alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: CVE similar to CVE-2015-3098
Matching passage: CVE-2015-3098. CWE: CWE-200. CVSS: 5.0. Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X and Android, Adobe AIR SDK before 18.0.0.144 on Windows and before 18.0.0.143 on OS X, and Adobe AIR SDK & Compiler before 18.0.0.144 on Windows and before 18.0.0.143 on OS X allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2015-3099 and CVE-2015-3102.
Near-miss passage: CVE-2015-1106. CWE: CWE-200. CVSS: 2.0999999046325684. The QuickType feature in the Keyboards subsystem in Apple iOS before 8.3 allows physically proximate attackers to discover passcodes by reading the lock screen during use of a Bluetooth keyboard.
Query: exploit Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Matching passage: CVE-2015-2986. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji (rktSNS2) 0.2.2b allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-4384. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Query: exploit WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime-audio:// URL.
Matching passage: CVE-2015-5820. CWE: CWE-20. CVSS: 4.300000190734863. WebKit in Apple iOS before 9 allows remote attackers to trigger a dialing action via a crafted (1) tel://, (2) facetime://, or (3) facetime-audio:// URL.
Near-miss passage: CVE-2015-8946. CWE: CWE-20. CVSS: 3.299999952316284. ecryptfs-setup-swap in eCryptfs before 111 does not prevent the unencrypted swap partition from activating during boot when using GPT partitioning and certain versions of systemd, which allows local users to obtain sensitive information via unspecified vectors.
Query: detection rule: Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for ap
Matching passage: Sigma rule: Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for ap. Logsource: windows / file_event. Rule: title: Legitimate Application Writing Files In Uncommon Location id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67 related: - id: 2ddef153-167b-4e89-86b6-757a9e65dcac type: similar status: experimental description: 'Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution. Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions. ' references: - https://lolbas-project.github.io/#/download author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-10 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: product: windows category: file_event detection: selection_img: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \cmdl32.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \bitsadmin.exe - \Desktopimgdownldr.exe - \esentutl.exe - \expand.exe - \extrac32.exe - \replace.exe - \mshta.exe - \ftp.exe - \Ldifde.exe - \RdrCEF.exe - \hh.exe - \finger.exe - \findstr.exe selection_locations: TargetFilename|contains: - :\Perflogs - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\ - \$Recycle.Bin\ - \AppData\Local\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location/info.yml
Near-miss passage: Sigma rule: Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons. Logsource: windows / dns_query. Rule: title: Suspicious Cobalt Strike DNS Beaconing - Sysmon id: f356a9c4-effd-4608-bbf8-408afd5cd006 related: - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2 type: similar status: test description: Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons references: - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2021-11-09 modified: 2023-01-16 tags: - attack.command-and-control - attack.t1071.004 logsource: product: windows category: dns_query detection: selection1: QueryName|startswith: - aaa.stage. - post.1 selection2: QueryName|contains: .stage.123456. condition: 1 of selection* falsepositives: - Unknown level: critical
Query: exploit The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block.
Matching passage: CVE-2015-8081. CWE: CWE-200. CVSS: 5.0. The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block.
Near-miss passage: CVE-2015-7437. CWE: CWE-200. CVSS: 5.5. Queue Watcher in IBM Sterling B2B Integrator 5.2 allows local users to obtain sensitive information via unspecified vectors.
Query: exploit The ANSendForFormDistribution method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrob
Matching passage: CVE-2015-6716. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForFormDistribution method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-4474. CWE: UNKNOWN. CVSS: 10.0. Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 40.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
Query: write Sigma for Detects value modification of registry key containing path to binary used as screensaver.
Matching passage: Sigma rule: Detects value modification of registry key containing path to binary used as screensaver.. Logsource: windows / registry_event. Rule: title: Path To Screensaver Binary Modified id: 67a6c006-3fbe-46a7-9074-2ba3b82c3000 status: test description: Detects value modification of registry key containing path to binary used as screensaver. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf author: Bartlomiej Czyz @bczyz1, oscd.community date: 2020-10-11 modified: 2021-11-27 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.002 logsource: category: registry_event product: windows detection: selection: TargetObject|endswith: \Control Panel\Desktop\SCRNSAVE.EXE filter: Image|endswith: - \rundll32.exe - \explorer.exe condition: selection and not filter falsepositives: - Legitimate modification of screensaver level: medium
Near-miss passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation STDIN+ Launcher - Powershell id: 779c8c12-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+" condition: selection_4104 falsepositives: - Unknown level: high
Query: exploit Use-after-free vulnerability in the CElement object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service 
Matching passage: CVE-2015-6045. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the CElement object implementation in Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JavaScript that improperly interacts with use of the Cascading Style Sheets (CSS) empty-cells property for a TABLE element, aka "Internet Explorer Memory Corruption Vulnerability."
Near-miss passage: CVE-2015-2594. CWE: UNKNOWN. CVSS: 6.599999904632568. Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 4.0.32, 4.1.40, 4.2.32, and 4.3.30 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.
Query: CWE for Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
Matching passage: CWE-1302 Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC). The product implements a security identifier mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. A transaction is sent without a security identifier.
Near-miss passage: CWE-406 Insufficient Control of Network Message Volume (Network Amplification). The product does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the product to transmit more traffic than should be allowed for that actor.
Query: Encoded PowerShell / command-line abuse matching LSASS Driver
Matching passage: T1547.008 LSASS Driver. Tactics: persistence, privilege escalation. Description: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.(Citation: Microsoft Security Subsystem) Adversaries may target LSASS drivers to obtain persistence. By either replacing or adding illegitimate drivers (e.g., [Hijack Execution Flow](https://attack.mitre.org/techniques/T1574)), an adversary can use LSA operations to continuously execute malicious payloads.
Near-miss passage: T1547.014 Active Setup. Tactics: persistence, privilege escalation. Description: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine. Active Setup is a Windows mechanism that is used to execute programs when a user logs in. The value stored in the Registry key will be executed after a user logs into the computer.(Citation: Klein Active Setup 2010) These programs will be executed under the context of the user and will have the account's associated permissions level. Adversaries may abuse Active Setup by creating a key under <code> HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\</code> and setting a malicious value for <code>StubPath</code>. This value will serve as the program that will be executed when a user logs into the computer.(Citation: Mandiant Glyer APT 2010)(Citation: Citizenlab Packrat 2015)(Citation: FireEye CFR Watering Hole 2012)(Citation: SECURELIST Bright Star 2015)(Citation: paloalto Tropic Trooper 2016) Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.
Query: vulnerability: The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via unspecified vectors.
Matching passage: CVE-2015-1141. CWE: UNKNOWN. CVSS: 4.900000095367432. The mach_vm_read functionality in the kernel in Apple OS X before 10.10.3 allows local users to cause a denial of service (system crash) via unspecified vectors.
Near-miss passage: CVE-2015-7636. CWE: UNKNOWN. CVSS: 10.0. Use-after-free vulnerability in Adobe Flash Player before 18.0.0.252 and 19.x before 19.0.0.207 on Windows and OS X and before 11.2.202.535 on Linux, Adobe AIR before 19.0.0.213, Adobe AIR SDK before 19.0.0.213, and Adobe AIR SDK & Compiler before 19.0.0.213 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2015-7629, CVE-2015-7631, CVE-2015-7635, CVE-2015-7637, CVE-2015-7638, CVE-2015-7639, CVE-2015-7640, CVE-2015-7641, CVE-2015-7642, CVE-2015-7643, and CVE-2015-7644.
Query: describe CVE-2015-3888
Matching passage: CVE-2015-3888. CWE: CWE-284. CVSS: 7.5. Jolla Sailfish OS before 1.1.2.16 allows remote attackers to spoof phone numbers and trigger calls to arbitrary numbers via spaces in a tel: URL.
Near-miss passage: CVE-2015-1854. CWE: CWE-284. CVSS: 7.5. 389 Directory Server before 1.3.3.10 allows attackers to bypass intended access restrictions and modify directory entries via a crafted ldapmodrdn call.
Query: describe CVE-2015-3288
Matching passage: CVE-2015-3288. CWE: CWE-20. CVSS: 7.800000190734863. mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.
Near-miss passage: CVE-2015-8727. CWE: CWE-20. CVSS: 5.5. The dissect_rsvp_common function in epan/dissectors/packet-rsvp.c in the RSVP dissector in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not properly maintain request-key data, which allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted packet.
Query: patch priority for CVE-2015-0394
Matching passage: CVE-2015-0394. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Report Distribution.
Near-miss passage: CVE-2015-8876. CWE: UNKNOWN. CVSS: 9.800000190734863. Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
Query: Sigma rule for Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line
Matching passage: Sigma rule: Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded FromBase64String Cmdlet id: fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c status: test description: Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line references: - Internal Research author: Florian Roth (Nextron Systems) date: 2019-08-24 modified: 2023-04-06 tags: - attack.stealth - attack.t1140 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|base64offset|contains: ::FromBase64String - CommandLine|contains: - OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA - oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA - 6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the passwor. Logsource: azure / signinlogs. Rule: title: Multifactor Authentication Interrupted id: 5496ff55-42ec-4369-81cb-00f417029e25 status: test description: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1078.004 - attack.t1110 - attack.t1621 logsource: product: azure service: signinlogs detection: selection_50074: ResultType: 50074 ResultDescription|contains: Strong Auth required selection_500121: ResultType: 500121 ResultDescription|contains: Authentication failed during strong authentication request condition: 1 of selection_* falsepositives: - Unknown level: medium
Query: vulnerability: Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote attackers to af
Matching passage: CVE-2015-0495. CWE: UNKNOWN. CVSS: 7.5. Unspecified vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager component in Oracle Commerce Platform 3.x and 11.x allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Workbench.
Near-miss passage: CVE-2015-7620. CWE: UNKNOWN. CVSS: 6.800000190734863. The ANSendForBrowserReview method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7618, CVE-2015-7619, and CVE-2015-7623.
Query: vulnerability: CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from paramete
Matching passage: CVE-2015-5285. CWE: UNKNOWN. CVSS: 5.0. CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.
Near-miss passage: CVE-2015-0373. CWE: UNKNOWN. CVSS: 6.5. Unspecified vulnerability in the OJVM component in Oracle Database Server 11.1.0.7, 11.2.0.3, 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
Query: playbook for alert: Encoded PowerShell / command-line abuse matching Trust Modification
Matching passage: Playbook for T1484.002 Trust Modification. 1) Validate alert telemetry against T1484.002. 2) Scope affected hosts and accounts. 3) Contain by isolating endpoint / disabling account if confirmed. 4) Hunt for related tactics: defense impairment, privilege escalation. 5) Eradicate persistence and recover. Reference detection notes: Adversaries may add new domain trusts, modify the properties of existing domain trusts, or otherwise change the configuration of trust relationships between domains and tenants to evade defenses and/or elevate privileges.Trust details, such as whether or not user identities are federated, allow authentication and authorization properties to apply between domains or tenants for the purpose of acces
Near-miss passage: Playbook for T1484 Domain or Tenant Policy Modification. Different response path focused on defense impairment, privilege escalation.
Query: exploit Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbi
Matching passage: CVE-2015-3443. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the basic dashboard in Thycotic Secret Server 8.6.x, 8.7.x, and 8.8.x before 8.8.000005 allows remote authenticated users to inject arbitrary web script or HTML via a password entry, which is not properly handled when toggling the password mask.
Near-miss passage: CVE-2015-6061. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in Microsoft Skype for Business 2016, Lync 2010 and 2013 SP1, Lync 2010 Attendee, and Lync Room System allows remote attackers to inject arbitrary web script or HTML via an instant-message session, aka "Server Input Validation Information Disclosure Vulnerability."
Query: Sigma YAML for jvm / application
Matching passage: Sigma rule: Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation.. Logsource: jvm / application. Rule: title: Potential JNDI Injection Exploitation In JVM Based Application id: bb0e9cec-d4da-46f5-997f-22efc59f3dca status: test description: Detects potential JNDI Injection exploitation. Often coupled with Log4Shell exploitation. references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs - https://secariolabs.com/research/analysing-and-reproducing-poc-for-log4j-2-15-0 author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords: - com.sun.jndi.ldap. - org.apache.logging.log4j.core.net.JndiManager condition: keywords falsepositives: - Application bugs level: high
Near-miss passage: Sigma rule: Detects when a configuration change is made to an applications AppID URI.. Logsource: azure / auditlogs. Rule: title: Application AppID Uri Configuration Changes id: 1b45b0d1-773f-4f23-aedc-814b759563b1 status: test description: Detects when a configuration change is made to an applications AppID URI. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.initial-access - attack.persistence - attack.credential-access - attack.privilege-escalation - attack.stealth - attack.t1552 - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: - Update Application - Update Service principal condition: selection falsepositives: - When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event. level: high