alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: describe CVE-2015-7618
Matching passage: CVE-2015-7618. CWE: CWE-416. CVSS: 6.800000190734863. The CBAutoConfigCommentRepository method in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to bypass JavaScript API execution restrictions via unspecified vectors, a different vulnerability than CVE-2015-6707, CVE-2015-6708, CVE-2015-6709, CVE-2015-6710, CVE-2015-6711, CVE-2015-6712, CVE-2015-6713, CVE-2015-6714, CVE-2015-6715, CVE-2015-6716, CVE-2015-6717, CVE-2015-6718, CVE-2015-6719, CVE-2015-6720, CVE-2015-6721, CVE-2015-6722, CVE-2015-6723, CVE-2015-6724, CVE-2015-6725, CVE-2015-7614, CVE-2015-7616, CVE-2015-7619, CVE-2015-7620, and CVE-2015-7623.
Near-miss passage: CVE-2015-7621. CWE: CWE-416. CVSS: 6.800000190734863. Use-after-free vulnerability in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to execute arbitrary code via a crafted U3D object, a different vulnerability than CVE-2015-5586, CVE-2015-6683, CVE-2015-6684, CVE-2015-6687, CVE-2015-6688, CVE-2015-6689, CVE-2015-6690, CVE-2015-6691, CVE-2015-7615, and CVE-2015-7617.
Query: CWE for Floating Point Comparison with Incorrect Operator
Matching passage: CWE-1077 Floating Point Comparison with Incorrect Operator. The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.
Near-miss passage: CWE-1234 Hardware Internal or Debug Modes Allow Override of Locks. System configuration protection may be bypassed during debug mode.
Query: patch priority for CVE-2015-2682
Matching passage: CVE-2015-2682. CWE: CWE-17. CVSS: 5.0. Citrix Command Center before 5.1 Build 35.4 and 5.2 before Build 42.7 allows remote attackers to obtain credentials via a direct request to conf/securitydbData.xml.
Near-miss passage: CVE-2015-4941. CWE: CWE-17. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 mishandles abbreviated TLS handshakes, which allows remote attackers to cause a denial of service (MQXR service crash) via unspecified vectors.
Query: detection rule: Detects suspicious change of file privileges with chown and chmod commands
Matching passage: Sigma rule: Detects suspicious change of file privileges with chown and chmod commands. Logsource: linux / process_creation. Rule: title: Setuid and Setgid id: c21c4eaa-ba2e-419a-92b2-8371703cbe21 status: test description: Detects suspicious change of file privileges with chown and chmod commands references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.001/T1548.001.md author: Ömer Günal date: 2020-06-16 modified: 2022-10-05 tags: - attack.persistence - attack.privilege-escalation - attack.t1548.001 logsource: product: linux category: process_creation detection: selection_root: CommandLine|contains: chown root selection_perm: CommandLine|contains: - ' chmod u+s' - ' chmod g+s' condition: all of selection_* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation). Logsource: windows / process_creation. Rule: title: Shell Process Spawned by Java.EXE id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 related: - id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d type: similar status: test description: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \bash.exe - \cmd.exe - \powershell.exe - \pwsh.exe filter_main_build: ParentImage|contains: build CommandLine|contains: build condition: selection and not 1 of filter_main_* falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: medium
Query: risk of chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial o
Matching passage: CVE-2015-1822. CWE: CWE-17. CVSS: 6.5. chrony before 1.31.1 does not initialize the last "next" pointer when saving unacknowledged replies to command requests, which allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a large number of command requests.
Near-miss passage: CVE-2015-6760. CWE: CWE-17. CVSS: 7.5. The Image11::map function in renderer/d3d/d3d11/Image11.cpp in libANGLE, as used in Google Chrome before 46.0.2490.71, mishandles mapping failures after device-lost events, which allows remote attackers to cause a denial of service (invalid read or write) or possibly have unspecified other impact via vectors involving a removed device.
Query: alert when Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
Matching passage: Sigma rule: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0. Logsource: windows / ps_classic_start. Rule: title: PowerShell Downgrade Attack - PowerShell id: 6331d09b-4785-4c13-980f-f96661356249 status: test description: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0 references: - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/ author: Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements) date: 2017-03-22 modified: 2023-10-27 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: EngineVersion=2. filter_main: Data|contains: HostVersion=2. condition: selection and not filter_main falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend E. Logsource: windows / process_creation. Rule: title: Hacktool - EDR-Freeze Execution id: c598cc0c-9e70-4852-b9eb-8921af79f598 status: experimental description: 'Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions. ' references: - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://github.com/TwoSevenOneT/EDR-Freeze author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 modified: 2025-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: Image|contains: - \EDR-Freeze - \EDRFreeze Image|endswith: .exe selection_imphash: Hashes|contains: - IMPHASH=1195F7935954A2CD09157390C33F8E8C - IMPHASH=129F58DE3D687FB7F012BF6C3D679997 - IMPHASH=2C617A175D0086251642C6619F7CC8BA - IMPHASH=8828F0B906F7844358FB92A899E9520F - IMPHASH=AF76D95157EC554DC1EF178E4E66D447 - IMPHASH=E1B04316B61ACA31DD52ABBEC0A37FD5 - IMPHASH=8B2D5B54AFCFEC60D54F6B31D80ED4A0 - IMPHASH=AB8BB31EDD91D2A05FE7B62A535E9EB7 condition: 1 of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_edr_freeze/info.yml
Query: mitigate Serverless
Matching passage: T1584.007 Serverless. Tactics: resource development. Description: Adversaries may compromise serverless cloud infrastructure, such as Cloudflare Workers, AWS Lambda functions, or Google Apps Scripts, that can be used during targeting. By utilizing serverless infrastructure, adversaries can make it more difficult to attribute infrastructure used during operations back to them. Once compromised, the serverless runtime environment can be leveraged to either respond directly to infected machines or to [Proxy](https://attack.mitre.org/techniques/T1090) traffic to an adversary-owned command and control server.(Citation: BlackWater Malware Cloudflare Workers)(Citation: AWS Lambda Redirector)(Citation: GWS Apps Script Abuse 2021) As traffic generated by these functions will appear to come from subdomains of common cloud providers, it may be difficult to distinguish from ordinary traffic to these providers - making it easier to [Hide Infrastructure](https://attack.mitre.org/techniques/T1665).(Citation: Detecting Command & Control in the Cloud)(Citation: BlackWater Malware Cloudflare Workers)
Near-miss passage: T1584.002 DNS Server. Tactics: resource development. Description: Adversaries may compromise third-party DNS servers that can be used during targeting. During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: [Application Layer Protocol](https://attack.mitre.org/techniques/T1071)). Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations. By compromising DNS servers, adversaries can alter DNS records. Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary.(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may leverage such control in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004) to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications.(Citation: FireEye DNS Hijack 2019)(Citation: Crowdstrike DNS Hijack 2019) Alternatively, they may be able to prove ownership of a domain to a SaaS service in order to assert control of the service or create a new administrative [Cloud Account](https://attack.mitre.org/techniques/T1136/003).(Citation: CyberCX SaaS Domain Hijacking 2025) Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.(Citation: CiscoAngler)(Citation: Proofpoint Domain Shadowing)
Query: CVE similar to CVE-2015-2002
Matching passage: CVE-2015-2002. CWE: CWE-118. CVSS: 9.800000190734863. The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Near-miss passage: CVE-2015-2000. CWE: CWE-118. CVSS: 9.800000190734863. The Jumio SDK before 1.5.0 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Query: risk of RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
Matching passage: CVE-2015-1165. CWE: CWE-200. CVSS: 5.0. RT (aka Request Tracker) 3.8.8 through 4.x before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to obtain sensitive RSS feed URLs and ticket data via unspecified vectors.
Near-miss passage: CVE-2015-4996. CWE: CWE-200. CVSS: 5.099999904632568. IBM Rational ClearQuest 7.1.x and 8.0.0.x before 8.0.0.17 and 8.0.1.x before 8.0.1.10 allows local users to spoof database servers and discover credentials via unspecified vectors.
Query: detect Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with m in logs
Matching passage: Sigma rule: Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with m. Logsource: fortigate / event. Rule: title: FortiGate - New VPN SSL Web Portal Added id: 2bfb6216-0c31-4d20-8501-2629b29a3fa2 status: experimental description: 'Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings. ' references: - https://www.fortiguard.com/psirt/FG-IR-24-535 - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2025-11-01 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: product: fortigate service: event detection: selection: action: Add cfgpath: vpn.ssl.web.portal condition: selection falsepositives: - A VPN SSL Web Portal can be added for legitimate purposes. level: medium
Near-miss passage: Sigma rule: Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and w. Logsource: linux / process_creation. Rule: title: Audit Rules Deleted Via Auditctl id: bed26dea-4525-47f4-b24a-76e30e44ffb0 status: experimental description: 'Detects the execution of ''auditctl'' with the ''-D'' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system. ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012 - https://linux.die.net/man/8/auditct author: Mohamed LAKRI date: 2025-10-17 tags: - attack.defense-impairment - attack.t1685.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: /auditctl CommandLine|re: -D condition: selection falsepositives: - An administrator troubleshooting. Investigate all attempts. level: high
Query: describe CVE-2015-1881
Matching passage: CVE-2015-1881. CWE: CWE-399. CVSS: 4.0. OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them, a different vulnerability than CVE-2014-9684.
Near-miss passage: CVE-2015-4240. CWE: CWE-399. CVSS: 5.0. Cisco IP Communicator 8.6(4) allows remote attackers to cause a denial of service (service outage) via an unspecified URL in a GET request, aka Bug ID CSCuu37656.
Query: patch priority for CVE-2015-1082
Matching passage: CVE-2015-1082. CWE: CWE-399. CVSS: 6.800000190734863. WebKit, as used in Apple Safari before 6.2.4, 7.x before 7.1.4, and 8.x before 8.0.4, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other CVEs listed in APPLE-SA-2015-03-17-1.
Near-miss passage: CVE-2015-0593. CWE: CWE-399. CVSS: 7.099999904632568. The Zone-Based Firewall implementation in Cisco IOS 12.4(122)T and earlier does not properly manage session-object structures, which allows remote attackers to cause a denial of service (device reload) via crafted network traffic, aka Bug ID CSCul65003.
Query: CVE similar to CVE-2015-9103
Matching passage: CVE-2015-9103. CWE: CWE-79. CVSS: 5.400000095367432. Multiple cross-site scripting (XSS) vulnerabilities in Synology Note Station 1.1-0212 and earlier allow remote authenticated attackers to inject arbitrary web script or HTML via the (1) note title or (2) file name of attachments.
Near-miss passage: CVE-2015-4725. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in forgot.php in AudioShare 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the email parameter.
Query: describe CVE-2015-6248
Matching passage: CVE-2015-6248. CWE: CWE-20. CVSS: 4.300000190734863. The ptvcursor_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expected amount of data is available, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.
Near-miss passage: CVE-2015-6546. CWE: CWE-20. CVSS: 6.099999904632568. The vCMP host in F5 BIG-IP Analytics, APM, ASM, GTM, Link Controller, and LTM 11.0.0 before 11.6.0, BIG-IP AAM 11.4.0 before 11.6.0, BIG-IP AFM and PEM 11.3.0 before 11.6.0, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.0.0 through 11.3.0, BIG-IP PSM 11.0.0 through 11.4.1 allows remote attackers to cause a denial of service via "malicious traffic."
Query: rule covering Detects execution of AppleScript of the macOS scripting language AppleScript.
Matching passage: Sigma rule: Detects execution of AppleScript of the macOS scripting language AppleScript.. Logsource: macos / process_creation. Rule: title: MacOS Scripting Interpreter AppleScript id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 status: test description: Detects execution of AppleScript of the macOS scripting language AppleScript. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md - https://redcanary.com/blog/applescript/ author: Alejandro Ortuno, oscd.community date: 2020-10-21 modified: 2026-05-21 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: Image|endswith: /osascript CommandLine|contains: - ' -e ' - .scpt - .js filter_optional_opencode: ParentImage|endswith: opencode CommandLine|contains|all: - osascript - ' -e ' - set imageData to the clipboard - set fileRef condition: selection and not 1 of filter_optional_* falsepositives: - Application installers might contain scripts as part of the installation process. level: medium
Near-miss passage: Sigma rule: Detect the use of "<" to read and potentially execute a file via cmd.exe. Logsource: windows / process_creation. Rule: title: Read Contents From Stdin Via Cmd.EXE id: 241e802a-b65e-484f-88cd-c2dc10f9206d related: - id: 00a4bacd-6db4-46d5-9258-a7d5ebff4003 type: obsolete status: test description: Detect the use of "<" to read and potentially execute a file via cmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1059.003/T1059.003.md - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-07 tags: - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection_cmd: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|contains: < condition: all of selection_* falsepositives: - Unknown level: medium
Query: vulnerability: The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
Matching passage: CVE-2015-7264. CWE: CWE-74. CVSS: 9.800000190734863. The SPDY/2 codec in Facebook Proxygen before 2015-11-09 truncates a certain field to two bytes, which allows hijacking and injection attacks.
Near-miss passage: CVE-2015-5377. CWE: CWE-74. CVSS: 9.800000190734863. Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability
Query: exploit Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.
Matching passage: CVE-2015-1329. CWE: CWE-416. CVSS: 8.800000190734863. Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code.
Near-miss passage: CVE-2015-1726. CWE: CWE-416. CVSS: 7.199999809265137. Use-after-free vulnerability in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Microsoft Windows Kernel Brush Object Use After Free Vulnerability."
Query: alert when Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.
Matching passage: Sigma rule: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.. Logsource: windows / process_creation. Rule: title: Portable Gpg.EXE Execution id: 77df53a5-1d78-4f32-bc5a-0e7465bd8f41 status: test description: Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data. references: - https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a - https://securelist.com/locked-out/68960/ - https://github.com/redcanaryco/atomic-red-team/blob/c4097dc7ed14d7f7d08c89d148c4307097e8c294/atomics/T1486/T1486.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-08-06 modified: 2023-11-10 tags: - attack.impact - attack.t1486 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \gpg.exe - \gpg2.exe - OriginalFileName: gpg.exe - Description: GnuPG’s OpenPGP tool filter_main_legit_location: Image|contains: - :\Program Files (x86)\GNU\GnuPG\bin\ - :\Program Files (x86)\GnuPG VS-Desktop\ - :\Program Files (x86)\GnuPG\bin\ - :\Program Files (x86)\Gpg4win\bin\ condition: selection and not 1 of filter_main_* level: medium
Near-miss passage: Sigma rule: Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCK. Logsource: aws / cloudtrail. Rule: title: AWS IAM S3Browser Templated S3 Bucket Policy Creation id: db014773-7375-4f4e-b83b-133337c0ffee status: test description: Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>". references: - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor author: daniel.bohannon@permiso.io (@danielhbohannon) date: 2023-05-17 tags: - attack.execution - attack.stealth - attack.t1059.009 - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: PutUserPolicy userAgent|contains: S3 Browser requestParameters|contains|all: - '"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"' - '"s3:GetObject"' - '"Allow"' condition: selection falsepositives: - Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value level: high