alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: adversary uses Virtual Private Server
Matching passage: T1583.003 Virtual Private Server. Tactics: resource development. Description: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure. Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
Near-miss passage: T1583 Acquire Infrastructure. Tactics: resource development. Description: Adversaries may buy, lease, rent, or obtain infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Some infrastructure providers offer free trial periods, enabling infrastructure acquisition at limited to no cost.(Citation: Free Trial PurpleUrchin) Additionally, botnets are available for rent or purchase. Use of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.
Query: rule covering Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI b
Matching passage: Sigma rule: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI b. Logsource: windows / file_event. Rule: title: UEFI Persistence Via Wpbbin - FileCreation id: e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f status: test description: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method references: - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c - https://persistence-info.github.io/Data/wpbbin.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-18 tags: - attack.persistence - attack.stealth - attack.t1542.001 logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\System32\wpbbin.exe condition: selection falsepositives: - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip) level: high
Near-miss passage: Sigma rule: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High Integrity. Logsource: windows / process_creation. Rule: title: Suspicious High IntegrityLevel Conhost Legacy Option id: 3037d961-21e9-4732-b27a-637bcc7bf539 status: test description: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context. references: - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29 - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control author: frack113 date: 2022-12-09 modified: 2024-12-01 tags: - attack.stealth - attack.t1202 logsource: product: windows category: process_creation detection: selection: IntegrityLevel: - High - S-1-16-12288 CommandLine|contains|all: - conhost.exe - '0xffffffff' - -ForceV1 condition: selection falsepositives: - Very Likely, including launching cmd.exe via Run As Administrator level: informational
Query: vulnerability: Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a c
Matching passage: CVE-2015-8113. CWE: UNKNOWN. CVSS: 7.199999809265137. Untrusted search path vulnerability in the client in Symantec Endpoint Protection (SEP) 12.1 before 12.1-RU6-MP3 allows local users to gain privileges via a Trojan horse DLL in a client install package. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1492.
Near-miss passage: CVE-2015-8401. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8437, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Query: vulnerability: The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
Matching passage: CVE-2015-9340. CWE: CWE-434. CVSS: 7.5. The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.
Near-miss passage: CVE-2015-1784. CWE: CWE-434. CVSS: 8.800000190734863. In nextgen-galery wordpress plugin before 2.0.77.3 there are two vulnerabilities which can allow an attacker to gain full access over the web application. The vulnerabilities lie in how the application validates user uploaded files and lack of security measures preventing unwanted HTTP requests.
Query: CVE similar to CVE-2015-1712
Matching passage: CVE-2015-1712. CWE: CWE-119. CVSS: 9.300000190734863. Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1691.
Near-miss passage: CVE-2015-8981. CWE: CWE-119. CVSS: 9.800000190734863. Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.
Query: write Sigma for Detects the use of various CLI utilities exfiltrating data via web requests
Matching passage: Sigma rule: Detects the use of various CLI utilities exfiltrating data via web requests. Logsource: windows / process_creation. Rule: title: Potential Data Exfiltration Activity Via CommandLine Tools id: 7d1aaf3d-4304-425c-b7c3-162055e0b3ab status: test description: Detects the use of various CLI utilities exfiltrating data via web requests references: - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2025-10-19 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_iwr: Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \cmd.exe CommandLine|contains: - 'curl ' - Invoke-RestMethod - Invoke-WebRequest - 'irm ' - 'iwr ' - 'wget ' CommandLine|contains|all: - ' -ur' - ' -me' - ' -b' - ' POST ' selection_curl: Image|endswith: \curl.exe CommandLine|contains: --ur selection_curl_data: CommandLine|contains: - ' -d ' - ' --data ' selection_wget: Image|endswith: \wget.exe CommandLine|contains: - --post-data - --post-file payloads: - CommandLine|re: - net\s+view - sc\s+query - CommandLine|contains: - Get-Content - GetBytes - hostname - ifconfig - ipconfig - netstat - nltest - qprocess - systeminfo - tasklist - ToBase64String - whoami - CommandLine|contains|all: - 'type ' - ' > ' - ' C:\' condition: (selection_iwr or all of selection_curl* or selection_wget) and payloads falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detect the use of "<" to read and potentially execute a file via cmd.exe. Logsource: windows / process_creation. Rule: title: Read Contents From Stdin Via Cmd.EXE id: 241e802a-b65e-484f-88cd-c2dc10f9206d related: - id: 00a4bacd-6db4-46d5-9258-a7d5ebff4003 type: obsolete status: test description: Detect the use of "<" to read and potentially execute a file via cmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1059.003/T1059.003.md - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-07 tags: - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection_cmd: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|contains: < condition: all of selection_* falsepositives: - Unknown level: medium
Query: CVE similar to CVE-2015-1398
Matching passage: CVE-2015-1398. CWE: CWE-22. CVSS: 6.5. Multiple directory traversal vulnerabilities in Magento Community Edition (CE) 1.9.1.0 and Enterprise Edition (EE) 1.14.1.0 allow remote authenticated users to include and execute certain PHP files via (1) .. (dot dot) sequences in the PATH_INFO to index.php or (2) vectors involving a block value in the ___directive parameter to the Cms_Wysiwyg controller in the Adminhtml module, related to the blockDirective function and the auto loading mechanism. NOTE: vector 2 might not cross privilege boundaries, since administrators might already have the privileges to execute code and upload files.
Near-miss passage: CVE-2015-1395. CWE: CWE-22. CVSS: 7.5. Directory traversal vulnerability in GNU patch versions which support Git-style patching before 2.7.3 allows remote attackers to write to arbitrary files with the permissions of the target user via a .. (dot dot) in a diff file name.
Query: Sigma rule for Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately
Matching passage: Sigma rule: Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately. Logsource: azure / activitylogs. Rule: title: Azure Subscription Permission Elevation Via ActivityLogs id: 09438caa-07b1-4870-8405-1dbafe3dad95 status: test description: 'Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn''t planned. This setting could allow an attacker access to Azure subscriptions in your environment. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization author: Austin Songer @austinsonger date: 2021-11-26 modified: 2022-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: activitylogs detection: selection: operationName: MICROSOFT.AUTHORIZATION/ELEVATEACCESS/ACTION condition: selection falsepositives: - If this was approved by System Administrator. level: high
Near-miss passage: Sigma rule: Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name locate. Logsource: windows / system. Rule: title: Critical Hive In Suspicious Location Access Bits Cleared id: 39f919f3-980b-4e6f-a975-8af7e507ef2b related: - id: 839dd1e8-eda8-4834-8145-01beeee33acd type: obsolete status: test description: 'Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior. ' references: - https://github.com/nasbench/Misc-Research/blob/b20da2336de0f342d31ef4794959d28c8d3ba5ba/ETW/Microsoft-Windows-Kernel-General.md author: Florian Roth (Nextron Systems) date: 2017-05-15 modified: 2024-01-18 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows service: system detection: selection: EventID: 16 Provider_Name: Microsoft-Windows-Kernel-General HiveName|contains: - \Temp\SAM - \Temp\SECURITY condition: selection falsepositives: - Unknown level: high
Query: Sigma rule for Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.
Matching passage: Sigma rule: Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.. Logsource: windows / process_creation. Rule: title: Potential Provlaunch.EXE Binary Proxy Execution Abuse id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c related: - id: f9999590-1f94-4a34-a91e-951e47bedefd type: similar - id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 type: similar - id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 type: similar status: test description: Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution. references: - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/ - https://twitter.com/0gtweet/status/1674399582162153472 author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-08-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \provlaunch.exe filter_main_covered_children: - Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \mshta.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - Image|contains: - :\PerfLogs\ - :\Temp\ - :\Users\Public\ - \AppData\Temp\ - \Windows\System32\Tasks\ - \Windows\Tasks\ - \Windows\Temp\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions). Logsource: windows / process_creation. Rule: title: Suspicious SysAidServer Child id: 60bfeac3-0d35-4302-8efb-1dd16f715bc6 status: test description: Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions) references: - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/ author: Florian Roth (Nextron Systems) date: 2022-08-26 tags: - attack.lateral-movement - attack.t1210 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: SysAidServer condition: selection falsepositives: - Unknown level: medium
Query: describe CVE-2015-3277
Matching passage: CVE-2015-3277. CWE: CWE-200. CVSS: 7.5. The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring.
Near-miss passage: CVE-2015-3881. CWE: CWE-200. CVSS: 7.5. Information disclosure issue in qdPM 8.3 allows remote attackers to obtain sensitive information via a direct request to (1) core/config/databases.yml, (2) core/log/qdPM_prod.log, or (3) core/apps/qdPM/config/settings.yml.
Query: write Sigma for Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse sh
Matching passage: Sigma rule: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse sh. Logsource: linux / process_creation. Rule: title: Potential Netcat Reverse Shell Execution id: 7f734ed0-4f47-46c0-837f-6ee62505abd9 status: test description: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup. references: - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet - https://www.revshells.com/ - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/ - https://www.infosecademy.com/netcat-reverse-shells/ - https://man7.org/linux/man-pages/man1/ncat.1.html author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)' date: 2023-04-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_nc: Image|endswith: - /nc - /ncat selection_flags: CommandLine|contains: - ' -c ' - ' -e ' selection_shell: CommandLine|contains: - ' ash' - ' bash' - ' bsh' - ' csh' - ' ksh' - ' pdksh' - ' sh' - ' tcsh' - /bin/ash - /bin/bash - /bin/bsh - /bin/csh - /bin/ksh - /bin/pdksh - /bin/sh - /bin/tcsh - /bin/zsh - $IFSash - $IFSbash - $IFSbsh - $IFScsh - $IFSksh - $IFSpdksh - $IFSsh - $IFStcsh - $IFSzsh condition: all of selection_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injecti. Logsource: windows / process_creation. Rule: title: RegAsm.EXE Execution Without CommandLine Flags or Files id: 651f87f7-12db-47f9-84c5-f27b081b94b6 status: experimental description: 'Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity. Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag. ' references: - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/ - https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool - https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2 - https://www.joesandbox.com/analysis/1467354/0/html author: frack113 date: 2025-06-04 tags: - attack.stealth - attack.t1218.009 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \RegAsm.exe - OriginalFileName: RegAsm.exe selection_cli: CommandLine|endswith: - RegAsm - RegAsm.exe - RegAsm.exe" - RegAsm.exe' condition: all of selection_* falsepositives: - Legitimate use of Regasm by developers. level: low
Query: describe CVE-2015-4624
Matching passage: CVE-2015-4624. CWE: CWE-284. CVSS: 7.5. Hak5 WiFi Pineapple 2.0 through 2.3 uses predictable CSRF tokens.
Near-miss passage: CVE-2015-5116. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3115, CVE-2015-3116, and CVE-2015-3125.
Query: common weakness: Unexpected Sign Extension
Matching passage: CWE-194 Unexpected Sign Extension. The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
Near-miss passage: CWE-276 Incorrect Default Permissions. During installation, installed file permissions are set to allow anyone to modify those files.
Query: CVE similar to CVE-2015-1224
Matching passage: CVE-2015-1224. CWE: CWE-17. CVSS: 5.0. The VpxVideoDecoder::VpxDecode function in media/filters/vpx_video_decoder.cc in the vpxdecoder implementation in Google Chrome before 41.0.2272.76 does not ensure that alpha-plane dimensions are identical to image dimensions, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted VPx video data.
Near-miss passage: CVE-2015-6823. CWE: CWE-17. CVSS: 7.5. The allocate_buffers function in libavcodec/alac.c in FFmpeg before 2.7.2 does not initialize certain context data, which allows remote attackers to cause a denial of service (segmentation violation) or possibly have unspecified other impact via crafted Apple Lossless Audio Codec (ALAC) data.
Query: rule covering Detects inline execution of PowerShell code from a file
Matching passage: Sigma rule: Detects inline execution of PowerShell code from a file. Logsource: windows / process_creation. Rule: title: Powershell Inline Execution From A File id: ee218c12-627a-4d27-9e30-d6fb2fe22ed2 status: test description: Detects inline execution of PowerShell code from a file references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50 author: frack113 date: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_exec: CommandLine|contains: - 'iex ' - 'Invoke-Expression ' - 'Invoke-Command ' - 'icm ' selection_read: CommandLine|contains: - 'cat ' - 'get-content ' - 'type ' selection_raw: CommandLine|contains: ' -raw' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.. Logsource: windows / ps_script. Rule: title: PowerShell Script With File Upload Capabilities id: d2e3f2f6-7e09-4bf2-bc5d-90186809e7fb status: test description: Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md - https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.4 author: frack113 date: 2022-01-07 modified: 2025-07-18 tags: - attack.exfiltration - attack.t1020 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection_cmdlet: ScriptBlockText|contains: - Invoke-RestMethod - Invoke-WebRequest - 'irm ' - 'iwr ' selection_flag: ScriptBlockText|contains: - -Method "POST" - -Method "PUT" - -Method POST - -Method PUT - -Method 'POST' - -Method 'PUT' condition: all of selection_* falsepositives: - Unknown level: low