alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon loc. Logsource: windows / appxdeployment-server. Rule: title: AppX Located in Uncommon Directory Added to Deployment Pipeline id: c977cb50-3dff-4a9f-b873-9290f56132f1 status: test description: 'Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations. ' references: - Internal Research - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2025-12-03 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection: EventID: 854 filter_main_generic: Path|contains: - :/Program%20Files - :/Windows/System32/ - :\Program Files (x86)\ - :\Program Files\ - :\Windows\ImmersiveControlPanel\ - :\Windows\PrintDialog\ - :\Windows\SystemApps\ - AppData/Local/Temp/WinGet/Microsoft.Winget.Source - x-windowsupdate:// filter_main_specific: Path|contains: - https://installer.teams.static.microsoft/ - https://res.cdn.office.net - https://statics.teams.cdn.live.net/ - https://statics.teams.cdn.office.net/ - microsoft.com filter_optional_onedrive: Path|contains: AppData\Local\Microsoft\OneDrive\ filter_optional_winget: Path|contains: - AppData/Local/Temp/WinGet/Microsoft.Winget.Source - AppData\Local\Temp\WinGet\Microsoft.Winget.Source filter_optional_x_windowsupdate: Path|contains: x-windowsupdate:// condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing referen. Logsource: windows / system. Rule: title: Uncommon Service Installation Image Path id: 26481afe-db26-4228-b264-25a29fe6efc7 related: - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53 type: obsolete - id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b type: derived status: test description: 'Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc. ' references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-18 modified: 2024-02-09 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 suspicious_paths: ImagePath|contains: - \\\\.\\pipe - \Users\Public\ - \Windows\Temp\ suspicious_encoded_flag: ImagePath|contains: ' -e' suspicious_encoded_keywords: ImagePath|contains: - ' aQBlAHgA' - ' aWV4I' - ' IAB' - ' JAB' - ' PAA' - ' SQBFAFgA' - ' SUVYI' filter_optional_thor_remote: ImagePath|startswith: C:\WINDOWS\TEMP\thor10-remote\thor64.exe filter_main_defender_def_updates: ImagePath|startswith: C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ condition: selection and ( suspicious_paths or all of suspicious_encoded_* ) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via ClassicExplorer32.dll id: caa02837-f659-466f-bca6-48bde2826ab4 status: test description: Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software references: - https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets - https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/ author: frack113 date: 2022-12-13 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection_classicexplorer: ImageLoaded|endswith: \ClassicExplorer32.dll filter_classicexplorer: ImageLoaded|startswith: C:\Program Files\Classic Shell\ condition: selection_classicexplorer and not filter_classicexplorer falsepositives: - Unknown level: medium
Sigma rule: Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScr. Logsource: windows / process_creation. Rule: title: HackTool - SharpMove Tool Execution id: 055fb54c-a8f4-4aee-bd44-f74cf30a0d9d status: test description: 'Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options. ' references: - https://github.com/0xthirteen/SharpMove/ - https://pentestlab.blog/tag/sharpmove/ author: Luca Di Bartolomeo (CrimpSec) date: 2024-01-29 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \SharpMove.exe - OriginalFileName: SharpMove.exe selection_cli_computer: CommandLine|contains: computername= selection_cli_actions: CommandLine|contains: - action=create - action=dcom - action=executevbs - action=hijackdcom - action=modschtask - action=modsvc - action=query - action=scm - action=startservice - action=taskscheduler condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Sigma rule: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse.. Logsource: gcp / google_workspace.login. Rule: title: Google Workspace Out Of Domain Email Forwarding id: 2a0bb2dd-eb5f-4517-8cb9-404f8ba764a5 status: experimental description: Detects automatic email forwarding to external domains in Google Workspace, which may indicate data leakage or misuse. references: - https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain author: Tom kluter date: 2026-04-28 tags: - attack.t1114.003 - attack.collection logsource: product: gcp service: google_workspace.login detection: selection: protoPayload.serviceName: login.googleapis.com protoPayload.metadata.event.eventName: email_forwarding_out_of_domain condition: selection falsepositives: - Legitimate forwarding level: medium
Sigma rule: Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain. Logsource: windows / process_creation. Rule: title: Cloudflared Tunnel Execution id: 9a019ffc-3580-4c9d-8d87-079f7e8d3fd4 status: test description: Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks. references: - https://blog.reconinfosec.com/emergence-of-akira-ransomware-group - https://github.com/cloudflare/cloudflared - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems) date: 2023-05-17 modified: 2023-12-20 tags: - attack.command-and-control - attack.t1102 - attack.t1090 - attack.t1572 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' tunnel ' - ' run ' CommandLine|contains: - '-config ' - '-credentials-contents ' - '-credentials-file ' - '-token ' condition: selection falsepositives: - Legitimate usage of Cloudflared tunnel. level: medium
Sigma rule: Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the. Logsource: windows / process_creation. Rule: title: Potential Arbitrary Command Execution Using Msdt.EXE id: 258fc8ce-8352-443a-9120-8a11e4857fa5 status: test description: Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - https://twitter.com/_JohnHammond/status/1531672601067675648 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-29 modified: 2024-03-13 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe selection_cmd_inline: CommandLine|contains: IT_BrowseForFile= selection_cmd_answerfile_flag: CommandLine|contains: ' PCWDiagnostic' selection_cmd_answerfile_param: CommandLine|contains|windash: ' -af ' condition: selection_img and (selection_cmd_inline or all of selection_cmd_answerfile_*) falsepositives: - Unknown level: high
Sigma rule: Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the M. Logsource: windows / image_load. Rule: title: Suspicious Loading of Dbgcore/Dbghelp DLLs from Uncommon Location id: 416bc4a2-7217-4519-8dc7-c3271817f1d5 related: - id: 9f5c1d59-33be-4e60-bcab-85d2f566effd type: similar status: experimental description: 'Detects loading of dbgcore.dll or dbghelp.dll from uncommon locations such as user directories. These DLLs contain the MiniDumpWriteDump function, which can be abused for credential dumping purposes or in some cases for evading EDR/AV detection by suspending processes. ' references: - https://blog.axelarator.net/hunting-for-edr-freeze/ - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 modified: 2026-01-09 tags: - attack.credential-access - attack.defense-impairment - attack.t1003 - attack.t1685 logsource: category: image_load product: windows detection: selection_img: Image|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - \$Recycle.Bin\ - \Contacts\ - \Documents\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ selection_dll: ImageLoaded|endswith: - \dbgcore.dll - \dbghelp.dll condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load/info.yml
Sigma rule: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location. Logsource: linux / process_creation. Rule: title: Potentially Suspicious Named Pipe Created Via Mkfifo id: 999c3b12-0a8c-40b6-8e13-dd7d62b75c7a related: - id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4 type: derived status: test description: Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location references: - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-16 tags: - attack.execution logsource: category: process_creation product: linux detection: selection: Image|endswith: /mkfifo CommandLine|contains: ' /tmp/' condition: selection falsepositives: - Unknown level: medium
Sigma rule: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Logsource: windows / registry_set. Rule: title: Disable Microsoft Defender Firewall via Registry id: 974515da-6cc5-4c95-ae65-f97f9150ec7f status: test description: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-2---disable-microsoft-defender-firewall-via-registry author: frack113 date: 2022-01-09 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Services\SharedAccess\Parameters\FirewallPolicy\ TargetObject|endswith: \EnableFirewall Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_defender_firewall/info.yml simulation: - type: atomic-red-team name: Disable Microsoft Defender Firewall via Registry technique: T1562.004 atomic_guid: afedc8c4-038c-4d82-b3e5-623a95f8a612
Sigma rule: Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get acces. Logsource: windows / appmodel-runtime. Rule: title: Sysinternals Tools AppX Versions Execution id: d29a20b2-be4b-4827-81f2-3d8a59eab5fc status: test description: 'Detects execution of Sysinternals tools via an AppX package. Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-16 modified: 2023-09-12 tags: - attack.execution - attack.stealth logsource: product: windows service: appmodel-runtime detection: selection: EventID: 201 ImageName: - procdump.exe - psloglist.exe - psexec.exe - livekd.exe - ADExplorer.exe condition: selection falsepositives: - Legitimate usage of sysinternals applications from the Windows Store will trigger this. Apply exclusions as needed. level: low
Sigma rule: Detects changes to the bitbucket audit log configuration.. Logsource: bitbucket / audit. Rule: title: Bitbucket Audit Log Configuration Updated id: 6aa12161-235a-4dfb-9c74-fe08df8d8da1 status: test description: Detects changes to the bitbucket audit log configuration. references: - https://confluence.atlassian.com/bitbucketserver/view-and-configure-the-audit-log-776640417.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Auditing auditType.action: Audit log configuration updated condition: selection falsepositives: - Legitimate user activity. level: medium
Sigma rule: Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmd. Logsource: windows / process_creation. Rule: title: Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet id: c8a180d6-47a3-4345-a609-53f9c3d834fc related: - id: cef24b90-dddc-4ae1-a09a-8764872f69fc type: similar status: test description: Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-10 tags: - attack.discovery - attack.t1087.001 logsource: category: process_creation product: windows detection: selection_cmdlet: CommandLine|contains: 'Get-LocalGroupMember ' selection_group: CommandLine|contains: - domain admins - ' administrator' - ' administrateur' - enterprise admins - Exchange Trusted Subsystem - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto condition: all of selection_* falsepositives: - Administrative activity level: medium
Sigma rule: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32). Logsource: windows / file_event. Rule: title: UAC Bypass Using Windows Media Player - File id: 68578b43-65df-4f81-9a9b-92f32711a951 status: test description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: file_event product: windows detection: selection1: TargetFilename|startswith: C:\Users\ TargetFilename|endswith: \AppData\Local\Temp\OskSupport.dll selection2: Image: C:\Windows\system32\DllHost.exe TargetFilename: C:\Program Files\Windows Media Player\osk.exe condition: 1 of selection* falsepositives: - Unknown level: high
Sigma rule: Detects the abuse of custom file open handler, executing powershell. Logsource: windows / registry_set. Rule: title: Custom File Open Handler Executes PowerShell id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc status: test description: Detects the abuse of custom file open handler, executing powershell references: - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728 author: CD_R0M_ date: 2022-06-11 modified: 2023-08-17 tags: - attack.stealth - attack.t1202 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: shell\open\command\ Details|contains|all: - powershell - -command condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or pe. Logsource: windows / dns_query. Rule: title: Cloudflared Tunnels Related DNS Requests id: a1d9eec5-33b2-4177-8d24-27fe754d0812 related: - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903 type: similar status: test description: 'Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-20 tags: - attack.command-and-control - attack.t1071.001 - attack.t1572 logsource: category: dns_query product: windows detection: selection: QueryName|endswith: - .v2.argotunnel.com - protocol-v2.argotunnel.com - trycloudflare.com - update.argotunnel.com condition: selection falsepositives: - Legitimate use of cloudflare tunnels will also trigger this. level: medium
Sigma rule: Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry. Logsource: windows / process_creation. Rule: title: Enable LM Hash Storage - ProcCreation id: 98dedfdd-8333-49d4-9f23-d7018cccae53 related: - id: c420410f-c2d8-4010-856b-dffe21866437 type: similar status: test description: 'Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes. By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases. ' references: - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-15 modified: 2023-12-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - \System\CurrentControlSet\Control\Lsa - NoLMHash - ' 0' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS. Logsource: windows / process_creation. Rule: title: Dropping Of Password Filter DLL id: b7966f4a-b333-455b-8370-8ca53c229762 status: test description: Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS references: - https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/ - https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter author: Sreeman date: 2020-10-29 modified: 2022-10-09 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: category: process_creation product: windows detection: selection_cmdline: CommandLine|contains|all: - HKLM\SYSTEM\CurrentControlSet\Control\Lsa - scecli\0* - reg add condition: selection_cmdline falsepositives: - Unknown level: medium
Sigma rule: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service. Logsource: windows / process_creation. Rule: title: Suspicious Serv-U Process Pattern id: 58f4ea09-0fc2-4520-ba18-b85c540b0eaf status: test description: Detects a suspicious process pattern which could be a sign of an exploited Serv-U service references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems) date: 2021-07-14 modified: 2022-07-14 tags: - attack.credential-access - attack.t1555 - cve.2021-35211 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Serv-U.exe Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \sh.exe - \bash.exe - \schtasks.exe - \regsvr32.exe - \wmic.exe - \mshta.exe - \rundll32.exe - \msiexec.exe - \forfiles.exe - \scriptrunner.exe condition: selection falsepositives: - Legitimate uses in which users or programs use the SSH service of Serv-U for remote command execution level: high
Sigma rule: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary. Logsource: windows / registry_event. Rule: title: UAC Bypass Via Wsreset id: 6ea3bf32-9680-422d-9f50-e90716b12a66 status: test description: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry. references: - https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly - https://lolbas-project.github.io/lolbas/Binaries/Wsreset author: oscd.community, Dmitry Uchakin date: 2020-10-07 modified: 2021-11-27 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd. Logsource: linux. Rule: title: Symlink Etc Passwd id: c67fc22a-0be5-4b4f-aad5-2b32c4b69523 status: test description: Detects suspicious command lines that look as if they would create symbolic links to /etc/passwd references: - https://www.qualys.com/2021/05/04/21nails/21nails.txt author: Florian Roth (Nextron Systems) date: 2019-04-05 modified: 2021-11-27 tags: - attack.t1204.001 - attack.execution logsource: product: linux detection: keywords: - ln -s -f /etc/passwd - ln -s /etc/passwd condition: keywords falsepositives: - Unknown level: high
Sigma rule: Detects when an a role privilege is deleted in Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Role Privilege Deleted id: bf638ef7-4d2d-44bb-a1dc-a238252e6267 status: test description: Detects when an a role privilege is deleted in Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings author: Austin Songer date: 2021-08-24 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: REMOVE_PRIVILEGE condition: selection falsepositives: - Unknown level: medium