alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects PowerShell scripts set ACL to of a file or a folder
Matching passage: Sigma rule: Detects PowerShell scripts set ACL to of a file or a folder. Logsource: windows / ps_script. Rule: title: PowerShell Script Change Permission Via Set-Acl - PsScript id: cae80281-ef23-44c5-873b-fd48d2666f49 related: - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 type: derived - id: bdeb2cff-af74-4094-8426-724dc937f20a type: derived - id: 3bf1d859-3a7e-44cb-8809-a99e066d3478 type: derived status: test description: Detects PowerShell scripts set ACL to of a file or a folder references: - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.defense-impairment - attack.t1222 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|contains|all: - 'Set-Acl ' - '-AclObject ' - '-Path ' condition: selection falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights. Logsource: windows / process_creation. Rule: title: PsExec/PAExec Escalation to LOCAL SYSTEM id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 related: - id: 207b0396-3689-42d9-8399-4222658efc99 type: similar status: test description: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-23 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection_sys: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' selection_other: CommandLine|contains: - psexec - paexec - accepteula condition: all of selection_* falsepositives: - Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare) - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension level: high
Query: exploit Unspecified vulnerability in Oracle Java SE 8u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.
Matching passage: CVE-2015-4901. CWE: UNKNOWN. CVSS: 9.300000190734863. Unspecified vulnerability in Oracle Java SE 8u60 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX.
Near-miss passage: CVE-2015-4730. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL 5.6.20 and earlier allows remote authenticated users to affect availability via unknown vectors related to Types.
Query: alert when Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Matching passage: Sigma rule: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation). Logsource: windows / process_creation. Rule: title: Shell Process Spawned by Java.EXE id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 related: - id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d type: similar status: test description: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \bash.exe - \cmd.exe - \powershell.exe - \pwsh.exe filter_main_build: ParentImage|contains: build CommandLine|contains: build condition: selection and not 1 of filter_main_* falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: medium
Near-miss passage: Sigma rule: Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat serv. Logsource: windows / file_event. Rule: title: Suspicious File Write to Webapps Root Directory id: 89c42960-f244-4dad-9151-ae9b1a3287a2 status: experimental description: 'Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers. This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts. ' references: - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-20 tags: - attack.persistence - attack.t1505.003 - attack.initial-access - attack.t1190 logsource: product: windows category: file_event detection: selection_susp_img: Image|endswith: - \dotnet.exe - \w3wp.exe - \java.exe selection_servers: TargetFilename|contains: - \apache - \tomcat selection_path: TargetFilename|contains: \webapps\ROOT\ selection_susp_extensions: TargetFilename|endswith: .jsp condition: all of selection_* falsepositives: - Unknown level: medium
Query: risk of Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a diffe
Matching passage: CVE-2015-4931. CWE: CWE-119. CVSS: 10.0. Stack-based buffer overflow in the server in IBM Tivoli Storage Manager FastBack 6.1 before 6.1.12.1 allows remote attackers to execute arbitrary code via a crafted packet, a different vulnerability than CVE-2015-4932, CVE-2015-4933, CVE-2015-4934, and CVE-2015-4935.
Near-miss passage: CVE-2015-8382. CWE: CWE-119. CVSS: 6.400000095367432. The match function in pcre_exec.c in PCRE before 8.37 mishandles the /(?:((abcd))|(((?:(?:(?:(?:abc|(?:abcdef))))b)abcdefghi)abc)|((*ACCEPT)))/ pattern and related patterns involving (*ACCEPT), which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (partially initialized memory and application crash) via a crafted regular expression, as demonstrated by a JavaScript RegExp object encountered by Konqueror, aka ZDI-CAN-2547.
Query: patch priority for CVE-2015-8358
Matching passage: CVE-2015-8358. CWE: CWE-22. CVSS: 9.0. Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execute arbitrary local files via a .. (dot dot) in the element name of the "work" array parameter to admin/bitrix.mpbuilder_step2.php.
Near-miss passage: CVE-2015-7669. CWE: CWE-22. CVSS: 9.800000190734863. Multiple directory traversal vulnerabilities in (1) includes/MapImportCSV2.php and (2) includes/MapImportCSV.php in the Easy2Map plugin before 1.3.0 for WordPress allow remote attackers to include and execute arbitrary files via the csvfile parameter related to "upload file functionality."
Query: CVE similar to CVE-2015-0599
Matching passage: CVE-2015-0599. CWE: CWE-254. CVSS: 4.300000190734863. The web interface in Cisco Integrated Management Controller in Cisco Unified Computing System (UCS) on C-Series Rack Servers does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCuf50138.
Near-miss passage: CVE-2015-1281. CWE: CWE-254. CVSS: 4.300000190734863. core/loader/ImageLoader.cpp in Blink, as used in Google Chrome before 44.0.2403.89, does not properly determine the V8 context of a microtask, which allows remote attackers to bypass Content Security Policy (CSP) restrictions by providing an image from an unintended source.
Query: CVE similar to CVE-2015-5463
Matching passage: CVE-2015-5463. CWE: CWE-285. CVSS: 9.800000190734863. AxiomSL's Axiom java applet module (used for editing uploaded Excel files and associated Java RMI services) 9.5.3 and earlier allows remote attackers to (1) access data of other basic users through arbitrary SQL commands, (2) perform a horizontal and vertical privilege escalation, (3) cause a Denial of Service on global application, or (4) write/read/delete arbitrary files on server hosting the application.
Near-miss passage: CVE-2015-10033. CWE: CWE-285. CVSS: 6.5. A vulnerability, which was classified as problematic, was found in jvvlee MerlinsBoard. This affects an unknown part of the component Grade Handler. The manipulation leads to improper authorization. The identifier of the patch is 134f5481e2914b7f096cd92a22b1e6bcb8e6dfe5. It is recommended to apply a patch to fix this issue. The identifier VDB-217713 was assigned to this vulnerability.
Query: CVE similar to CVE-2015-8437
Matching passage: CVE-2015-8437. CWE: UNKNOWN. CVSS: 9.300000190734863. Use-after-free vulnerability in the Selection object implementation in Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before 20.0.0.228 on Windows and OS X and before 11.2.202.554 on Linux, Adobe AIR before 20.0.0.204, Adobe AIR SDK before 20.0.0.204, and Adobe AIR SDK & Compiler before 20.0.0.204 allows attackers to execute arbitrary code via a crafted setFocus call, a different vulnerability than CVE-2015-8048, CVE-2015-8049, CVE-2015-8050, CVE-2015-8055, CVE-2015-8056, CVE-2015-8057, CVE-2015-8058, CVE-2015-8059, CVE-2015-8061, CVE-2015-8062, CVE-2015-8063, CVE-2015-8064, CVE-2015-8065, CVE-2015-8066, CVE-2015-8067, CVE-2015-8068, CVE-2015-8069, CVE-2015-8070, CVE-2015-8071, CVE-2015-8401, CVE-2015-8402, CVE-2015-8403, CVE-2015-8404, CVE-2015-8405, CVE-2015-8406, CVE-2015-8410, CVE-2015-8411, CVE-2015-8412, CVE-2015-8413, CVE-2015-8414, CVE-2015-8420, CVE-2015-8421, CVE-2015-8422, CVE-2015-8423, CVE-2015-8424, CVE-2015-8425, CVE-2015-8426, CVE-2015-8427, CVE-2015-8428, CVE-2015-8429, CVE-2015-8430, CVE-2015-8431, CVE-2015-8432, CVE-2015-8433, CVE-2015-8434, CVE-2015-8435, CVE-2015-8436, CVE-2015-8441, CVE-2015-8442, CVE-2015-8447, CVE-2015-8448, CVE-2015-8449, CVE-2015-8450, CVE-2015-8452, and CVE-2015-8454.
Near-miss passage: CVE-2015-4913. CWE: UNKNOWN. CVSS: 3.5. Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and 5.6.26 and earlier allows remote authenticated users to affect availability via vectors related to Server : DML, a different vulnerability than CVE-2015-4858.
Query: risk of QuickLook in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted iWork fil
Matching passage: CVE-2015-7107. CWE: CWE-119. CVSS: 6.800000190734863. QuickLook in Apple iOS before 9.2 and OS X before 10.11.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted iWork file.
Near-miss passage: CVE-2015-2740. CWE: CWE-119. CVSS: 10.0. Buffer overflow in the nsXMLHttpRequest::AppendToResponseText function in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 might allow remote attackers to cause a denial of service or have unspecified other impact via unknown vectors.
Query: risk of The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
Matching passage: CVE-2015-9435. CWE: CWE-338. CVSS: 9.800000190734863. The oauth2-provider plugin before 3.1.5 for WordPress has incorrect generation of random numbers.
Near-miss passage: CVE-2015-4633. CWE: CWE-89. CVSS: 9.800000190734863. Multiple SQL injection vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow (1) remote attackers to execute arbitrary SQL commands via the number parameter to opac-tags_subject.pl in the OPAC interface or (2) remote authenticated users to execute arbitrary SQL commands via the Filter or (3) Criteria parameter to reports/borrowers_out.pl in the Staff interface.
Query: alert when Detects Obfuscated Powershell via RUNDLL LAUNCHER
Matching passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell id: e6cb92b4-b470-4eb8-8a9d-d63e8583aae0 status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection_4104 falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is. Logsource: windows / process_access. Rule: title: Potential Credential Dumping Activity Via LSASS id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da status: test description: 'Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature. ' references: - https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md - https://research.splunk.com/endpoint/windows_possible_credential_dumping/ author: Samir Bousseaden, Michael Haag date: 2019-04-03 modified: 2026-06-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess|contains: - '0x1038' - '0x1438' - '0x143a' - '0x1fffff' CallTrace|contains: - dbgcore.dll - dbghelp.dll - kernel32.dll - kernelbase.dll - ntdll.dll filter_main_system_user: SourceUser|contains: - AUTHORI - AUTORI filter_optional_thor: CallTrace|contains|all: - :\Windows\Temp\asgard2-agent\ - \thor\thor64.exe+ - '|UNKNOWN(' GrantedAccess: '0x103800' filter_optional_sysmon: SourceImage|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Query: describe CVE-2015-1404
Matching passage: CVE-2015-1404. CWE: CWE-79. CVSS: 4.300000190734863. Cross-site scripting (XSS) vulnerability in the Content Rating Extbase extension 2.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Near-miss passage: CVE-2015-1619. CWE: CWE-79. CVSS: 3.5. Cross-site scripting (XSS) vulnerability in the Secure Web Mail Client user interface in McAfee Email Gateway (MEG) 7.6.x before 7.6.3.2, 7.5.x before 75.6, 7.0.x through 7.0.5, 5.6, and earlier allows remote authenticated users to inject arbitrary web script or HTML via unspecified tokens in Digest messages.
Query: risk of The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Matching passage: CVE-2015-9295. CWE: CWE-79. CVSS: 6.099999904632568. The contact-form-plugin plugin before 3.96 for WordPress has XSS.
Near-miss passage: CVE-2015-9336. CWE: CWE-79. CVSS: 6.099999904632568. The clean-login plugin before 1.5.1 for WordPress has reflected XSS.
Query: threat report mentioning Cloud Service Hijacking
Matching passage: T1496.004 Cloud Service Hijacking. Tactics: impact. Description: Adversaries may leverage compromised software-as-a-service (SaaS) applications to complete resource-intensive tasks, which may impact hosted service availability. For example, adversaries may leverage email and messaging services, such as AWS Simple Email Service (SES), AWS Simple Notification Service (SNS), SendGrid, and Twilio, in order to send large quantities of spam / [Phishing](https://attack.mitre.org/techniques/T1566) emails and SMS messages.(Citation: Invictus IR DangerDev 2024)(Citation: Permiso SES Abuse 2023)(Citation: SentinelLabs SNS Sender 2024) Alternatively, they may engage in LLMJacking by leveraging reverse proxies to hijack the power of cloud-hosted AI models.(Citation: Sysdig LLMJacking 2024)(Citation: Lacework LLMJacking 2024) In some cases, adversaries may leverage services that the victim is already using. In others, particularly when the service is part of a larger cloud platform, they may first enable the service.(Citation: Sysdig LLMJacking 2024) Leveraging SaaS applications may cause the victim to incur significant financial costs, use up service quotas, and otherwise impact availability.
Near-miss passage: T1496.003 SMS Pumping. Tactics: impact. Description: Adversaries may leverage messaging services for SMS pumping, which may impact system and/or hosted service availability.(Citation: Twilio SMS Pumping) SMS pumping is a type of telecommunications fraud whereby a threat actor first obtains a set of phone numbers from a telecommunications provider, then leverages a victim’s messaging infrastructure to send large amounts of SMS messages to numbers in that set. By generating SMS traffic to their phone number set, a threat actor may earn payments from the telecommunications provider.(Citation: Twilio SMS Pumping Fraud) Threat actors often use publicly available web forms, such as one-time password (OTP) or account verification fields, in order to generate SMS traffic. These fields may leverage services such as Twilio, AWS SNS, and Amazon Cognito in the background.(Citation: Twilio SMS Pumping)(Citation: AWS RE:Inforce Threat Detection 2024) In response to the large quantity of requests, SMS costs may increase and communication channels may become overwhelmed.(Citation: Twilio SMS Pumping)
Query: exploit An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
Matching passage: CVE-2015-4664. CWE: CWE-20. CVSS: 9.800000190734863. An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
Near-miss passage: CVE-2015-5248. CWE: CWE-20. CVSS: 6.5. Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform.
Query: secure coding against Empty Code Block
Matching passage: CWE-1071 Empty Code Block. The source code contains a block that does not contain any code, i.e., the block is empty.
Near-miss passage: CWE-694 Use of Multiple Resources with Duplicate Identifier. The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
Query: explain CWE-402
Matching passage: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak'). The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
Near-miss passage: CWE-103 Struts: Incomplete validate() Method Definition. The product has a validator form that either does not define a validate() method, or defines a validate() method but does not call super.validate().
Query: exploit Use-after-free vulnerability in the Infobars implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified o
Matching passage: CVE-2015-6780. CWE: UNKNOWN. CVSS: 6.800000190734863. Use-after-free vulnerability in the Infobars implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site, related to browser/ui/views/website_settings/website_settings_popup_view.cc.
Near-miss passage: CVE-2015-0405. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in Oracle MySQL Server 5.6.22 and earlier allows remote authenticated users to affect availability via unknown vectors related to XA.
Query: exploit The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.
Matching passage: CVE-2015-6736. CWE: CWE-17. CVSS: 5.0. The Quiz extension for MediaWiki allows remote attackers to cause a denial of service via regex metacharacters in a regular expression.
Near-miss passage: CVE-2015-4943. CWE: CWE-17. CVSS: 5.300000190734863. IBM WebSphere MQ Light 1.x before 1.0.2 allows remote attackers to cause a denial of service (MQXR service crash) via a series of connect and disconnect actions, a different vulnerability than CVE-2015-4942.
Query: describe CVE-2015-5181
Matching passage: CVE-2015-5181. CWE: CWE-79. CVSS: 5.400000095367432. The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
Near-miss passage: CVE-2015-1475. CWE: CWE-79. CVSS: 4.300000190734863. Multiple cross-site scripting (XSS) vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) page or (2) category parameter to forum.php or the (3) page or (4) order parameter to (a) board_entry.php or (b) forum_entry.php.
Query: write Sigma for Detects Obfuscated Powershell via use Clip.exe in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Clip.exe in Scripts. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Via Use Clip id: e1561947-b4e3-4a74-9bdd-83baed21bdb5 status: test description: Detects Obfuscated Powershell via use Clip.exe in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2026-03-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: (?i)echo.*clip.*&&.*(?:Clipboard|i`?n`?v`?o`?k`?e`?) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects removing immutable file attribute.. Logsource: linux / auditd. Rule: title: Remove Immutable File Attribute - Auditd id: a5b977d6-8a81-4475-91b9-49dbfcd941f7 status: test description: Detects removing immutable file attribute. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Jakob Weinzettl, oscd.community date: 2019-09-23 modified: 2022-11-26 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux service: auditd detection: selection: type: EXECVE a0|contains: chattr a1|contains: -i condition: selection falsepositives: - Administrator interacting with immutable files (e.g. for instance backups). level: medium simulation: - type: atomic-red-team name: Remove immutable file attribute technique: T1222.002 atomic_guid: e7469fe2-ad41-4382-8965-99b94dd3c13f