \sam.bck - \sam.backup condition: selection falsepositives: - Rare cases of administrative activity level: high
Sigma rule: Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - in. Logsource: linux / process_creation. Rule: title: Suspicious Download and Execute Pattern via Curl/Wget id: a2d9e2f3-0f43-4c7a-bcd9-9acfc0d723aa status: experimental description: 'Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks. ' references: - https://gtfobins.github.io/gtfobins/wget/ - https://gtfobins.github.io/gtfobins/curl/ author: Aayush Gupta date: 2025-06-17 tags: - attack.execution - attack.t1059.004 - attack.t1203 logsource: category: process_creation product: linux detection: selection_downloader: CommandLine|contains: - /curl - /wget selection_tmp: CommandLine|contains: - /tmp/ - /dev/shm/ selection_executor: CommandLine|contains: sh -c condition: all of selection_* falsepositives: - System update scripts using temporary files - Installer scripts or automated provisioning tools level: high
Sigma rule: Detects tamper attempts to sophos av functionality via registry key modification. Logsource: windows / registry_set. Rule: title: Tamper With Sophos AV Registry Keys id: 9f4662ac-17ca-43aa-8f12-5d7b989d0101 status: test description: Detects tamper attempts to sophos av functionality via registry key modification references: - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-02 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Sophos Endpoint Defense\TamperProtection\Config\SAVEnabled - \Sophos Endpoint Defense\TamperProtection\Config\SEDEnabled - \Sophos\SAVService\TamperProtection\Enabled Details: DWORD (0x00000000) condition: selection falsepositives: - Some FP may occur when the feature is disabled by the AV itself, you should always investigate if the action was legitimate level: high
Sigma rule: Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely.. Logsource: jvm / application. Rule: title: Potential XXE Exploitation Attempt In JVM Based Application id: c4e06896-e27c-4583-95ac-91ce2279345d status: test description: Detects XML parsing issues, if the application expects to work with XML make sure that the parser is initialized safely. references: - https://rules.sonarsource.com/java/RSPEC-2755 - https://owasp.org/www-community/vulnerabilities/XML_External_Entity_(XXE)_Processing - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - SAXParseException - DOMException condition: keywords falsepositives: - If the application expects to work with XML there may be parsing issues that don't necessarily mean XXE. level: high
Sigma rule: Hides the file extension through modification of the registry. Logsource: windows / registry_set. Rule: title: IE Change Domain Zone id: 45e112d0-7759-4c2a-aa36-9f8fb79d3393 related: - id: d88d0ab2-e696-4d40-a2ed-9790064e66b3 type: derived status: test description: Hides the file extension through modification of the registry references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries author: frack113 date: 2022-01-22 modified: 2023-08-17 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection_domains: TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ filter: Details: - DWORD (0x00000000) - DWORD (0x00000001) - (Empty) condition: selection_domains and not filter falsepositives: - Administrative scripts level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_security_zones/info.yml simulation: - type: atomic-red-team name: Add Domain to Trusted Sites Zone technique: T1112 atomic_guid: cf447677-5a4e-4937-a82c-e47d254afd57
Sigma rule: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Invoking Inline VBScript id: 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd status: test description: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - Execute - RegRead - window.close condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default loc. Logsource: windows / process_creation. Rule: title: Wab Execution From Non Default Location id: 395907ee-96e5-4666-af2e-2ca91688e151 status: test description: Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity references: - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime - https://thedfirreport.com/2022/09/26/bumblebee-round-two/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2022-09-27 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: - \wab.exe - \wabmig.exe filter: Image|startswith: - C:\Windows\WinSxS\ - C:\Program Files\Windows Mail\ - C:\Program Files (x86)\Windows Mail\ condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual. Logsource: azure / activitylogs. Rule: title: Azure Virtual Network Device Modified or Deleted id: 15ef3fac-f0f0-4dc4-ada0-660aa72980b3 status: test description: 'Identifies when a virtual network device is being modified or deleted. This can be a network interface, network virtual appliance, virtual hub, or virtual router. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/WRITE - MICROSOFT.NETWORK/NETWORKINTERFACES/TAPCONFIGURATIONS/DELETE - MICROSOFT.NETWORK/NETWORKINTERFACES/WRITE - MICROSOFT.NETWORK/NETWORKINTERFACES/JOIN/ACTION - MICROSOFT.NETWORK/NETWORKINTERFACES/DELETE - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/DELETE - MICROSOFT.NETWORK/NETWORKVIRTUALAPPLIANCES/WRITE - MICROSOFT.NETWORK/VIRTUALHUBS/DELETE - MICROSOFT.NETWORK/VIRTUALHUBS/WRITE - MICROSOFT.NETWORK/VIRTUALROUTERS/WRITE - MICROSOFT.NETWORK/VIRTUALROUTERS/DELETE condition: selection falsepositives: - Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of. Logsource: windows / image_load. Rule: title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d status: experimental description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File. references: - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/ - https://x.com/Threatlabz/status/1879956781360976155 author: X__Junior date: 2025-01-20 tags: - attack.execution - attack.t1059 logsource: category: image_load product: windows detection: selection_dll: ImageLoaded|endswith: \clfs.sys selection_folders_1: Image|contains: - :\Perflogs\ - :\Users\Public\ - \Temporary Internet - \Windows\Temp\ selection_folders_2: - Image|contains|all: - :\Users\ - \Favorites\ - Image|contains|all: - :\Users\ - \Favourites\ - Image|contains|all: - :\Users\ - \Contacts\ - Image|contains|all: - :\Users\ - \Pictures\ condition: selection_dll and 1 of selection_folders_* falsepositives: - Unknown level: medium
Sigma rule: See what files are being deleted from flash file systems. Logsource: cisco / aaa. Rule: title: Cisco File Deletion id: 71d65515-c436-43c0-841b-236b1f32c21e status: test description: See what files are being deleted from flash file systems author: Austin Clark date: 2019-08-12 modified: 2023-01-04 tags: - attack.impact - attack.stealth - attack.t1070.004 - attack.t1561.001 - attack.t1561.002 logsource: product: cisco service: aaa detection: keywords: - erase - delete - format condition: keywords falsepositives: - Will be used sometimes by admins to clean up local flash space level: medium
Sigma rule: Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an att. Logsource: aws / cloudtrail. Rule: title: AWS Identity Center Identity Provider Change id: d3adb3ef-b7e7-4003-9092-1924c797db35 status: test description: 'Detects a change in the AWS Identity Center (FKA AWS SSO) identity provider. A change in identity provider allows an attacker to establish persistent access or escalate privileges via user impersonation. ' references: - https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html - https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html - https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html author: Michael McIntyre @wtfender date: 2023-09-27 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556 logsource: product: aws service: cloudtrail detection: selection: eventSource: - sso-directory.amazonaws.com - sso.amazonaws.com eventName: - AssociateDirectory - DisableExternalIdPConfigurationForDirectory - DisassociateDirectory - EnableExternalIdPConfigurationForDirectory condition: selection falsepositives: - Authorized changes to the AWS account's identity provider level: high
Sigma rule: Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.e. Logsource: windows / process_creation. Rule: title: Rundll32 UNC Path Execution id: 5cdb711b-5740-4fb2-ba88-f7945027afac status: test description: 'Detects rundll32 execution where the DLL is located on a remote location (share). Threat actors can abuse the rundll32.exe binary to execute remote DLLs from a UNC pathh. ' references: - https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code - https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-10 modified: 2026-07-20 tags: - attack.execution - attack.lateral-movement - attack.stealth - attack.t1021.002 - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli: CommandLine|contains: - ' \\\\' - ' ''\\\\' - ' "\\\\' filter_main_cli_pipe: CommandLine|contains: \\\\.\\pipe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_rundll32_unc_path/info.yml
Sigma rule: Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various. Logsource: windows / image_load. Rule: title: Potential JLI.dll Side-Loading id: 7a3b6d1f-4a2b-4f8c-9d7e-e9f8cbf21a35 status: experimental description: 'Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. ' references: - https://securelist.com/apt41-in-africa/116986/ - https://lab52.io/blog/snake-keylogger-in-geopolitical-affairs-abuse-of-trusted-java-utilities-in-cybercrime-operations/ - https://hijacklibs.net/entries/3rd_party/oracle/jli.html - https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \jli.dll filter_main_legitimate_install_paths: ImageLoaded|startswith: - C:\Program Files\ - C:\Program Files (x86)\ Description: OpenJDK Platform binary OriginalFileName: jli.dll Product|startswith: OpenJDK Platform Signed: 'true' filter_optional_eclipse: ImageLoaded|startswith: C:\eclipse\plugins\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Sigma rule: Detects suspicious modification of crontab file.. Logsource: linux / cron. Rule: title: Modifying Crontab id: af202fd3-7bff-4212-a25a-fb34606cfcbe status: test description: Detects suspicious modification of crontab file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md author: Pawel Mazur date: 2022-04-16 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.003 logsource: product: linux service: cron detection: keywords: - REPLACE condition: keywords falsepositives: - Legitimate modification of crontab level: medium
Sigma rule: Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain t. Logsource: windows / process_creation. Rule: title: Renamed AdFind Execution id: df55196f-f105-44d3-a675-e9dfb6cc2f2b status: test description: Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain. references: - https://www.joeware.net/freetools/tools/adfind/ - https://thedfirreport.com/2020/05/08/adfind-recon/ - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md author: Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2025-02-26 tags: - attack.discovery - attack.t1018 - attack.t1087.002 - attack.t1482 - attack.t1069.002 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - domainlist - trustdmp - dcmodes - adinfo - ' dclist ' - computer_pwdnotreqd - objectcategory= - -subnets -f - name="Domain Admins" - '-sc u:' - domainncs - dompol - ' oudmp ' - subnetdmp - gpodmp - fspdmp - users_noexpire - computers_active - computers_pwdnotreqd selection_2: Hashes|contains: - IMPHASH=BCA5675746D13A1F246E2DA3C2217492 - IMPHASH=53E117A96057EAF19C41380D0E87F1C2 - IMPHASH=d144de8117df2beceaba2201ad304764 - IMPHASH=12ce1c0f3f5837ecc18a3782408fa975 - IMPHASH=4fbf3f084fbbb2470b80b2013134df35 - IMPHASH=49b639b4acbecc49d72a01f357aa4930 - IMPHASH=680dad9e300346e05a85023965867201 - IMPHASH=21aa085d54992511b9f115355e468782 selection_3: OriginalFileName: AdFind.exe filter: Image|endswith: \AdFind.exe condition: 1 of selection* and not filter falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_adfind/info.yml
Sigma rule: Detects a Windows command line executable started from MMC. Logsource: windows / process_creation. Rule: title: MMC Spawning Windows Shell id: 05a2ab7e-ce11-4b63-86db-ab32e763e11d status: test description: Detects a Windows command line executable started from MMC references: - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/ author: Karneades, Swisscom CSIRT date: 2019-08-05 modified: 2022-07-14 tags: - attack.lateral-movement - attack.t1021.003 logsource: category: process_creation product: windows detection: selection1: ParentImage|endswith: \mmc.exe selection2: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \sh.exe - \bash.exe - \reg.exe - \regsvr32.exe - Image|contains: \BITSADMIN condition: all of selection* level: high
Sigma rule: Detects commandline operations on shell history files. Logsource: macos / process_creation. Rule: title: Suspicious History File Operations id: 508a9374-ad52-4789-b568-fc358def2c65 status: test description: Detects commandline operations on shell history files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Mikhail Larin, oscd.community date: 2020-10-17 modified: 2021-11-27 tags: - attack.credential-access - attack.t1552.003 logsource: product: macos category: process_creation detection: selection: CommandLine|contains: - .bash_history - .zsh_history - .zhistory - .history - .sh_history - fish_history condition: selection falsepositives: - Legitimate administrative activity - Legitimate software, cleaning hist file level: medium
Sigma rule: Detects suspicious renamed SysInternals DebugView execution. Logsource: windows / process_creation. Rule: title: Renamed SysInternals DebugView Execution id: cd764533-2e07-40d6-a718-cfeec7f2da7f status: test description: Detects suspicious renamed SysInternals DebugView execution references: - https://www.epicturla.com/blog/sysinturla author: Florian Roth (Nextron Systems) date: 2020-05-28 modified: 2023-02-14 tags: - attack.resource-development - attack.t1588.002 logsource: category: process_creation product: windows detection: selection: Product: Sysinternals DebugView filter: OriginalFileName: Dbgview.exe Image|endswith: \Dbgview.exe condition: selection and not filter falsepositives: - Unknown level: high