alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_module. Rule: title: Suspicious PowerShell Invocations - Specific - PowerShell Module id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090 related: - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c type: obsolete - id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71 type: similar - id: 536e2947-3729-478c-9903-745aaffe60d2 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro date: 2017-03-05 modified: 2025-02-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_convert_b64: ContextInfo|contains|all: - -nop - ' -w ' - hidden - ' -c ' - '[Convert]::FromBase64String' selection_iex: ContextInfo|contains|all: - ' -w ' - hidden - -noni - -nop - ' -c ' - iex - New-Object selection_enc: ContextInfo|contains|all: - ' -w ' - hidden - -ep - bypass - -Enc selection_reg: ContextInfo|contains|all: - powershell - reg - add ContextInfo|contains: - \software\microsoft\windows\currentversion\run - \software\wow6432node\microsoft\windows\currentversion\run - \software\microsoft\windows\currentversion\policies\explorer\run selection_webclient: ContextInfo|contains|all: - bypass - -noprofile - -windowstyle - hidden - new-object - system.net.webclient - .download selection_iex_webclient: ContextInfo|contains|all: - iex - New-Object - Net.WebClient - .Download filter_chocolatey: ContextInfo|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1 - Write-ChocolateyWarning condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unknown level: high
Sigma rule: Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension.. Logsource: windows / process_creation. Rule: title: File Download From Browser Process Via Inline URL id: 94771a71-ba41-4b6e-a757-b531372eaab6 status: test description: Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state. references: - https://twitter.com/mrd0x/status/1478116126005641220 - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2025-10-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe selection_http: CommandLine|contains: http selection_extensions: - CommandLine|endswith: - .7z - .dat - .dll - .exe - .hta - .ps1 - .psm1 - .txt - .vbe - .vbs - .zip - CommandLine|contains: - .7z" - .dat" - .dll" - .hta" - .ps1" - .psm1" - .txt" - .vbe" - .vbs" - .zip" condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_inline_file_download/info.yml
Sigma rule: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legi. Logsource: windows / ps_script. Rule: title: Remove Account From Domain Admin Group id: 48a45d45-8112-416b-8a67-46e03a4b2107 status: test description: 'Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1531/T1531.md#atomic-test-3---remove-account-from-domain-admin-group author: frack113 date: 2021-12-26 tags: - attack.impact - attack.t1531 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Remove-ADGroupMember - '-Identity ' - '-Members ' condition: selection falsepositives: - Unknown level: medium
Sigma rule: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential. Logsource: windows / ps_script. Rule: title: Create Volume Shadow Copy with Powershell id: afd12fed-b0ec-45c9-a13d-aa86625dac81 status: test description: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7 author: frack113 date: 2022-01-12 tags: - attack.credential-access - attack.t1003.003 - attack.ds0005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Win32_ShadowCopy - ).Create( - ClientAccessible condition: selection falsepositives: - Legitimate PowerShell scripts level: high
Sigma rule: Detects the use of tools that copy files from or to remote systems. Logsource: linux. Rule: title: Remote File Copy id: 7a14080d-a048-4de8-ae58-604ce58a795b status: stable description: Detects the use of tools that copy files from or to remote systems references: - https://www.cisa.gov/stopransomware/ransomware-guide author: Ömer Günal date: 2020-06-18 tags: - attack.command-and-control - attack.lateral-movement - attack.t1105 logsource: product: linux detection: tools: - 'scp ' - 'rsync ' - 'sftp ' filter: - '@' - ':' condition: tools and filter falsepositives: - Legitimate administration activities level: low
Sigma rule: Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.. Logsource: windows / process_creation. Rule: title: Potential Arbitrary DLL Load Using Winword id: f7375e28-5c14-432f-b8d1-1db26c832df3 related: - id: 2621b3a6-3840-4810-ac14-a02426086171 type: obsolete status: test description: Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag. references: - https://github.com/D4Vinci/One-Lin3r/blob/9fdfa5f0b9c698dfbd4cdfe7d2473192777ae1c6/one_lin3r/core/liners/windows/cmd/dll_loader_word.py author: Victor Sergeev, oscd.community date: 2020-10-09 modified: 2023-03-29 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WINWORD.exe - OriginalFileName: WinWord.exe selection_dll: CommandLine|contains|all: - '/l ' - .dll condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child p. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution From Parent Process In Public Folder id: 69bd9b97-2be2-41b6-9816-fb08757a4d1a status: test description: 'Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines. ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-25 modified: 2024-07-12 tags: - attack.execution - attack.stealth - attack.t1564 - attack.t1059 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: :\Users\Public\ selection_child: - Image|endswith: - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - CommandLine|contains: - bitsadmin - certutil - cscript - mshta - powershell - regsvr32 - rundll32 - wscript condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.. Logsource: windows / ps_script. Rule: title: NTFS Alternate Data Stream id: 8c521530-5169-495d-a199-0a3a881ad24e status: test description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging. references: - https://web.archive.org/web/20220614030603/http://www.powertheshell.com/ntfsstreams/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md author: Sami Ruohonen date: 2018-07-24 modified: 2022-12-25 tags: - attack.stealth - attack.t1564.004 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_content: ScriptBlockText|contains: - set-content - add-content selection_stream: ScriptBlockText|contains: -stream condition: all of selection* falsepositives: - Unknown level: high
Sigma rule: Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting th. Logsource: windows / registry_set. Rule: title: NET NGenAssemblyUsageLog Registry Key Tamper id: 28036918-04d3-423d-91c0-55ecf99fb892 status: test description: 'Detects changes to the NGenAssemblyUsageLog registry key. .NET Usage Log output location can be controlled by setting the NGenAssemblyUsageLog CLR configuration knob in the Registry or by configuring an environment variable (as described in the next section). By simplify specifying an arbitrary value (e.g. fake output location or junk data) for the expected value, a Usage Log file for the .NET execution context will not be created. ' references: - https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/ author: frack113 date: 2022-11-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: SOFTWARE\Microsoft\.NETFramework\NGenAssemblyUsageLog condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an c. Logsource: windows / security. Rule: title: Suspicious Windows ANONYMOUS LOGON Local Account Created id: 1bbf25b9-8038-4154-a50b-118f2a32be27 status: test description: Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts. references: - https://twitter.com/SBousseaden/status/1189469425482829824 author: James Pemberton / @4A616D6573 date: 2019-10-31 modified: 2022-10-09 tags: - attack.persistence - attack.t1136.001 - attack.t1136.002 logsource: product: windows service: security detection: selection: EventID: 4720 SamAccountName|contains|all: - ANONYMOUS - LOGON condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of mali. Logsource: windows / terminalservices-localsessionmanager. Rule: title: Ngrok Usage with Remote Desktop Service id: 64d51a51-32a6-49f0-9f3d-17e34d640272 status: test description: Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour references: - https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg - https://ngrok.com/ author: Florian Roth (Nextron Systems) date: 2022-04-29 tags: - attack.command-and-control - attack.t1090 logsource: product: windows service: terminalservices-localsessionmanager detection: selection: EventID: 21 Address|contains: '16777216' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or. Logsource: windows / process_creation. Rule: title: Suspicious Windows Service Tampering id: ce72ef99-22f1-43d4-8695-419dcb5d9330 related: - id: eb87818d-db5d-49cc-a987-d5da331fbd90 type: obsolete - id: 6783aa9e-0dc3-49d4-a94a-8b39c5fd700b type: obsolete - id: 7fd4bb39-12d0-45ab-bb36-cebabc73dc7b type: obsolete status: test description: 'Detects the usage of binaries such as ''net'', ''sc'' or ''powershell'' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts ' references: - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ - https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955 - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems) date: 2022-09-01 modified: 2025-08-27 tags: - attack.impact - attack.defense-impairment - attack.t1489 - attack.t1685 logsource: category: process_creation product: windows detection: selection_tools_img: - OriginalFileName: - net.exe - net1.exe - PowerShell_ISE.EXE - PowerShell.EXE - psservice.exe - pwsh.dll - sc.exe - wmic.exe - Image|endswith: - \net.exe - \net1.exe - \PowerShell_ISE.EXE - \powershell.exe - \PsService.exe - \PsService64.exe - \pwsh.exe - \sc.exe - \wmic.exe selection_tools_cli: - CommandLine|contains: - ' delete ' - .delete() - ' pause ' - ' stop ' - 'Stop-Service ' - 'Remove-Service ' - CommandLine|contains|all: - config - start=disabled selection_services: CommandLine|contains: - 143Svc - Acronis VSS Provider - AcronisAgent - AcrSch2Svc - AdobeARMservice - AHS Service - Antivirus - Apache4 - ARSM - aswBcc - AteraAgent - Avast Business Console Client Antivirus Service - avast! Antivirus - AVG Antivirus - avgAdminClient - AvgAdminServer - AVP1 - BackupExec - bedbg - BITS - BrokerInfrastructure - CASLicenceServer - CASWebServer - Client Agent 7.60 - Core Browsing Protection - Core Mail Protection -
Sigma rule: Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe. Logsource: windows / process_creation. Rule: title: Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE id: b6e04788-29e1-4557-bb14-77f761848ab8 related: - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/ - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-23 modified: 2026-03-29 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_websites: CommandLine|contains: - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at selection_download: CommandLine|contains: - .DownloadString( - .DownloadFile( - 'Invoke-WebRequest ' - 'iwr ' - 'wget ' condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to contr. Logsource: linux / process_creation. Rule: title: Install Root Certificate id: 78a80655-a51e-4669-bc6b-e9d206a462ee status: test description: Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md author: Ömer Günal, oscd.community date: 2020-10-05 modified: 2022-07-07 tags: - attack.defense-impairment - attack.t1553.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: - /update-ca-certificates - /update-ca-trust condition: selection falsepositives: - Legitimate administration activities level: low
Sigma rule: Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update fea. Logsource: windows / process_creation. Rule: title: Dism Remove Online Package id: 43e32da2-fdd0-4156-90de-50dfd62636f9 status: test description: Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-26---disable-windows-defender-with-dism - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html author: frack113 date: 2022-01-16 modified: 2022-08-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_dismhost: Image|endswith: \DismHost.exe ParentCommandLine|contains|all: - /Online - /Disable-Feature selection_dism: Image|endswith: \Dism.exe CommandLine|contains|all: - /Online - /Disable-Feature condition: 1 of selection_* falsepositives: - Legitimate script level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dism_remove/info.yml simulation: - type: atomic-red-team name: Disable Windows Defender with DISM technique: T1562.001 atomic_guid: 871438ac-7d6e-432a-b27d-3e7db69faf58
Sigma rule: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields. Logsource: windows / process_creation. Rule: title: Renamed AutoHotkey.EXE Execution id: 0f16d9cf-0616-45c8-8fad-becc11b5a41c status: test description: Detects execution of a renamed autohotkey.exe binary based on PE metadata fields references: - https://www.autohotkey.com/download/ - https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/ author: Nasreddine Bencherchali date: 2023-02-07 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Product|contains: AutoHotkey - Description|contains: AutoHotkey - OriginalFileName: - AutoHotkey.exe - AutoHotkey.rc filter: - Image|endswith: - \AutoHotkey.exe - \AutoHotkey32.exe - \AutoHotkey32_UIA.exe - \AutoHotkey64.exe - \AutoHotkey64_UIA.exe - \AutoHotkeyA32.exe - \AutoHotkeyA32_UIA.exe - \AutoHotkeyU32.exe - \AutoHotkeyU32_UIA.exe - \AutoHotkeyU64.exe - \AutoHotkeyU64_UIA.exe - Image|contains: \AutoHotkey condition: selection and not filter falsepositives: - Unknown level: medium
Sigma rule: Detects the use of SharpUp, a tool for local privilege escalation. Logsource: windows / process_creation. Rule: title: HackTool - SharpUp PrivEsc Tool Execution id: c484e533-ee16-4a93-b6ac-f0ea4868b2f1 status: test description: Detects the use of SharpUp, a tool for local privilege escalation references: - https://github.com/GhostPack/SharpUp author: Florian Roth (Nextron Systems) date: 2022-08-20 modified: 2023-02-13 tags: - attack.persistence - attack.privilege-escalation - attack.discovery - attack.execution - attack.stealth - attack.t1615 - attack.t1569.002 - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SharpUp.exe - Description: SharpUp - CommandLine|contains: - HijackablePaths - UnquotedServicePath - ProcessDLLHijack - ModifiableServiceBinaries - ModifiableScheduledTask - DomainGPPPassword - CachedGPPPassword condition: selection falsepositives: - Unknown level: critical
Sigma rule: An application has been removed. Check if it is critical.. Logsource: windows / application. Rule: title: Application Uninstalled id: 570ae5ec-33dc-427c-b815-db86228ad43e status: test description: An application has been removed. Check if it is critical. references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging author: frack113 date: 2022-01-28 modified: 2022-09-17 tags: - attack.impact - attack.t1489 logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1034 - 11724 condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report. Logsource: windows / system. Rule: title: Moriya Rootkit - System id: 25b9c01c-350d-4b95-bed1-836d04a4f324 status: test description: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report references: - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831 author: Bhabesh Raj date: 2021-05-06 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName: ZzNetSvc condition: selection falsepositives: - Unknown level: critical