alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: weakness Modification of Assumed-Immutable Data (MAID)
Matching passage: CWE-471 Modification of Assumed-Immutable Data (MAID). The product does not properly protect an assumed-immutable element from being modified by an attacker.
Near-miss passage: CWE-316 Cleartext Storage of Sensitive Information in Memory. The product stores sensitive information in cleartext in memory.
Query: vulnerability: The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to 
Matching passage: CVE-2015-3292. CWE: CWE-17. CVSS: 10.0. The installer in NetApp OnCommand Workflow Automation before 2.2.1P1 and 3.x before 3.0P1 sets up the Java Debugging Wire Protocol (JDWP) service, which allows remote attackers to execute arbitrary code via unspecified vectors.
Near-miss passage: CVE-2015-7035. CWE: CWE-17. CVSS: 7.5. Apple Mac EFI before 2015-002, as used in OS X before 10.11.1 and other products, mishandles arguments, which allows attackers to reach "unused" functions via unspecified vectors.
Query: CVE similar to CVE-2015-7286
Matching passage: CVE-2015-7286. CWE: CWE-310. CVSS: 6.400000095367432. CSL DualCom GPRS CS2300-R devices with firmware 1.25 through 3.53 rely on a polyalphabetic substitution cipher with hardcoded keys, which makes it easier for remote attackers to defeat a cryptographic protection mechanism by capturing IP or V.22bis PSTN protocol traffic.
Near-miss passage: CVE-2015-8329. CWE: CWE-310. CVSS: 5.0. SAP Manufacturing Integration and Intelligence (aka MII, formerly xMII) uses weak encryption (Base64 and DES), which allows attackers to conduct downgrade attacks and decrypt passwords via unspecified vectors, aka SAP Security Note 2240274.
Query: exploit Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to inject arbitrary web script or
Matching passage: CVE-2015-4957. CWE: CWE-79. CVSS: 5.400000095367432. Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
Near-miss passage: CVE-2015-3942. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in the web-server component in MNS before 4.5.6 on Belden GarrettCom Magnum 6K and Magnum 10K switches allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Query: describe CVE-2015-9227
Matching passage: CVE-2015-9227. CWE: CWE-94. CVSS: 7.199999809265137. PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.
Near-miss passage: CVE-2015-0091. CWE: CWE-94. CVSS: 9.300000190734863. Adobe Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a crafted (1) web site or (2) file, aka "Adobe Font Driver Remote Code Execution Vulnerability," a different vulnerability than CVE-2015-0088, CVE-2015-0090, CVE-2015-0092, and CVE-2015-0093.
Query: vulnerability: MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update vers
Matching passage: CVE-2015-7336. CWE: CWE-347. CVSS: 7.5. MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A vulnerability was reported (fixed and publicly disclosed in 2015) in Lenovo System Update version 5.07.0008 and prior that could allow the signature check of an update to be bypassed.
Near-miss passage: CVE-2015-3298. CWE: CWE-347. CVSS: 8.800000190734863. Yubico ykneo-openpgp before 1.0.10 has a typo in which an invalid PIN can be used. When first powered up, a signature will be issued even though the PIN has not been validated.
Query: patch priority for CVE-2015-8995
Matching passage: CVE-2015-8995. CWE: CWE-190. CVSS: 7.800000190734863. In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel.
Near-miss passage: CVE-2015-7599. CWE: CWE-190. CVSS: 8.100000381469727. Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC) protocol is enabled, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a username and password.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects actions that clear the local ShimCache and remove forensic evidence. Logsource: windows / process_creation. Rule: title: ShimCache Flush id: b0524451-19af-4efa-a46f-562a977f792e status: stable description: Detects actions that clear the local ShimCache and remove forensic evidence references: - https://medium.com/@blueteamops/shimcache-flush-89daff28d15e author: Florian Roth (Nextron Systems) date: 2021-02-01 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection1a: CommandLine|contains|all: - rundll32 - apphelp.dll selection1b: CommandLine|contains: - ShimFlushCache - '#250' selection2a: CommandLine|contains|all: - rundll32 - kernel32.dll selection2b: CommandLine|contains: - BaseFlushAppcompatCache - '#46' condition: ( selection1a and selection1b ) or ( selection2a and selection2b ) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation CLIP+ Launcher - PowerShell id: 73e67340-0d25-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+" condition: selection_4104 falsepositives: - Unknown level: high
Query: CVE similar to CVE-2015-0063
Matching passage: CVE-2015-0063. CWE: CWE-399. CVSS: 9.300000190734863. Microsoft Excel 2007 SP3; the proofing tools in Office 2010 SP2; Excel 2010 SP2; Excel 2013 Gold, SP1, and RT; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Excel Remote Code Execution Vulnerability."
Near-miss passage: CVE-2015-8003. CWE: CWE-399. CVSS: 6.800000190734863. MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads.
Query: write Sigma for Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.
Matching passage: Sigma rule: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.. Logsource: windows / security. Rule: title: Suspicious Scheduled Task Creation id: 3a734d25-df5c-4b99-8034-af1ddb5883a4 status: test description: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2022-12-07 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection_eid: EventID: 4698 selection_paths: TaskContent|contains: - \AppData\Local\Temp\ - \AppData\Roaming\ - \Users\Public\ - \WINDOWS\Temp\ - C:\Temp\ - \Desktop\ - \Downloads\ - \Temporary Internet - C:\ProgramData\ - C:\Perflogs\ selection_commands: TaskContent|contains: - regsvr32 - rundll32 - cmd.exe</Command> - cmd</Command> - '<Arguments>/c ' - '<Arguments>/k ' - '<Arguments>/r ' - powershell - pwsh - mshta - wscript - cscript - certutil - bitsadmin - bash.exe - 'bash ' - scrcons - 'wmic ' - wmic.exe - forfiles - scriptrunner - hh.exe condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects calls to hidden files or files located in hidden directories in NIX systems.. Logsource: linux / auditd. Rule: title: Use Of Hidden Paths Or Files id: 9e1bef8d-0fff-46f6-8465-9aa54e128c1e related: - id: d08722cd-3d09-449a-80b4-83ea2d9d4616 type: similar status: test description: Detects calls to hidden files or files located in hidden directories in NIX systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md author: David Burkett, @signalblur date: 2022-12-30 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: linux service: auditd detection: selection: type: PATH name|contains: /. filter: name|contains: - /.cache/ - /.config/ - /.pyenv/ - /.rustup/toolchains condition: selection and not filter falsepositives: - Unknown level: low
Query: vulnerability: QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file
Matching passage: CVE-2015-3790. CWE: CWE-119. CVSS: 6.800000190734863. QuickTime 7 in Apple OS X before 10.10.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted file, a different vulnerability than CVE-2015-3765, CVE-2015-3779, CVE-2015-3788, CVE-2015-3789, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751, CVE-2015-5753, and CVE-2015-5779.
Near-miss passage: CVE-2015-3906. CWE: CWE-119. CVSS: 5.0. The logcat_dump_text function in wiretap/logcat.c in the Android Logcat file parser in Wireshark 1.12.x before 1.12.5 does not properly handle a lack of \0 termination, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted message in a packet, a different vulnerability than CVE-2015-3815.
Query: Sigma YAML for windows / registry_set
Matching passage: Sigma rule: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be. Logsource: windows / registry_set. Rule: title: Potential Persistence Via MyComputer Registry Keys id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06 status: test description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example) references: - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2024-01-11 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\Explorer\MyComputer TargetObject|endswith: (Default) condition: selection falsepositives: - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for level: high
Near-miss passage: Sigma rule: Detects the addition of a new user to a privileged group such as "root" or "sudo". Logsource: linux. Rule: title: Privileged User Has Been Created id: 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e status: test description: Detects the addition of a new user to a privileged group such as "root" or "sudo" references: - https://digital.nhs.uk/cyber-alerts/2018/cc-2825 - https://linux.die.net/man/8/useradd - https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid author: Pawel Mazur date: 2022-12-21 modified: 2025-01-21 tags: - attack.privilege-escalation - attack.persistence - attack.t1136.001 - attack.t1098 logsource: product: linux definition: /var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work detection: selection_new_user: - new user selection_uids_gids: - GID=0, - UID=0, - GID=10, - GID=27, condition: all of selection_* falsepositives: - Administrative activity level: high
Query: describe CVE-2015-1338
Matching passage: CVE-2015-1338. CWE: CWE-59. CVSS: 7.199999809265137. kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
Near-miss passage: CVE-2015-3436. CWE: CWE-59. CVSS: 6.599999904632568. provider/server/ECServer.cpp in Zarafa Collaboration Platform (ZCP) before 7.1.13 and 7.2.x before 7.2.1 allows local users to write to arbitrary files via a symlink attack on /tmp/zarafa-upgrade-lock.
Query: write Sigma for Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passco
Matching passage: Sigma rule: Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passco. Logsource: cisco / duo. Rule: title: Cisco Duo Successful MFA Authentication Via Bypass Code id: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8 status: test description: 'Detects when a successful MFA authentication occurs due to the use of a bypass code. A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can''t use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems. ' references: - https://duo.com/docs/adminapi#logs - https://help.duo.com/s/article/6327?language=en_US author: Nikita Khalimonenkov date: 2024-04-17 tags: - attack.credential-access - attack.initial-access - attack.stealth logsource: product: cisco service: duo detection: selection: event_type: authentication reason: bypass_user condition: selection falsepositives: - Legitimate user that was assigned on purpose to a bypass group level: medium
Near-miss passage: Sigma rule: Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitra. Logsource: windows / process_creation. Rule: title: Visual Studio NodejsTools PressAnyKey Renamed Execution id: 65c3ca2c-525f-4ced-968e-246a713d164f related: - id: a20391f8-76fb-437b-abc0-dba2df1952c6 type: similar status: test description: Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries references: - https://twitter.com/mrd0x/status/1463526834918854661 - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5 author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-04-11 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: OriginalFileName: Microsoft.NodejsTools.PressAnyKey.exe filter_main_legit_name: Image|endswith: \Microsoft.NodejsTools.PressAnyKey.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: risk of Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause 
Matching passage: CVE-2015-3717. CWE: CWE-120. CVSS: 7.5. Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
Near-miss passage: CVE-2015-6692. CWE: CWE-120. CVSS: 5.0. Buffer overflow in Adobe Reader and Acrobat 10.x before 10.1.16 and 11.x before 11.0.13, Acrobat and Acrobat Reader DC Classic before 2015.006.30094, and Acrobat and Acrobat Reader DC Continuous before 2015.009.20069 on Windows and OS X allows attackers to obtain sensitive information via unspecified vectors.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the removal or uninstallation of an application via "Wmic.EXE".. Logsource: windows / process_creation. Rule: title: Application Removed Via Wmic.EXE id: b53317a0-8acf-4fd1-8de8-a5401e776b96 related: - id: 847d5ff3-8a31-4737-a970-aeae8fe21765 type: derived status: test description: Detects the removal or uninstallation of an application via "Wmic.EXE". references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-10---application-uninstall-using-wmic author: frack113 date: 2022-01-28 modified: 2024-07-02 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - call - uninstall condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: Application uninstall using WMIC technique: T1047 atomic_guid: c510d25b-1667-467d-8331-a56d3e9bc4ff regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_uninstall_application/info.yml
Near-miss passage: Sigma rule: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Mailbox Export to Share id: 889719ef-dd62-43df-86c3-768fb08dc7c0 status: test description: Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations references: - https://youtu.be/5mqid-7zp8k?t=2481 - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1 - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Florian Roth (Nextron Systems) date: 2021-08-07 modified: 2022-10-26 tags: - attack.exfiltration logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - New-MailboxExportRequest - ' -Mailbox ' - ' -FilePath \\\\' condition: selection falsepositives: - Unknown level: critical
Query: Sigma YAML for azure / activitylogs
Matching passage: Sigma rule: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen sourc. Logsource: azure / activitylogs. Rule: title: Rare Subscription-level Operations In Azure id: c1182e02-49a3-481c-b3de-0fadc4091488 status: test description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used. references: - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml author: sawwinnnaung date: 2020-05-07 modified: 2023-10-11 tags: - attack.t1003 - attack.credential-access logsource: product: azure service: activitylogs detection: keywords: - Microsoft.DocumentDB/databaseAccounts/listKeys/action - Microsoft.Maps/accounts/listKeys/action - Microsoft.Media/mediaservices/listKeys/action - Microsoft.CognitiveServices/accounts/listKeys/action - Microsoft.Storage/storageAccounts/listKeys/action - Microsoft.Compute/snapshots/write - Microsoft.Network/networkSecurityGroups/write condition: keywords falsepositives: - Valid change level: medium
Near-miss passage: Sigma rule: Detects potential DLL sideloading of "vivaldi_elf.dll". Logsource: windows / image_load. Rule: title: Potential Vivaldi_elf.DLL Sideloading id: 2092cacb-d77b-4f98-ab0d-32b32f99a054 status: test description: Detects potential DLL sideloading of "vivaldi_elf.dll" references: - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vivaldi_elf.dll filter_main_legit_path: Image|endswith: \Vivaldi\Application\vivaldi.exe ImageLoaded|contains: \Vivaldi\Application\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Query: Sigma rule for Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"
Matching passage: Sigma rule: Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64". Logsource: windows / ps_script. Rule: title: Powershell Install a DLL in System Directory id: 63bf8794-9917-45bc-88dd-e1b5abc0ecfd status: test description: Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64" references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-27 modified: 2024-01-22 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|re: (Copy-Item|cpi) .{2,128} -Destination .{1,32}\\Windows\\(System32|SysWOW64) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download addition. Logsource: windows / process_creation. Rule: title: Suspicious CertReq Command to Download id: 4480827a-9799-4232-b2c4-ccc6c4e9e12b status: experimental description: 'Detects a suspicious CertReq execution downloading a file. This behavior is often used by attackers to download additional payloads or configuration files. Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Certreq/ author: Christian Burkard (Nextron Systems) date: 2021-11-24 modified: 2025-10-29 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certreq.exe - OriginalFileName: CertReq.exe selection_cli_flag_post: CommandLine|contains|windash: -Post selection_cli_flag_config: CommandLine|contains|windash: -config selection_cli_http: CommandLine|contains: http condition: all of selection_* falsepositives: - Unlikely level: high