src/__init__.py,sha256=4fcgGsDpTl46cA_FUR-0cVSp4WCoDfMY1bY6_7JnWTU,236
src/logging_config.py,sha256=YS9Ve_gUHT5TkmuTnAjRT0YaQVCNXrAGDR7KRrrO0Wo,20048
src/paths.py,sha256=9oD9OYF_-WbPA0Y30FVRhyBEXypkhSJNrRD7nStSYU4,5612
src/py.typed,sha256=ZSegze1ahS5tlaVlEVAF0HG-jTkkScOwTjUnglYQOS8,22
src/risk_config.py,sha256=zkpMS87ExJDEBHYLbwH7B2qXpjYfKQmqYN8NRI5jW3Y,2529
src/server.py,sha256=XnyHX9cCfKyrtbwB6m7CVjXwN43AQk2wpiYkmB1w3hQ,18672
src/transport_audit.py,sha256=DIujcCv5SKSoXjcdoUmhQhDPbpm5d8altdv2nEgU_Gw,4846
src/transport_security.py,sha256=4rjzH9cjgvgUmZApJDmM6NyUXnwE0FiO7k0m7Jq3_mM,5453
src/version.py,sha256=cID1jLnC_vj48GgMN6Yb1FA3JsQ95zNmCHmRYE8TFhY,22
src/agent/__init__.py,sha256=YCteGsBM9K8L7Q0_zk591Z68yZi9jM_jngnFpQkXkS4,68
src/agent/auth.py,sha256=eIlWegxFlHVEnUqyzbvWVpTyH9QTneE8hwX9IfM_BN8,20351
src/agent/config.py,sha256=vGkoYZ_ABppOQzYOPPPhxC9BTAyTOpmCRtlcOxOX_B4,3794
src/agent/loop.py,sha256=Q7jkw8G4cDwAG2YsAD2Izf90-7Nfx_fkOctCerrb394,10551
src/agent/mcp_bridge.py,sha256=Thw5QPiBn0a9QtpBJwmE9OC7c_lG4luCgNUHkp8fRoE,18366
src/agent/oauth_pkce.py,sha256=VUIdBmqA10ZSh5wnb8UTA9N4E0lpDxefgm3R5gx3dcE,8240
src/agent/prompts.py,sha256=ayLtr3woPqkPldM04V2PcLR06fLWXcjejL7tDFfK1RY,5150
src/agent/providers.py,sha256=sQFrSwvASRbrGXxHBzSy0iQSzoe853xpPfLH1Jp2Wd0,13330
src/cli/__init__.py,sha256=5Q0IcO_UV6DhZlRYddWYtzAN5J4gj9tRa0kF8wKGkKs,71
src/cli/main.py,sha256=JvrbTHRsScY3U9pnvE0XaeALrHJDjZdMtmrrhax4iyI,63488
src/clients/__init__.py,sha256=NFL6I1gv8MPNVN5LEjT_jtsKQUddHNk5nhdYFQId82w,6908
src/clients/base.py,sha256=NRcMsFEozRQtjxyiD12JnNqsja2V22k93npa8_xMiyQ,8898
src/clients/exceptions.py,sha256=-k7H1US8IolMdQSkB2rzjFVpQpnX_HVqU0MDxAB2FRA,10167
src/clients/velociraptor_client.py,sha256=_ZoOE5XBh4aB8av4U07zdsE6xnSWyKym7ArEdJ5eY_s,19324
src/clients/common/__init__.py,sha256=5D7LcD2oNl3ty7ulzVmS81GYIL-M6ROkELsQiQK5T8s,260
src/clients/common/alias.py,sha256=9Q0DU64A-yTZK1ohAdxW3_t1ctyQ8yJLlKtL9rDvFJM,796
src/clients/common/asset_discovery.py,sha256=Owln_GvCzjTEUyh6_AuZe8OSjADK0c3TJdKmdgM3fps,12066
src/clients/common/attack_catalog_data.py,sha256=ptlXY57APKgJJlAdfxhHJp1frJZYM6d_j83nANnBojk,27851
src/clients/common/attack_mapping.py,sha256=DGFVB0vGl6KzSJCz6rsOIGWU_Z0c7ZI3jS6PoZfrHlk,13301
src/clients/common/chainsaw_client.py,sha256=Jcff7zu3MMStYamPzWPh6R8luR-4Y44ExxgvswqMc4Y,21614
src/clients/common/client.py,sha256=BSR7lfSczeO-MHwYyb-vcdUp6DfCnEko_G1p_d9M5sU,1452
src/clients/common/cluster.py,sha256=6KccOyQcJfvb8zyCy23RTGF0dU3o0rrpDmZOgdpkoao,424
src/clients/common/cyber_kill_chain.py,sha256=UEo2O1kdQMksNYWKVtr4ttouF-GImFvmJFMI6nTS88c,39302
src/clients/common/data_stream.py,sha256=3eGDtwaLCHkEG6zoNJiSgo_xUxQSdlnkMZuRyZdf2o0,719
src/clients/common/deobfuscate.py,sha256=0iQwoZj8ahzewkSfEBjK1MDfJ3y6NRqeGIpn972yqTo,10647
src/clients/common/document.py,sha256=N4CwzBSA6zI6ZXYSHmCvtwMzScG7M3YTSSJABos9bSY,2912
src/clients/common/eql_query.py,sha256=m0V_op0Uwqh9VaJ7-SEevoSfB10uEqG3AcFxwRe3d4A,8659
src/clients/common/esql_capabilities.py,sha256=0luLoZbxk5r1LWHfQMLZMKSfH7GbZbW7pfMTGh4v9W0,9579
src/clients/common/esql_client.py,sha256=2q3CHdKfNMXvCNrgxJZniVonFLrRBCBnuN8ZxTJM_LY,42362
src/clients/common/field_mapper.py,sha256=K5-bEzvwhqzNRdTC5V0VvB3wJI34jS4rHSB3-sbXx8o,25442
src/clients/common/general.py,sha256=oDPHDc_M1X3A2AeCBIpB3rkn1i7z4CQwvzSMc_3IvaI,470
src/clients/common/hunting_rule_loader.py,sha256=NJRxng04DormN71iPXOblSZ_Q0xXAuvdOA2uz8Edenk,7971
src/clients/common/index.py,sha256=RHDEg4BVt6_7PUrFm7YgzLIShSvxC-i__Yn3GX57_Jc,781
src/clients/common/investigation_prompts.py,sha256=cs3qPj0WZAs3ioI1UMu6-JjcKPYMy-fhVIDfUHbZnnI,21373
src/clients/common/ioc_analysis.py,sha256=69Df_rgNX_nUgQsEMWOkq0PmGHtbylqrd1RKnBdZYPw,49012
src/clients/common/misp_client.py,sha256=BJedb2tbXieMMnXaxtYVQv2iUc-Dh04RNspddiLBgmU,8377
src/clients/common/osquery_client.py,sha256=CZmsKmqzaazwooMi6X0VX3D6nMTEq16-TeEm8_YUbF0,8502
src/clients/common/rule_loader.py,sha256=3gHA8ncdArlghHNt9Hgd9zr3IkD8jvJ-8xtQr-GEYbc,26881
src/clients/common/threat_hunting.py,sha256=ktzBBmQrLK6yYHUB0S3HGjaX3LmCsUXXYDVoLgrphzw,32389
src/clients/common/threat_intel.py,sha256=I6g0k5VO4S8trqjgBcLHPVQ6ay61n7i4oIxD1yAic8s,16777
src/clients/common/schemas/__init__.py,sha256=LpzeITtpD1rqTAJW28nogKsUzNQfd7B-oeLn7hPiRJM,919
src/clients/common/schemas/auditd.py,sha256=ZkcWaaAe7HUtNEOSKtLJ9NRKhWVNfrwJiB8woxCM96Y,3637
src/clients/common/schemas/base.py,sha256=0NEZODv2VpSKYe0pXiAIvow5gCKKLCvZCtAq4yF5a58,10813
src/clients/common/schemas/ecs.py,sha256=68Pn2JWGW5F9N62f8o_YGorcsU0LfIbz_7o-Gzdp--Q,9161
src/clients/common/schemas/loader.py,sha256=z_0MX7xDGw8zG2s9XzMYgtxUMVL16HlijaQJ0VdicA4,4371
src/clients/common/schemas/query_builder.py,sha256=SwvJ4AppjZjUYQlspj8l6vWvPXokjmpS4n2PbBawrQg,24611
src/clients/common/schemas/registry.py,sha256=JM32hF3gl705a7tpwuMoU6nbOyWqXi5iqm8tF5v3Df0,10974
src/clients/common/schemas/sysmon.py,sha256=ibjWYKKIodK-nsUn-lOa_F17P00mY-e-C2DVqSCV8KY,19722
src/clients/common/schemas/windows_security.py,sha256=IgxcTR4z3JVRIhr5uJzUkmJMRYmIDtqngel9oH8A3SI,18370
src/clients/common/schemas/defs/aws_cloudtrail.json,sha256=pAskJONE-25m9TSVfAo6YIJ3ZaNfUlJnERXobNdXEAI,1521
src/clients/common/schemas/defs/filebeat_system.json,sha256=ddpzXWSmvgO_bYYHgRxcP-r2K6RMQFdbmcHvcNs4XWs,1863
src/clients/common/schemas/defs/packetbeat.json,sha256=ictPBCNuhO3XFsW0ves_YXQiS6NwU7DFOh23HpKi6LQ,2251
src/clients/common/schemas/defs/zeek.json,sha256=vI3kcWJJ5duXXH3XocNSl-HP5WiuxpI2GxPVr3BSzdA,2206
src/config/__init__.py,sha256=5UacG9LWvuU4b13ccikElIHX1IHVFBQIYhqWMbiF7Z0,47
src/config/connectors.py,sha256=f2QDWHZ2CMAptteP8uqU1frfuJZygS5ZSNFT2ilE0lc,21869
src/storage/__init__.py,sha256=QJXKXfdgiXWmJP8KvCDx_TVw4zAQUSGHa_p4uq4bEHg,1255
src/storage/auto_capture.py,sha256=aGGVzDzGBv8cHNAuZGaXmiqMdFXYhfjaQkGDeIPAR1w,15096
src/storage/config.py,sha256=X7W-yh_yS7nCU1W2TD8JKoKyyVbDbeWciZK3zYptVAA,5569
src/storage/investigation_state.py,sha256=ouetG3g192rmDiLOde3q2P1u4d5G4GR_LfsoIRVZNms,44394
src/storage/models.py,sha256=DGDjZya2SpRzpoquuZW7jxp7976lLM_58S9RvFCXARw,15071
src/storage/smart_extractor.py,sha256=qdNVbcJLuL-sZz8Exy0gancsDgaXsF2OzCG_kTWZdI4,59476
src/storage/storage_manager.py,sha256=RvVv4x44fUUqUsLaXsM8b_ifdQYVeXKG0rwvnZiYRSA,13628
src/tools/__init__.py,sha256=bxJT3xQUPLebljezV2q41PVN81B48EjopF2yNTEkKRs,439
src/tools/alias.py,sha256=U7RPpM6ZjFOhyXfwES51ydI3NxP--uuB6viznXuq6Ow,1383
src/tools/asset_discovery.py,sha256=6jvW-onVSzIfEPtpwT759bvCYOGCtBWDWoDeIO1R1aY,2715
src/tools/chainsaw_hunting.py,sha256=dkeychrVX3gBodfYDc0b-bffHRsNPdSJQE5tvB6yum0,34975
src/tools/cluster.py,sha256=IVygzTv4xZvk_RTpky6wO1MIYm0lj0wDx43dRmrr8AM,616
src/tools/cross_correlation.py,sha256=nF63YkbdUii8kKzbpepJXxGwoUIqs-1ZuiYj-ygJ1lY,33733
src/tools/data_stream.py,sha256=ANjA30_h0yBq9alKoddOzcjtJobmXrGVEMbqJshKv2M,1730
src/tools/dfir_resources.py,sha256=JzH2AnBnR3NKJntiULralhV38MNoSMIq27vwQR6JmbI,18020
src/tools/document.py,sha256=5llN8qelZKkKY54UCMPCZhGkSqq9hjhgoXuv9LAXpc0,1974
src/tools/eql_query.py,sha256=3oMLfyyLhG1s8cvjTC-uOP9jdqYPRMpfVvUvg9PlvpM,2635
src/tools/esql_hunting.py,sha256=rOcu9qyTZ9fiWSFCYsAn624wAC8q8PWKK6J-F8mJq6Q,61201
src/tools/general.py,sha256=XcbWGO9SP8rfalIJqeV1-1VI8ewqYXe5uVv5r84dWvM,817
src/tools/index.py,sha256=DvCJ6a6B0TxxHK19LAANG6H4885q9S1jyewa_vmipGg,1318
src/tools/investigation_prompts.py,sha256=zZqojgjrtRDGtnOs9W7ATP-XqeR4hm6CFpvMH5Pf4Dc,17408
src/tools/investigation_state_tools.py,sha256=69qJrs1tzk9Aaw2PQXB98PUSNHNzpQNV1Af8D-SIDjQ,24694
src/tools/ioc_analysis.py,sha256=qM_gaYu3HqReXbb9BhsbkFQ_tENcYy6EdWMPru0-2WI,19521
src/tools/osquery_tools.py,sha256=yrG1uQRuiz-Nf3efXDGGuJBULwhhPty7ETtAJy0vFY4,7004
src/tools/register.py,sha256=Rejdolu3olg_5uUuKwdTmeImTPq7Q5Gu8W36LFGm4IQ,3269
src/tools/rule_management.py,sha256=tikXqSb47RgBaSPrry4aUo_fAtvlW5NC3Hsohek-Jxg,47356
src/tools/schema_resources.py,sha256=e6_FQqZVupnAkZcbdzuycQe_bUQ4j4CP44mc_uw-4Nw,22936
src/tools/smart_search.py,sha256=wk-cwzyVmZfXqBSUnJ7_bAAAoo9L9wZEGwARLxUd-Yo,39537
src/tools/status_tools.py,sha256=sajxR7inIFYX7SLRaa-bGWPaYUn_JEfTcEJxUs0fK3E,1978
src/tools/threat_hunting.py,sha256=KQpVbREh83zTLdpWIPQ8oCmM0B40FG-YO6FLLQWoRG8,31140
src/tools/threat_intel.py,sha256=-pPMxmFWD1OvZzIzBuTCAfKIuooQHhyXqmUMR-8WBg0,18703
src/tools/velociraptor_tools.py,sha256=y_zYbx7c6r7CmoQyvYWccczTdayvtj9ULM15lOCfgdg,38780
src/tools/wireshark_tools.py,sha256=NYGyhKxr3QjaOqbp-7ObqZzGEk8BqoVVS9_Jsu4wc6g,35987
src/tools/workflow_guidance.py,sha256=O5LVI-WkN6XZq8nA__lTTty6UZ9axbjqGQKo55nGn0U,19272
src/utils/__init__.py,sha256=q2vyUzMqT-GTEEN0raExn1thU-Ph2Z1V3JeAAKGIA4g,640
src/utils/query_sanitizer.py,sha256=HjdVpJa7neaXaGYiVUbmq6oCRlZ6kxQHvY9cZ8UEEco,2877
src/utils/response_handler.py,sha256=i41oYofgI0w2BKlE6JzD9UAKwIWA4S-kV28Fbd0e7xY,22904
src/wireshark/__init__.py,sha256=OmXqvYOtjpAHecNWpY0vO7M9dENfULX-vgayXQy5KOk,93
src/wireshark/config.py,sha256=f6O6d9bLTxEqyKtlc5X9bCdMdKxWJRUnBWo3LR8C8OQ,2492
src/wireshark/models.py,sha256=Gl0kJ_AMphndvV0VX-00zlU5GbhsRcNnW9uOTNAwoiI,4065
src/wireshark/baseline/__init__.py,sha256=B6Y1cNaLZLbXf44MOktNFSU7aG5b75ilOIKwURx67vo,48
src/wireshark/baseline/baseline_builder.py,sha256=P3EKD5UNbkxKE8NwPlDawRsOR1XpMsph7-caeP2rq_0,7457
src/wireshark/baseline/baseline_store.py,sha256=1e7BAFzqvwpfZMDLVysitjBwg9_KD1tCBbnp7VqSn3Q,3149
src/wireshark/baseline/defaults.py,sha256=SSvU-rxdBssrZzYD3GyRmaUPm8Z6p4IAweQUVwFtw88,5319
src/wireshark/core/__init__.py,sha256=dhMNDis3AxaiXtLPDuHF5BkZKdnSltVzeM3GHA9l-ds,39
src/wireshark/core/pcap_analyzer.py,sha256=Qkn-XD0QGQP1C5GccYduG70nfduZaZXSnP74Jig7kg8,13936
src/wireshark/core/tshark_executor.py,sha256=Pv0_4IFnnh_780iEk0pOrTFyA_7drXpj9WjgBJRxchM,7632
src/wireshark/extraction/__init__.py,sha256=PF3C9738df6auERBqL-kiqQyoCV9AxLmyPVNgu6nGQk,258
src/wireshark/extraction/hasher.py,sha256=7LFy74b2Jg6VwegUifOQJ2WeKNhNz0Cm6LuhcEm8U-U,11392
src/wireshark/extraction/object_extractor.py,sha256=w2YSvpe0XU0L6Ri8iyBKxnlE5OAnmJyLVh8UwZuIU-o,13060
src/wireshark/hunting/__init__.py,sha256=Q5ZrYZmp8K6UgEcFrDSHLm9JqFZJWxJAyEiwpY1rxMQ,518
src/wireshark/hunting/anomaly_detector.py,sha256=qpYNqG11X8ZG9SQ7qWCvg-ahzwiNKWbpTRIKD_pqtpc,11676
src/wireshark/hunting/beaconing_detector.py,sha256=59zTL86tfW-q06SS94L0YRNt2ektfvd1GQSlYOKhX8o,11789
src/wireshark/hunting/ioc_hunter.py,sha256=GFla2hxsYZECZxWad4edR3Y2_L1QWuB-0GBfPBqztYo,10629
src/wireshark/hunting/lateral_movement.py,sha256=uek0G2qMuHnDRxhqhSma1rweVueJjAohiXFpjfpOCns,14698
src/wireshark/hunting/session_tracker.py,sha256=5RQVYYiV0HgBhHOU32RJ5JQuCVOvw9LZLi-qfuIzBs0,11093
src/wireshark/reporting/__init__.py,sha256=S3BKJ2biwzYDN8UwWDqIRDcg06JrU5W3uIJCthfEfdE,255
src/wireshark/reporting/report_generator.py,sha256=SHbtTJhFUtfdzzHZuTau9fL5bXK8rqalna8gRoJ3Wkk,16656
src/wireshark/reporting/timeline_visualizer.py,sha256=PUuRhaFfBxCobdmAmtxUMLX9cFySbdE3ZVkj0A5r-70,9586
src/rules/application__bitbucket__audit__bitbucket_audit_full_data_export_triggered.eql,sha256=kESrZRWjzrNKpfaduVB6EN7Yl91s1pTw-EDPJ5pmQjE,95
src/rules/application__bitbucket__audit__bitbucket_audit_full_data_export_triggered.lucene,sha256=Fk9rDY5FIbyh5opQrn9wra9AjmgoQFlN7TsX-IruG0c,85
src/rules/application__bitbucket__audit__bitbucket_audit_full_data_export_triggered.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_global_permissions_change_detected.eql,sha256=186Eei5m39F3s3QNElIjUw5hKMf_jJqh-TROhLPnvl0,198
src/rules/application__bitbucket__audit__bitbucket_audit_global_permissions_change_detected.lucene,sha256=McEdKFxapkPcb4A1d35TSpDMEQ-yRJxvOxTvBUDr7_Y,187
src/rules/application__bitbucket__audit__bitbucket_audit_global_permissions_change_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_global_secret_scanning_rule_deleted.eql,sha256=bbksvGjBM-FR0pxW5CFR0hZiqb8TtwGEwf76z8w30YM,112
src/rules/application__bitbucket__audit__bitbucket_audit_global_secret_scanning_rule_deleted.lucene,sha256=Hch284IJoSFWRQKAMWGm6d3z5gHIc2brycsX0JjHH1E,103
src/rules/application__bitbucket__audit__bitbucket_audit_global_secret_scanning_rule_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_global_ssh_settings_change_detected.eql,sha256=KEPlCY3mWk0YU3VtYqqpC0C9vNY8OOhxL-lGP01-bec,97
src/rules/application__bitbucket__audit__bitbucket_audit_global_ssh_settings_change_detected.lucene,sha256=ExpVu4co4-Ss2srG5A25lDKI8rlahFVvtWITQeTqjGQ,86
src/rules/application__bitbucket__audit__bitbucket_audit_global_ssh_settings_change_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_log_configuration_update_detected.eql,sha256=DkCQKsbz3xl6z1kIVF-cbkYdA6FP_5rpp8C-5Zbs420,95
src/rules/application__bitbucket__audit__bitbucket_audit_log_configuration_update_detected.lucene,sha256=kUxF0Z28tpEGkdOX1_zcsQDnHwXqIn_rKzl84PCubEI,84
src/rules/application__bitbucket__audit__bitbucket_audit_log_configuration_update_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_project_secret_scanning_allowlist_added.eql,sha256=U59ybF7mZzbrG_QYRxd-7MUYjLpWI518k1Ir6XGrAnY,108
src/rules/application__bitbucket__audit__bitbucket_audit_project_secret_scanning_allowlist_added.lucene,sha256=b9077g_7ZwX5eFYIe6bZdk8BRUxcU7q31qfTRurx8Zc,99
src/rules/application__bitbucket__audit__bitbucket_audit_project_secret_scanning_allowlist_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_exempt_repository_detected.eql,sha256=adKNWz4Ibbrkbl170YiAy4t-qOTPXt5qZ6VUM8Gve3A,107
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_exempt_repository_detected.lucene,sha256=5p9UF0qtXOn9-u523lsBw_pYeAvBTJXWg1asUVsgi8k,97
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_exempt_repository_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_rule_deleted.eql,sha256=sHPFUCdEXbtTSNEUdEkKhKLc8-MC8I2oaP4-mpg01hc,179
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_rule_deleted.lucene,sha256=xqI789FZlPLBaqFOMEy3T42K84Imz-_wovyiDtWqdaA,161
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_rule_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_access_detected.eql,sha256=X140cGQbQ5UVmUIhdVFcptI3XfOZmSDHxPz4dTuVKiQ,97
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_access_detected.lucene,sha256=aSQMhl09bobNJnyOuhxD_F1HGrQGrDo3fRAJmguNb2U,87
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_access_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_full_data_export_triggered.eql,sha256=bwKLfoVjgznazD4_DMJSBBjPcR_3D1pOIcRTqc92_j8,108
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_full_data_export_triggered.lucene,sha256=HNlV67FFdTPSoHzNZmr5KQ5_rf9CpQ5zCMrEzH24jrQ,99
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_full_data_export_triggered.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_user_details_export_attempt_detected.eql,sha256=A0LcQkBJS-Pv0k2tP7ueAvTGEmA2Zx1tewZ3s1RmhM0,176
src/rules/application__bitbucket__audit__bitbucket_audit_user_details_export_attempt_detected.lucene,sha256=5fFK1qst2KQttZyJNaL3505xjjdTnlBhzC-MPUu5ABU,166
src/rules/application__bitbucket__audit__bitbucket_audit_user_details_export_attempt_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_detected.eql,sha256=D4LxOV58rR26qGJ23EIY_RnHDH04QNK71NNGF929zIg,87
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_detected.lucene,sha256=RxavI1AyojFgCp4PfABO-aoxmiD3un-VBqeLEZFIQ9I,75
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_via_ssh_detected.eql,sha256=0u4BL9ZYFI46fe_ee0xXKrLf4CLQvJbqDYvG1UkNXG0,92
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_via_ssh_detected.lucene,sha256=A6juFKaeJ-P5x1JQf8dC_KKcEIKZATu2S6auAG9pZ3U,82
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_via_ssh_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_user_permissions_export_attempt_detected.eql,sha256=t5e1_w2pPxhieYQoq08DvpL7fg6NBJxtq2MIvAyuZJc,164
src/rules/application__bitbucket__audit__bitbucket_audit_user_permissions_export_attempt_detected.lucene,sha256=FibonHBTTp96QW7oa7KYZvqv6y5UQz-ZhltH_qFd43g,154
src/rules/application__bitbucket__audit__bitbucket_audit_user_permissions_export_attempt_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__django__appframework_django_exceptions.eql,sha256=R1Cw_4rfmR3YOOYw2bxwtKdW3arJvh6iv88IRR3_AtE,313
src/rules/application__django__appframework_django_exceptions.lucene,sha256=9MZUR2SHX7ShkKK2CNEmg6D2vD4SOgs24j0pQNweyvE,303
src/rules/application__django__appframework_django_exceptions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_delete_action_invoked.eql,sha256=lYGHA-hMpK-E8GeMq5xj-i2ByC3A6L4gKUKkX33Lgfs,101
src/rules/application__github__audit__github_delete_action_invoked.lucene,sha256=bq9wvl0NNeOuIY-lOcTe7kErc5hvrRNgDCts2UiKNwE,83
src/rules/application__github__audit__github_delete_action_invoked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_disable_high_risk_configuration.eql,sha256=ax-ctJIx3ySmreBDXW5QDegvpJ8yBmnbxlRwmDmNPW0,507
src/rules/application__github__audit__github_disable_high_risk_configuration.lucene,sha256=va7_0rONVhX4KijbDkplSLVq3_GwRcwhFKrUslDwV-0,489
src/rules/application__github__audit__github_disable_high_risk_configuration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_disabled_outdated_dependency_or_vulnerability.eql,sha256=aSIpoxVU5ZowQrvbrYYCpoITpkgY7oNJKoQaVR9JXIg,223
src/rules/application__github__audit__github_disabled_outdated_dependency_or_vulnerability.lucene,sha256=o8iIu63stMBbwTFPy5XU1pc4s3MFYtk19v447T6B2tc,205
src/rules/application__github__audit__github_disabled_outdated_dependency_or_vulnerability.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_fork_private_repos_enabled_or_cleared.eql,sha256=s_1OFNYlVvheh1X0o-Ljt4RhsVC428iVfosHMM019Dk,97
src/rules/application__github__audit__github_fork_private_repos_enabled_or_cleared.lucene,sha256=z_vLgn5hi-HGv1MblCEugh_OeplQNO1y3XuzJPgElOU,79
src/rules/application__github__audit__github_fork_private_repos_enabled_or_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_new_org_member.eql,sha256=ogJ7oeQ3z5I2hfXpPlNKLGeyGUNqbf1Flgr69wh7_j0,63
src/rules/application__github__audit__github_new_org_member.lucene,sha256=DP_QDi_SO56WC58JYONHny78IF6kBh4GC4hdKAKPR0Q,45
src/rules/application__github__audit__github_new_org_member.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_new_secret_created.eql,sha256=kemn6Uou15qke603Qr5wOdzHd9Lbv0LWPYcpdst2HcU,155
src/rules/application__github__audit__github_new_secret_created.lucene,sha256=5fQRxm_taz7755Svy_xHw9Cuni8VYGLoivXnOpgmBqE,137
src/rules/application__github__audit__github_new_secret_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_outside_collaborator_detected.eql,sha256=D1d910JHiCGMX9xJimT8v5SMXY1fIpeQ7y5EzQvZJXY,93
src/rules/application__github__audit__github_outside_collaborator_detected.lucene,sha256=dqn_j4RjLHY6CvAuYsi6DxWDVbejqr1k6yZBsGfNsuI,75
src/rules/application__github__audit__github_outside_collaborator_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_pages_site_changed_to_public.eql,sha256=vn5ztOkYrR-LZwvwZnAHxPgz1GecCj-BCcKSm96gOzA,37
src/rules/application__github__audit__github_pages_site_changed_to_public.lucene,sha256=I5iZOiu-1_I8mJ6JzHaEGb3OwQj0dHpe7QmN2u9CdjI,25
src/rules/application__github__audit__github_pages_site_changed_to_public.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_push_protection_bypass_detected.eql,sha256=YG2fXWqBi-01ns_IaKHd_iLjSPn8ZGoGOXau4lMYD0w,60
src/rules/application__github__audit__github_push_protection_bypass_detected.lucene,sha256=J0cQb9Up0X9veyVv2i3qlcY4RUC1LfsRoPUSIW6_Jtw,48
src/rules/application__github__audit__github_push_protection_bypass_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_push_protection_disabled.eql,sha256=zntuocuHnijCqInhKhbnKcyC2jBz3l9OsdhwGvYNjJQ,448
src/rules/application__github__audit__github_push_protection_disabled.lucene,sha256=dJ4GoIxFqT4dZuRCcYnsBP8r89BDlvbG3V1YygSp8l0,430
src/rules/application__github__audit__github_push_protection_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_repo_or_org_transferred.eql,sha256=_PRBKqVnSaLk_ApIGVPsGTRVTexVQ8tLwEQvegrUr3E,111
src/rules/application__github__audit__github_repo_or_org_transferred.lucene,sha256=6vcHIMCZmWqfBiSuH-TxBklMETpecwc0S8mO9KE6pIg,93
src/rules/application__github__audit__github_repo_or_org_transferred.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_repository_archive_status_changed.eql,sha256=xI3mQ8B60wgDQygUJTzEcp6YW6q6z-7LX5Im-d-PXHc,60
src/rules/application__github__audit__github_repository_archive_status_changed.lucene,sha256=ZKvRQE3j-DIHF5ZN4jnyV1PdFir_tPxRpzETAoPIno0,42
src/rules/application__github__audit__github_repository_archive_status_changed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_secret_scanning_feature_disabled.eql,sha256=4HR9hXMOug-ZUoGMJ-iGXUGU5_Opp5II-YufWbGiB4Y,213
src/rules/application__github__audit__github_secret_scanning_feature_disabled.lucene,sha256=PV-_HF_qHFK-6G2psSlpxi4LuY3qAy9FJ96Z7Br7rLc,195
src/rules/application__github__audit__github_secret_scanning_feature_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_self_hosted_runner_changes_detected.eql,sha256=dBgb3RFmu5w5uER2osdJlWW-0g-DU8T5J1SzbRcUlw4,316
src/rules/application__github__audit__github_self_hosted_runner_changes_detected.lucene,sha256=wNOu6CHtKe_x0LjXIyKRjEDAPCB-pPIwU2NSpJd7j4g,298
src/rules/application__github__audit__github_self_hosted_runner_changes_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_ssh_certificate_config_changed.eql,sha256=tA1Hea6K-Y04t4a-XMoSZ6roYGglsIRkfuu6xoxjjjs,99
src/rules/application__github__audit__github_ssh_certificate_config_changed.lucene,sha256=oLd0AWy4Ljywuufp4ICuhc8BapSvFh95doyJpytQqAw,81
src/rules/application__github__audit__github_ssh_certificate_config_changed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_jndi_injection_exploitation_attempt.eql,sha256=uGUPPt43JYipmNM1j-ENSHWHHzCI7G9_3GSxT0-nnTI,82
src/rules/application__jvm__java_jndi_injection_exploitation_attempt.lucene,sha256=w0vtOzROqky9S_te5_JDhATVpSUFir_xcYWY7zIo5Ls,72
src/rules/application__jvm__java_jndi_injection_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_local_file_read.eql,sha256=1bwIOBILzElFYoZsu9C04AU-0-HZAPX-LEjy5x2GYhc,50
src/rules/application__jvm__java_local_file_read.lucene,sha256=wKEt6pmz6AsgR2AMLXDNnoJn0T8556WNVCYjZPYwNNo,43
src/rules/application__jvm__java_local_file_read.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_ognl_injection_exploitation_attempt.eql,sha256=OtlyQFYCDLtPBti77cCHCWyzyjaZoGhSg3Dj7DlnBc8,81
src/rules/application__jvm__java_ognl_injection_exploitation_attempt.lucene,sha256=viSdItA9Z6I-W0ZyyL0Mw9QCWo7-rz7yxbE5gaRmjK4,71
src/rules/application__jvm__java_ognl_injection_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_rce_exploitation_attempt.eql,sha256=VP1kB01wmmzP-vVoXBW2DS5rL9fgOi2tRRTrJnvNrQw,88
src/rules/application__jvm__java_rce_exploitation_attempt.lucene,sha256=nykrrJQibD4I-CXbHJuOpQOwKQQB7pURoP9R-ZVAeE8,80
src/rules/application__jvm__java_rce_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_xxe_exploitation_attempt.eql,sha256=BqVC9CDCnXLE9hd-iweEXIjMF93G5WV92dSmGZ5jITo,48
src/rules/application__jvm__java_xxe_exploitation_attempt.lucene,sha256=DO7V8wGhETiwez0_E_B3R6rdC3xO0n9NMc5Lf6Rn-AE,38
src/rules/application__jvm__java_xxe_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_change_admission_controller.eql,sha256=Xd8a9sJtMHhwGmWp0YClPfeHu6z5OCjZO1HxcLRqMRQ,228
src/rules/application__kubernetes__audit__kubernetes_audit_change_admission_controller.lucene,sha256=bh1Xcgh8LMEOS9VT9iNoCgp8jQomTMLxql_5RwWBbhI,200
src/rules/application__kubernetes__audit__kubernetes_audit_change_admission_controller.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_cronjob_modification.eql,sha256=x_FId32ulBAmAnKk7nU0kxi_llbepZpVtlSEQncsCZk,157
src/rules/application__kubernetes__audit__kubernetes_audit_cronjob_modification.lucene,sha256=cEFOE5AkW3A2145e_byJuK0RnHNaDqS6jtRwRnNy7Hk,129
src/rules/application__kubernetes__audit__kubernetes_audit_cronjob_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_deployment_deleted.eql,sha256=3Nz-64Q6RaPqAbKdcUFbkTk7pJAbE_sx7br_7Fsdvco,61
src/rules/application__kubernetes__audit__kubernetes_audit_deployment_deleted.lucene,sha256=G0MtNN7MecSdz7oMhY3YetvNAHXb-MmT4GO2LBLVRbs,47
src/rules/application__kubernetes__audit__kubernetes_audit_deployment_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_events_deleted.eql,sha256=u6nGCVX2_oDTSZ_qM87fivf_1ODiSsJKn8mbZ0wTqds,56
src/rules/application__kubernetes__audit__kubernetes_audit_events_deleted.lucene,sha256=blJErSwsCwBmhERJjmYZn_1CW3tijVWH1jXYW8_EpvU,42
src/rules/application__kubernetes__audit__kubernetes_audit_events_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_exec_into_container.eql,sha256=mzanqo-dtGGA2v41KHm57kfumB3CIwMrFGwJqUgOdIo,87
src/rules/application__kubernetes__audit__kubernetes_audit_exec_into_container.lucene,sha256=qnpqdb9xHVom3OHurTeTcosuE8rn-51IW10_IH2EaBc,71
src/rules/application__kubernetes__audit__kubernetes_audit_exec_into_container.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_hostpath_mount.eql,sha256=KKHogm2GUglcRHRYIy_nq0NfQsOkANbFo2Qe9-jQcGQ,71
src/rules/application__kubernetes__audit__kubernetes_audit_hostpath_mount.lucene,sha256=CzGDdV8OHUlCVkQ6s2nEHOmdDU_WMcOo_Ayp1zTe0rU,55
src/rules/application__kubernetes__audit__kubernetes_audit_hostpath_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_pod_in_system_namespace.eql,sha256=HwuZ8s-lL-BN47574XUMBZSp1renxd446BXwMKOY230,92
src/rules/application__kubernetes__audit__kubernetes_audit_pod_in_system_namespace.lucene,sha256=89vMfKJX5Y5NkvhhHvlasFglGjffoIPnhqivQfCAZBI,77
src/rules/application__kubernetes__audit__kubernetes_audit_pod_in_system_namespace.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_privileged_pod_creation.eql,sha256=UPDoLQPQnKtsaTgJamv0Ws48hez_47aeNcYXTc1p-3I,75
src/rules/application__kubernetes__audit__kubernetes_audit_privileged_pod_creation.lucene,sha256=nzIdVWbhhusjpAiFkhysuvZZombsgP5nhGX1KUuV8gk,59
src/rules/application__kubernetes__audit__kubernetes_audit_privileged_pod_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_rbac_permisions_listing.eql,sha256=SN6-lz29OsgJ8eOh5hJwitYY3qFZKwXvb849-qPpClI,109
src/rules/application__kubernetes__audit__kubernetes_audit_rbac_permisions_listing.lucene,sha256=vVnGRyPvDRv0snWDhtSP3rjZ2Sx-4gfTskDVujYdTyQ,93
src/rules/application__kubernetes__audit__kubernetes_audit_rbac_permisions_listing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_rolebinding_modification.eql,sha256=9lXmHLOC7jGYKRYeusljCiU_dydlrKYMW9kWmjAC2GU,196
src/rules/application__kubernetes__audit__kubernetes_audit_rolebinding_modification.lucene,sha256=fRxc_jgFB7RPrpZ8DPC4UNpBrWoITTQkKHCv-dmPfeE,168
src/rules/application__kubernetes__audit__kubernetes_audit_rolebinding_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_enumeration.eql,sha256=YI4EILrFfJA7-MPBUn-GskcY4iTegWEfs5aPS2CaNQs,55
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_enumeration.lucene,sha256=3FsZnNo_RTl7z0G4PhGrUUwbMurKzSEFZ1TjwdBYZpU,41
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_enumeration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_modified_or_deleted.eql,sha256=5-qtGwIKd99PR0xTln6NBdTmGu-dVxYlhJQqdoPRV_U,107
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_modified_or_deleted.lucene,sha256=zntIAl_AncyytIzduLVgChwVRpfV59XYG52cdPddBt4,87
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_modified_or_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_serviceaccount_creation.eql,sha256=7MIXYfBx7b6zxcOLL1OQ9EB_rlZwBZ2EfNzMmb8-oQA,65
src/rules/application__kubernetes__audit__kubernetes_audit_serviceaccount_creation.lucene,sha256=OrYBefU9m5Vg4bgO0qgBN8lKjUkhSpCt35PFxv8cZQw,51
src/rules/application__kubernetes__audit__kubernetes_audit_serviceaccount_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_sidecar_injection.eql,sha256=fg4-Ca80zcgiQBp_7Nc18VPrQkkDekRTrH3pdw9bzPE,80
src/rules/application__kubernetes__audit__kubernetes_audit_sidecar_injection.lucene,sha256=HBQZq15a79pbKHbk-SB06zD3KbgPCHC_rUbnRVb8jZY,64
src/rules/application__kubernetes__audit__kubernetes_audit_sidecar_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_unauthorized_unauthenticated_actions.eql,sha256=HW9_tlU3NJqORvv5qWPyeQT6kvM_JuDU4C0097ATwnk,47
src/rules/application__kubernetes__audit__kubernetes_audit_unauthorized_unauthenticated_actions.lucene,sha256=NRJCTjBM1c53kPoLiT-UkWry9oRtauq_bUv8CprwMOo,33
src/rules/application__kubernetes__audit__kubernetes_audit_unauthorized_unauthenticated_actions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__nodejs__nodejs_rce_exploitation_attempt.eql,sha256=TXIj_EFQmj-4pU6hmk9N8hQnyh1klOED_e7KQmXIn1k,31
src/rules/application__nodejs__nodejs_rce_exploitation_attempt.lucene,sha256=VE3ZmLuqA687zDMuQCWqdX-Ed7n2gF7dYgMT7Jcogmg,22
src/rules/application__nodejs__nodejs_rce_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_ftp_login_attempt.eql,sha256=9fI-eXhmsC8xc4nvnM1a-x6OGGqnOkzhXnJ08z11vgs,23
src/rules/application__opencanary__opencanary_ftp_login_attempt.lucene,sha256=DzEwWE8gr900jAyQga_MVliIAG8o1zD2CxW10QDitNw,13
src/rules/application__opencanary__opencanary_ftp_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_git_clone_request.eql,sha256=UTDdLk69SOXCpor733bv0yAhqqFaCcBActlo4RsmJFk,24
src/rules/application__opencanary__opencanary_git_clone_request.lucene,sha256=8YEntSVnkMCTNy3RhBSMFN6TOXuJPggNl6WoeYlxACc,14
src/rules/application__opencanary__opencanary_git_clone_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_http_get.eql,sha256=Ztyns9a4S38qgWIq_eotdz1x4xkQL3SxWx55MM6dMes,23
src/rules/application__opencanary__opencanary_http_get.lucene,sha256=frzT0e4mYnHuNQgsYZt3aUrjGZDDhG0m9ui72Mi4e7U,13
src/rules/application__opencanary__opencanary_http_get.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_http_post_login_attempt.eql,sha256=kTohMSA6WmosqK16TOYlaVwoWzRxJ7I7OugkjnAotiA,23
src/rules/application__opencanary__opencanary_http_post_login_attempt.lucene,sha256=jvMKgXwC82XKWoh5YNQ_b3_hv-XasUkMs86rl0bnnIQ,13
src/rules/application__opencanary__opencanary_http_post_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_httpproxy_login_attempt.eql,sha256=yey4gzBrqACrtybPAWO8GbMJdfmV4QWAH7FxOAYToqg,23
src/rules/application__opencanary__opencanary_httpproxy_login_attempt.lucene,sha256=Vs0m8-YSH4KLj3sZmeAKI56ka24INe3zFzueS7LHrL8,13
src/rules/application__opencanary__opencanary_httpproxy_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_mssql_login_sqlauth.eql,sha256=0X8xNsBLo-E2qwYvqhRXg6s7zMhZ3tCVLVTN3S7Yi5I,23
src/rules/application__opencanary__opencanary_mssql_login_sqlauth.lucene,sha256=gfHQtdANXuMyhjCCYZIB2Yls9wEewYTbfnzNvDiBPiw,13
src/rules/application__opencanary__opencanary_mssql_login_sqlauth.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_mssql_login_winauth.eql,sha256=Qcx_Hiq5vTCuwHZqllFePIznnYNG9c_I--A9DvlkOLw,23
src/rules/application__opencanary__opencanary_mssql_login_winauth.lucene,sha256=bD67b8u6zNR4oQQoT6fvgVqc655qyPWpuU4NAPK1tPs,13
src/rules/application__opencanary__opencanary_mssql_login_winauth.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_mysql_login_attempt.eql,sha256=NssxYCw8BebPJPT2NIcdWJnPliwoUcwUd6fLp7x3HQY,23
src/rules/application__opencanary__opencanary_mysql_login_attempt.lucene,sha256=Cnw1MTE-RfqCUB22oNo98Q48Wh-G7Zx0_jMpgwV9L9g,13
src/rules/application__opencanary__opencanary_mysql_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_ntp_monlist.eql,sha256=WU6vrzrAt898NhPQi50ui7Gp5muVrBOFhOaxf1BmQ44,24
src/rules/application__opencanary__opencanary_ntp_monlist.lucene,sha256=ApN4QuiJpVOJJlAlKsZA81DWSsS1Uw7xg4OBWcKLO_I,14
src/rules/application__opencanary__opencanary_ntp_monlist.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_redis_command.eql,sha256=plVCrCG8qZLZoh0nJ2ZN9z16JRXDXzIV5ObHPN6LMyY,24
src/rules/application__opencanary__opencanary_redis_command.lucene,sha256=yBE9OyFP-7E8VL_ZkO-BmaVEpblKRohYHjPNqhf5y4A,14
src/rules/application__opencanary__opencanary_redis_command.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_sip_request.eql,sha256=MctcUCRX2-Vj2yTRQLBRik7Z7lOtTIkGpK8wZCtk0Po,24
src/rules/application__opencanary__opencanary_sip_request.lucene,sha256=12BwZpQtYd4SUB1fOhdXZa9LcGgKd65i0c17c14E8iQ,14
src/rules/application__opencanary__opencanary_sip_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_smb_file_open.eql,sha256=E7WtMOQwwv8x4Lr5EL8mo4FhpDjZSRW9sRNwOf9yutM,23
src/rules/application__opencanary__opencanary_smb_file_open.lucene,sha256=1bThDLHsHmVwXO0vHrm1zLtROWSq6hiMAUWUQepEHDA,13
src/rules/application__opencanary__opencanary_smb_file_open.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_snmp_cmd.eql,sha256=gUu8E_BP0u0v-mB4nFiIXbHZ2vL_GZ6BXPeiT_Xi_4A,24
src/rules/application__opencanary__opencanary_snmp_cmd.lucene,sha256=ykXRsDzeS7DuuwIk8oVo6S_CuLRMYw1vMRCgpvjBm6s,14
src/rules/application__opencanary__opencanary_snmp_cmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_ssh_login_attempt.eql,sha256=0i_ZxbxFdxEkUcrOQkxnR6GISEkVFCrwIAumcD4jAw8,23
src/rules/application__opencanary__opencanary_ssh_login_attempt.lucene,sha256=t80MfVNDrE_LJ1SlSQAMKPd_Et6Kn-bzWDfwmIHZFzc,13
src/rules/application__opencanary__opencanary_ssh_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_ssh_new_connection.eql,sha256=Qvm30H9jxUZE7UO5WwDnAeagby16ODaf2IkZKE6MBtI,23
src/rules/application__opencanary__opencanary_ssh_new_connection.lucene,sha256=-DbG2-1A_tJ4VIxgzsrhLfbaWEOs6iOGcvXbQRM12N8,13
src/rules/application__opencanary__opencanary_ssh_new_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_telnet_login_attempt.eql,sha256=hPqK3jMqLBFkAp5GTI1bHSGuyiH5__EFFtHCuhdlMME,23
src/rules/application__opencanary__opencanary_telnet_login_attempt.lucene,sha256=zCiuqrRzm28CHvZoFiRiFfFznjyKafQYgAUb1NfIeBU,13
src/rules/application__opencanary__opencanary_telnet_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_tftp_request.eql,sha256=OwaF1-1sOXuWhA0LFlCmnEFL-T8P3v0vCe4Pr6u-Ov4,24
src/rules/application__opencanary__opencanary_tftp_request.lucene,sha256=fJGcsOdWHxuKlFTKao6lN-iUFgs-ghlWdWdnaQyNUZw,14
src/rules/application__opencanary__opencanary_tftp_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_vnc_connection_attempt.eql,sha256=eEgi4IDmQkmsEw_CDTYEnwilpteCmJX2lZYvZ55En8I,24
src/rules/application__opencanary__opencanary_vnc_connection_attempt.lucene,sha256=72toTKpdVfXVkm5i-X27L7jZc6TIyiGDM8fok4LMSzc,14
src/rules/application__opencanary__opencanary_vnc_connection_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__python__app_python_sql_exceptions.eql,sha256=cQ08Wh4o0mgoLbcA87u-z8tWIc0mzEuJIgTPHGaLLuM,86
src/rules/application__python__app_python_sql_exceptions.lucene,sha256=rBzlvc7ASFDM05yvlYr87EDmngmAQ_mqm5-Y1lb-rzA,76
src/rules/application__python__app_python_sql_exceptions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_atsvc_lateral_movement.eql,sha256=gym9Idm2aJ24yrLuSr79R0mM4tiuEqK9Z8Stl4dgGps,123
src/rules/application__rpc_firewall__rpc_firewall_atsvc_lateral_movement.lucene,sha256=Wm_m3wBcp4y-DWR2rktzTjtVxKdHMsF0obwv_4cm_o0,109
src/rules/application__rpc_firewall__rpc_firewall_atsvc_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_atsvc_recon.eql,sha256=w7w7OdcHgODrNpvS4jZhavGLTnfCeqFBYwMkpNWZINw,131
src/rules/application__rpc_firewall__rpc_firewall_atsvc_recon.lucene,sha256=gssMjpPhlwuCGW-x8aQwfg3VtqGtFOB1CB727eE3G4c,117
src/rules/application__rpc_firewall__rpc_firewall_atsvc_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_dcsync_attack.eql,sha256=3n4ddgD5DYNVqZHfYR4jDERf3sv87zK1wU7mvWhfejw,135
src/rules/application__rpc_firewall__rpc_firewall_dcsync_attack.lucene,sha256=dLk_xP-jwn0Lh62V9AOlakJ2ON9Tk6xcpNzFee48qGw,123
src/rules/application__rpc_firewall__rpc_firewall_dcsync_attack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_efs_abuse.eql,sha256=7Bz2cL-MydlG5jYGDaVwOrQPvPvALaaub9Uq-NTaT6U,148
src/rules/application__rpc_firewall__rpc_firewall_efs_abuse.lucene,sha256=ORMzYsULVwihe5W8o710CCW0QxNhefF9CL2ZqbLXh4Q,136
src/rules/application__rpc_firewall__rpc_firewall_efs_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_eventlog_recon.eql,sha256=0MnjigVELbeEK4z3DNAqP7he6T8f1F5Cy3Hop2paYKY,148
src/rules/application__rpc_firewall__rpc_firewall_eventlog_recon.lucene,sha256=GeV4S6lgqj32_m2Bp0a-TdrJXD-OlbOY4jJ0xu0--C0,136
src/rules/application__rpc_firewall__rpc_firewall_eventlog_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_lateral_movement.eql,sha256=jIxNpyFcBtMUDvpwGB5ZKGDMmc68NuAGllpqDoF5D9M,150
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_lateral_movement.lucene,sha256=E1WBBV_EPMZKsO9EyrtwcWnyMU7McCD8kEnXmMIVC2U,150
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_recon.eql,sha256=ElHm8nxBOsyhVl5eJTQvJ_rlEdWX0d0DRQo9xf9hDAo,158
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_recon.lucene,sha256=PW3shLtpIkxnyof3ap-_itPnv-NTnJZiEnxtqRlrmBE,158
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_printing_lateral_movement.eql,sha256=lEUDc9CMcTDM5s_bjJNe9cVk3CrpXxIl6mmb02x2QY0,228
src/rules/application__rpc_firewall__rpc_firewall_printing_lateral_movement.lucene,sha256=bCRa9ekcxMY81SFVQ0WSEnPBZQwrrSSgElbHQejUxt8,224
src/rules/application__rpc_firewall__rpc_firewall_printing_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_dcom_or_wmi.eql,sha256=_r_AnpBzRJJmMH6bLqDGAxRFOO8bH4UO-9VBIGTmRpg,308
src/rules/application__rpc_firewall__rpc_firewall_remote_dcom_or_wmi.lucene,sha256=uo0tUpI3RCf2SHe70J-zg2NNVXyxmgnDX7Xu12sXd14,312
src/rules/application__rpc_firewall__rpc_firewall_remote_dcom_or_wmi.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_lateral_movement.eql,sha256=8GQr23_Ru2cO2TezZfa0U9iIdOg9xA9tXb2c0xdxH1M,154
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_lateral_movement.lucene,sha256=HWuKoKgSAm0wDJ7obTphUWdquSMEefWh-Tcf1UJtjoQ,156
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_recon.eql,sha256=FZuQJNSbVUKywuPa-DpM7qbg6SOz9GvxUPrklBiX3b4,162
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_recon.lucene,sha256=2Tzi4Ui-heArXfzjegv7hDpfRT07Lwc3ID97uoc6x6c,164
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_server_service_abuse.eql,sha256=UKNx57ZbGaO4K26Z-WWSpj3pp2zoo2e0uDyhBSRUiiY,98
src/rules/application__rpc_firewall__rpc_firewall_remote_server_service_abuse.lucene,sha256=ue90-k3LNcEzPARmjxXs_tv3-zdcg4UTlbj-E4BQkII,88
src/rules/application__rpc_firewall__rpc_firewall_remote_server_service_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_service_lateral_movement.eql,sha256=NZf1uOg1_4FoauCMVTiF4yOy29iKVVNZwDLKdsmzXiE,98
src/rules/application__rpc_firewall__rpc_firewall_remote_service_lateral_movement.lucene,sha256=950Yh85Fxhgtl6cZ2no1-6wnJzc0Ffqgs9Z6auvuZS0,88
src/rules/application__rpc_firewall__rpc_firewall_remote_service_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_sasec_lateral_movement.eql,sha256=U6gY_XkCAr05GuIEQh-IxbkTMruoVKEcONHEgAp9iNY,123
src/rules/application__rpc_firewall__rpc_firewall_sasec_lateral_movement.lucene,sha256=k9tPY98SbFDgsyGPR_0RHp-WFOhNS6S8y4Bbke8Y89c,109
src/rules/application__rpc_firewall__rpc_firewall_sasec_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_sasec_recon.eql,sha256=puyzRzEWCIRK7leDr2SglJmHVGF04JNCl0NSLSoeXgE,131
src/rules/application__rpc_firewall__rpc_firewall_sasec_recon.lucene,sha256=Vk-LUFzqG7d1j0n8M1j-TGgCqv5I2mD-lzSsy70mt7c,117
src/rules/application__rpc_firewall__rpc_firewall_sasec_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_account.eql,sha256=eugpoyzoGnMhZ5lXFsqRrlcXMTrEdbbGcL0z2brBh5I,110
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_account.lucene,sha256=qdXk6YTHzD18jdn-5x9XA9LAz7_VrInMPE8u5DYrrjM,100
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_sessions.eql,sha256=SekonmxMef5GT9taB9QLFqdsNrW1W47wDPzTxOe2JEY,111
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_sessions.lucene,sha256=xnJQP_QEp2pwHucp0C6SeAqRx2XaPuSGeCcKJMyB98Q,101
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_sessions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__ruby__appframework_ruby_on_rails_exceptions.eql,sha256=XgCNEJoQGGOITA52-VDOi6HSyH6s_VdMcA9NSkokcp8,218
src/rules/application__ruby__appframework_ruby_on_rails_exceptions.lucene,sha256=hdHeAjns9j1OHK3fy5aluEJmK14q220H4PeIxB4qkRg,218
src/rules/application__ruby__appframework_ruby_on_rails_exceptions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__spring__spring_application_exceptions.eql,sha256=w0H1iabwk0mZoztIlCwKnAEUF1pJOnskTVeW4x_TIHg,199
src/rules/application__spring__spring_application_exceptions.lucene,sha256=fI6qxQrPK1uYkZ9KgykzlQ9_siQfNbKLSZ7jKASeSAM,189
src/rules/application__spring__spring_application_exceptions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__spring__spring_spel_injection.eql,sha256=DtGDv65LBVX6ntWpM18uODRBeGcMWlr7hwXWEsGNF7A,63
src/rules/application__spring__spring_spel_injection.lucene,sha256=Nk2pmcS0WbS6WtIW3Plsy7wYedEOc8GdYNqEmzpEN_Q,53
src/rules/application__spring__spring_spel_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__sql__app_sqlinjection_errors.eql,sha256=Hw5-779reRhW-EFDsNtCa28sMA9bhPUC3Xi775EZhDg,241
src/rules/application__sql__app_sqlinjection_errors.lucene,sha256=xn-nai8nGu8qPZoS_6dqNIZsydWyyNhhP8PIRMrZDYk,264
src/rules/application__sql__app_sqlinjection_errors.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__velocity__velocity_ssti_injection.eql,sha256=xhc3fbgMR8lNXOZW_ZtRFdgBDhMmc3FapUxzaBYtTgs,82
src/rules/application__velocity__velocity_ssti_injection.lucene,sha256=Wdnw83zgBSbpMxoGx9Qn_R3yPeC_EJ_PZkRt9cN5pFg,72
src/rules/application__velocity__velocity_ssti_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_exploiting.eql,sha256=x29U7ABCGPQTxMZCRvPf8thY34uQGly4pf2pxcty6dI,340
src/rules/category__antivirus__av_exploiting.lucene,sha256=qiekJ7-RPeNQ_by9pikg_RqBl_IB2fepbJHXq8eYi3w,322
src/rules/category__antivirus__av_exploiting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_hacktool.eql,sha256=61aF9KGPoAscP9G-VkrCSRvMyOuS2d6-7cuuof6dUHc,662
src/rules/category__antivirus__av_hacktool.lucene,sha256=DwBr7wePFX4iApwvrfSkR7K1PirZfVem865NupAttpg,637
src/rules/category__antivirus__av_hacktool.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_password_dumper.eql,sha256=xZQ9-HRkNFMMATMOSlEGFCBYe7PDKR6XZbkLygfCJSY,480
src/rules/category__antivirus__av_password_dumper.lucene,sha256=WriGpu8pDCh_FNMKlVpLDX2uq8O8PR1bkNUcqfN00zI,461
src/rules/category__antivirus__av_password_dumper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_ransomware.eql,sha256=qJEN6egeGTSlyE1487vOtiywzMqh2qLJoGRqYH8u0Qo,421
src/rules/category__antivirus__av_ransomware.lucene,sha256=o5Jyxj8S1Q_nzQPZqPA1UJ0PdEHexbF9_GNVp43CTno,403
src/rules/category__antivirus__av_ransomware.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_relevant_files.eql,sha256=7Y48CUU8H4FbvVEeh_zJHWtWkuGZrKezsUoQ-mhO6OE,617
src/rules/category__antivirus__av_relevant_files.lucene,sha256=P4uMxBuj2Ho-pROg1JeI7YheCStN1p2icRc1NatKQ7o,598
src/rules/category__antivirus__av_relevant_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_webshell.eql,sha256=i9KlWVXz-ivtLQcXLUgkfc6FGNwPLSMcuRC8MCc326c,735
src/rules/category__antivirus__av_webshell.lucene,sha256=1DGNn6NiEKNm49Q8vKufGWE9J25ps8hn-cmAvy5iOTo,729
src/rules/category__antivirus__av_webshell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__database__db_anomalous_query.eql,sha256=T79T98vhD0kOj9a3U9xItdQLdgDz_ZX7jS9uvoZjmsQ,57
src/rules/category__database__db_anomalous_query.lucene,sha256=l9SK2bzxe11IrOeR--FjGOcMmO9KA-rNUEndBVD8uus,47
src/rules/category__database__db_anomalous_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_bucket_deleted.eql,sha256=LTiwF2EthSv3vZ-DIfetIbSa7JQw3lteO3dTRUEVuIc,85
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_console_login_failed_authentication.eql,sha256=v8FrmH69_0m_54lvWAnzibUSjGQ2H5R3U1BPOiet948,76
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_console_login_success_without_mfa.eql,sha256=SbqD9lMUFFM_CD-WvglHWPsSMuO65IfvdkbabALJqj0,116
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_disable_logging.eql,sha256=illiIswa9Cvan5_k0XRnu6_13qtQYRDT_5rPaYpfnjc,117
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_guardduty_detector_deleted_or_updated.eql,sha256=iK791FyfY-Vok-7G1wBbm7OJFH0yNsGYUer-ELiBXnI,200
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_imds_malicious_usage.eql,sha256=mPtJpPya8DI1qdFlPNKd-TxAD3RMEHhhAPqtFti7V4k,176
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_new_acl_entries.eql,sha256=U8rD_1idk-iYrsLCuCfn0fMTNeHYSnztyHfttzftkC4,80
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_new_route_added.eql,sha256=uxOGQHT4B9lYliBgwblCMD3Kesab5QScKQTWvhBoM2M,70
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_pua_trufflehog.eql,sha256=9eKDy0T-4w689iRIBOTbLLjSxmKAoUayxvDf7pOJ1C0,33
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_region_enabled.eql,sha256=lHY2NxrcJeWfK0E3lMCRSNFU3vaJXP1irVkSYYu6aF0,75
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_security_group_change_ingress_egress.eql,sha256=2StiWLZeogBn8hnEoVkl4hOIHdxfU5-5j2f5YweR8nc,189
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_security_group_change_loadbalancer.eql,sha256=D6gqMz-5pdo997CfZc_ba3NV7QNk6nFD1JBkou_HUus,140
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_security_group_change_rds.eql,sha256=ypF6luzwonlruQZHWTYsmElgx3P6nWdElETNqlLBe1I,182
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_ssm_malicious_usage.eql,sha256=xPN6lvhB4aGKx3gQ4aVRFnVOf8WVcZW7tRWF7q5WvYw,122
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_vpc_flow_logs_deleted.eql,sha256=VBHYjb34JdEg2LHG-cRTLawUJ-6NVGQLdLdiwDTMBSQ,87
src/rules/cloud__aws__cloudtrail__aws_config_disable_recording.eql,sha256=SsQcwdjF4wBkFTQPTa6mEj6qyYxZeeRiqe8Lt4LtJ_g,122
src/rules/cloud__aws__cloudtrail__aws_console_getsignintoken.eql,sha256=SQndD3sykvMqzfNMX_tZz-q9DRcxFmYncXTk4oaPu1o,128
src/rules/cloud__aws__cloudtrail__aws_delete_identity.eql,sha256=SlW7HJ2IHOvcXGUlm_jWof0WJo62oPsoIElU1xh-pGI,73
src/rules/cloud__aws__cloudtrail__aws_delete_saml_provider.eql,sha256=0yk1esEDAmkCw04nbvzZPgb3Yv0Bi7wk6-Oz91qnudc,98
src/rules/cloud__aws__cloudtrail__aws_disable_bucket_versioning.eql,sha256=JdzE8PgPQPcswAHmqAgGSPdAEJilFQ60rViM9pZN6s0,113
src/rules/cloud__aws__cloudtrail__aws_ec2_disable_encryption.eql,sha256=oL5tsk0Fz3S00e4qZTpxhjjbcb1mNWE36kjW-ZYWG7E,88
src/rules/cloud__aws__cloudtrail__aws_ec2_import_key_pair_activity.eql,sha256=sGjPCbtIQfn4qFNhKg3cE6WjWDgBM_cs-Xjp09ZmCPQ,72
src/rules/cloud__aws__cloudtrail__aws_ec2_startup_script_change.eql,sha256=x8nFu3TFRRcbJPOS2JAuZwDeCyDmkS2H-oZOhwlbdhQ,125
src/rules/cloud__aws__cloudtrail__aws_ec2_vm_export_failure.eql,sha256=5KAopDEkadAwmKHk46KqbyOE8sBc6QfZHRs8INCVA4M,163
src/rules/cloud__aws__cloudtrail__aws_ecs_task_definition_cred_endpoint_query.eql,sha256=LtQZR5i4CXLJ-jh4xsXAkUSHZ7n0kXl6lyMlVn4ooXA,223
src/rules/cloud__aws__cloudtrail__aws_efs_fileshare_modified_or_deleted.eql,sha256=wqZFZCoWOE1mCKJ9lxN-tf5OUG1fEl91Mb8Z0jjqOI8,89
src/rules/cloud__aws__cloudtrail__aws_efs_fileshare_mount_modified_or_deleted.eql,sha256=4N7Ui-fW0rtfnPEOGY5VoZip817V9oFkXCblOK9dO6k,90
src/rules/cloud__aws__cloudtrail__aws_eks_cluster_created_or_deleted.eql,sha256=H2kQtbPT2mqtMmCUpIyx1aEMbzlNVuSfsE6IzoGBn5U,99
src/rules/cloud__aws__cloudtrail__aws_elasticache_security_group_created.eql,sha256=8xtyoh9b1NZORFbJYILB6aGksZTCoCx4wVnzn83Mi_c,91
src/rules/cloud__aws__cloudtrail__aws_elasticache_security_group_modified_or_deleted.eql,sha256=Pp47v865Iai40CRqR8DE-YPkP4gMUPXTvcVTCqj92Ec,245
src/rules/cloud__aws__cloudtrail__aws_enum_buckets.eql,sha256=x0AFvSg8ZokdbfOVPkkBq6BKNrAeeFzhlUPR9PeH7Jk,113
src/rules/cloud__aws__cloudtrail__aws_guardduty_disruption.eql,sha256=k38xpPNEUwzlus75Fo5tAc-FO9lEQ3LREObl73a6ehQ,76
src/rules/cloud__aws__cloudtrail__aws_iam_backdoor_users_keys.eql,sha256=Jo59XkYb_56L0eP8BDFqY3wTST2YEVOUs75zL1CcLDE,143
src/rules/cloud__aws__cloudtrail__aws_iam_s3browser_loginprofile_creation.eql,sha256=kitov1-fjROryZStfRlpIuurM_fdCb2koHd588YJ4oY,135
src/rules/cloud__aws__cloudtrail__aws_iam_s3browser_templated_s3_bucket_policy_creation.eql,sha256=5fjojwhe8U88MsLwQfL4yTgVKY00M51vcknEuAKWZzA,246
src/rules/cloud__aws__cloudtrail__aws_iam_s3browser_user_or_accesskey_creation.eql,sha256=5dEtTG81DhllJZe39DJ69gf3_z7ZO9fM0IVbo727JIQ,127
src/rules/cloud__aws__cloudtrail__aws_kms_import_key_material.eql,sha256=MjUKgFTrW3UpHKic7lk5B-0Z5hq5VqtuSGlIdfTcpO0,115
src/rules/cloud__aws__cloudtrail__aws_lambda_function_url.eql,sha256=XNcGQJp_KtU-Ah6NtkqJgU_-CdDWWGg22rThkTPXPnI,85
src/rules/cloud__aws__cloudtrail__aws_new_lambda_layer_attached.eql,sha256=pqhdpZ8i0t6c5OK8iHo6z_lBGGH7CdsLTcmRzrAY54w,123
src/rules/cloud__aws__cloudtrail__aws_passed_role_to_glue_development_endpoint.eql,sha256=HVHQu9pLeEmfTWN_bw2J4lqhSGiJPA5MGTESwu0Qnxk,129
src/rules/cloud__aws__cloudtrail__aws_rds_change_master_password.eql,sha256=sOQF53yDutlsb3XGh-FImNEbRl6IPrx6QBiH6p3zcdk,141
src/rules/cloud__aws__cloudtrail__aws_rds_dbcluster_actions.eql,sha256=D3itjh5Yi42MeAMfZG6h47MYZSaLKmqPiSkyT2waiGE,103
src/rules/cloud__aws__cloudtrail__aws_rds_public_db_restore.eql,sha256=52_L-p0HI2nfXT8XpzZB-JaDmHN7_KrJOWbmlPRuyv8,137
src/rules/cloud__aws__cloudtrail__aws_root_account_usage.eql,sha256=FdvTAhOsaSKApmiApeBj61MSTCZwpTy36fFucv26EXo,73
src/rules/cloud__aws__cloudtrail__aws_route_53_domain_transferred_lock_disabled.eql,sha256=MADjfH3MrFVM7HiiHw6q0S0juTEjn8YtcvSplTiE-JM,88
src/rules/cloud__aws__cloudtrail__aws_route_53_domain_transferred_to_another_account.eql,sha256=jak7tfy8mxdqSe0lxlAn2g0pOAMGawjai6ruveWNQMs,96
src/rules/cloud__aws__cloudtrail__aws_s3_data_management_tampering.eql,sha256=csrIfvFs5leg4fYt0BiV7uMFl5w6pFlgiGFdq3tbWBc,230
src/rules/cloud__aws__cloudtrail__aws_securityhub_finding_evasion.eql,sha256=d6GD6uGKn3Y31y33OPK40PTQ0oE-W_37U8pHeOMSmps,148
src/rules/cloud__aws__cloudtrail__aws_snapshot_backup_exfiltration.eql,sha256=nKwu1NIoS62F2fd_OPV0W2HX5ASl8Uf44wO_Slm9KH0,82
src/rules/cloud__aws__cloudtrail__aws_sso_idp_change.eql,sha256=-klePNQljbC1QsnHyxFwJ_v0olrhUHuukjqjJjJnhZQ,246
src/rules/cloud__aws__cloudtrail__aws_sts_assumerole_misuse.eql,sha256=7E5MhPext2JCrtud-GCG_c0WKmnk2LgjCpXi90ACpog,100
src/rules/cloud__aws__cloudtrail__aws_sts_getcalleridentity_trufflehog.eql,sha256=ZtR3iLJFEOF-kNsyy307hsgmwiTtBwhdEcjMloZEiAU,105
src/rules/cloud__aws__cloudtrail__aws_sts_getsessiontoken_misuse.eql,sha256=BFrSJ6KIuaczhRx_OKNNrTXuKRTJ2ZclES-pq0irrEY,106
src/rules/cloud__aws__cloudtrail__aws_susp_saml_activity.eql,sha256=Yey3OxIEl1LjW9pSV8UVl-ba9RPAqpt2L-naMPj8GaI,151
src/rules/cloud__azure__activity_logs__azure_aadhybridhealth_adfs_new_server.eql,sha256=azGhJliBadeIlLW8Uv3ctZGEA-F4qcvPtKMVLkfvWMo,228
src/rules/cloud__azure__activity_logs__azure_aadhybridhealth_adfs_service_delete.eql,sha256=eCIOE3riwsrs9p0zRS8hanEX3Kh_OR8RhlwWryDT89s,213
src/rules/cloud__azure__activity_logs__azure_ad_user_added_to_admin_role.eql,sha256=dHCdUPdrhGFnYjqayxRVZfJW495o8BtDDG5SQT_N2jc,148
src/rules/cloud__azure__activity_logs__azure_application_deleted.eql,sha256=SNqmc2CSJZB4j0D-B70DiW4RVNrA2u3BppqB4iEOtFA,85
src/rules/cloud__azure__activity_logs__azure_application_gateway_modified_or_deleted.eql,sha256=zoIF2XKjG_VR9AbQcvTiXu23U1OrSS01LVbs1kmN8VE,126
src/rules/cloud__azure__activity_logs__azure_application_security_group_modified_or_deleted.eql,sha256=WZ3ApuxiWm_GSyi7S8lhI4oZ13vtu4neXJFIH-ZzOxY,138
src/rules/cloud__azure__activity_logs__azure_container_registry_created_or_deleted.eql,sha256=gflbBTekLDdH9hxwsEoUtAA6vOYhr7o6iF0AWGgv_gk,128
src/rules/cloud__azure__activity_logs__azure_creating_number_of_resources_detection.eql,sha256=rYE1ymX-wNXMlNa52XoXGKVqjO7oOLBXQg2sRN2tBy0,95
src/rules/cloud__azure__activity_logs__azure_device_no_longer_managed_or_compliant.eql,sha256=ceqjHFSEwWBNZiF2eBCAPYBT_CfU0XaUUbKs6I5nzXU,94
src/rules/cloud__azure__activity_logs__azure_device_or_configuration_modified_or_deleted.eql,sha256=tFNYaRg9IKY3RjkNtvuTpvW_KFG-pqpJoFi3uvPmHfU,132
src/rules/cloud__azure__activity_logs__azure_dns_zone_modified_or_deleted.eql,sha256=i7gtu3K4x4pDslbP-2s8h2m2EcwsMTnuJoYiTms3vyY,104
src/rules/cloud__azure__activity_logs__azure_firewall_modified_or_deleted.eql,sha256=lYuCmAdId-H-nfCNYtV8-UMN2lIW4LDLDqfxM6cYeA4,116
src/rules/cloud__azure__activity_logs__azure_firewall_rule_collection_modified_or_deleted.eql,sha256=SwnaMYN_6eAeEgerWqsu_CkhKTx670uv_LffIV7PS5Y,424
src/rules/cloud__azure__activity_logs__azure_granting_permission_detection.eql,sha256=kK-FYNcZUglkJAvCFONKx6gXsQKmthKFIR6pSXc74NA,58
src/rules/cloud__azure__activity_logs__azure_keyvault_key_modified_or_deleted.eql,sha256=4JjLAP9NLoT5sQhcrasq24W-qFA3qGWR1hYG2j2ZTho,450
src/rules/cloud__azure__activity_logs__azure_keyvault_modified_or_deleted.eql,sha256=LhOvMGI_fIS7QGyChNtBoFqT-dcTflKP_p54W802R5c,195
src/rules/cloud__azure__activity_logs__azure_keyvault_secrets_modified_or_deleted.eql,sha256=wp_kksU1Ya45K8MLMT4LHNnrqX6tCndtrb5Mm4leLr8,428
src/rules/cloud__azure__activity_logs__azure_kubernetes_admission_controller.eql,sha256=yA29yrny-AduqawCSlFHEczCkeorEzxbbDg_GrObJy8,292
src/rules/cloud__azure__activity_logs__azure_kubernetes_cluster_created_or_deleted.eql,sha256=ISaPhXUrmqHINgGUiuRGZ2bz_xtHLGeIfkNFllhDQUI,128
src/rules/cloud__azure__activity_logs__azure_kubernetes_cronjob.eql,sha256=L0Zz9ItPwoQs2fB_s_zA_j8xOOIlfqcJZwH-O_qvqgg,198
src/rules/cloud__azure__activity_logs__azure_kubernetes_events_deleted.eql,sha256=KXSxrvXWblzlWov4OnMYpFKgi7tMQeIsTXiHd9QJK-0,93
src/rules/cloud__azure__activity_logs__azure_kubernetes_network_policy_change.eql,sha256=vMn9f4DCgnjI9SqQsGAJjnOGLocs3HITY-XTzLPD_PI,347
src/rules/cloud__azure__activity_logs__azure_kubernetes_pods_deleted.eql,sha256=H3q9Y1iZgfr0r-I4-V8xkAD9y0pMzToFuIZ5uaVeq9Q,77
src/rules/cloud__azure__activity_logs__azure_kubernetes_role_access.eql,sha256=VlaccxLI2ddHJ93kXiTuo4bPhENh3Ch8srkXnEqhvrg,733
src/rules/cloud__azure__activity_logs__azure_kubernetes_rolebinding_modified_or_deleted.eql,sha256=yH3Zz5PjoDejH8oI3jULHqNUljlHvvPQbqtqxpAKVok,395
src/rules/cloud__azure__activity_logs__azure_kubernetes_secret_or_config_object_access.eql,sha256=A0nZEXu2RMHmkazrAEVNq_00ambtQ5FgTYQG6xXxiCM,263
src/rules/cloud__azure__activity_logs__azure_kubernetes_service_account_modified_or_deleted.eql,sha256=yfIYJOvnj_6SbCFo4cbGCg2cH78Dr1bBU9KcgA88MH0,237
src/rules/cloud__azure__activity_logs__azure_mfa_disabled.eql,sha256=zk4QfugIjhx2I-f906dO9LB4YH8rXf3gmaEdLaUyUjk,113
src/rules/cloud__azure__activity_logs__azure_network_firewall_policy_modified_or_deleted.eql,sha256=-A3bvx9q8rooD1djRUuEyOqi6q3Db1A9dXKcVkozkv0,228
src/rules/cloud__azure__activity_logs__azure_network_firewall_rule_modified_or_deleted.eql,sha256=QOpyU31ZkOd_4M4I0eOMz-0_L4Y3E7PiAol2WM0jstk,273
src/rules/cloud__azure__activity_logs__azure_network_p2s_vpn_modified_or_deleted.eql,sha256=NoOat9TSS7p1OwISCmYUQ4oMJSc29odgSVIRtf394kY,388
src/rules/cloud__azure__activity_logs__azure_network_security_modified_or_deleted.eql,sha256=15Hzorw5oUJmHi2U-fdtp-LZml6X3LhCJfC6svVqnaI,409
src/rules/cloud__azure__activity_logs__azure_network_virtual_device_modified_or_deleted.eql,sha256=0YeOHJE66F2bvx6m5Kpu3pd1QQcVcbP9LhzKHB19dtQ,569
src/rules/cloud__azure__activity_logs__azure_new_cloudshell_created.eql,sha256=SqRQWRYkQuFUTR03HtyyzzibsnXfMhSU9HAD4wsLVOY,58
src/rules/cloud__azure__activity_logs__azure_owner_removed_from_application_or_service_principal.eql,sha256=0SkbmaHisIfAZSwjI4u0X6IvMnqff7jzfINabPlEk2o,108
src/rules/cloud__azure__activity_logs__azure_rare_operations.eql,sha256=1somAK_U43SZYAI6mCXisG-TqKdagxm-Y7dZ_xNRg8U,365
src/rules/cloud__azure__activity_logs__azure_service_principal_created.eql,sha256=b_yJAznrOVs60OJbgQrDdOhY6GoLfH5zFW3h44BBL1E,53
src/rules/cloud__azure__activity_logs__azure_service_principal_removed.eql,sha256=g4C3CEyjGdAbWfYptSY_QN7gfj67xKBOg6L_fD1BJwQ,56
src/rules/cloud__azure__activity_logs__azure_subscription_permissions_elevation_via_activitylogs.eql,sha256=yCU2ndRj3VNzSiHgYdpSsO3fCoB0bZ7rTTCgjQ1ISGQ,71
src/rules/cloud__azure__activity_logs__azure_suppression_rule_created.eql,sha256=36RdderUywQsR52D-LdvxVEWuQP5eGmtYiOpeap6Sds,74
src/rules/cloud__azure__activity_logs__azure_virtual_network_modified_or_deleted.eql,sha256=kyHpCCC_Iu6xsaj4OlAzLIL_pOoo4aPfcrQXzFv_lsQ,168
src/rules/cloud__azure__activity_logs__azure_vpn_connection_modified_or_deleted.eql,sha256=f_G_hT1NCEQb8uB0I5_liKObN_NjBSSWLQxWpdGPP3c,140
src/rules/cloud__azure__audit_logs__azure_aad_secops_ca_policy_removedby_bad_actor.eql,sha256=63vMeEU-SJc1_VQb3ompKXgU_45eiA1lf6cFfVeeWjE,64
src/rules/cloud__azure__audit_logs__azure_aad_secops_ca_policy_updatedby_bad_actor.eql,sha256=2j2yG99ZvNpScfIxtfQAMXSjmtCemHYZOpIrgwQUrFU,64
src/rules/cloud__azure__audit_logs__azure_aad_secops_new_ca_policy_addedby_bad_actor.eql,sha256=iHbonbFM1JgdO7zlyKhIo0rI3j-5Vn8vHaA1wPU_qK0,61
src/rules/cloud__azure__audit_logs__azure_ad_account_created_deleted.eql,sha256=BOK2d5wv46lmrhypNTT37KSM0CVvigKp3nfTAcgVz58,86
src/rules/cloud__azure__audit_logs__azure_ad_bitlocker_key_retrieval.eql,sha256=Q7p35-0FBMjWoX93DDRpdERfRBX01nCYjQxHnSMHXeY,74
src/rules/cloud__azure__audit_logs__azure_ad_certificate_based_authencation_enabled.eql,sha256=9Ymfw4SADb_jdvB5a7-gZwoPBxYWl6kY7Z_PIyAVzv0,134
src/rules/cloud__azure__audit_logs__azure_ad_device_registration_policy_changes.eql,sha256=VILsvhHE60b-Lk6aBRl2-9HfLbwc-u07lykf1UnR07Q,87
src/rules/cloud__azure__audit_logs__azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.eql,sha256=biF8WhTLyoJiSP2nsFKBqij52QSrNJ4KsvKM_mgFAH0,150
src/rules/cloud__azure__audit_logs__azure_ad_new_root_ca_added.eql,sha256=nnHTQbpO_gZOVNAEL9rgo7fR_ShygpAqGqmqBVLDfy8,132
src/rules/cloud__azure__audit_logs__azure_ad_users_added_to_device_admin_roles.eql,sha256=15fXTCMvF_Ns73vVKauDTVvyNBz8zXdvKotoszfZOi0,214
src/rules/cloud__azure__audit_logs__azure_app_appid_uri_changes.eql,sha256=rnmLpNVoMsy_g30L5LfGaj5BCZpV93UtgGaL4Vkq-Os,86
src/rules/cloud__azure__audit_logs__azure_app_credential_added.eql,sha256=flOQbD5h3Mn1kCm_hhiSGEbXsTexLr25KZ-RJE0V7ww,145
src/rules/cloud__azure__audit_logs__azure_app_delegated_permissions_all_users.eql,sha256=-gN1p8OCD7auMtUX7D_Y_R63Mr2aHRoDQQS67diJ5xQ,62
src/rules/cloud__azure__audit_logs__azure_app_end_user_consent.eql,sha256=Cldec9Kqn9PmszsAH30gC9qNGkJdRSsLMTkHSxwJLLI,48
src/rules/cloud__azure__audit_logs__azure_app_end_user_consent_blocked.eql,sha256=egIZjR2qG6bk-Vq-qRa01ct2uY1CcqaG-7a3qVw-1_Q,101
src/rules/cloud__azure__audit_logs__azure_app_owner_added.eql,sha256=4GGM8VTSiIIGjWCw5zJJ1l-k_g_bNLm-VJIcNKqeNfo,56
src/rules/cloud__azure__audit_logs__azure_app_permissions_msft.eql,sha256=kK7py8P1lkWYvqUtutN18f9M6hLsA56-WxskttM8Y-A,118
src/rules/cloud__azure__audit_logs__azure_app_privileged_permissions.eql,sha256=9XDTz5FplU3OrsqKc0MUKq2YXN-1IMeZPPUPZSAScEk,76
src/rules/cloud__azure__audit_logs__azure_app_role_added.eql,sha256=CqRmOLoXUVwxEMlBPTxxLbBBRJiA4WPOFtt7K9dUWww,165
src/rules/cloud__azure__audit_logs__azure_app_uri_modifications.eql,sha256=vqhxBczdBF8qVTjUjvBFjFurgguVHrY3QMYTWJ4EI70,83
src/rules/cloud__azure__audit_logs__azure_auditlogs_laps_credential_dumping.eql,sha256=bYdKxuh8_C1Bvkn7k0yORNmqeSd_ITaKPaaN5FzFrOw,187
src/rules/cloud__azure__audit_logs__azure_change_to_authentication_method.eql,sha256=hSoxhtXGknf9b6hXfBSUgVE5va1EUaPujB0qAAnToDk,131
src/rules/cloud__azure__audit_logs__azure_federation_modified.eql,sha256=dyRlVTLSGXSVvbiw590ShFOQUK_DFLvPZ8NX6yC6UAk,66
src/rules/cloud__azure__audit_logs__azure_group_user_addition_ca_modification.eql,sha256=rvtFSjOyOYLA27pzy3C-uIh-pAWqT4qUOd4hx61n1Ek,53
src/rules/cloud__azure__audit_logs__azure_group_user_removal_ca_modification.eql,sha256=a0u0uIPs_rLR7iiGZ_uTDhsnJb2OfpLF12ERq88FXtw,56
src/rules/cloud__azure__audit_logs__azure_guest_invite_failure.eql,sha256=39pHLP2y6WW__KiePEHOqrsoezcJs9Afub8AS9qqIow,73
src/rules/cloud__azure__audit_logs__azure_guest_to_member.eql,sha256=Pla9atQpyGHSBgijBaUfN6COKXyiG-CtzuyeZmN-or8,189
src/rules/cloud__azure__audit_logs__azure_pim_activation_approve_deny.eql,sha256=X76C8BWAkFSqsUSfDsqqcFhDQ8t3DSy4VBO_KwbjTlM,55
src/rules/cloud__azure__audit_logs__azure_pim_alerts_disabled.eql,sha256=GuNl8d6x0NQ_zpJIFFXa0Uy-IdQQkV6IbiLxb3UUadc,49
src/rules/cloud__azure__audit_logs__azure_pim_change_settings.eql,sha256=0h1ebuSgCwe9Z1r6cnGUE1BsLb_MJdJMSPwmQgG9OpY,58
src/rules/cloud__azure__audit_logs__azure_priviledged_role_assignment_add.eql,sha256=4QLq-Rn1qd42EK2IdIpjRwONirUFHXEIuE7zilaDpJM,105
src/rules/cloud__azure__audit_logs__azure_priviledged_role_assignment_bulk_change.eql,sha256=fudxoPqyI3cpprP0JmZklgGob0EaKYCyVcxx9UkbrQw,111
src/rules/cloud__azure__audit_logs__azure_privileged_account_creation.eql,sha256=DP-2A-Jg6-meUu6chxSFZwUaUhT2UBB-0VCT4vS0uls,111
src/rules/cloud__azure__audit_logs__azure_subscription_permissions_elevation_via_auditlogs.eql,sha256=_00nTXpetgZwUK-CNq2BCD_SFRn7heAK2Cm8vGLoUoM,96
src/rules/cloud__azure__audit_logs__azure_tap_added.eql,sha256=GRdODGpqtEhSiXz2fQMVnKcAoQh86BTYax8nlV_AlyM,130
src/rules/cloud__azure__audit_logs__azure_update_risk_and_mfa_registration_policy.eql,sha256=cFIw9moDBrMR-SFeGKp9Wttoqeux1zAMDh6Tmr-SGuY,133
src/rules/cloud__azure__audit_logs__azure_user_account_mfa_disable.eql,sha256=gVEsqP5EHOebx9-i9wFf8HswMgSuoCAfkYEu4U8Vncs,252
src/rules/cloud__azure__audit_logs__azure_user_password_change.eql,sha256=ktCWSkBpE20hzVcS83qLxDSf_DEKd_bLrlCmm_zTiYo,138
src/rules/cloud__azure__identity_protection__azure_identity_protection_anomalous_token.eql,sha256=ilEQ2-DkElnp3G-D0w7XCfOeHsjGlHlsrSUlc_LawXc,41
src/rules/cloud__azure__identity_protection__azure_identity_protection_anomalous_user.eql,sha256=FYMPqXcXAcaGu8apBHwfZDQAxnDHaJib93NOEtQno7M,48
src/rules/cloud__azure__identity_protection__azure_identity_protection_anonymous_ip_activity.eql,sha256=VOkuc1SB0bnVjtSfAGrnoeDSRtY9Gi5FlOt9LOFEHhE,41
src/rules/cloud__azure__identity_protection__azure_identity_protection_anonymous_ip_address.eql,sha256=MTIbREiSL2T-eX6_RzAGmH8q8b3kClF30N-no5wyZwg,46
src/rules/cloud__azure__identity_protection__azure_identity_protection_atypical_travel.eql,sha256=fhWxUZVhuMxeh1RvifaaIh5RKqCRed4Vl4spshn8O9M,41
src/rules/cloud__azure__identity_protection__azure_identity_protection_impossible_travel.eql,sha256=WUd_f5aTYyOovN8zzci-cpHAjbdx-jGTrboYGAi_3w4,43
src/rules/cloud__azure__identity_protection__azure_identity_protection_inbox_forwarding_rule.eql,sha256=UhrcGDEpcSNCASR5beTiZPzHLIAfTRNTTM0UU-sW4Dw,52
src/rules/cloud__azure__identity_protection__azure_identity_protection_inbox_manipulation.eql,sha256=GFvE-Vx6eG8UdK5dVyj5CTGaoeyGuWqn1Z1jV8rSfIE,63
src/rules/cloud__azure__identity_protection__azure_identity_protection_leaked_credentials.eql,sha256=BixsADQYYsYEA-kprKbECT9_0CSQdqrOEE90jh7Ub9A,44
src/rules/cloud__azure__identity_protection__azure_identity_protection_malicious_ip_address.eql,sha256=5sW2GzwOWYyxjtG4xhThUfKeXtDRf7bCAswZUlM99tc,45
src/rules/cloud__azure__identity_protection__azure_identity_protection_malicious_ip_address_suspicious.eql,sha256=fhU6UE0qO2rW190Qu85q3I67tOlPAC3J3stcFIu6dSA,46
src/rules/cloud__azure__identity_protection__azure_identity_protection_malware_linked_ip.eql,sha256=FT64aN48yJUe89TqTJJujmObAXGIeegon7AWUBOWbec,51
src/rules/cloud__azure__identity_protection__azure_identity_protection_new_coutry_region.eql,sha256=v-zU5F0X3-bvpNTFyFB70DDyXm9OMOancKedHi-Hf6A,37
src/rules/cloud__azure__identity_protection__azure_identity_protection_password_spray.eql,sha256=FTBx9ptTLuTR9Lk3Vhg18zjqLhMzIJSTEFSHmQy5F4E,40
src/rules/cloud__azure__identity_protection__azure_identity_protection_prt_access.eql,sha256=P21b7bD8TLAouREY5t5_M2L3jNRzw7SMAiEQ01PavAU,45
src/rules/cloud__azure__identity_protection__azure_identity_protection_suspicious_browser.eql,sha256=ZW4_EuZLB_pMbDQlzjUDfg5wCCUwR_BkoXpuWQHP6aM,44
src/rules/cloud__azure__identity_protection__azure_identity_protection_threat_intel.eql,sha256=5aL55g2f177s3UyFObCEQWKgX8XCv1A31VLsgFDt658,59
src/rules/cloud__azure__identity_protection__azure_identity_protection_token_issuer_anomaly.eql,sha256=0t4kx-pnjfBPyJ2wwKabf1oHLiIJhv-_a2Anl244KGk,45
src/rules/cloud__azure__identity_protection__azure_identity_protection_unfamilar_sign_in.eql,sha256=8aqdIdxNvyJWfsrmLUL3M0UlbVHcpzEs0ZjSGi22h5E,45
src/rules/cloud__azure__privileged_identity_management__azure_pim_account_stale.eql,sha256=VDlCZCt3GPl-ulkLlzCWt7CBBHMJfGrf647sF-KlVmo,51
src/rules/cloud__azure__privileged_identity_management__azure_pim_invalid_license.eql,sha256=zsBiouwt3l0KfQ6RzWqXYnhxRi6fqvATj7xZg6tQE5s,54
src/rules/cloud__azure__privileged_identity_management__azure_pim_role_assigned_outside_of_pim.eql,sha256=EDvLKGD_dHORoBPHFokS3BrhLFSxA_fwOI5CEF8cxkU,93
src/rules/cloud__azure__privileged_identity_management__azure_pim_role_frequent_activation.eql,sha256=GrdmBdZxvZ7KUXiSM_MSPt8HVcyshfXupMZ0BNDA5rY,68
src/rules/cloud__azure__privileged_identity_management__azure_pim_role_no_mfa_required.eql,sha256=YzAygQzuv9ENvNUTBCGPOntevHaeYBOPMH2-XMAFb_k,61
src/rules/cloud__azure__privileged_identity_management__azure_pim_role_not_used.eql,sha256=p9W2AZTeZ6i9oAcCnmmO5OKdaqzHqI4JnRxqYTu2HDA,59
src/rules/cloud__azure__privileged_identity_management__azure_pim_too_many_global_admins.eql,sha256=8_2KqxiABnPXl7ZOohBRfhDglRXVaGO7askOi_oubak,75
src/rules/cloud__azure__signin_logs__azure_account_lockout.eql,sha256=urQauhkU6uXbeGCjhI8Z0hgHhThmKjUt9GaBHrsRtUw,27
src/rules/cloud__azure__signin_logs__azure_ad_auth_failure_increase.eql,sha256=Y6sHfIR0Ls1dvh1iV7ButjubY7Q4ZjlPUoHKvHznLvE,44
src/rules/cloud__azure__signin_logs__azure_ad_auth_sucess_increase.eql,sha256=9FPsIZi35zuZXHtUiZnRqKpG2NI2_iF6j8IJIacl9do,44
src/rules/cloud__azure__signin_logs__azure_ad_auth_to_important_apps_using_single_factor_auth.eql,sha256=VBoRjtfYBrXWwhYqBujnzNEMtcghrJHz4mNkt50Gzzw,140
src/rules/cloud__azure__signin_logs__azure_ad_authentications_from_countries_you_do_not_operate_out_of.eql,sha256=ZPBxxgiJ1gXV1LVy2JtUZmQPp2ovUKiidu44drwBecI,112
src/rules/cloud__azure__signin_logs__azure_ad_azurehound_discovery.eql,sha256=0_7K1_kQie9TL9jfRJAMJ3KliXCw0n5Bl8APM4OMsmo,52
src/rules/cloud__azure__signin_logs__azure_ad_device_registration_or_join_without_mfa.eql,sha256=G2TIEyOXJ47Wl0kE2JGlaXJ7Y1f8fwJIAno8NcPc8yc,164
src/rules/cloud__azure__signin_logs__azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.eql,sha256=Ok9U-jx2gr2SQ5cNYiIEvkgm0bQ8wXRRB7pX40F-azA,118
src/rules/cloud__azure__signin_logs__azure_ad_only_single_factor_auth_required.eql,sha256=wL8PPs-_-XARzxGhvATohlGfw9JliAoX4TZKOSON9BQ,86
src/rules/cloud__azure__signin_logs__azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.eql,sha256=HjWknMYD4OujyZXkc2h-7x-1_y3H_JBlE5Ve6zSxqQs,181
src/rules/cloud__azure__signin_logs__azure_ad_sign_ins_from_noncompliant_devices.eql,sha256=bzjDpVylpNIS1120UnqT9IFVW8u1xCw8-v0qZpqAx14,43
src/rules/cloud__azure__signin_logs__azure_ad_sign_ins_from_unknown_devices.eql,sha256=UQw_oqXwu35Y7-e0Rr659OBYSLQbSezkQpLZ0tYzChg,144
src/rules/cloud__azure__signin_logs__azure_ad_suspicious_signin_bypassing_mfa.eql,sha256=3IYoVkGlZ-r7k-cMq-FGoJL62_fjMGHbz4e4KDjomwc,93
src/rules/cloud__azure__signin_logs__azure_app_device_code_authentication.eql,sha256=7cj3vn-fOOppR9StZqf9kfc3Lkky3bdUtzOIXbU7Nl8,43
src/rules/cloud__azure__signin_logs__azure_app_ropc_authentication.eql,sha256=YQw9YkV5LU6gqMed_j0FdIP3x_I8Y6lv6D5fRa2yMcY,36
src/rules/cloud__azure__signin_logs__azure_blocked_account_attempt.eql,sha256=x5BEDU1--K84GJ7qjE4Je3VvcybIplPVriA7yo-iryU,59
src/rules/cloud__azure__signin_logs__azure_conditional_access_failure.eql,sha256=kVhtTTd1iltQs6p2fvj0m1mKGzBzmi0blYbZCgviVOU,81
src/rules/cloud__azure__signin_logs__azure_legacy_authentication_protocols.eql,sha256=sawbqcimwz55riCrjEfLOtQF-CmsPYBVT7-vY73OsmY,175
src/rules/cloud__azure__signin_logs__azure_login_to_disabled_account.eql,sha256=rRvr8lSMo1T2UBUr9kCJ9GRI2n0vCky6VeeRGva2Xz8,128
src/rules/cloud__azure__signin_logs__azure_mfa_denies.eql,sha256=0kvM2Lnzuh8PvO_DKkIyn_D69vByfC1-MLtSPepHzEw,90
src/rules/cloud__azure__signin_logs__azure_mfa_interrupted.eql,sha256=V4nXjKQphONs3ybXR7qgzZVsXtLyStJqQk1Jzrbp42s,184
src/rules/cloud__azure__signin_logs__azure_unusual_authentication_interruption.eql,sha256=Hj7PZN7yYkhSj9lrp6LQkSHeIEaVWVtu1SsPyZ0ygXc,280
src/rules/cloud__azure__signin_logs__azure_user_login_blocked_by_conditional_access.eql,sha256=lvpBRWMTOxI4tKiOJcDreuyQBVSStRMaI0TvlnoEa-c,27
src/rules/cloud__azure__signin_logs__azure_users_authenticating_to_other_azure_ad_tenants.eql,sha256=12CldDz_24U59SY1RdSP_k1kBJ3_fB_PiVH2kUV3FDU,105
src/rules/cloud__gcp__audit__gcp_access_policy_deleted.eql,sha256=9sPXPFgLYFVXXDfpBzfbvAfk1_qieZM12aY6IIBubRo,422
src/rules/cloud__gcp__audit__gcp_breakglass_container_workload_deployed.eql,sha256=uaxerHQerQpFAMpcOz9fFQv5QDH8xwiQ_26nUZDBxsk,275
src/rules/cloud__gcp__audit__gcp_bucket_enumeration.eql,sha256=YS0Nwls1-RbpumUD6sZbNsdLUtlYhvGdRvjMw1vyxNA,95
src/rules/cloud__gcp__audit__gcp_bucket_modified_or_deleted.eql,sha256=AW76sbfoiAq0bWIOSqJ6rbBMsQHdyHNU4LwvPAIoacs,142
src/rules/cloud__gcp__audit__gcp_dlp_re_identifies_sensitive_information.eql,sha256=Ay23TU8b7o_2Nt_vcVIbLkHho_yk-i2APO-8-bmvxwk,62
src/rules/cloud__gcp__audit__gcp_dns_zone_modified_or_deleted.eql,sha256=lATPB4G00uGHc7Dx9rTGc3_QNF6c5x5YgtVUoCNRcGE,119
src/rules/cloud__gcp__audit__gcp_firewall_rule_modified_or_deleted.eql,sha256=U6mJx_9YK-hSZ7pZcBS3i8uploPUvYNTz7ueDlvFjpY,162
src/rules/cloud__gcp__audit__gcp_full_network_traffic_packet_capture.eql,sha256=1ERmH-7gF2nHCFcyrTdA4kKaLCcOAMfYn8F6EzNObkg,269
src/rules/cloud__gcp__audit__gcp_kubernetes_admission_controller.eql,sha256=2zSgDdIpoXCX6KSedHM-C5k6wm4bb9Y6TNMtzvmehks,245
src/rules/cloud__gcp__audit__gcp_kubernetes_cronjob.eql,sha256=Dx_LZ8VdWWYiyFmeyCv2N4tEtQ7aaah7Bj2JB0rB49M,97
src/rules/cloud__gcp__audit__gcp_kubernetes_rolebinding.eql,sha256=sNOGLLEcjxU8L0LA73SqkewpsB77af7jUIKY3fUZe18,481
src/rules/cloud__gcp__audit__gcp_kubernetes_secrets_modified_or_deleted.eql,sha256=9Nlx5ttsIS7jWMWD1Sk7BPf-RznjwNju0TMN5P2ciVE,170
src/rules/cloud__gcp__audit__gcp_service_account_disabled_or_deleted.eql,sha256=4fxW1vFdARG8tc_-G4PGqjjuQflbTKy9DwjgoHR-6Is,96
src/rules/cloud__gcp__audit__gcp_service_account_modified.eql,sha256=Q_XjL2Qg7JqWkb-em2VDg4Zr6EBZ9uVk_UxyvrmbKj8,180
src/rules/cloud__gcp__audit__gcp_sql_database_modified_or_deleted.eql,sha256=oj1qIEJMke3UNeBiGO-WFEiayxyER99kQrClvuEMkSA,147
src/rules/cloud__gcp__audit__gcp_vpn_tunnel_modified_or_deleted.eql,sha256=Y2O_f24V_0hNL-cj1L2ha6UWzDYFPK0Ek9lXwRH7vyA,97
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_application_access_levels_modified.eql,sha256=oo5PeOj3iwNQwLGpRUb5Kupj81If8yKCSvyYf0LEN5w,128
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_application_removed.eql,sha256=Y5yUq0PJzSybLEko3sfA-jgkXHNTJ2n45YqRzN8ijoc,128
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_granted_domain_api_access.eql,sha256=WX4fObD_1V4e6mP4wbOv7bwAdh-kqGaXLVQ9DFzGeOc,90
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_mfa_disabled.eql,sha256=MBJHViECCpiHYu2N443WcuxIk8neyp90mJnaEkLl2N8,157
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_role_modified_or_deleted.eql,sha256=9MnNdeWpuU62ugnde68rR0FzWOfHh3FNJXM_SuElO5k,114
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_role_privilege_deleted.eql,sha256=n5xDupZ3PKKpmrFZgxz08z7HAmqyW3julT3jkFOn-mc,79
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_user_granted_admin_privileges.eql,sha256=CZxX4Sgr-zR4137HBVLN97ZMSrtYRwP4jECDpoBCqeY,130
src/rules/cloud__m365__audit__microsoft365_bypass_conditional_access.eql,sha256=yduCyLqA8wvH5UYm-IKD4BV82EosVomQqdrPPHXiLcg,207
src/rules/cloud__m365__audit__microsoft365_disabling_mfa.eql,sha256=MzK-IczswuT3S0w0xIuznkuIU-tTiT2w9OtrtvTu22A,55
src/rules/cloud__m365__audit__microsoft365_new_federated_domain_added_audit.eql,sha256=oIWzUX5d98Uzk8xodxjgoZLLLXA8tR_HlC0RweIDy5s,72
src/rules/cloud__m365__exchange__microsoft365_new_federated_domain_added_exchange.eql,sha256=EpRShu0VIzUzAI3OOQIMDA_Um5QP9T4uEIvoNOkny3k,90
src/rules/cloud__m365__threat_detection__microsoft365_from_susp_ip_addresses.eql,sha256=Qi23X8ajbDC8tO-DpTOdXZ15Xwve1YR8dOqFlM5wtCQ,124
src/rules/cloud__m365__threat_management__microsoft365_activity_by_terminated_user.eql,sha256=L-Knu_BZtVtHObi1fvu01KVPzGaJUxQ_43D-ZE_0Ij4,124
src/rules/cloud__m365__threat_management__microsoft365_activity_from_anonymous_ip_addresses.eql,sha256=bpQHL11y8FPAOm1BJQ3SATV_iXpey6bl17UrqpQaZKY,123
src/rules/cloud__m365__threat_management__microsoft365_activity_from_infrequent_country.eql,sha256=yp0-cTmNvD5GgAgMNUbto86pBcEj1YOl3YW9VUTJ7rc,119
src/rules/cloud__m365__threat_management__microsoft365_data_exfiltration_to_unsanctioned_app.eql,sha256=Qssw7GKaiFmQ5OkA9Ul5zDhUsDZOURQGVU3hA0mr7yA,125
src/rules/cloud__m365__threat_management__microsoft365_impossible_travel_activity.eql,sha256=UIVWgOi5ZtE8RdLXLIVv9UCeta2F-Bmb_kq6vtlUxWE,113
src/rules/cloud__m365__threat_management__microsoft365_logon_from_risky_ip_address.eql,sha256=w0raf_3uvs4gHMR3ZhAHNUMh1fqiXxdlWTiDS8tPMYA,117
src/rules/cloud__m365__threat_management__microsoft365_potential_ransomware_activity.eql,sha256=1O6HALvGpccCbqiKVAFF3xPMsRp3XS04PK4tMuc2NSc,116
src/rules/cloud__m365__threat_management__microsoft365_pst_export_alert.eql,sha256=6ErYh-Yda5-_ZZhjnoBNDthXc8-wUiRL9QPbQWdqJEc,124
src/rules/cloud__m365__threat_management__microsoft365_pst_export_alert_using_new_compliancesearchaction.eql,sha256=3lDwodbmfnrCyZJSFeqlSDVBauqwiBwIHOIDsNLYEzA,137
src/rules/cloud__m365__threat_management__microsoft365_susp_inbox_forwarding.eql,sha256=QCXOFkCYe25hLO1yJrxD0pNyMHRR4YM1Pkx4l86uGQA,114
src/rules/cloud__m365__threat_management__microsoft365_susp_oauth_app_file_download_activities.eql,sha256=scUoQ9Ydblx3aLNaOElXJ3XRveRVEusKrD72kAhPm9s,132
src/rules/cloud__m365__threat_management__microsoft365_unusual_volume_of_file_deletion.eql,sha256=DPdAMgHfcBI7BXXUHFnBL0QpCugRhcmOpBBuyxMdan8,118
src/rules/cloud__m365__threat_management__microsoft365_user_restricted_from_sending_email.eql,sha256=pPDnwWnKEHelu50UGKsfyJmLCjWLtpeVbwL0bS1VhmY,121
src/rules/convert-eql.log,sha256=ZWgoxqi6eu-iaKVZycgCYP1yU7O3SfT5gmxyCX-RA8g,469361
src/rules/identity__cisco_duo__cisco_duo_mfa_bypass_via_bypass_code.eql,sha256=1QXZIiIEfo2qk3X3CX3iUwSyv48EliihyIwrmUWTico,63
src/rules/identity__okta__okta_admin_activity_from_proxy_query.eql,sha256=vdED_Zd2W2UgEda6B5LH9Uu5Y36srvOmf7vjNUPtBaM,89
src/rules/identity__okta__okta_admin_role_assigned_to_user_or_group.eql,sha256=Gnp2q_pwP2-7PAS0rKvKHARPSncx2SKXszgkZ7FfLmc,84
src/rules/identity__okta__okta_admin_role_assignment_created.eql,sha256=nXSGsdWcYFFJOwYg-zPq5CUyOE7PYnl9HRIhuJtadO4,51
src/rules/identity__okta__okta_api_token_created.eql,sha256=8ZzoH47Rf2VhOjXypl_iZQUNahq34gOsJ83vOqroAXU,46
src/rules/identity__okta__okta_api_token_revoked.eql,sha256=XO8osz4SmW5ZKtd7nLk3YRcjg8YnQBHvh_kMoMwBjCc,46
src/rules/identity__okta__okta_application_modified_or_deleted.eql,sha256=a4qUZOAzW8-DdgQHYw7m76b4mIPqzYcuGms6rG9PXKo,91
src/rules/identity__okta__okta_application_sign_on_policy_modified_or_deleted.eql,sha256=TaZoxx57acKfhqW6zUEYUzZvLmqtdk5GMq67XofYVqs,106
src/rules/identity__okta__okta_fastpass_phishing_detection.eql,sha256=AbKta2hXunUpeJGeda296b05JspwZDsVsZQeWgkVssw,140
src/rules/identity__okta__okta_identity_provider_created.eql,sha256=422YQsZ1MqUPWRdxwVwE_um0P_FGibDBmFQL7yMj4xs,50
src/rules/identity__okta__okta_mfa_reset_or_deactivated.eql,sha256=UxJD3DxbUDiIu1UUCh_wJT_941UqZIfWZA_iq1deSSY,86
src/rules/identity__okta__okta_network_zone_deactivated_or_deleted.eql,sha256=o4Ef9JgEU7pjAY9puiMXGTWQDDzxudSa85Guj2x-91I,61
src/rules/identity__okta__okta_new_behaviours_admin_console.eql,sha256=55lloDPjjiz1xNF4KC6EASqTuWWCUvDoCWDhVOV_AXU,203
src/rules/identity__okta__okta_password_in_alternateid_field.eql,sha256=yxU3CJZXcbjr9cR4t0lXFHZn7hhVHX6rqDSgZhqMKn4,152
src/rules/identity__okta__okta_policy_modified_or_deleted.eql,sha256=0tI512eqelFVCzmCH1nMDNDyoNJCRAJgrkauatBVLuA,81
src/rules/identity__okta__okta_policy_rule_modified_or_deleted.eql,sha256=a77brtoGvbhnf6LA5yZD71BuQKkC28F0LPUbM8bwFmA,71
src/rules/identity__okta__okta_security_threat_detected.eql,sha256=qAZVKXlkN2QCwHbgTzmyjw-5TLLBr0VR5WRfBj75b1I,47
src/rules/identity__okta__okta_suspicious_activity_enduser_report.eql,sha256=Bv1eUXvfjwxCvpip2LsUdVLquNfRBR8I8j0SR7xoaXI,73
src/rules/identity__okta__okta_unauthorized_access_to_app.eql,sha256=Yl_d_VDmAdiK4Cuk0b30zUGOW4Ds5fo9MpDoFKzLj3I,69
src/rules/identity__okta__okta_user_account_locked_out.eql,sha256=2GPNeBFoEIKRZMPsFItpGllkX26XPkhEuyra2YPoYSM,57
src/rules/identity__okta__okta_user_created.eql,sha256=ST1rDm6WgZm1ck_GxyZLbPhdj2jDzER1D8m4WVYb7Ec,44
src/rules/identity__okta__okta_user_session_start_via_anonymised_proxy.eql,sha256=Ay22tgqIU7Ayy7aJmEGtJDYJfKf_X-dBO-zzEY2XEaU,76
src/rules/identity__onelogin__onelogin_assumed_another_user.eql,sha256=UsmaRqulZr8XAGJm6onGKVuMNtmSf6eVdag-inuT4Y4,26
src/rules/identity__onelogin__onelogin_user_account_locked.eql,sha256=y3CoZhLhchPadHEg1D4QuLV5t2eQ3oAEuq4pD2vqmT0,46
src/rules/linux__auditbeat__collection__lnx_auditd_t1074_001_tmp_loot_staging.lucene,sha256=RPvFTmy1RowZD9eMSYAWBgZhbYVTucHeyYdHNoCzrV8,97
src/rules/linux__auditbeat__command_and_control__lnx_auditd_t1071_001_susp_user_agent.lucene,sha256=fl-_gsJudV0FaVbpx8hAD8END9n1q-jixOzfRykX5R0,229
src/rules/linux__auditbeat__command_and_control__lnx_auditd_t1105_ingress_download_tmp.lucene,sha256=tqLMnAa3rlkPwcvBdJpvazePREWQgA5BztytoFhMjn4,186
src/rules/linux__auditbeat__credential_access__lnx_auditd_t1003_008_etc_passwd_access.lucene,sha256=k0EE_dS1-CtEIO7-YGOCAz0Jz7THIZ7XSKcT9ScRpnM,175
src/rules/linux__auditbeat__credential_access__lnx_auditd_t1003_008_etc_shadow_read.lucene,sha256=KDAvX2abgTPraoAN8_3bNJjiotJh385B9eAas7OpUqM,51
src/rules/linux__auditbeat__defense_evasion__lnx_auditd_t1140_base64_decode.lucene,sha256=UuIwiMwBIKlnLwXHuHI7vOTy9ZNfts7vXNdxS__kwK4,186
src/rules/linux__auditbeat__defense_evasion__lnx_auditd_t1222_chmod_susp_location.lucene,sha256=I8o0kg-RvqJUDXUH2S_awxBlUldp7OjlEzP6Q_N3-Jo,214
src/rules/linux__auditbeat__discovery__lnx_auditd_t1082_system_info_to_tmp.lucene,sha256=BSALtVUWyvwHMPtlIZgGeE4H1uB17PJLv0yCzLlfqHM,244
src/rules/linux__auditbeat__execution__lnx_auditd_t1059_004_reverse_shell.lucene,sha256=kR7HqcVm3MaeXo5tww0Qimpu5Fh9SpbgDjjFpyo7qwk,148
src/rules/linux__auditbeat__persistence__lnx_auditd_t1053_autostart_write.lucene,sha256=I46iJo9LFH3rx74BF96nN5c6W1RM8CroHiQBEtbzW24,327
src/rules/linux__auditd__execve__lnx_auditd_binary_padding.eql,sha256=WkjPc38RaPdEzNZtIKPfXwl84Q9SLuvjRAvRikjqad4,90
src/rules/linux__auditd__execve__lnx_auditd_binary_padding.lucene,sha256=GQ-mLt-YmxVbPaoRErdnmqOwqoh8P5eJXoqadXxwoQk,81
src/rules/linux__auditd__execve__lnx_auditd_binary_padding.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_bpfdoor_port_redirect.eql,sha256=2dfGSbfWwJaJgRdC1UtW2jp5X6Qr0iy9ailzNTjBeF8,111
src/rules/linux__auditd__execve__lnx_auditd_bpfdoor_port_redirect.lucene,sha256=RmiglCNKkGykheTgFF8DV88R4iBjKE3svxdfD6MMZ0Q,102
src/rules/linux__auditd__execve__lnx_auditd_bpfdoor_port_redirect.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_capabilities_discovery.eql,sha256=OOovl08KXVADoEGS8qsEmwkDNHoquwN0DDRHuOkADWo,63
src/rules/linux__auditd__execve__lnx_auditd_capabilities_discovery.lucene,sha256=BP2Ohpj1297JC61srL1zM2MjZrxbmYQpfJQTndIepe0,47
src/rules/linux__auditd__execve__lnx_auditd_capabilities_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_change_file_time_attr.eql,sha256=dn__2F-JR1O-oyTwWfD3gt5CUMiShrnIXC_mf-DhI3w,74
src/rules/linux__auditd__execve__lnx_auditd_change_file_time_attr.lucene,sha256=B0Jh19-v4D96YlphZWDxnGQ8J5lW8O8o1pmWYG2zYg4,66
src/rules/linux__auditd__execve__lnx_auditd_change_file_time_attr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_chattr_immutable_removal.eql,sha256=0crW8-wtrKpFruwMcjWv8wJdqi5NUQkOsh-u1EMLAZQ,56
src/rules/linux__auditd__execve__lnx_auditd_chattr_immutable_removal.lucene,sha256=PVcUnR6LiSSgYB-WNe4z_x0Jt7c12DaPt9g4QvGtY8g,41
src/rules/linux__auditd__execve__lnx_auditd_chattr_immutable_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_clipboard_collection.eql,sha256=ZmYMgqDI5kuYoYRB-9qJn-gKUI1UBUZbISukNEbpgGQ,126
src/rules/linux__auditd__execve__lnx_auditd_clipboard_collection.lucene,sha256=T-ObBY9LYhbR5tL8MXHWbDOJ2Xr0hplOFTDrwbC5lgk,97
src/rules/linux__auditd__execve__lnx_auditd_clipboard_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_clipboard_image_collection.eql,sha256=Lid-uCz59-lScOvncPcwgMHljsX6fjS5UoIVRZm8bH0,155
src/rules/linux__auditd__execve__lnx_auditd_clipboard_image_collection.lucene,sha256=-NrQuTQkwaigYmpERmtK-aFBBwl0Bh0O82mW6Rglba8,124
src/rules/linux__auditd__execve__lnx_auditd_clipboard_image_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_coinminer.eql,sha256=ZUePEzegEy1vfj0jKoiKVIMuh0RbacVBhIqQCT1T0GA,175
src/rules/linux__auditd__execve__lnx_auditd_coinminer.lucene,sha256=_gC3CFv0hkHN8zt1efMr8q27T5y-nb67E1bXEFEwLfA,172
src/rules/linux__auditd__execve__lnx_auditd_coinminer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_data_compressed.eql,sha256=LmTr_CXQswxPlzZWeGkO66PGt-hJffelISuKRMGsXqg,130
src/rules/linux__auditd__execve__lnx_auditd_data_compressed.lucene,sha256=niXTyk3o3nJlwvfAKbL9jf2qxVCBmgfVnbh8BKYaGq8,106
src/rules/linux__auditd__execve__lnx_auditd_data_compressed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_data_exfil_wget.eql,sha256=fTMI5jP5nxtxs7UO1KmUKD_gSkNAHbKEkopIfvhbtHY,61
src/rules/linux__auditd__execve__lnx_auditd_data_exfil_wget.lucene,sha256=PiwsWOm0CnlA9gJxOFFEx3n_XIYTFz39n6MbBp_yXzE,49
src/rules/linux__auditd__execve__lnx_auditd_data_exfil_wget.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_dd_delete_file.eql,sha256=bj_bwDQFCAPJnjw2gjuvR5WN08jKlsu63hIIMHrgoT0,90
src/rules/linux__auditd__execve__lnx_auditd_dd_delete_file.lucene,sha256=w2jvd_FruzgiSwjvS-6aLi359JpJxdysK-nGQQrIL14,74
src/rules/linux__auditd__execve__lnx_auditd_dd_delete_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_file_or_folder_permissions.eql,sha256=eWSOK1Hcj3vyyGhc5FMEszLdiKLMN62ygLohAzzr26I,62
src/rules/linux__auditd__execve__lnx_auditd_file_or_folder_permissions.lucene,sha256=6Lde80kCb9_136XXMbe1phhNvwwysUWV9eJGA5_uxtU,42
src/rules/linux__auditd__execve__lnx_auditd_file_or_folder_permissions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_find_cred_in_files.eql,sha256=8L_Ogn267aoGo68Avo4eL5juYKwC5XPpj_9uX1uZ4kQ,52
src/rules/linux__auditd__execve__lnx_auditd_find_cred_in_files.lucene,sha256=9YU7QvqBVFP9ARHm4XzfEWFfWUSFJkmLKfMO85Af1JA,40
src/rules/linux__auditd__execve__lnx_auditd_find_cred_in_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_hidden_files_directories.eql,sha256=01QtzPjirgh2tmOwpu9NlM079FndWh9M-eDpysU9PKk,150
src/rules/linux__auditd__execve__lnx_auditd_hidden_files_directories.lucene,sha256=kZ1IkeqbwC9j3R-vr7bXS6aKVGcoDS6eMpWwXEi5YY4,114
src/rules/linux__auditd__execve__lnx_auditd_hidden_files_directories.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_hidden_zip_files_steganography.eql,sha256=eXI_tpQay7Muyez8k7H7p0Ev21TUyyHpFDW40SY1uOc,88
src/rules/linux__auditd__execve__lnx_auditd_hidden_zip_files_steganography.lucene,sha256=jZHRaPStAgkADrMMbQOPmaww1ZtURVesmbmjxS-HeNM,64
src/rules/linux__auditd__execve__lnx_auditd_hidden_zip_files_steganography.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_masquerading_crond.eql,sha256=1K6P44Be98jQfVyx3ONcWUQTNtOWu6sI-dw3l60KVR4,70
src/rules/linux__auditd__execve__lnx_auditd_masquerading_crond.lucene,sha256=9qB68cuDO35Hh0mHGYVW25YFww_yHWgc1NB1Sknm0IA,55
src/rules/linux__auditd__execve__lnx_auditd_masquerading_crond.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_modify_system_firewall.eql,sha256=WkK5e4SgKn13iNHN99Z3WiOjURzY91EpeedVe3Za1V8,240
src/rules/linux__auditd__execve__lnx_auditd_modify_system_firewall.lucene,sha256=euCC1cA8DtQosUMkQs1a47L0Y4BAk1YLIPkOdrfpZnM,201
src/rules/linux__auditd__execve__lnx_auditd_modify_system_firewall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_network_sniffing.eql,sha256=5OTus2chSL0FmNSsugpyIhQhgT3QSnK1l6TiKrP1Q5c,128
src/rules/linux__auditd__execve__lnx_auditd_network_sniffing.lucene,sha256=aeS7ZepiOHJb7TPXZ6i74C7hGVr4dDa0Rz6hyl8Ok2Y,106
src/rules/linux__auditd__execve__lnx_auditd_network_sniffing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_screencapture_import.eql,sha256=_DsqR01KMKOfrphSoiZPlEmc35qCg3VyPADVyFsQnbA,164
src/rules/linux__auditd__execve__lnx_auditd_screencapture_import.lucene,sha256=E_AkehpdHfR4Hr6yOKfWZo1_8yKDfsHlYgprGTSDyBQ,131
src/rules/linux__auditd__execve__lnx_auditd_screencapture_import.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_screencaputre_xwd.eql,sha256=jFQZko_Eoxz6B8LJf8hqtMG1AMQ3_swt_xp1WRKTzHc,117
src/rules/linux__auditd__execve__lnx_auditd_screencaputre_xwd.lucene,sha256=ncNouUWPPt8ZuILRj-6i60VT6m_5CjK010NMCc0YvGo,96
src/rules/linux__auditd__execve__lnx_auditd_screencaputre_xwd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_steghide_embed_steganography.eql,sha256=t-Y-XQR2FSG-Uy38OzNUc5aUdvBjrhDsDqZaPUTDqdc,117
src/rules/linux__auditd__execve__lnx_auditd_steghide_embed_steganography.lucene,sha256=cBsKZZLc5_uluwvA5XOsTBbDkinPLpYebwm6bUSHS_s,89
src/rules/linux__auditd__execve__lnx_auditd_steghide_embed_steganography.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_steghide_extract_steganography.eql,sha256=bsn1AVe2PvhTqBHp5EdCHTGRtfMlPR3nv4V0R4vKxxQ,106
src/rules/linux__auditd__execve__lnx_auditd_steghide_extract_steganography.lucene,sha256=jS5Qua_MvrEuUstlR1zb8uMC0LholOXsrxA7Q0f8kyU,81
src/rules/linux__auditd__execve__lnx_auditd_steghide_extract_steganography.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_susp_cmds.eql,sha256=YZ7Q9aKoeSG8ibOiFsKbatP3exryhB9OVsGRnZ-_Npo,196
src/rules/linux__auditd__execve__lnx_auditd_susp_cmds.lucene,sha256=tgFPqludK9uCiGkFyZi_7d49gudC_gMhvvong_t76Ho,169
src/rules/linux__auditd__execve__lnx_auditd_susp_cmds.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_susp_histfile_operations.eql,sha256=1YPL_hI5wdk02ZTz5CLNk1Az6Ul9WwAXkz_t_2CGqRo,128
src/rules/linux__auditd__execve__lnx_auditd_susp_histfile_operations.lucene,sha256=-DsDiV2etv-mm5F7Ij3c_d8bT6ZX3QTWwR9fmaZRDyY,116
src/rules/linux__auditd__execve__lnx_auditd_susp_histfile_operations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_susp_service_reload_or_restart.eql,sha256=IB-EiKCauzoFF3ZA_IuS5_Yn6prlKUGdeKQ-iYDGzmY,107
src/rules/linux__auditd__execve__lnx_auditd_susp_service_reload_or_restart.lucene,sha256=Bcato_Ron_1VaizqVwKiL7tk1T6dWeDaUoH_Rrimgbo,79
src/rules/linux__auditd__execve__lnx_auditd_susp_service_reload_or_restart.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_system_shutdown_reboot.eql,sha256=rxy0GqQstY87nktvnhK5aVcXCmFVrAvX5XSbjPoxt6U,119
src/rules/linux__auditd__execve__lnx_auditd_system_shutdown_reboot.lucene,sha256=wDbWcu6Ja_IZnnhPpVtNy4bp87wTV6TdQFnvCYAQCHE,107
src/rules/linux__auditd__execve__lnx_auditd_system_shutdown_reboot.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_unzip_hidden_zip_files_steganography.eql,sha256=TxkVP0qkCHRlJVIeMATg2yfEyeBSaFmI_qfix-PLVJo,75
src/rules/linux__auditd__execve__lnx_auditd_unzip_hidden_zip_files_steganography.lucene,sha256=6Do5EveRgqOm7W6K1H-G4j7c5NxkmA57khKw6RkajSg,53
src/rules/linux__auditd__execve__lnx_auditd_unzip_hidden_zip_files_steganography.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_user_discovery.eql,sha256=f1VvDYEk7y_ulIdn7Av9iTS5fdgvqS3Y124zVupoEdw,106
src/rules/linux__auditd__execve__lnx_auditd_user_discovery.lucene,sha256=NeYLxiAyn7ru40aAjON6MYGk7V-9iD-keZ1zM0J-hBE,86
src/rules/linux__auditd__execve__lnx_auditd_user_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_audio_capture.eql,sha256=3ZQIq761561bJ0dav32km-RUjpwhhXj4FgJtQPl4X54,139
src/rules/linux__auditd__lnx_auditd_audio_capture.lucene,sha256=vUUXi-XzHy0y3XvOSWkJaw-mF28YjkFk_ZV2hP45d7s,118
src/rules/linux__auditd__lnx_auditd_audio_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_disable_aslr_protection.eql,sha256=oYBvbpAZxqQHDwdK-s-KHH3our5tYPQzpQHpHls7d2Y,150
src/rules/linux__auditd__lnx_auditd_disable_aslr_protection.lucene,sha256=vdKew01CtnDcMR-zLXEJA5-Fz_xsFlYJBW7P3a5bG8o,130
src/rules/linux__auditd__lnx_auditd_disable_aslr_protection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_keylogging_with_pam_d.eql,sha256=tjGR2B2hzJp7iAgE4i4Xf3xbnwFM4x-XtMjugmc6fcs,132
src/rules/linux__auditd__lnx_auditd_keylogging_with_pam_d.lucene,sha256=KHjzoeMDpndKVXk2rdnBnCGkjc6J64olbMhLl5HtNqI,112
src/rules/linux__auditd__lnx_auditd_keylogging_with_pam_d.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_password_policy_discovery.eql,sha256=tqo2RmVgrjnTr5lPvppSIgdMhsBXNrt30EliIsHz6dg,358
src/rules/linux__auditd__lnx_auditd_password_policy_discovery.lucene,sha256=s0nehRB9jE2JYOWjXiqkclvTyjxIWBUc5KP1M4DQz0o,344
src/rules/linux__auditd__lnx_auditd_password_policy_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_susp_c2_commands.eql,sha256=I91zgIljLKEX9GRPUBQR1afCAA5AvWx-RJQqH46Xey8,30
src/rules/linux__auditd__lnx_auditd_susp_c2_commands.lucene,sha256=aTGTCzWR-jfORZg0NXeKihSz-RiQEag9CippmbiwIFM,18
src/rules/linux__auditd__lnx_auditd_susp_c2_commands.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_system_info_discovery.eql,sha256=AomX99aThIOU-4y8IcAJEN-2GH1bFx17qMcS8nxquoc,324
src/rules/linux__auditd__lnx_auditd_system_info_discovery.lucene,sha256=ZVeObHgLDl-8iD0FQ0EHJ7Jsw2Gcrd8KyGUduObfrHs,284
src/rules/linux__auditd__lnx_auditd_system_info_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_auditing_config_change.eql,sha256=tWVFA1T7hJq_4BCm65S-6hwKjUrZXnBKjHJ65VJOvFQ,95
src/rules/linux__auditd__path__lnx_auditd_auditing_config_change.lucene,sha256=-PNcYWqwjXo_GASoxUK4BRzmAqBYw_jI1jtgqTkcNUM,83
src/rules/linux__auditd__path__lnx_auditd_auditing_config_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_bpfdoor_file_accessed.eql,sha256=gLHTkHjGvdklKJZ_GVgO4l42qwYHJOrxb__oGTwku2w,114
src/rules/linux__auditd__path__lnx_auditd_bpfdoor_file_accessed.lucene,sha256=cJYLbuWkP9hyPFPe4h1idFUxzhflV5xcEY8VUeWGSoM,103
src/rules/linux__auditd__path__lnx_auditd_bpfdoor_file_accessed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_hidden_binary_execution.eql,sha256=k-FlUSZGesswmtst9rp_RbZOZtajv7a4Pt581B_wDnI,132
src/rules/linux__auditd__path__lnx_auditd_hidden_binary_execution.lucene,sha256=f4B5mEywv2BDht4HGvkl4XppldOKbe66UbOO-wGuQXI,119
src/rules/linux__auditd__path__lnx_auditd_hidden_binary_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_ld_so_preload_mod.eql,sha256=8kh7nUaBen9DVBd8dLgygj2OdVbDbHcCQEO79EW4CnA,52
src/rules/linux__auditd__path__lnx_auditd_ld_so_preload_mod.lucene,sha256=-fMJDhBiG8KE_iQpfdFFqY4BSAuCx364v3hFUYME_zA,40
src/rules/linux__auditd__path__lnx_auditd_ld_so_preload_mod.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_logging_config_change.eql,sha256=-m3apkESqw3Ri67Ps5fDXBpV8SFCIfD0xKnvwFrrnPE,114
src/rules/linux__auditd__path__lnx_auditd_logging_config_change.lucene,sha256=9zEY-Sp-w6H7DchjVER22-UarBpeGHhG3p4yOHTGsxw,103
src/rules/linux__auditd__path__lnx_auditd_logging_config_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_magic_system_request_key.eql,sha256=fS5jEE2OcEcI7YlJDFNsYSGZa7CqQyd-Xy7bDDrr9xg,87
src/rules/linux__auditd__path__lnx_auditd_magic_system_request_key.lucene,sha256=SQlmBSvZl0N9c0RdgeBltOo4bb7fji14KdERcsx8zJ4,71
src/rules/linux__auditd__path__lnx_auditd_magic_system_request_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_system_info_discovery2.eql,sha256=ST6VpT1GFR1edSbMLba2uldNqlfMYhByhg4puziuvyc,251
src/rules/linux__auditd__path__lnx_auditd_system_info_discovery2.lucene,sha256=vF1tUcViLsyhkDM-tqNVzDHY20waTFAGWz0rr4GTs1w,261
src/rules/linux__auditd__path__lnx_auditd_system_info_discovery2.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_systemd_service_creation.eql,sha256=CM2oPhyrQgvze7v51iWG9LhQKcQZP_OsdAkqDEjG82I,155
src/rules/linux__auditd__path__lnx_auditd_systemd_service_creation.lucene,sha256=PNIsVwM0bYMqLhB4dlChXPH802j-B404RltCSOuEvaU,144
src/rules/linux__auditd__path__lnx_auditd_systemd_service_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_unix_shell_configuration_modification.eql,sha256=7uMYf5HGlqG9wmrN8ZBOL6U5lnhzYGUYz53syqtoqJ0,522
src/rules/linux__auditd__path__lnx_auditd_unix_shell_configuration_modification.lucene,sha256=paQx3UitSfWSA8W-PiCkbMa2vOv-yJVMgPAyB5E7Pgo,566
src/rules/linux__auditd__path__lnx_auditd_unix_shell_configuration_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__service_stop__lnx_auditd_disable_system_firewall.eql,sha256=AtUHbIjSyF_j0wSlqBQDcxpPirkxQxI4_nxQt9NMz6U,80
src/rules/linux__auditd__service_stop__lnx_auditd_disable_system_firewall.lucene,sha256=qCXnXUkjvfd3N764ueMzxApj8OtxTwBDHkEkwtYnoSI,60
src/rules/linux__auditd__service_stop__lnx_auditd_disable_system_firewall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_clean_disable_dmesg_logs_via_syslog.eql,sha256=V5qXoe9qDxuuIN3eSzqAghBSetYymZ2gDJzRiUI5iu4,71
src/rules/linux__auditd__syscall__lnx_auditd_clean_disable_dmesg_logs_via_syslog.lucene,sha256=BfEqHqqQ-cWmfQ2oFsvD1ifsVpp_B_mkdbv_GCp3IEA,55
src/rules/linux__auditd__syscall__lnx_auditd_clean_disable_dmesg_logs_via_syslog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_create_account.eql,sha256=cGgtpGmGs2A_fpcpKq4YzRB07lBkZgoZMGQBpvEzt1Y,66
src/rules/linux__auditd__syscall__lnx_auditd_create_account.lucene,sha256=FXKQqz1W2ASBLgASOEqclW-y7UGwIE46CpJ1W5Od9RM,51
src/rules/linux__auditd__syscall__lnx_auditd_create_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_load_module_insmod.eql,sha256=vYHU9-Rwo7WMj0-X8e16xMYIsiXSZ0yd05nMtEHyvtw,67
src/rules/linux__auditd__syscall__lnx_auditd_load_module_insmod.lucene,sha256=2HTHbTlAcF06H5-nspohmvo9OGWL4faXKtkNkN8FtQQ,54
src/rules/linux__auditd__syscall__lnx_auditd_load_module_insmod.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_network_service_scanning.eql,sha256=i1StOoxI-l8R4XsJ3ilmIQqM6S5D77dsoPP9YwcA-dQ,138
src/rules/linux__auditd__syscall__lnx_auditd_network_service_scanning.lucene,sha256=Vvv5lfqQ_XqL6dH8EB5795edIvj4JipTMKMtW01Fgao,122
src/rules/linux__auditd__syscall__lnx_auditd_network_service_scanning.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_split_file_into_pieces.eql,sha256=_kzGIvYYfwSN8BCwNjDAIxfPldHyoIkdXCj3o985GHI,42
src/rules/linux__auditd__syscall__lnx_auditd_split_file_into_pieces.lucene,sha256=vK91avUdDtrdt5Y0rwZi4QYnqvL61XirT3Z2GBlpuyY,28
src/rules/linux__auditd__syscall__lnx_auditd_split_file_into_pieces.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_susp_discovery_sysinfo_syscall.eql,sha256=_WEZ5gLajYFam8SbkuiCLw6z2OTHm5HGKpFvfA2Af2A,79
src/rules/linux__auditd__syscall__lnx_auditd_susp_discovery_sysinfo_syscall.lucene,sha256=y3V0dvIJ4istwQJwJ9AddB5J5T7wBPjcht9pUahpN7k,65
src/rules/linux__auditd__syscall__lnx_auditd_susp_discovery_sysinfo_syscall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_susp_exe_folders.eql,sha256=nck-qinvgyukqEHQKH6YCyUvuvl2jnkhmvt9d5SkDoA,352
src/rules/linux__auditd__syscall__lnx_auditd_susp_exe_folders.lucene,sha256=UI3qOoEyM4LaXt4wLEh0DdEkFOJp3uhfY97BTKjpwyc,390
src/rules/linux__auditd__syscall__lnx_auditd_susp_exe_folders.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_susp_special_file_creation_via_mknod_syscall.eql,sha256=JKIXHeBkJp5jg1bfnqnZvm2Wfs9zC1nFYZ4g0YA-XmM,45
src/rules/linux__auditd__syscall__lnx_auditd_susp_special_file_creation_via_mknod_syscall.lucene,sha256=QjGVI0erlRSbDKry79A9ryUdmxsobIaUb9IE5sWF_YY,31
src/rules/linux__auditd__syscall__lnx_auditd_susp_special_file_creation_via_mknod_syscall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_web_rce.eql,sha256=lva5eLgK1P-g4rDgCa7B0VrYHCLwSIRKECUXV4K8AUE,80
src/rules/linux__auditd__syscall__lnx_auditd_web_rce.lucene,sha256=RCIkchPq-7YcmNBVDN_l5ovjE2u3Sy-BueygvKkI3g0,60
src/rules/linux__auditd__syscall__lnx_auditd_web_rce.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__clamav__lnx_clamav_relevant_message.eql,sha256=ID0JNsU-UTXnp9uXOIomla2sPtGM-vvNZMm7wri-4RE,100
src/rules/linux__builtin__clamav__lnx_clamav_relevant_message.lucene,sha256=iWCNYp7RhfBhCzrPluy0BDcxAISEN4TnynyL0YZAo8Q,90
src/rules/linux__builtin__clamav__lnx_clamav_relevant_message.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__cron__lnx_cron_crontab_file_modification.eql,sha256=LHL9flxMo-Kt1vorBA4Jw1kB3e3Bqaf8HnjWwJODxjA,20
src/rules/linux__builtin__cron__lnx_cron_crontab_file_modification.lucene,sha256=gZBXxoP4kXHhH0SBBa7UU0Z6NJWgH2BBSj0JF1r42HY,10
src/rules/linux__builtin__cron__lnx_cron_crontab_file_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__guacamole__lnx_guacamole_susp_guacamole.eql,sha256=L0-aslw5R9g3se9OiB-0e_Bs82Ve9gfrbixgRySdwiA,34
src/rules/linux__builtin__guacamole__lnx_guacamole_susp_guacamole.lucene,sha256=pEpOv5KfyVIofOoXYL-lFj3tBM9heDDF2RV5rCFKn40,29
src/rules/linux__builtin__guacamole__lnx_guacamole_susp_guacamole.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_apt_equationgroup_lnx.eql,sha256=5nH7VEXhFZrRPeu_uFPv1ssHZ6fV8N5ncWgH1oEv5aU,1375
src/rules/linux__builtin__lnx_apt_equationgroup_lnx.lucene,sha256=4ygdrfzn8fdAnAdjeTxtHz8ePq2cPVUmvfDaYPagrWg,1657
src/rules/linux__builtin__lnx_apt_equationgroup_lnx.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_buffer_overflows.eql,sha256=C9odX2d89IFFpLr_JYMAcxuTMnK8i1SDzST4K3JrM4A,193
src/rules/linux__builtin__lnx_buffer_overflows.lucene,sha256=dhCdPM6FhtZ9MuPYMyuP2QfpWTtgeZvJPiLeJdKj9Ig,191
src/rules/linux__builtin__lnx_buffer_overflows.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_clear_syslog.eql,sha256=yKIWcNqmkn4YGgZHNwbqc_bYdoecfrYTi258RAKdLdI,207
src/rules/linux__builtin__lnx_clear_syslog.lucene,sha256=bg2p0sVi2U5n_j58Vvyqwe5F6tqrsf013yogBhFBvWE,235
src/rules/linux__builtin__lnx_clear_syslog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_file_copy.eql,sha256=03NMHUzEHHaf6PW4CmkR0Y-iSwqt6nycpw6SUkM-wPc,59
src/rules/linux__builtin__lnx_file_copy.lucene,sha256=_i9Q38jvs5qfvnOjl6D1jGtGydzcGMK9bgGxRsOcQGU,53
src/rules/linux__builtin__lnx_file_copy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_ldso_preload_injection.eql,sha256=8pvodB0Q5gLC0zZMEhUJoaDaBlW3dAnOAMIT522doAk,31
src/rules/linux__builtin__lnx_ldso_preload_injection.lucene,sha256=JFFTUDRv3g-OEX6DyJxuMEDfFSdUwwqfffFyTuKOLEs,23
src/rules/linux__builtin__lnx_ldso_preload_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_potential_susp_ebpf_activity.eql,sha256=v-AMjwBwevC3riDErcTZ7wVr4aJlGpS5XPH4vs2TGQ8,33
src/rules/linux__builtin__lnx_potential_susp_ebpf_activity.lucene,sha256=tgO0lMpQ0U9t4_9YF2kczajdYLBdAkLZ09a7FurI5J0,23
src/rules/linux__builtin__lnx_potential_susp_ebpf_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_privileged_user_creation.eql,sha256=JqEoh_Ireu30Zae14S8jzB8VPQsbPLif96tK621hUgg,74
src/rules/linux__builtin__lnx_privileged_user_creation.lucene,sha256=SAQlqHuey3a-EhZyvwH2XSGtzLvSNmiddRN-_LL05KM,69
src/rules/linux__builtin__lnx_privileged_user_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shell_clear_cmd_history.eql,sha256=2qiwlfiJwFOcTQVZ_-3mRm4nU1OWt7RzJe_u3bbBe8c,395
src/rules/linux__builtin__lnx_shell_clear_cmd_history.lucene,sha256=duuCl10nNzg7vTf76tFDxYU_7cHCl12FnpNAJEh3Qks,429
src/rules/linux__builtin__lnx_shell_clear_cmd_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shell_susp_commands.eql,sha256=6Oj1rjdWfC7QCq4IDb27PnUx-zB-tBszmJ2KSj7dvkY,764
src/rules/linux__builtin__lnx_shell_susp_commands.lucene,sha256=Rdt-53gLeHzy5lQvd-e3jGH07kNjll9VOYOwaJTny1A,891
src/rules/linux__builtin__lnx_shell_susp_commands.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shell_susp_log_entries.eql,sha256=5VQ5TDWwZoFkBNDrnKn0A3fYwCjVXv6ZEAy6HcvT2yk,137
src/rules/linux__builtin__lnx_shell_susp_log_entries.lucene,sha256=RgUPeDX8KWs1UAg3iDB5DbwvKcau9_pHowSe9e3qqnE,137
src/rules/linux__builtin__lnx_shell_susp_log_entries.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shell_susp_rev_shells.eql,sha256=boVyeGSkFt60TAH0ovdqUkyZzuq1UsiZc1fv22VXz-A,1106
src/rules/linux__builtin__lnx_shell_susp_rev_shells.lucene,sha256=WZU2drN1r0g5yvC6Bez1TGVPh2EY55gtvRrxya-i3Mw,1336
src/rules/linux__builtin__lnx_shell_susp_rev_shells.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shellshock.eql,sha256=hcbcVlQVPm8mGKRjaxKFxw7KpMDwTk2vrKuSSE35W_0,65
src/rules/linux__builtin__lnx_shellshock.lucene,sha256=ZXC8RNqewefKoLJJmbFN2XgXFgiBsyg1mDXl9h4Qc-8,81
src/rules/linux__builtin__lnx_shellshock.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_susp_dev_tcp.eql,sha256=ejLNV7Vej10jI6R30MOhSKyMY2k7pIOedrNb0fY3bCc,281
src/rules/linux__builtin__lnx_susp_dev_tcp.lucene,sha256=nAE-GYm7uvM5O91jda3aPNU_6Y1kXV5x628Ep_5qX5k,352
src/rules/linux__builtin__lnx_susp_dev_tcp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_susp_jexboss.eql,sha256=7_eD_lehrJ0QmutJ2IvU0C9CyoRbHqaIWBVfBYFN5Zo,47
src/rules/linux__builtin__lnx_susp_jexboss.lucene,sha256=2M7CAqOdNxgRIlcift7sKUHAvruJFAsU5JqhSpw0Kic,46
src/rules/linux__builtin__lnx_susp_jexboss.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_symlink_etc_passwd.eql,sha256=HUfwv_ExAU-aDkrBl2kbC2GHYUEaaAphML625SkFUCM,56
src/rules/linux__builtin__lnx_symlink_etc_passwd.lucene,sha256=28mHyZrJFb2O3PI9FPmcXJQBL3LOQLtWmkMSGQIEfEg,58
src/rules/linux__builtin__lnx_symlink_etc_passwd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__sshd__lnx_sshd_susp_ssh.eql,sha256=l6ndrcyL6-Y3TdNlRsiRJ6vuDSZXTxVfxmeFwRTskbw,379
src/rules/linux__builtin__sshd__lnx_sshd_susp_ssh.lucene,sha256=ngnzRgPsLHMqtC3LEqlzXsLKDeHtCHOB1Dltoy4_E8k,404
src/rules/linux__builtin__sshd__lnx_sshd_susp_ssh.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__syslog__lnx_syslog_security_tools_disabling_syslog.eql,sha256=h4bM50iyaNIzcISyCZi0QJhUL0zndC6Ic5Nq96k4Y3M,129
src/rules/linux__builtin__syslog__lnx_syslog_security_tools_disabling_syslog.lucene,sha256=2tnazxDsRVLPHQQUvmwA7_4YMokMuOMSVkY0V8JUC-U,125
src/rules/linux__builtin__syslog__lnx_syslog_security_tools_disabling_syslog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__syslog__lnx_syslog_susp_named.eql,sha256=InDgTgohF4zsieOkfqu5z0z91xGR60njJKCqVS60Ky4,111
src/rules/linux__builtin__syslog__lnx_syslog_susp_named.lucene,sha256=nK-n7ZmZ0qRP5R8Faf_lwp0ZNftFik3rgNmf-ga4_2M,119
src/rules/linux__builtin__syslog__lnx_syslog_susp_named.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__vsftpd__lnx_vsftpd_susp_error_messages.eql,sha256=soTRwUwKPoc0Ro-5CqllP-a75EHQKxVzTYhAditcZIw,606
src/rules/linux__builtin__vsftpd__lnx_vsftpd_susp_error_messages.lucene,sha256=sSIQROTnjp7VCnmW9pQK-Jj7S8-5Lp_a9J4BEKiHz34,659
src/rules/linux__builtin__vsftpd__lnx_vsftpd_susp_error_messages.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_doas_conf_creation.eql,sha256=WM1JO36FPFGw9f_t72T3We5jjEfO9QaySkhC9QF5ikU,43
src/rules/linux__file_event__file_event_lnx_doas_conf_creation.lucene,sha256=GnyqF0W_TDCYAdYsCN3IxJd2FB5pyGhhV8pR-PBwTNc,33
src/rules/linux__file_event__file_event_lnx_doas_conf_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_persistence_cron_files.eql,sha256=6AHdXIO0Phf9_R4Q8yGu1rnJB78WWWjL9iZZMAmSgls,255
src/rules/linux__file_event__file_event_lnx_persistence_cron_files.lucene,sha256=Qw0SExs7FJGguwnUPpMGzxJnw_ExPY4L7aVCMIOl_Kc,255
src/rules/linux__file_event__file_event_lnx_persistence_cron_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_persistence_sudoers_files.eql,sha256=kFHmMfp6tb82OV9gGn1CTzj1y5xo19I5WF-UtbYsWSY,44
src/rules/linux__file_event__file_event_lnx_persistence_sudoers_files.lucene,sha256=Sw7N0josEg2soazSRH22drK96A_MaeBa3Qy3PK8datc,35
src/rules/linux__file_event__file_event_lnx_persistence_sudoers_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_susp_filename_with_embedded_base64_command.eql,sha256=meyErXd8mbNQvaStWEpsdHTonW74hzmATHSRWFf1igw,60
src/rules/linux__file_event__file_event_lnx_susp_filename_with_embedded_base64_command.lucene,sha256=qwh_ys8Vw-xFXmLWptSCyfq4Srmig9Ze1nHMNQDCvAY,46
src/rules/linux__file_event__file_event_lnx_susp_filename_with_embedded_base64_command.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_susp_shell_script_under_profile_directory.eql,sha256=ACUSFy_0LE4P4ESUssaRCgL0B0f6nUidljnnhCZg8sU,90
src/rules/linux__file_event__file_event_lnx_susp_shell_script_under_profile_directory.lucene,sha256=LYXH4RSbm0D7VQsorzCQW_6uOYCf0OKwNcEvBQfVHF0,73
src/rules/linux__file_event__file_event_lnx_susp_shell_script_under_profile_directory.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_lock_file.eql,sha256=4JtnkuZXrK0bbnTlwJPDf841cOXzSiYUNDPclNs_AG4,40
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_lock_file.lucene,sha256=2EkE1EJTCC2dYqoMhIh-rzS_zX-Id11VK9GiAnDEkIY,30
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_lock_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_persistence.eql,sha256=kQEm_U2nPv0_KN3rRBqO6JnLDq9MI422epjptGmiA44,41
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_persistence.lucene,sha256=4z1tjYCG3Hr7bX6HJ7aMdY9A2YI-LWM1BXRW8G6Thvk,29
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_wget_download_file_in_tmp_dir.eql,sha256=OKr13C_7eUIMfCUD_r_CnbaOoonPnxiXsEY3hqkUOIw,77
src/rules/linux__file_event__file_event_lnx_wget_download_file_in_tmp_dir.lucene,sha256=HvKujR3Ld4BRZDqZpnDP3uqTqRXXB-wJXgneUfLOlZs,63
src/rules/linux__file_event__file_event_lnx_wget_download_file_in_tmp_dir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_back_connect_shell_dev.eql,sha256=0NSdPLvDsDTVnOMdXk5W7fxijciARZl89ttO2PKCkwg,86
src/rules/linux__network_connection__net_connection_lnx_back_connect_shell_dev.lucene,sha256=3krx5jQXM0-54Jim8j_mENreLr8rmmsp_M5_FOJ0BNA,68
src/rules/linux__network_connection__net_connection_lnx_back_connect_shell_dev.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_crypto_mining_indicators.eql,sha256=ol6d7JFTnNTyi12ADf6wv_aDG0qYU6vkbDhwIr9Z_4Q,510
src/rules/linux__network_connection__net_connection_lnx_crypto_mining_indicators.lucene,sha256=HMMiGDygb_EL6Q8bzG9htWVorULODL-eJ6pZ6oGJoyw,502
src/rules/linux__network_connection__net_connection_lnx_crypto_mining_indicators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_domain_localtonet_tunnel.eql,sha256=EPZxWquZGBqm-CL7DQ7kupH2CYlO5-28_dZ2AMfD8-g,97
src/rules/linux__network_connection__net_connection_lnx_domain_localtonet_tunnel.lucene,sha256=gtIds_HAK9S4lxNePy8SRAzqlv7CSl-qJmyrW2GoVCs,77
src/rules/linux__network_connection__net_connection_lnx_domain_localtonet_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_ngrok_tunnel.eql,sha256=R_tKHH1vMYoT_gJfqom0zamNjpiUHYap7o55kXq8qXU,212
src/rules/linux__network_connection__net_connection_lnx_ngrok_tunnel.lucene,sha256=qLU_GZCGL4TPZJjeEZJ8plLD_9ik0MvqNmcgimysIrM,194
src/rules/linux__network_connection__net_connection_lnx_ngrok_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_susp_malware_callback_port.eql,sha256=x57Qt-4J4FCZzFCciG5X3WUrpKasOxbW7Vl2lWN4PMo,469
src/rules/linux__network_connection__net_connection_lnx_susp_malware_callback_port.lucene,sha256=9U6MqdszoUEwyfPUk99V-zICsBS3iWdIHMmI9kZ-Chc,371
src/rules/linux__network_connection__net_connection_lnx_susp_malware_callback_port.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_apt_shell_execution.eql,sha256=DvxZ7pKnDZ8uFVYGKf4G-KYcZgeVnuuH27wn99tYzUc,94
src/rules/linux__process_creation__proc_creation_lnx_apt_shell_execution.lucene,sha256=tbiHLC5-fD4NgMRabaUtK-MmXUzSeeTPy5L5Ltm9gBE,85
src/rules/linux__process_creation__proc_creation_lnx_apt_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_at_command.eql,sha256=tMGfGRLe4xmc0OuIrpC-3M4L4a5KP6Fa4BfILNi3Obk,40
src/rules/linux__process_creation__proc_creation_lnx_at_command.lucene,sha256=PB0TNtxfWUz8Ufi2CitHSQ32HyU3ykjtXZtdPWsc67s,24
src/rules/linux__process_creation__proc_creation_lnx_at_command.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_auditctl_clear_rules.eql,sha256=_QeBCAd0zAE9xCq6hzOa2oMlp3rbDQQUjmsfYHrGHVk,57
src/rules/linux__process_creation__proc_creation_lnx_auditctl_clear_rules.lucene,sha256=sCVIYpIoDTJKiamje-PHzec8KF-PotLtnaIu7XEojL0,39
src/rules/linux__process_creation__proc_creation_lnx_auditctl_clear_rules.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_av_kaspersky_av_disabled.eql,sha256=Uko31PtRlyUdKQpduUMBKTy-6d3U-yJPFRHhUCyQhaw,110
src/rules/linux__process_creation__proc_creation_lnx_av_kaspersky_av_disabled.lucene,sha256=b6-uYrGq24HS1mRC3zDjP98yE1K6gIoU7OjNeQTBw1U,91
src/rules/linux__process_creation__proc_creation_lnx_av_kaspersky_av_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_awk_shell_spawn.eql,sha256=bFMYkRv8Fk6_8n0uKjkQXnyq0dXGwCXqkVAg-8dl0W4,197
src/rules/linux__process_creation__proc_creation_lnx_awk_shell_spawn.lucene,sha256=W7CBZ30dqTrm6qJqILPNk0E6YYh-zgZcceaDty2iAw8,185
src/rules/linux__process_creation__proc_creation_lnx_awk_shell_spawn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_base64_decode.eql,sha256=DRv0646XrnuVxxC2cst910VNscBC-xFRzuTp33KzeGE,50
src/rules/linux__process_creation__proc_creation_lnx_base64_decode.lucene,sha256=scDbYZmwjKGpcWwRuhfleg7V0tS4vmDtkJiLWYlCm3U,38
src/rules/linux__process_creation__proc_creation_lnx_base64_decode.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_base64_execution.eql,sha256=XSjje9zFkyZx-zecE4ypMEoGOSG_seoWQlMP48JOsH0,170
src/rules/linux__process_creation__proc_creation_lnx_base64_execution.lucene,sha256=_FZSDRo6YLNOLNU8dooakf71jxk6lGqve24y8qTXX3I,160
src/rules/linux__process_creation__proc_creation_lnx_base64_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_base64_shebang_cli.eql,sha256=aKg9nPVEEE-nUV2zvXfgfo7Yq_TOgAcIc6yODla-zOU,126
src/rules/linux__process_creation__proc_creation_lnx_base64_shebang_cli.lucene,sha256=h1FnH4iHyw2DB36FE-_VZxBU-rp8b9yOwgxVYv9nErk,108
src/rules/linux__process_creation__proc_creation_lnx_base64_shebang_cli.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_bash_interactive_shell.eql,sha256=ZYDzDTgrGQFK2AYEjvtV8Bgda8wxENTqiM-WkPiqMMQ,50
src/rules/linux__process_creation__proc_creation_lnx_bash_interactive_shell.lucene,sha256=cuZ8Wubaka-m2d79kdOcBwj6aDemSqk5LTTGUqk7PtI,40
src/rules/linux__process_creation__proc_creation_lnx_bash_interactive_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_bpf_kprob_tracing_enabled.eql,sha256=nF9v3o24zX1JwofeW9zU0GWV6fHe9a-Swr9wTVEDfB4,169
src/rules/linux__process_creation__proc_creation_lnx_bpf_kprob_tracing_enabled.lucene,sha256=t9kKLabfV4JECrrcRm7WbdPbmV4kR5vfY_XtFnHrWcs,161
src/rules/linux__process_creation__proc_creation_lnx_bpf_kprob_tracing_enabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_bpftrace_unsafe_option_usage.eql,sha256=r2ctoW3Rc1lOv4C9vrj8QD8DrSPSCfwMOmzYkGl6tnk,57
src/rules/linux__process_creation__proc_creation_lnx_bpftrace_unsafe_option_usage.lucene,sha256=t38igrDwkesERN90Ilc5uitlfShsnnemAw-Veb_Vxi4,45
src/rules/linux__process_creation__proc_creation_lnx_bpftrace_unsafe_option_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_capa_discovery.eql,sha256=gEg3aeJtINsOauH--R8cFe4tSxzXIlpB5buIDNm46EI,106
src/rules/linux__process_creation__proc_creation_lnx_capa_discovery.lucene,sha256=Z5EurlfPpfPcoHCeV-DTxNKASmAzfbXbo5kF11vFx74,99
src/rules/linux__process_creation__proc_creation_lnx_capa_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_capsh_shell_invocation.eql,sha256=_-yw0XuB-jHFdVhQ5u8eoajUeaaaZuvkSNpsueBAzic,49
src/rules/linux__process_creation__proc_creation_lnx_capsh_shell_invocation.lucene,sha256=cSbq72Bhg6RTRp82xp1Om5rbcaIa6P5XmT2_s-yqF_U,39
src/rules/linux__process_creation__proc_creation_lnx_capsh_shell_invocation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_chattr_immutable_removal.eql,sha256=gHHbjRSOs00YzGVybb0h43WuK8Nsaby3cP7jKikFeio,52
src/rules/linux__process_creation__proc_creation_lnx_chattr_immutable_removal.lucene,sha256=alW0f-v30VRmBkMZNWqpzHhBEMEkExnYbvP-k2HPzxw,42
src/rules/linux__process_creation__proc_creation_lnx_chattr_immutable_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_chroot_execution.eql,sha256=YjCO8dwgL8rN10KyvveI8JLxZLEwKFVG3C_hvReG1cg,80
src/rules/linux__process_creation__proc_creation_lnx_chroot_execution.lucene,sha256=bgS29_2SV8KKTqltIBsxGaWQN0mWVP5JOONvdQixlIY,68
src/rules/linux__process_creation__proc_creation_lnx_chroot_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_clear_logs.eql,sha256=nSoqQyt8PKDlzHd-R0qOdx2aCnVbtITBfPW28VoaLzw,116
src/rules/linux__process_creation__proc_creation_lnx_clear_logs.lucene,sha256=o0htXshmP5jdWbbgi0dbPRsBE1ufwHb8zZXdBFWPeQg,98
src/rules/linux__process_creation__proc_creation_lnx_clear_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_clear_syslog.eql,sha256=cyYMwkzSbKfqoZlHu3B3zo06is2XLPEdib3Fmf_EG08,822
src/rules/linux__process_creation__proc_creation_lnx_clear_syslog.lucene,sha256=KuAhyT-bjqXn7Jx8qK7ffbiLAXz30K29BVToh2Jb6Ck,839
src/rules/linux__process_creation__proc_creation_lnx_clear_syslog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_clipboard_collection.eql,sha256=Ys1B85paPkJaKh_6wgMCqf7bva6_S6Qt7qay_KWjjnI,101
src/rules/linux__process_creation__proc_creation_lnx_clipboard_collection.lucene,sha256=x-8fU2RMqs2eDCZdn7gf7tmHjDnEK3KPQSIoK1Domzs,85
src/rules/linux__process_creation__proc_creation_lnx_clipboard_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_cp_passwd_or_shadow_tmp.eql,sha256=Wdap8uJQMtcmiu4e62KDt0yTFmuB4h6lUb9IRyDIlLk,98
src/rules/linux__process_creation__proc_creation_lnx_cp_passwd_or_shadow_tmp.lucene,sha256=khUNtKGfD1_J0d_D3cgPNgWNSei1zuTG-YUMJ3DGGEc,79
src/rules/linux__process_creation__proc_creation_lnx_cp_passwd_or_shadow_tmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_crontab_enumeration.eql,sha256=LzOshB8mmKIS2FdTg-2AMv3jZbE6up9-BDCUqnhsdhE,52
src/rules/linux__process_creation__proc_creation_lnx_crontab_enumeration.lucene,sha256=4QLiLv-8k5Q5BfalLDrUkCKmZ6x_7Q6GZSsMvqG0G8c,41
src/rules/linux__process_creation__proc_creation_lnx_crontab_enumeration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_crontab_removal.eql,sha256=8f_OfH2ii3qlsr44hvzItSFGaA-LEZL6VG0n7h2rC9g,51
src/rules/linux__process_creation__proc_creation_lnx_crontab_removal.lucene,sha256=8G7jam6YUMnvMNGkn9fxTUl4uvsmc2Dgrmf6NPR-aB4,39
src/rules/linux__process_creation__proc_creation_lnx_crontab_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_crypto_mining.eql,sha256=-HLH1bbagu1BDywREVlgWUW-Fhp7f2GWFGt1KyUYVhM,430
src/rules/linux__process_creation__proc_creation_lnx_crypto_mining.lucene,sha256=Djl5W-eG7Z5To2I4rkybsXg9OMjS2_PlHaK-jy9W4yA,449
src/rules/linux__process_creation__proc_creation_lnx_crypto_mining.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_curl_usage.eql,sha256=J6262jlHT-ePB93oNjQgsJ1RY40r_Fy_JsVmiyjFUkA,25
src/rules/linux__process_creation__proc_creation_lnx_curl_usage.lucene,sha256=i7NA-ROpwkBhDc-pW_bX-Z1v1C_FeOG9km9tgPHa6v8,14
src/rules/linux__process_creation__proc_creation_lnx_curl_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_curl_wget_exec_tmp.eql,sha256=Rx4dwLoAfcYkxa5lGzUGz-1p0oUxQEvULfRtSJhT5nk,130
src/rules/linux__process_creation__proc_creation_lnx_curl_wget_exec_tmp.lucene,sha256=ObqqOB1n_BCR2m5-XTd7oaEpIcSzgg0nabtWqQOTpRA,111
src/rules/linux__process_creation__proc_creation_lnx_curl_wget_exec_tmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_dd_file_overwrite.eql,sha256=hYxbIsED2QDOWq_GPwjIvgNq8l_s_EAH_csD3fjygZM,136
src/rules/linux__process_creation__proc_creation_lnx_dd_file_overwrite.lucene,sha256=56CQWhGl3wr-cYLSKxgVXnSOBV-eEMAIXjUDw4f-OMc,120
src/rules/linux__process_creation__proc_creation_lnx_dd_file_overwrite.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_dd_process_injection.eql,sha256=7LcKJYm2g0nqIomuy7_Ly0RWopgJd8Cz49ULsY4p0Fw,101
src/rules/linux__process_creation__proc_creation_lnx_dd_process_injection.lucene,sha256=4aaTOJdbdD0DTw3Efhqh0tqSrnxbeM1zf5AIbxVLiTo,88
src/rules/linux__process_creation__proc_creation_lnx_dd_process_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_disable_ufw.eql,sha256=Uv32v5BzfQtghspqyAs5dx2K3wVkGscVeOuMDGpTnP0,122
src/rules/linux__process_creation__proc_creation_lnx_disable_ufw.lucene,sha256=xT4B5qfkpIQgPYXnOIRvEna7MT5mL-oInsvFhtMYjI0,107
src/rules/linux__process_creation__proc_creation_lnx_disable_ufw.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_doas_execution.eql,sha256=-eHfxjoE4rfZ4zstubs7pCPuEWSA8xsI3T22RTLN1o0,25
src/rules/linux__process_creation__proc_creation_lnx_doas_execution.lucene,sha256=IYgi4zSH5wrYeowWRifWk5_vyJoP_j7xivujNAic86g,14
src/rules/linux__process_creation__proc_creation_lnx_doas_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_env_shell_invocation.eql,sha256=uXLXqW_QC2DF-IUbU_Tc96PjIwKoJuwS5RDppquz1uE,116
src/rules/linux__process_creation__proc_creation_lnx_env_shell_invocation.lucene,sha256=SIDUJBpc-NdrKCCXYRudXNHs2pPkfPg0yHWOgt--3MA,107
src/rules/linux__process_creation__proc_creation_lnx_env_shell_invocation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_network_discovery.eql,sha256=6tAvr4KvfSTCCFuJZTjVX-DLACXZUHHR89Cyk9ZtH_A,103
src/rules/linux__process_creation__proc_creation_lnx_esxcli_network_discovery.lucene,sha256=JIw64yTR3jw-K5GtjHhGe6gBC0oHCJVNMqBqImSrsZ4,84
src/rules/linux__process_creation__proc_creation_lnx_esxcli_network_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_permission_change_admin.eql,sha256=7SUZRR7frkMpagdShTotAROBMloh3Vf5G6Ln8XEIuIU,140
src/rules/linux__process_creation__proc_creation_lnx_esxcli_permission_change_admin.lucene,sha256=shGXVObPg0p4sP05A2Jz1cMQB8KHi87MYQkp8Pz_KPk,124
src/rules/linux__process_creation__proc_creation_lnx_esxcli_permission_change_admin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_storage_discovery.eql,sha256=Jr3phHiCd1JD9fRznIHzN9RS5heTctxPihsKqSyzwWM,103
src/rules/linux__process_creation__proc_creation_lnx_esxcli_storage_discovery.lucene,sha256=citn1T2GrSolBzdcO7nS8mMAVxiuvXy8vvHrduVDSV0,84
src/rules/linux__process_creation__proc_creation_lnx_esxcli_storage_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_syslog_config_change.eql,sha256=gloZpqtcYWHHWnsdy7Q9RQZ5rCCiHXyeZOh5UtUrrFQ,135
src/rules/linux__process_creation__proc_creation_lnx_esxcli_syslog_config_change.lucene,sha256=9nXDfOD60oa9t0lkNY1LkLAv2NHZNsdyiw-YXc8v-O4,117
src/rules/linux__process_creation__proc_creation_lnx_esxcli_syslog_config_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_system_discovery.eql,sha256=n0AVJkK3sBv8yCj5nvx4YhwqQDXgx7axZjzL85Xqww4,102
src/rules/linux__process_creation__proc_creation_lnx_esxcli_system_discovery.lucene,sha256=zq1azljX5_4oiAd2ruqFHshR6A5Ao5Z3ZrZD8tGC9eM,83
src/rules/linux__process_creation__proc_creation_lnx_esxcli_system_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_user_account_creation.eql,sha256=0MTCjbP2e1htO4RJPKBqQ-bmZhZBhkO5JCyFIdCiI_Y,111
src/rules/linux__process_creation__proc_creation_lnx_esxcli_user_account_creation.lucene,sha256=AZ3Ch3uDEhAXWr2CtZThf9XbmI_RG9DsimYRghT1LCY,97
src/rules/linux__process_creation__proc_creation_lnx_esxcli_user_account_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_discovery.eql,sha256=A8L_C1kVfk6mTWuf8yCx29IFVEqD6RTcVMBbJ1ljiWQ,83
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_discovery.lucene,sha256=Cj6-J10NP6w-zFkwQ9yIhNajxXZpIggOGegez-Qjl9E,70
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_kill.eql,sha256=T9qiJ1oZfz0yjECXZM-foBho90jwPLOO_8MCqzxle-c,85
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_kill.lucene,sha256=thR-w-yB4o6av81PtbiLJpuCP1oDXYVV91Qc625vFlk,71
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_kill.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vsan_discovery.eql,sha256=MbWvslEAvZS-58VkRHgFWsznXCF7WjoTrJ40I0gvWm0,100
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vsan_discovery.lucene,sha256=5O8jHKtLxxbkOi9ozNXnZaq-ipdFRy9cNpzHFZ8LCws,81
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vsan_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_file_and_directory_discovery.eql,sha256=dG-pWeQkL3-rhMj3ZLmLT1smgkxIuy3N_Tk3_ptqawU,181
src/rules/linux__process_creation__proc_creation_lnx_file_and_directory_discovery.lucene,sha256=wL7rIm9d7P1CTpASYLpWWeCVPVxagxxHsCTS1S3k5ro,157
src/rules/linux__process_creation__proc_creation_lnx_file_and_directory_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_file_deletion.eql,sha256=wsdG5BUGo6Vk0Z-NtkWF6hq8UlaEwDXzoF5SitqkP3c,54
src/rules/linux__process_creation__proc_creation_lnx_file_deletion.lucene,sha256=261SbP2eNCMF6uDpW5h-tULpLFF5iRUwU2NSJMEClRQ,39
src/rules/linux__process_creation__proc_creation_lnx_file_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_find_shell_execution.eql,sha256=8ei_fyb79iVoMBFW03IuwK41j1QdGa1XNfWUn42s3fU,176
src/rules/linux__process_creation__proc_creation_lnx_find_shell_execution.lucene,sha256=_ovkE1eGRwABdfb_-Dom-GfJZWIABVjrRJmd9S_jyWE,166
src/rules/linux__process_creation__proc_creation_lnx_find_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_flock_shell_execution.eql,sha256=xOj2psvbfKqt0FjiOzM-pmEf0tRUMygArZGTgQv2OoI,150
src/rules/linux__process_creation__proc_creation_lnx_flock_shell_execution.lucene,sha256=SkDUe_gL5L05iSKZ6KZYm9O5GW5noR3oE3SCJpKPVVU,142
src/rules/linux__process_creation__proc_creation_lnx_flock_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_gcc_shell_execution.eql,sha256=rSg0nLdRCAK8LchvMfDl_rB1nm5pLRjkC2NJbCFnOwM,195
src/rules/linux__process_creation__proc_creation_lnx_gcc_shell_execution.lucene,sha256=oLwwdn6HyN7dJy5JUHGHwzDEHUo5uJHJitri0ixBl6g,186
src/rules/linux__process_creation__proc_creation_lnx_gcc_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_git_shell_execution.eql,sha256=-QX-Xz1secCUIxRil2LyVlWLehbBcPpf4k9AjCA6CGI,162
src/rules/linux__process_creation__proc_creation_lnx_git_shell_execution.lucene,sha256=4KWDGrnZf_5MkR0D4OwIPPCtdKHpga4La9-p5ls9HMQ,151
src/rules/linux__process_creation__proc_creation_lnx_git_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_grep_os_arch_discovery.eql,sha256=sItYZmXySv_BmYvJDh6vDBs_tdqCgdpxiC5EcnFrciA,108
src/rules/linux__process_creation__proc_creation_lnx_grep_os_arch_discovery.lucene,sha256=PkRHhFOyj-S9P_72in62z_PD-IixEcZS2dJpb_nhlcs,89
src/rules/linux__process_creation__proc_creation_lnx_grep_os_arch_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_groupdel.eql,sha256=F4Q7x9lkO11zKCuz-3x_4jXUCmlmqyVwcb7zbnKgbOU,29
src/rules/linux__process_creation__proc_creation_lnx_groupdel.lucene,sha256=M6iVg4EBOiczNFa8St7xwRewEpyot5FdfedsDkttdOc,18
src/rules/linux__process_creation__proc_creation_lnx_groupdel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_install_root_certificate.eql,sha256=s9B55uW766fupr2UxbCpgIFPhcB-06xobqGU_3Rw-_8,72
src/rules/linux__process_creation__proc_creation_lnx_install_root_certificate.lucene,sha256=uwQHSJpVZL-V9ucuxXeDXlwkzYAEE5XWCHSNwUioCIc,60
src/rules/linux__process_creation__proc_creation_lnx_install_root_certificate.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_install_suspicioua_packages.eql,sha256=LzUuFh2I1yRroNHPiYzfQn1O0NQt7efMr-WLLpsGBac,381
src/rules/linux__process_creation__proc_creation_lnx_install_suspicioua_packages.lucene,sha256=TJK6Fq1V6r7sG90y4RkRXp5oqkAKlF75RkniMU9hiBY,340
src/rules/linux__process_creation__proc_creation_lnx_install_suspicioua_packages.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_iptables_flush_ufw.eql,sha256=hSc8z15Sf3G_VB5CZAW4uZabSTaymCW35dyls6RRHUQ,301
src/rules/linux__process_creation__proc_creation_lnx_iptables_flush_ufw.lucene,sha256=RRY7ERCc1eIWBcM2i5vP9eo9L4GmN41kUCbGPFqRdNE,289
src/rules/linux__process_creation__proc_creation_lnx_iptables_flush_ufw.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_local_account.eql,sha256=1eN1YFvxkk6pF9fZB_RyYWqkxx7aXWIfqk3f3Q7p22g,390
src/rules/linux__process_creation__proc_creation_lnx_local_account.lucene,sha256=rH62SUqnEX8m6FlGa2ZN56W_C8rr9BBiXhLmN-di2yI,384
src/rules/linux__process_creation__proc_creation_lnx_local_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_local_groups.eql,sha256=yCegWQa1hBBQKL6Yp_-fhElP7-vCw4qUrSA5RjdKaiU,162
src/rules/linux__process_creation__proc_creation_lnx_local_groups.lucene,sha256=Xfg94GGN5P1Yj4flXz79XzwYKW1ZGjd0zeCh7lWRchs,152
src/rules/linux__process_creation__proc_creation_lnx_local_groups.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_malware_gobrat_grep_payload_discovery.eql,sha256=t2SOaFpOHXqgSHrGIEdiXoeXDqBYuMp_V9hl41M2Le0,100
src/rules/linux__process_creation__proc_creation_lnx_malware_gobrat_grep_payload_discovery.lucene,sha256=_1m9cECFvm6PVl14ZVz8Tsa9NwW4cCpImYzfVCx0TmM,81
src/rules/linux__process_creation__proc_creation_lnx_malware_gobrat_grep_payload_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation.eql,sha256=lNsNUl5anwksdCJghiYkdtjPN5D3jdRZjNkcEFwD5qk,27
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation.lucene,sha256=w1uMZx5-Z6uclIRJK2OZXEZ4OBK-RfYTOqH06_YnKv8,16
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.eql,sha256=uXj42zLmGlcswMecrd0yktQAerc4L2BcPEF1zS8qy1c,54
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.lucene,sha256=iW2ossrKQlohDah5b7A2x5p2JmyZEshxhcIYByqNJ9U,44
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_mount_hidepid.eql,sha256=03iAG-SvwvlRAd7Ls-4J_iv5ivXaPGTt72Ud6tuKeiQ,83
src/rules/linux__process_creation__proc_creation_lnx_mount_hidepid.lucene,sha256=jTTrIxcwUnwVkRwI5b3UsxxpIEMgTJ42kIBiE2Qryw0,72
src/rules/linux__process_creation__proc_creation_lnx_mount_hidepid.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_netcat_reverse_shell.eql,sha256=V41xNYOo0SAvpUatqEUMVK3opfIfX8X_Qhc5YId8Dnw,445
src/rules/linux__process_creation__proc_creation_lnx_netcat_reverse_shell.lucene,sha256=iWJfh4QDdf5Oklr26v27nUngcfq0WMHvcl_03Fed_3Q,445
src/rules/linux__process_creation__proc_creation_lnx_netcat_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_nice_shell_execution.eql,sha256=6maCoQNlSypxaAr_frZrHdqzg33J_wlKxfLterrHyKk,117
src/rules/linux__process_creation__proc_creation_lnx_nice_shell_execution.lucene,sha256=gG5lMPQOxb5ZU2b1MjerD1plOSOt7ri_-PUGUBayHew,108
src/rules/linux__process_creation__proc_creation_lnx_nice_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_nohup.eql,sha256=P00CqXeSaaGuYHPWIAVdzINdlYpRF4upXgGuSulwweY,26
src/rules/linux__process_creation__proc_creation_lnx_nohup.lucene,sha256=rnF2nwSrKB5FUJXZ44Tvp_xpuvZX0TkqT_qCO-JaLBw,15
src/rules/linux__process_creation__proc_creation_lnx_nohup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_nohup_susp_execution.eql,sha256=55KgaAL5fe5fW8B5dPh0TVdgbval5wt0oFGLWnphcaw,52
src/rules/linux__process_creation__proc_creation_lnx_nohup_susp_execution.lucene,sha256=SnSN9h8bD5TfwZJZMObO2DMUjDznOJQ4ilcGDoYzVhU,41
src/rules/linux__process_creation__proc_creation_lnx_nohup_susp_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executescript.eql,sha256=zWJ9PEN9-A2hyOgiaWo6xEpwriwnA65lyGeF0QljWSU,145
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executescript.lucene,sha256=S0lfAU9EXUukkq9pwrux5-jkHGpE3QnGUngU1lxMpTY,141
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executescript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.eql,sha256=L6pEc6AfZ9kcKUd_mONP0B0wkVtO5UGtRtkobL2Hvlw,114
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.lucene,sha256=F7lvV1oRp-U6On5tlnobKEtLRiTU8T22p2muWkDv5hg,105
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_perl_reverse_shell.eql,sha256=Rn909IcRnHzrkrQGOQLThnkevJsVHoMBSWI8g75zSfA,225
src/rules/linux__process_creation__proc_creation_lnx_perl_reverse_shell.lucene,sha256=4qe7PU9K6QR7ukcdhOv9L-O-8EZ176bBM8Gls4OCo40,208
src/rules/linux__process_creation__proc_creation_lnx_perl_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_php_reverse_shell.eql,sha256=Z3pJvdy32tXB8YdQPFn2B6F85j8ggk-NdV9ulbAZk3s,191
src/rules/linux__process_creation__proc_creation_lnx_php_reverse_shell.lucene,sha256=stsB8xZORC4yjBCyKk-54KdfqlRmzBCZkm_VVUPm9q8,171
src/rules/linux__process_creation__proc_creation_lnx_php_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_pnscan_binary_cli_pattern.eql,sha256=WNkalxEMs4Trp3a7f0RrzJofzmbmnSWUgUk4G6d2KtE,86
src/rules/linux__process_creation__proc_creation_lnx_pnscan_binary_cli_pattern.lucene,sha256=ykaWNEUe8lbxr_d6QLgICtJY4oVqVlrYGCqovl7VJno,65
src/rules/linux__process_creation__proc_creation_lnx_pnscan_binary_cli_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_proxy_connection.eql,sha256=HAvhqr8fPeKxacjoGhAGjYaVO0tbIwQ3-H0Q4DWhegU,64
src/rules/linux__process_creation__proc_creation_lnx_proxy_connection.lucene,sha256=r-tlGDGEqZ8AiSYLPxDyM2VRM2GdryX9xobs3UHJQMc,48
src/rules/linux__process_creation__proc_creation_lnx_proxy_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_pua_trufflehog.eql,sha256=3hfqNyWsqmRdp11-DHsdxZpjRibfMOhoD3eDW9073kM,226
src/rules/linux__process_creation__proc_creation_lnx_pua_trufflehog.lucene,sha256=QSpbgT-HF3tx1uMg11nyiC8ygbaXjQ7LyikStIrX7uQ,230
src/rules/linux__process_creation__proc_creation_lnx_pua_trufflehog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_python_http_server_execution.eql,sha256=EeRfe_Pku4JYjfoBzUxuFpV2q4K9Ijz6hYHQFDNbREo,177
src/rules/linux__process_creation__proc_creation_lnx_python_http_server_execution.lucene,sha256=SxjA0BfOwDSsHTTrdzWxPJjTUFtHuSTH-BHFLTaLxx0,148
src/rules/linux__process_creation__proc_creation_lnx_python_http_server_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_python_pty_spawn.eql,sha256=Mh49JrjpmtP0RlEQuEsHcXCWqpKSNpzyMWyZI-RZZM8,195
src/rules/linux__process_creation__proc_creation_lnx_python_pty_spawn.lucene,sha256=q5-eANucdKuT7SvN8r1e0Nyklk-HexfEs60CXqZuHr4,167
src/rules/linux__process_creation__proc_creation_lnx_python_pty_spawn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_python_reverse_shell.eql,sha256=Fimo7HJo8tnlgms0rv1t3XqUvF5OPtJlsVaGcHLsXwY,187
src/rules/linux__process_creation__proc_creation_lnx_python_reverse_shell.lucene,sha256=xeC7THXaLN4B4BU1KK0sKRmkz70yZctU2cVQfVfupv0,166
src/rules/linux__process_creation__proc_creation_lnx_python_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_python_shell_os_system.eql,sha256=btjqqRE0Ov6GUKA5Q64c_1n-x_KO5pJglQnHpBD-v-4,270
src/rules/linux__process_creation__proc_creation_lnx_python_shell_os_system.lucene,sha256=2DCGqw4ytAk7YDNl8fb6nSxsXo2uc3v-lmpBL6sSLTo,251
src/rules/linux__process_creation__proc_creation_lnx_python_shell_os_system.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.eql,sha256=JuBU7I_DkcIcu4OMdV_SnwMtjLcoevp86zjk7-rCySE,143
src/rules/linux__process_creation__proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.lucene,sha256=CUseXHsjfgej1nTtIPly3VVlIoR7ZKUIh2NjUXUkf2o,138
src/rules/linux__process_creation__proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_remote_system_discovery.eql,sha256=QQlwlJthbEb-dZ-VvS-CwngzsnMwnIyNqTvAKSMblZQ,369
src/rules/linux__process_creation__proc_creation_lnx_remote_system_discovery.lucene,sha256=ykvTJqYwbMihwzt18vikY_vAYCQramSP0nruOosA-dE,368
src/rules/linux__process_creation__proc_creation_lnx_remote_system_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_remove_package.eql,sha256=BlLpEjwzi6EO25VC-_tokRWgaVI3Lht6JEPsOECmh8o,278
src/rules/linux__process_creation__proc_creation_lnx_remove_package.lucene,sha256=PyS44ryHPp4i3lWfOrrONSoD6Ixu20V6Y_4RxP_lD9A,243
src/rules/linux__process_creation__proc_creation_lnx_remove_package.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_execution.eql,sha256=O9EMkQooHLL8HE15e0k9OTymnQaIKM4WLOOo2Bo4aOc,280
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_execution.lucene,sha256=Fvl0unPhd5zN2jO36Q1q48GkZptmaLspJVps_wabkYw,281
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_spawn.eql,sha256=yLBTnU8V8NXX85-DFWYHddzJNOUYVK-EcWQJoEMZJOE,180
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_spawn.lucene,sha256=2ho6r94TLan9EpJV91rdF5TZbj2vYmoOj_msGwYHfBk,165
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_spawn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_ruby_reverse_shell.eql,sha256=O8P12XNRdcZTIY5kcT3lXFVwW46vMWiayNblRAT7qiU,217
src/rules/linux__process_creation__proc_creation_lnx_ruby_reverse_shell.lucene,sha256=b85y-cygmYhv7AEmiJWpdL_tPWHjA4-Dh2EEo34UEPk,201
src/rules/linux__process_creation__proc_creation_lnx_ruby_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_schedule_task_job_cron.eql,sha256=sOJ-EJikYz3gDEiFh5J12EK76PsGOYPX-Zfo6dYkXJ4,53
src/rules/linux__process_creation__proc_creation_lnx_schedule_task_job_cron.lucene,sha256=wWjYmCS9xMeSTMC-HXYz_qGDopLMKPfg_ewXlfkkNzQ,41
src/rules/linux__process_creation__proc_creation_lnx_schedule_task_job_cron.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_security_software_discovery.eql,sha256=XdOy5AmXzRfF_-9ukbPwTVtwhQv3EypB3APttQTEENo,184
src/rules/linux__process_creation__proc_creation_lnx_security_software_discovery.lucene,sha256=t57E_kwmxok3NK09ela1llZ8xtI0d354qfG7_2DgiOI,161
src/rules/linux__process_creation__proc_creation_lnx_security_software_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_security_tools_disabling.eql,sha256=BxxeDJkUWXTw2g8jdpoiXwAS02Ijl5sMthwZs7eVgOQ,1043
src/rules/linux__process_creation__proc_creation_lnx_security_tools_disabling.lucene,sha256=wBuRNN8ZHVhvRt5rd-n3yDCe9Qi-WLbrLeqfSRPGOIo,972
src/rules/linux__process_creation__proc_creation_lnx_security_tools_disabling.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_services_stop_and_disable.eql,sha256=8gtWo8FgSL9Px115kavxVMSkgMNhCmwUTSsCHQ4s2hc,116
src/rules/linux__process_creation__proc_creation_lnx_services_stop_and_disable.lucene,sha256=UycTm5fErEkYjEmo4Sf-6evdCVDANIflU0QOYGXvc-o,93
src/rules/linux__process_creation__proc_creation_lnx_services_stop_and_disable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_setgid_setuid.eql,sha256=eug-KnUkiXmwW2MWcGa-PqR3gpPB_M5F5171zTLjBCo,94
src/rules/linux__process_creation__proc_creation_lnx_setgid_setuid.lucene,sha256=fMegdqGBtXoPkzi2Th-PG7dTfuwYLKsWK8GY7z-g_yY,81
src/rules/linux__process_creation__proc_creation_lnx_setgid_setuid.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_ssh_shell_execution.eql,sha256=SdDvCCOOn3l0o0lYxLp7x5-PiZyKmBqHX21AhWPAVik,247
src/rules/linux__process_creation__proc_creation_lnx_ssh_shell_execution.lucene,sha256=kMKRmg-ZVPtJX6tzFTZh5WDSeHKTARB9X-Jk9M0NmSc,244
src/rules/linux__process_creation__proc_creation_lnx_ssh_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_ssm_agent_abuse.eql,sha256=MmnE3ZF7s7395WeQFHcqy0CvKQLybTvsb4rU4-ZAjvI,151
src/rules/linux__process_creation__proc_creation_lnx_ssm_agent_abuse.lucene,sha256=k5ICkteOHQxyXGytDnXOZeg--uuNBGYJacRas8hgkNs,142
src/rules/linux__process_creation__proc_creation_lnx_ssm_agent_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_chmod_directories.eql,sha256=x4YtCS6VIpmGL35DHL_eiAIlJKgjr8xTw0vErZpwWUc,100
src/rules/linux__process_creation__proc_creation_lnx_susp_chmod_directories.lucene,sha256=k1HgHBa_6qAsmNdj1oeqtxtsBstlZt4D_540JUO7h78,89
src/rules/linux__process_creation__proc_creation_lnx_susp_chmod_directories.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_container_residence_discovery.eql,sha256=uZyBQT8K2d1g-eeQZQpLJyGCiPtBmlzMnXwKHocITLA,206
src/rules/linux__process_creation__proc_creation_lnx_susp_container_residence_discovery.lucene,sha256=TaMQucvsp8FT0H18VPPKNTSdSIBNnMeVn4xJeXMlb7A,189
src/rules/linux__process_creation__proc_creation_lnx_susp_container_residence_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_fileupload.eql,sha256=BWh5nw9QTsHdiKEDEsKuAAxVR0-aUqoDxoHwnbxhB2w,220
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_fileupload.lucene,sha256=hoYCrYqpRPMP8Mt459xFhx0MoqBVi1KcprGHpHdcFhM,206
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_fileupload.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_useragent.eql,sha256=XPcux3Q3yGhyRWzhxB5oFEItTlm2wXfgURZH86XrcJw,80
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_useragent.lucene,sha256=MCW2q4oveD_ANdx-4vQVEm9T5n3Qvc8xdjYPtrTsP0c,69
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_useragent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_dockerenv_recon.eql,sha256=oxlpVjtNmCieXTWiMd9WYrlNV9z1C-4LHkgC4XiMtv8,120
src/rules/linux__process_creation__proc_creation_lnx_susp_dockerenv_recon.lucene,sha256=mjLmlwyaQ4hkOYOCP_9Ibzy_tI__zxi8zDfjyb1Lhd0,106
src/rules/linux__process_creation__proc_creation_lnx_susp_dockerenv_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_execution_tmp_folder.eql,sha256=f0eGv9qXn0D9WzMS_WRDpsFllf1Q8bQc6iRI0vr_Bks,63
src/rules/linux__process_creation__proc_creation_lnx_susp_execution_tmp_folder.lucene,sha256=D7czEEJhDgxBJ0Jc08XYeurQpjsZsc5h7RFhndn8kuU,54
src/rules/linux__process_creation__proc_creation_lnx_susp_execution_tmp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_find_execution.eql,sha256=6BVn4yTW_hilgY4XzRcoX0MjhPwryfACgzoKW4Aymzk,180
src/rules/linux__process_creation__proc_creation_lnx_susp_find_execution.lucene,sha256=-SLDNN_kkSvcChSwEPtJQLgEIbh9VXH1W3wOHhzB9n4,188
src/rules/linux__process_creation__proc_creation_lnx_susp_find_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_git_clone.eql,sha256=Vla8LCP88diQLbth7fwiRQYU4h5ymSCj-SvjndhTZDY,286
src/rules/linux__process_creation__proc_creation_lnx_susp_git_clone.lucene,sha256=oNoPHv7BtkivtyfQjzZ5BX9Ff2Iqt12Yz0P7u-Y_Lso,272
src/rules/linux__process_creation__proc_creation_lnx_susp_git_clone.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_history_delete.eql,sha256=TGKGVaqp5QM0yaQ0r-_51jJM5Cv3Esw7cLg6czIatXE,185
src/rules/linux__process_creation__proc_creation_lnx_susp_history_delete.lucene,sha256=cABNOg8ig6vUq46ubSVy9yKZRET_LtzMAuhDeiNyoqU,156
src/rules/linux__process_creation__proc_creation_lnx_susp_history_delete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_history_recon.eql,sha256=vo93FzWMg0StQSgd4WF3Sv-sIEDmAhPS_shwNmO-IFk,193
src/rules/linux__process_creation__proc_creation_lnx_susp_history_recon.lucene,sha256=8QpzL0klZjSNKCLlvNSI9Azfw71COqjy4DmzQAqRw_s,165
src/rules/linux__process_creation__proc_creation_lnx_susp_history_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_hktl_execution.eql,sha256=okXWyVenYDMydENwC51095qXYENMXjyfYrFD8oxlah8,900
src/rules/linux__process_creation__proc_creation_lnx_susp_hktl_execution.lucene,sha256=U3T-ciIdSXanqvw7yiXU4lJyXkFGciIJpU6Apxoe_n8,904
src/rules/linux__process_creation__proc_creation_lnx_susp_hktl_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_inod_listing.eql,sha256=tRJhiKVn7gX3Ui6ipTQ_lspe6fqg1jHmrnLTfZd8wts,192
src/rules/linux__process_creation__proc_creation_lnx_susp_inod_listing.lucene,sha256=IEz4W3A9Mt8Lh-Y6oqBF4clBOhsIIpE1bvHEGcrN3jQ,156
src/rules/linux__process_creation__proc_creation_lnx_susp_inod_listing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_interactive_bash.eql,sha256=lQ4wBVUMX6sHBW2-zFku_w_Dkn_5RFMVx6ab05Pr6XI,180
src/rules/linux__process_creation__proc_creation_lnx_susp_interactive_bash.lucene,sha256=zW5bH6gQ2CTe4taQ6uIJaI2668oROwbg8bMipOk4lp0,160
src/rules/linux__process_creation__proc_creation_lnx_susp_interactive_bash.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_java_children.eql,sha256=fU69Vs9IL43cw7Q9MKkHRQf9tbtDRs1djr_p6JJ_k-w,158
src/rules/linux__process_creation__proc_creation_lnx_susp_java_children.lucene,sha256=p0u7NbFv2hmnDllZZylsnClqHLzTtDrxv-a-nKE-w6w,141
src/rules/linux__process_creation__proc_creation_lnx_susp_java_children.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_network_utilities_execution.eql,sha256=HFPJWCtqpVT-1RQKBc34cYhAlvwyUEYe-s_Z4RLBcSI,249
src/rules/linux__process_creation__proc_creation_lnx_susp_network_utilities_execution.lucene,sha256=ifm1y9VG4NGJldTrK7bbZ6JJlpeHhkYtrlIosqCSqHs,235
src/rules/linux__process_creation__proc_creation_lnx_susp_network_utilities_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_pipe_shell.eql,sha256=TqkVu8cGdkHVGWH09g1LTpbIU7pt8xabvVdeqo9eCsU,191
src/rules/linux__process_creation__proc_creation_lnx_susp_pipe_shell.lucene,sha256=GM2rY4W-k2TUKVgbhq9tIeYSqQ1Uwajef8t5NMWZWLk,180
src/rules/linux__process_creation__proc_creation_lnx_susp_pipe_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_process_reading_sudoers.eql,sha256=EjMqWxFCEe5vOIixr4uSNPPtvC6TGo1o1wXLzvthodg,169
src/rules/linux__process_creation__proc_creation_lnx_susp_process_reading_sudoers.lucene,sha256=3NzuL3lteDpDNefvdc_jfCOoct9zzsDKQwjWrQU5urk,163
src/rules/linux__process_creation__proc_creation_lnx_susp_process_reading_sudoers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_recon_indicators.eql,sha256=ZnC78dDSKyZUJebsNFnz28vI6MTgyVtKs9eQ31H5-Y0,70
src/rules/linux__process_creation__proc_creation_lnx_susp_recon_indicators.lucene,sha256=U7Nqyl20BmeamSCpnz4bO7XR2iCQoJN7D3dw7C5rp2U,60
src/rules/linux__process_creation__proc_creation_lnx_susp_recon_indicators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_sensitive_file_access.eql,sha256=7h_dTV5GvKN7r2ThvJjgOLMNeyG4JC-jcAwNEP9bqe8,409
src/rules/linux__process_creation__proc_creation_lnx_susp_sensitive_file_access.lucene,sha256=oICOAxdrLw8uWjeCQKG3NvZZ3nYRUiNqU_8ulWh8DxM,414
src/rules/linux__process_creation__proc_creation_lnx_susp_sensitive_file_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.eql,sha256=zqSOZrlsLHPNM3Ltc4YHpbKczmyATd0xlTyddXTvdf8,115
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.lucene,sha256=YiNVv9SfQXlsPkXFdCpbNCLImtKhaCk98cdr8pPLUDI,104
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_script_exec_from_susp_location.eql,sha256=BNr2lS9CYpORxg8eKydmBYXgQLlFP0Sjinz2LY0wd-s,141
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_script_exec_from_susp_location.lucene,sha256=OpyS0qKS6gsSJIQyliW5nbDRVgLLt78ymkyPTXjgFaY,131
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_script_exec_from_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_system_info_discovery.eql,sha256=McSFa-dx4tSVU92CiW83qzChJAYSwKTZfIlgqC2ZuNY,108
src/rules/linux__process_creation__proc_creation_lnx_system_info_discovery.lucene,sha256=CNgtdNY8NviXR8xzPgdhHG_-z45COkWjBjX5-M0F8TA,97
src/rules/linux__process_creation__proc_creation_lnx_system_info_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_system_network_connections_discovery.eql,sha256=fiZML-xYpVaiwOWhBqMXbATFgEaYdLxzSMZr94MR7w4,153
src/rules/linux__process_creation__proc_creation_lnx_system_network_connections_discovery.lucene,sha256=pV8Ri2EQXAYkWfYqlvoFU_kLW02LXt4TtNl8J-tv_1U,141
src/rules/linux__process_creation__proc_creation_lnx_system_network_connections_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_system_network_discovery.eql,sha256=ZEK0M7jc_wGbyddZCzdd1MqW16uro-CV8eNBV7E1oFc,177
src/rules/linux__process_creation__proc_creation_lnx_system_network_discovery.lucene,sha256=oXlvd7ivznL93-4ipr5X2dJAUi5l3IPkJbiQg9OWHkg,170
src/rules/linux__process_creation__proc_creation_lnx_system_network_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_systemctl_mask_power_settings.eql,sha256=4LUb_6tUfvpVfIFfePfrjbuq70JZ0Mps-NouMpIFo9M,150
src/rules/linux__process_creation__proc_creation_lnx_systemctl_mask_power_settings.lucene,sha256=5CxsV1whQ4pOE5h0ZUAS1NG93AUOUVLYb8wEtBqJzas,131
src/rules/linux__process_creation__proc_creation_lnx_systemctl_mask_power_settings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_touch_susp.eql,sha256=VhiG1m0kvl__aogYnWFR4cv7OO57ww6flSpwHxLbcPk,79
src/rules/linux__process_creation__proc_creation_lnx_touch_susp.lucene,sha256=lSkHpHbGJQ6_uZgxct6wlJkbt39elWBBx8GIwzFGi7w,67
src/rules/linux__process_creation__proc_creation_lnx_touch_susp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_execve_hijack.eql,sha256=BJ6_UODQwRjgjxwRulEVp7-jkKJ--WHz_N9s6fjh-ZY,59
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_execve_hijack.lucene,sha256=UtRoHVKALaambgha_oNlzwCwRv3P4puh2QfTVFgeNgc,46
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_execve_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_install.eql,sha256=YcGWujHkDbCVDU9tUUOP_FqRMVxGNUm3EChB2uJ5HYg,133
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_install.lucene,sha256=xKlTUPJa3rF04-NJ3IGHkjFdGvHVNZU16mbfqtnCtSw,118
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_userdel.eql,sha256=IaH7ikXgqXYHiVp6i3WkoXc8FtPD8DU463EYfyUMz2I,28
src/rules/linux__process_creation__proc_creation_lnx_userdel.lucene,sha256=7rSy700kWNbAnwh415avp8Df6Dzme5YKl21a8SUrsww,17
src/rules/linux__process_creation__proc_creation_lnx_userdel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_usermod_susp_group.eql,sha256=o-Wo7foPLtXRtaRG8VxTByN87t4CXd27MOjgKxgL-zY,84
src/rules/linux__process_creation__proc_creation_lnx_usermod_susp_group.lucene,sha256=ZlzHs8IVuvfGSNRW4IaDNnUfvjXU7w_1-HMxB1rEkho,69
src/rules/linux__process_creation__proc_creation_lnx_usermod_susp_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_vim_shell_execution.eql,sha256=ssMAXqXd74bYUXLXiDacr5d3z4jcopLVExouJgIFhH4,233
src/rules/linux__process_creation__proc_creation_lnx_vim_shell_execution.lucene,sha256=4vRMgK4GfFMwQJYb6U54iOn3DOk-GF7Buh1SFjwQDpU,225
src/rules/linux__process_creation__proc_creation_lnx_vim_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_webshell_detection.eql,sha256=-xBKKGgs5_TOFzHgQVvPTGFDYJYYJqekFOSgH4SAA3U,405
src/rules/linux__process_creation__proc_creation_lnx_webshell_detection.lucene,sha256=q9r9m4WVUmwwS9u3_Q1fn_evvKxpBJglaY3phB_Ip_Y,395
src/rules/linux__process_creation__proc_creation_lnx_webshell_detection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_wget_download_suspicious_directory.eql,sha256=Wm29EF-uc5epLa1w4CadQcqa4G3Xlwqmj_k_aBN10fU,124
src/rules/linux__process_creation__proc_creation_lnx_wget_download_suspicious_directory.lucene,sha256=0G3XK4PnwofnNqtKqtjpkAnFlYFbcApOBtMi68DL61A,105
src/rules/linux__process_creation__proc_creation_lnx_wget_download_suspicious_directory.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_xterm_reverse_shell.eql,sha256=iEhPnw_WNfl4aMuD5W8ol_QPKuDDxf0lPRVkh_HZD-s,77
src/rules/linux__process_creation__proc_creation_lnx_xterm_reverse_shell.lucene,sha256=cCnbU4HVdMOd2ABWpDPFNbzpdGYROlVxkNZzlJ6b-t0,63
src/rules/linux__process_creation__proc_creation_lnx_xterm_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__file_event__file_event_macos_emond_launch_daemon.eql,sha256=teapb-W8kVoEe46FnMUCelvsYbQh4FfzDdBTSljQ36s,132
src/rules/macos__file_event__file_event_macos_emond_launch_daemon.lucene,sha256=v6sSSZHrxcTrr2gFoXc1TtYWWQuJjqBWz6UFLuj4qUw,125
src/rules/macos__file_event__file_event_macos_emond_launch_daemon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__file_event__file_event_macos_susp_startup_item_created.eql,sha256=IpFqYW5xDphftHQZ73FOQ21SV3uEQBxOBmckI9xrl48,123
src/rules/macos__file_event__file_event_macos_susp_startup_item_created.lucene,sha256=TjdWuwhY0sVP-pHoj_Rf_bE0Aj4iSQWrBeTaOk_AJiE,109
src/rules/macos__file_event__file_event_macos_susp_startup_item_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_applescript.eql,sha256=a5jAYaFPqLXKCkSfhhevB_pq-2Nkd7J0_qDzqwYudOU,85
src/rules/macos__process_creation__proc_creation_macos_applescript.lucene,sha256=u0sAtqfOtqga1YyzyemWozn3kITZTJ989Od0gDvERzA,69
src/rules/macos__process_creation__proc_creation_macos_applescript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_base64_decode.eql,sha256=2LENEiDthMJtbWkbw94zDCN2SIpKPHhDwLaoDhHSfII,57
src/rules/macos__process_creation__proc_creation_macos_base64_decode.lucene,sha256=_j8OH8T5g0ogAPIAWWsCuMrEOkuVYvdpCzCaglanIHg,47
src/rules/macos__process_creation__proc_creation_macos_base64_decode.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_binary_padding.eql,sha256=JofI8GSS-Tgwt3UuR1_9J00qdGgILcQcMajg18S86U0,158
src/rules/macos__process_creation__proc_creation_macos_binary_padding.lucene,sha256=lECmwk1xU0q0KiAkktklrYdmcoSDiPoG4_npoKNvOPA,148
src/rules/macos__process_creation__proc_creation_macos_binary_padding.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_change_file_time_attr.eql,sha256=M29HQz9Rt28csaedj2mhi9FiL_rfeZBZ-gvb3QAoynE,86
src/rules/macos__process_creation__proc_creation_macos_change_file_time_attr.lucene,sha256=oiHPykh2qumF9jIaePZHgIx46U1St8pLM98UlJrHExM,71
src/rules/macos__process_creation__proc_creation_macos_change_file_time_attr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_chflags_hidden_flag.eql,sha256=9DN19nmWLw3dqOb435webSrGPwK7K5Dimh6I5xuUU6c,56
src/rules/macos__process_creation__proc_creation_macos_chflags_hidden_flag.lucene,sha256=CL6QCB5NivX9akJBCq4CQMjcMxeVZETBTW7GAOEk3wQ,44
src/rules/macos__process_creation__proc_creation_macos_chflags_hidden_flag.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_clear_system_logs.eql,sha256=WzK5-iK27AQDPEx5EqnTaeEJJ-TkZIHAjF08nL1H5I8,151
src/rules/macos__process_creation__proc_creation_macos_clear_system_logs.lucene,sha256=r2TN1WLJUwjTAf7mc5Xgwo0TbYry1u_vM5WP9eafsEw,137
src/rules/macos__process_creation__proc_creation_macos_clear_system_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_clipboard_data_via_osascript.eql,sha256=AcvZc8hh82uy2jF_2qg4Csk_R6GaLrZIz8SI5ftZ124,91
src/rules/macos__process_creation__proc_creation_macos_clipboard_data_via_osascript.lucene,sha256=EAKV68kY7lSwvp9OhaA8QtL-hSRhg9twTNMg145liJs,78
src/rules/macos__process_creation__proc_creation_macos_clipboard_data_via_osascript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_create_account.eql,sha256=exlqIMvHljRCuLAAUV3OCUMDDC-qKyy95sTAJRCHa2M,109
src/rules/macos__process_creation__proc_creation_macos_create_account.lucene,sha256=O_HN0w0jogP9jzSr0Xset1duh2ZZe7ybHfXQJKUwFVQ,93
src/rules/macos__process_creation__proc_creation_macos_create_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_create_hidden_account.eql,sha256=nNSkc8GQGaEJ2BR_F4A-w54D8pnq3bLw5I7jPXbP3UE,276
src/rules/macos__process_creation__proc_creation_macos_create_hidden_account.lucene,sha256=r_RHiu7PX6eKcfKYW4XruxXJDOwHwjyQtZQJ7f02kD0,241
src/rules/macos__process_creation__proc_creation_macos_create_hidden_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_creds_from_keychain.eql,sha256=Fg37tkg0Vjh4NNy9OkKIvGZ_Wn4Ipj8HaMIDrva7Xjg,166
src/rules/macos__process_creation__proc_creation_macos_creds_from_keychain.lucene,sha256=Tck1GK24rxWs3NTLeHa2ghCAt2nAV5HeBXXzO8XaOlI,150
src/rules/macos__process_creation__proc_creation_macos_creds_from_keychain.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_csrutil_disable.eql,sha256=iPavGtL2HkMtKQF5RWIku1UhVuybRMqk1TyoTr3Lx7I,56
src/rules/macos__process_creation__proc_creation_macos_csrutil_disable.lucene,sha256=Q-AHpl57WhK85pX3MIt49vPXwNVf2YJIQAUU-eDbTvY,43
src/rules/macos__process_creation__proc_creation_macos_csrutil_disable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_csrutil_status.eql,sha256=O9vgiLtLCILARR9MqSYpipM7IX3rAnnt4w8XJtZ9rZ4,55
src/rules/macos__process_creation__proc_creation_macos_csrutil_status.lucene,sha256=BaAXy6ilWM7yPoqfLTEGacN0CZryUnlHFwuIKs8xfP0,42
src/rules/macos__process_creation__proc_creation_macos_csrutil_status.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_disable_security_tools.eql,sha256=gkdTq4kKU0RO10G2NcRkYIf1951ii_hT0Ig6ywDORH4,601
src/rules/macos__process_creation__proc_creation_macos_disable_security_tools.lucene,sha256=DllW4cyPCxt7qZVZiqKwN5MUJr4tOA-mZ8qvAzQwJxk,583
src/rules/macos__process_creation__proc_creation_macos_disable_security_tools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_dscl_add_user_to_admin_group.eql,sha256=1A-gAf4S6J1j0BusJHf1iBWOKc6tI7GkD0HZfesTg9U,131
src/rules/macos__process_creation__proc_creation_macos_dscl_add_user_to_admin_group.lucene,sha256=Uz6Yj31YQ8i9tzEVqsC8VhnHxzLpoEHUE6lStXo7TQk,123
src/rules/macos__process_creation__proc_creation_macos_dscl_add_user_to_admin_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_dseditgroup_add_to_admin_group.eql,sha256=L-IyWNodO869A7BxCHwubk-EiYHM1_3r-ZiomZ9UGCg,144
src/rules/macos__process_creation__proc_creation_macos_dseditgroup_add_to_admin_group.lucene,sha256=P6FkdNrUp5nvcm2raN_DBnbjPeAOU4VFFJ10fr0qYio,135
src/rules/macos__process_creation__proc_creation_macos_dseditgroup_add_to_admin_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_dsenableroot_enable_root_account.eql,sha256=TKseVr-MQFElbHaTA8fMtgVFSROnNccLUAqeISjVNmk,64
src/rules/macos__process_creation__proc_creation_macos_dsenableroot_enable_root_account.lucene,sha256=Bj_WOeE-1pCPC52qBxA3kzcNiHZv3OtvP3UPwrmP86g,54
src/rules/macos__process_creation__proc_creation_macos_dsenableroot_enable_root_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_file_and_directory_discovery.eql,sha256=iRgyCf1ZSjFG29Dt4onCnXH0oRUhX3GEOP1X-ZowaPY,182
src/rules/macos__process_creation__proc_creation_macos_file_and_directory_discovery.lucene,sha256=l-9UMsRxbMBUyLwo4olAGx3SryVVeJOWeqUYtTRxaz4,166
src/rules/macos__process_creation__proc_creation_macos_file_and_directory_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_find_cred_in_files.eql,sha256=l6v52mJh1N0W-Wr4ioK7lXBr6iLHnRDaI6Bcp1cjhBM,83
src/rules/macos__process_creation__proc_creation_macos_find_cred_in_files.lucene,sha256=jcwFAHzPhO_bwSg40ekjxH2xcn81UNWT6fd8PFwirQo,68
src/rules/macos__process_creation__proc_creation_macos_find_cred_in_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_gui_input_capture.eql,sha256=iSbwrxcVtIu4XTtiFxLUkYsf3Wfe0o3Q6wHXAf-d37M,283
src/rules/macos__process_creation__proc_creation_macos_gui_input_capture.lucene,sha256=FPFU40qwmUC-Bw1fmAQnCyCoXR-gv8p4-cq1edkTkf8,257
src/rules/macos__process_creation__proc_creation_macos_gui_input_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_hdiutil_create.eql,sha256=aHb-Vtnad0M1wlTAOTH2CUa0AWCGxr8-B6Mif10T4fw,55
src/rules/macos__process_creation__proc_creation_macos_hdiutil_create.lucene,sha256=Ngtkylg7OvOfMcYfGOK4AiJgm7MmjB1PFnsK-03JOTA,42
src/rules/macos__process_creation__proc_creation_macos_hdiutil_create.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_hdiutil_mount.eql,sha256=CIqKK5ipsiKYgtbJgoNDL2YHiw77ZEZdnKM9EhqwXG0,78
src/rules/macos__process_creation__proc_creation_macos_hdiutil_mount.lucene,sha256=Ua8Zbnbqhno8494fa1_HFuUPRRmTvgsmP6p9CfaTpLs,61
src/rules/macos__process_creation__proc_creation_macos_hdiutil_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_installer_susp_child_process.eql,sha256=ijiyCwK8R6Iwr3IZyBIYj9AKrfcB7TRYOBrJ8hh4UNE,282
src/rules/macos__process_creation__proc_creation_macos_installer_susp_child_process.lucene,sha256=bQXwlugMy-fE9PL0ZsfErOleV2V-4E5DZNbn83bZPDQ,262
src/rules/macos__process_creation__proc_creation_macos_installer_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_ioreg_discovery.eql,sha256=EfKP42UMIAHwZv_7XIrHd3sHa6SWHCXDPrpzD_bXnf0,248
src/rules/macos__process_creation__proc_creation_macos_ioreg_discovery.lucene,sha256=nt_NbiRZx3gJlrBNawGUvQyu-cSFsPcM3L1mhu3AMKU,223
src/rules/macos__process_creation__proc_creation_macos_ioreg_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_jamf_susp_child.eql,sha256=80tK-1Q3fnyLSfR2VIr4tKA1-qLr41fOO9ISUAhASRs,68
src/rules/macos__process_creation__proc_creation_macos_jamf_susp_child.lucene,sha256=uI-_Eg5nlhDWlk75KzqZ-IYvJAWnaprPd4fOZY5E55g,51
src/rules/macos__process_creation__proc_creation_macos_jamf_susp_child.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_jamf_usage.eql,sha256=UGlkT0RFIBwZfyEwLbyXUhWcjrrg9YpXbGcLCuAGBno,164
src/rules/macos__process_creation__proc_creation_macos_jamf_usage.lucene,sha256=VmRppHwRRIVhuG_v9ndYlRP4eQoCLrMjZGdUmjtyw8Q,145
src/rules/macos__process_creation__proc_creation_macos_jamf_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_jxa_in_memory_execution.eql,sha256=zH9myeXTrdAawAswJqjBBmRSscFFJoC2gZQmB36BLOg,220
src/rules/macos__process_creation__proc_creation_macos_jxa_in_memory_execution.lucene,sha256=McBB9J-25uDqgmpKDkMq7OBQXCTOmVleK3JRtf91CGQ,202
src/rules/macos__process_creation__proc_creation_macos_jxa_in_memory_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_launchctl_execution.eql,sha256=htmoK8OW_L8KoIHiMfUzI1Johuv3sGt6oOMonC6s2HQ,88
src/rules/macos__process_creation__proc_creation_macos_launchctl_execution.lucene,sha256=Y3poP9Vj_JAW9Ssst_kUvp0N1PLDjx2auNKTNXCcQuU,69
src/rules/macos__process_creation__proc_creation_macos_launchctl_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_local_account.eql,sha256=W8cGaVzIVB9o-pMsq3a6NjmATqvusZ-s0sxvX8CXnuA,322
src/rules/macos__process_creation__proc_creation_macos_local_account.lucene,sha256=LBMFiJAzlGH2gEzIUbpT_4r6CPNgHfmrgGdUDLm4E3I,296
src/rules/macos__process_creation__proc_creation_macos_local_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_local_groups.eql,sha256=cSNP4MjEU5kn2osnOB6DypeTMm762ftjsgPkOkta9JE,211
src/rules/macos__process_creation__proc_creation_macos_local_groups.lucene,sha256=t72GdhOrh18LdTnF-26uC-ySASeW1Vk1zrJDDEoNJwI,193
src/rules/macos__process_creation__proc_creation_macos_local_groups.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_network_service_scanning.eql,sha256=G82PkFb5pvy8Y4WdgwdRWEhRLAoiQtEDL0X9Q4k7B2s,115
src/rules/macos__process_creation__proc_creation_macos_network_service_scanning.lucene,sha256=cH-2GFexACL2rQTAe5dit_7jopwq1phpytQQSs2qXvE,91
src/rules/macos__process_creation__proc_creation_macos_network_service_scanning.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_network_sniffing.eql,sha256=LJA3QV75OXCn9sNRcJq2Bo53SufTmtEQXL4ztEPTyu0,48
src/rules/macos__process_creation__proc_creation_macos_network_sniffing.lucene,sha256=ftQRuZ5EdI_wp04bY_OauMjaYeS1_k8bqDTGW35Lxjs,32
src/rules/macos__process_creation__proc_creation_macos_network_sniffing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_nscurl_usage.eql,sha256=RvksmvzeQfAUBhMBDosV5R5HqvY80x8Gc_sSd_RDjN0,150
src/rules/macos__process_creation__proc_creation_macos_nscurl_usage.lucene,sha256=PNknRT_VG8qkf3jfTQtZkohJJfpkcEpzbuSDi4VI-eM,148
src/rules/macos__process_creation__proc_creation_macos_nscurl_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_office_susp_child_processes.eql,sha256=maPqJ-tVCD7zHJIz4TH_pIf_-e2khrS9pIeP1p0NG_A,263
src/rules/macos__process_creation__proc_creation_macos_office_susp_child_processes.lucene,sha256=XROa6mfZLHLSJKbVYi_N5f5F6_jRe97FmSSI-oYHKTQ,252
src/rules/macos__process_creation__proc_creation_macos_office_susp_child_processes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_osacompile_runonly_execution.eql,sha256=hRR-YnmgbAqKpmTTPd9r5xeCaD-YrYJBjRJbtx7RSuE,87
src/rules/macos__process_creation__proc_creation_macos_osacompile_runonly_execution.lucene,sha256=kE19R330idw8zcv4-1cQPdqH8DiHIUVVcEHGMtJhCoc,77
src/rules/macos__process_creation__proc_creation_macos_osacompile_runonly_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_payload_decoded_and_decrypted.eql,sha256=DGAW3D5IrP-1sPOuFfHry7GWZuYk525B443AzGwdEmk,137
src/rules/macos__process_creation__proc_creation_macos_payload_decoded_and_decrypted.lucene,sha256=zeCJPrQ5P2wrqAfBgBLV7NtNpsKeB5yhNmfFVY5jlWM,124
src/rules/macos__process_creation__proc_creation_macos_payload_decoded_and_decrypted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_persistence_via_plistbuddy.eql,sha256=N-rSugCWAjOuyzJK0xTrDRyWQiSU6BPI3Ns6N5_0UTg,150
src/rules/macos__process_creation__proc_creation_macos_persistence_via_plistbuddy.lucene,sha256=Io1_CWWFujx7fhVDKkA6abrJJZuywKVd-iD6IUn1SPc,127
src/rules/macos__process_creation__proc_creation_macos_persistence_via_plistbuddy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_meshagent_arguments.eql,sha256=hskdsGtPlgY1gKyvknAG7oHlDxmbL1-7fYZ_wGfXOwU,44
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_meshagent_arguments.lucene,sha256=8mPmDUEgBZGscarJp80bStDVBfOtcuBtuAXhzU16xxU,34
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_meshagent_arguments.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_renamed_meshagent_execution.eql,sha256=I5Y9_10XJSk2W9eukGMST7AQZfweWtxf3xO5x75D_HU,141
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_renamed_meshagent_execution.lucene,sha256=Ysk2GSYvDC2zlbfuaGljicdBBbwkufjED8d_n2Z9y5A,123
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_renamed_meshagent_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.eql,sha256=JuBU7I_DkcIcu4OMdV_SnwMtjLcoevp86zjk7-rCySE,143
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.lucene,sha256=CUseXHsjfgej1nTtIPly3VVlIoR7ZKUIh2NjUXUkf2o,138
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_remote_system_discovery.eql,sha256=QQlwlJthbEb-dZ-VvS-CwngzsnMwnIyNqTvAKSMblZQ,369
src/rules/macos__process_creation__proc_creation_macos_remote_system_discovery.lucene,sha256=ykvTJqYwbMihwzt18vikY_vAYCQramSP0nruOosA-dE,368
src/rules/macos__process_creation__proc_creation_macos_remote_system_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_schedule_task_job_cron.eql,sha256=4E2lzrN7aWQyk1BKJ3eZYI1FIF14mi2zuMAu8pAokxk,54
src/rules/macos__process_creation__proc_creation_macos_schedule_task_job_cron.lucene,sha256=fNEzdVqCniIIbXGBB2PElTCTvFVsqUiUcL3oNQ0vMeY,43
src/rules/macos__process_creation__proc_creation_macos_schedule_task_job_cron.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_screencapture.eql,sha256=CrwstBWOa18STPX-_5VkM7HC-YZIiu0FgzW3XhpqzIs,42
src/rules/macos__process_creation__proc_creation_macos_screencapture.lucene,sha256=ueYYqtl1WTpvj5SIpugygDiYxvL_5XagDm1us8_8Li4,33
src/rules/macos__process_creation__proc_creation_macos_screencapture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_security_software_discovery.eql,sha256=sTkZkyKXEo-sDxbrPWoOjdo-cPIqvCXuIU-eNV8Lloc,266
src/rules/macos__process_creation__proc_creation_macos_security_software_discovery.lucene,sha256=-q9i8OGld7slE9ZzY96YFT2IfZc2iCobpMx2YCU9yv4,246
src/rules/macos__process_creation__proc_creation_macos_security_software_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_space_after_filename.eql,sha256=EfnpqF02B0cWqSVwl_BEJWZlAjymodYfEYx_1R2R97Y,41
src/rules/macos__process_creation__proc_creation_macos_space_after_filename.lucene,sha256=DYNbLiJCMT86Vorfta2XPc43Xw3c-XoQSQqE5HJfmUs,29
src/rules/macos__process_creation__proc_creation_macos_space_after_filename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_split_file_into_pieces.eql,sha256=sfauc5d9RRM3iIlHrrO7zF56jVftFcgPh616mhNmCI4,26
src/rules/macos__process_creation__proc_creation_macos_split_file_into_pieces.lucene,sha256=phMFNjsP7QdiX0sqoSo1QVqwpKnve27zSTXKHRq1sEc,15
src/rules/macos__process_creation__proc_creation_macos_split_file_into_pieces.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_browser_child_process.eql,sha256=9CF4MR__tJWaJXCHnI2XFu4RKwgKMJVY51jzuYBkeaY,1311
src/rules/macos__process_creation__proc_creation_macos_susp_browser_child_process.lucene,sha256=LvvWcaoiScrsSlYCOywDuGDnjA8j_HKXr0t24RBUyUE,1324
src/rules/macos__process_creation__proc_creation_macos_susp_browser_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_execution_macos_script_editor.eql,sha256=GlgSRIqBcowVbWvG-1cL4OlgkXmbgMji9YsAXwM_dWc,303
src/rules/macos__process_creation__proc_creation_macos_susp_execution_macos_script_editor.lucene,sha256=QbbMp3PD-5SgQL-vC_QwRrVtDrzAFRaYAi1mQopcRLs,295
src/rules/macos__process_creation__proc_creation_macos_susp_execution_macos_script_editor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_find_execution.eql,sha256=6BVn4yTW_hilgY4XzRcoX0MjhPwryfACgzoKW4Aymzk,180
src/rules/macos__process_creation__proc_creation_macos_susp_find_execution.lucene,sha256=-SLDNN_kkSvcChSwEPtJQLgEIbh9VXH1W3wOHhzB9n4,188
src/rules/macos__process_creation__proc_creation_macos_susp_find_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_histfile_operations.eql,sha256=tKRq0QnD_0ssrsvEo5BZtlxNTMso8FURw4YtJBaZSJk,130
src/rules/macos__process_creation__proc_creation_macos_susp_histfile_operations.lucene,sha256=A9Kjkbq_IuEnMIlDaWR_QIScgrWB7DNgS1gUxyfbYSw,112
src/rules/macos__process_creation__proc_creation_macos_susp_histfile_operations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_in_memory_download_and_compile.eql,sha256=Q-XJwOFUu3s7enH3rpuyIwQpjkYF-7ks_95sRtaUkJ8,62
src/rules/macos__process_creation__proc_creation_macos_susp_in_memory_download_and_compile.lucene,sha256=35N25px4q2GMtWU7bTa00bI9l2MDhLeEFM7HZ-El1pA,48
src/rules/macos__process_creation__proc_creation_macos_susp_in_memory_download_and_compile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_macos_firmware_activity.eql,sha256=AS_d6KELkCbO8FQNgiBNV7z2obvG4xN92s60_M5tObs,116
src/rules/macos__process_creation__proc_creation_macos_susp_macos_firmware_activity.lucene,sha256=qdXXVv_v-pa2rKskQQSoUbnhLgbXpOA_U44AoRbl0fA,99
src/rules/macos__process_creation__proc_creation_macos_susp_macos_firmware_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_system_network_discovery.eql,sha256=I7KTkAowgPBaPn9RyhuTM-Viyp6rXL8eWSM6tY3eDVA,254
src/rules/macos__process_creation__proc_creation_macos_susp_system_network_discovery.lucene,sha256=pJSebzQdS75AKZ0CagD_O1JnmwUJduihO8ArDrhWV_g,240
src/rules/macos__process_creation__proc_creation_macos_susp_system_network_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_suspicious_applet_behaviour.eql,sha256=DK1H87FVOXoG7ofTiEQVOWZ_Hnu-JQ441RwfRjj2ff0,89
src/rules/macos__process_creation__proc_creation_macos_suspicious_applet_behaviour.lucene,sha256=IKDA06Rov5-84jWA_GVVWDildZ1HMs3ECf8kmikMeWI,71
src/rules/macos__process_creation__proc_creation_macos_suspicious_applet_behaviour.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_swvers_discovery.eql,sha256=tAHGDnsnW0nw125GTgXE42eU_tbgKT1Az27c2DRwqOU,111
src/rules/macos__process_creation__proc_creation_macos_swvers_discovery.lucene,sha256=Gg3LZhvAsehG8AA8bIfBMjYsfgnmOCvHpMcsD59ih4A,95
src/rules/macos__process_creation__proc_creation_macos_swvers_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_add_user_to_admin_group.eql,sha256=MZThoHKaCvlY9iF5YV8oJRleBOO4ehZaJUJJy2ZMFiI,94
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_add_user_to_admin_group.lucene,sha256=1eg-yCidU7NOQOrUUS7TdeWx3tRmYJGVFu5B8ojqJng,85
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_add_user_to_admin_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_enable_guest_account.eql,sha256=j0I_JN9vSG0rSPLvcm44sk6yxaioN5ZzlDlRVcb5hJw,93
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_enable_guest_account.lucene,sha256=anvsfujwvOceaFI9nzo60iEzv5jOsePHALkFGlLSCgQ,81
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_enable_guest_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_sysctl_discovery.eql,sha256=Bxs2IFc7Q2FD-xct2omf4-m8LiSsruM0w7z_s5T7T2E,114
src/rules/macos__process_creation__proc_creation_macos_sysctl_discovery.lucene,sha256=ynwQQoT-CukCTH8gQHVaKjMwlOqzTGWB1WGz_CFaL-E,93
src/rules/macos__process_creation__proc_creation_macos_sysctl_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_system_network_connections_discovery.eql,sha256=wE7u1UO5UtgIrQu-c-iielRU-mx4n5aWs5HrjhHsq7o,72
src/rules/macos__process_creation__proc_creation_macos_system_network_connections_discovery.lucene,sha256=nokAwpY7_6EOl1wcURjCcEKdXTil-B0uERQn3oU5w0M,59
src/rules/macos__process_creation__proc_creation_macos_system_network_connections_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_system_profiler_discovery.eql,sha256=JHASMEW-m5SZlhlCi9TKiE4mJdGZfKjJ-48Tz7D6lXE,192
src/rules/macos__process_creation__proc_creation_macos_system_profiler_discovery.lucene,sha256=rBNPI3lW1XoLG1yG9SNaBrTIfukYnp55E3KH3jaI_P4,171
src/rules/macos__process_creation__proc_creation_macos_system_profiler_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_system_shutdown_reboot.eql,sha256=blpXcN_2tnBXyYHSHUF6ul1Rt1Ub3vHpUIkv8dV_17k,59
src/rules/macos__process_creation__proc_creation_macos_system_shutdown_reboot.lucene,sha256=aTS7a6OJ5sI91YEhtc1juma4noP-gOwwzRr8oUzyRJE,44
src/rules/macos__process_creation__proc_creation_macos_system_shutdown_reboot.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_tail_base64_decode_from_image.eql,sha256=PFyGkSJ3VEabFMuNXkvV31aV6ynRtxq7UeQiaS33R24,280
src/rules/macos__process_creation__proc_creation_macos_tail_base64_decode_from_image.lucene,sha256=SGQC55lr1FmID6fi0qZXx-WP_YKCfQLjUopqhdeQr6k,254
src/rules/macos__process_creation__proc_creation_macos_tail_base64_decode_from_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_tmutil_delete_backup.eql,sha256=4qjXHxS-_HOq6v2muqnryN8L-GbMnXTw_Z4UymK2nnU,82
src/rules/macos__process_creation__proc_creation_macos_tmutil_delete_backup.lucene,sha256=TwmgB7JYM6-skJI3OYpIzLzISrbll55dqGjcrvLb6YM,67
src/rules/macos__process_creation__proc_creation_macos_tmutil_delete_backup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_tmutil_disable_backup.eql,sha256=QtBlKBU6FvmHlwSQSrQ8vzR00nzhN4t5xq9uW7YZW4w,83
src/rules/macos__process_creation__proc_creation_macos_tmutil_disable_backup.lucene,sha256=0DT7JudjBL_hJ3eUKG9dpYgpVFTKQ_e811q8V0wUG48,68
src/rules/macos__process_creation__proc_creation_macos_tmutil_disable_backup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_tmutil_exclude_file_from_backup.eql,sha256=wC4IWU3psDImd4w7xIeOSYev-CQiKVcLDe8wdkV6ccY,88
src/rules/macos__process_creation__proc_creation_macos_tmutil_exclude_file_from_backup.lucene,sha256=tzRpQacKDQjRXcNeA2I6lA9vxss4XsvsPDgAJIN9YYE,73
src/rules/macos__process_creation__proc_creation_macos_tmutil_exclude_file_from_backup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_wizardupdate_malware_infection.eql,sha256=EiP7ihy22tSFiFPmJiFk0tPFPf1AkuLf3_sVkafnxY4,142
src/rules/macos__process_creation__proc_creation_macos_wizardupdate_malware_infection.lucene,sha256=ekqbq2Meb4k26CG1Vvcz_B4EfO2dy033SrSS3dguPD0,127
src/rules/macos__process_creation__proc_creation_macos_wizardupdate_malware_infection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_xattr_gatekeeper_bypass.eql,sha256=BIbh8nwAh4RNzFI3joVxMHirgqayHYpCag7o39zMyWY,92
src/rules/macos__process_creation__proc_creation_macos_xattr_gatekeeper_bypass.lucene,sha256=asYL2wpgbVgt9DTWjgZLQ8CKGRdkfP4iYl_qrxPi6rE,78
src/rules/macos__process_creation__proc_creation_macos_xattr_gatekeeper_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_xcsset_malware_infection.eql,sha256=og31_oSie2Bv_GiP18EQZnDOhnav-ZbjGgs1W9XLYHA,571
src/rules/macos__process_creation__proc_creation_macos_xcsset_malware_infection.lucene,sha256=n7B64dJ86Gyd6vg2Mw31HRA3AOInI5A8lgLhXoCJE64,557
src/rules/macos__process_creation__proc_creation_macos_xcsset_malware_infection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_clear_logs.eql,sha256=A7_I9HDFK_MlJFsFwxsaVl9322d_KKDckKZSn4Un_aI,45
src/rules/network__cisco__aaa__cisco_cli_clear_logs.lucene,sha256=4GaW2gaA2lcvi8ZoG0hpg5IGGjddcXbBOBKw0dpwJKE,37
src/rules/network__cisco__aaa__cisco_cli_clear_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_collect_data.eql,sha256=LTCqqBRv3cPXaF6iYbbCyUeEVlcTq9SiWMCOBfCVYxo,92
src/rules/network__cisco__aaa__cisco_cli_collect_data.lucene,sha256=OcmuA9NHHpk6FMnZc3WSLKrquPg-8SQuYPJoCXUrYBc,88
src/rules/network__cisco__aaa__cisco_cli_collect_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_crypto_actions.eql,sha256=0XKHQw7Xen_MTmjaE1oa2RgLyta2V27wV93KIpUYGX8,80
src/rules/network__cisco__aaa__cisco_cli_crypto_actions.lucene,sha256=zMQ1qRMqokPwThxQe_3BpQOppsQfptbVZJohirIk9eE,76
src/rules/network__cisco__aaa__cisco_cli_crypto_actions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_disable_logging.eql,sha256=8DQHkcjbEptKuzlch7Th4RVGGfrWjJBC3yxcJJzOxPA,45
src/rules/network__cisco__aaa__cisco_cli_disable_logging.lucene,sha256=5PS3DK3oggQPwxipxugDxGthmah7eKgCFzZMMDKK_e4,39
src/rules/network__cisco__aaa__cisco_cli_disable_logging.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_discovery.eql,sha256=jQkEl8AvMN4GSZskK-Idb0-wi8sJKoe2DVOgu9BXxlE,191
src/rules/network__cisco__aaa__cisco_cli_discovery.lucene,sha256=GDogSkoXIpeMT3OagImNuq-UyWpL6bpSYK3728tM74k,194
src/rules/network__cisco__aaa__cisco_cli_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_dos.eql,sha256=JNgxwgutVFJT_SSvxwQFeslEYOosIuYBq1RnGBxKtpE,77
src/rules/network__cisco__aaa__cisco_cli_dos.lucene,sha256=J_k3LaOCCCRmpjGCoMSzSBO4F8WeIjCzyrNZCq-sa0A,71
src/rules/network__cisco__aaa__cisco_cli_dos.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_file_deletion.eql,sha256=Wg0EADBk4KZa_N3DrnFd80lH6BONxdCORQMDapedhUg,42
src/rules/network__cisco__aaa__cisco_cli_file_deletion.lucene,sha256=GbPwg82WvkKK9hwtowDt-OgpzjVO0KCkCTdeNJHdAi0,32
src/rules/network__cisco__aaa__cisco_cli_file_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_input_capture.eql,sha256=NArJesA5K6vC5uwD9FTh-nuY0H3A4gG2JSyhmWEZ9cI,65
src/rules/network__cisco__aaa__cisco_cli_input_capture.lucene,sha256=GLFNRMWPWhwR8ytq_rnWo9aWny8nK4lt6UdvGgfT-8Y,59
src/rules/network__cisco__aaa__cisco_cli_input_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_local_accounts.eql,sha256=vxyOpFBPDbdb-DuMxJGpHE82oHTuGnPtHZggqQiFodM,30
src/rules/network__cisco__aaa__cisco_cli_local_accounts.lucene,sha256=q1p-9QWbk-pALeiY3Hqh27gh9bQp7nHqTh98EZ_JNGE,20
src/rules/network__cisco__aaa__cisco_cli_local_accounts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_modify_config.eql,sha256=dD_4CBQO0f7Adq-SsXjU2xF6IJDIqTWEaKe9Lew8oRs,183
src/rules/network__cisco__aaa__cisco_cli_modify_config.lucene,sha256=KpOYdfIKptSS1AvBx9AhH2KYJJ-KFMup2INJwc1n-KQ,186
src/rules/network__cisco__aaa__cisco_cli_modify_config.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_moving_data.eql,sha256=x_nz4rm-X-XAzV2XbN9kZFr0dWX3dzC3575c_d7fess,86
src/rules/network__cisco__aaa__cisco_cli_moving_data.lucene,sha256=1-dv83Wu2x1xEVmwoOvG-Aj0tZg_dH8QMOc71EdnsbA,78
src/rules/network__cisco__aaa__cisco_cli_moving_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_net_sniff.eql,sha256=nFJRYTdoB-XHlndWtZeAVZTGKUKhy0ihk-Hc8feEix0,63
src/rules/network__cisco__aaa__cisco_cli_net_sniff.lucene,sha256=LWjR-RFqVnQptYVD1DWGnSVU1VACHWocAtOYYMJlCqY,57
src/rules/network__cisco__aaa__cisco_cli_net_sniff.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__bgp__cisco_bgp_md5_auth_failed.eql,sha256=RCpJwKSWanNM9DFz6Rs3O5w-ZK4sAgES_MiiGpD3Q4k,40
src/rules/network__cisco__bgp__cisco_bgp_md5_auth_failed.lucene,sha256=DG3qQHIkGwXNm4bdmTG87VBnv6YAmUGDHNDeLJ4yvNE,34
src/rules/network__cisco__bgp__cisco_bgp_md5_auth_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__ldp__cisco_ldp_md5_auth_failed.eql,sha256=7bbcjUtXyZpqP5E3IhNcXEQrg9P1zbLvUypeu2qJsGQ,80
src/rules/network__cisco__ldp__cisco_ldp_md5_auth_failed.lucene,sha256=sbHQ_oqfekU83hQVqDBaLekUz1wvr2hZCnD6mhgBxQ4,70
src/rules/network__cisco__ldp__cisco_ldp_md5_auth_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_external_service_interaction_domains.eql,sha256=Di4l9SZxT2xcuOfDU-SmambIfECHyuG61wjre7uAvsc,561
src/rules/network__dns__net_dns_external_service_interaction_domains.lucene,sha256=qPta8dwOrRxPxsiZL52NFNAcidh0ZMU-ffPTvcgMy7U,543
src/rules/network__dns__net_dns_external_service_interaction_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_mal_cobaltstrike.eql,sha256=hcby-3i2mSVLRk0LEpd_505CgZjn5TtsZXVpTYCPYAI,79
src/rules/network__dns__net_dns_mal_cobaltstrike.lucene,sha256=-2x6eXgrYWdoCEFn3Ci3WtaaOeQhQdpzY_CSPIeyaWw,59
src/rules/network__dns__net_dns_mal_cobaltstrike.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_pua_cryptocoin_mining_xmr.eql,sha256=T_JcOiTq9xhrQ9FlBjPPn6OYzBjMhF0B7Scgn22F9Ok,493
src/rules/network__dns__net_dns_pua_cryptocoin_mining_xmr.lucene,sha256=Beoi1autWyL6PjNKiAynxohglc6kZEu8rBQsPtUOGSc,485
src/rules/network__dns__net_dns_pua_cryptocoin_mining_xmr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_susp_b64_queries.eql,sha256=Y-cjA1JCC3A1coqSWmV82FaNc5T5h-bd_q_0HFglek4,24
src/rules/network__dns__net_dns_susp_b64_queries.lucene,sha256=_-E4lGlW2Er4Ox7jHrejL-hSHi38ZQ6KDuNcUQCGajQ,14
src/rules/network__dns__net_dns_susp_b64_queries.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_susp_telegram_api.eql,sha256=SWjKElMSb0XLrmtJWnbW2ZHf0onR3GsazJE5ZseadrI,35
src/rules/network__dns__net_dns_susp_telegram_api.lucene,sha256=DyiaEFF-RSCMYxKpjolD_f5Xu9ieKDodp9lHJNlblXg,23
src/rules/network__dns__net_dns_susp_telegram_api.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_susp_txt_exec_strings.eql,sha256=73I-2b37yfqR764z33ixnKpFdWupyqKHv56b86juvI4,93
src/rules/network__dns__net_dns_susp_txt_exec_strings.lucene,sha256=mm7a178oU4YKgRwk4Y2-IXspOq0V55yZv3aVCm0rioM,74
src/rules/network__dns__net_dns_susp_txt_exec_strings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_wannacry_killswitch_domain.eql,sha256=OmvYFwJmxCZ5CMOsXpT6q7wxv_AB_udJTd9XvV_unSM,273
src/rules/network__dns__net_dns_wannacry_killswitch_domain.lucene,sha256=hTUNgASBdex17LrxveSo-GbHNl0Cs5KMx1FlNNiIPik,255
src/rules/network__dns__net_dns_wannacry_killswitch_domain.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__firewall__net_firewall_cleartext_protocols.eql,sha256=SG-_gL1Utz74cv1xYj-LF1kgadUiXHqNDO3Y4Egef_A,187
src/rules/network__firewall__net_firewall_cleartext_protocols.lucene,sha256=F3-tJwrkOxnNNXpH_WnBYh_J7c5bKZ-oxs_Z96dQv1M,193
src/rules/network__firewall__net_firewall_cleartext_protocols.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_admin_account_created.eql,sha256=C32wrV_fIW3nvrpZ7a5tEQ7TN-5k59ohCCqn93bpzbg,50
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_admin_account_created.lucene,sha256=E-jA0Eo-FwB0B6kjEGJ5TKNCwLbAhCwRg28vaakBE4U,36
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_admin_account_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_address_object.eql,sha256=V122IVZR-mHxgDtxwudiryVV9qAWwhnXFC8bo98T7JU,54
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_address_object.lucene,sha256=4dZirELbjClGVHOhUEy6foq1MOwA5uuAFVQh4oF2Se0,40
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_address_object.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_policy_added.eql,sha256=5lXMW13J8cQE5xkZW-TqNcFhZtGOKEF720akIcg8Sxc,53
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_policy_added.lucene,sha256=XoOD6EEQ2BEU57u7aQKFjfqlYAqnU_rI-76QgOfVJ8Y,39
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_policy_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_local_user_created.eql,sha256=3B2HqE9cXNhdUYDRILLYMfa-Xc190JuhsMSG6AK1wKE,48
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_local_user_created.lucene,sha256=xChIAuJVhUl2tdUu56KnOvvVkb-vmSfSlCkyhbPaONo,34
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_local_user_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_vpn_ssl_web_portal.eql,sha256=vrSSeaeURNjxyaRdyBfwPvGlItvIk3aU45oVgO-6SaU,56
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_vpn_ssl_web_portal.lucene,sha256=0dBwMEgSwsJQyturvi__RXx9KN6_W0VPYVcG3hjydnU,42
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_vpn_ssl_web_portal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_user_group_modified.eql,sha256=VKXksV_ImUMIH33p5RYY9xlY5vewQxGQdcd3cShmTDQ,49
src/rules/network__fortinet__fortigate__fortinet_fortigate_user_group_modified.lucene,sha256=tkRXI-J4_6_mVZsgEP7FKmvp3VaKvmBqWzB3AStBXKM,35
src/rules/network__fortinet__fortigate__fortinet_fortigate_user_group_modified.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_vpn_ssl_settings_modified.eql,sha256=utiQfgUo9j-u-b2xbSWmsPn4wUy5pN9CgPHxx1whFzQ,55
src/rules/network__fortinet__fortigate__fortinet_fortigate_vpn_ssl_settings_modified.lucene,sha256=oVGpNJ8GVcAvf2UaUODMsUwkVDNrnB7i7LlWuy418Pg,41
src/rules/network__fortinet__fortigate__fortinet_fortigate_vpn_ssl_settings_modified.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__huawei__bgp__huawei_bgp_auth_failed.eql,sha256=krhpwucPY84V-wi4HNufnAFHVeYxEyufGP4MfHqg_m0,39
src/rules/network__huawei__bgp__huawei_bgp_auth_failed.lucene,sha256=mBLAApEDjgRrvNSQXW6nip6gHqExxwfYuqNy1LDk8Jg,30
src/rules/network__huawei__bgp__huawei_bgp_auth_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__juniper__bgp__juniper_bgp_missing_md5.eql,sha256=Wm4C_4QRGpwFAv3J_nsCzz12ENPQs0VU7cSW4u4OOiI,42
src/rules/network__juniper__bgp__juniper_bgp_missing_md5.lucene,sha256=QQiGT8HWKCSCQmyMrdgEAColjWeLahIgm0v9xdK7Dvw,35
src/rules/network__juniper__bgp__juniper_bgp_missing_md5.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_execution.eql,sha256=PygTHpEF_aB8HSTP1SIEaATxTNg9-iq1GEPAHeonVlU,593
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_execution.lucene,sha256=w1PrjraaKsAgj5XA1JuJu3931SCo0Puq-Z3vWu3Plt4,543
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_persistence.eql,sha256=ZlCeJ5Z-Q514S1c_zwViGpkQU6YFq18MbipHZdeJK3k,405
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_persistence.lucene,sha256=BSKGZM0bnkkNoEcQREuRGanMevvOYTTJJqXFWvdtgGY,371
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dce_rpc_potential_petit_potam_efs_rpc_call.eql,sha256=P_tvRhqOCIwdeoViaWwF7dujM-nj4y7uWXoSNgndD2Q,27
src/rules/network__zeek__zeek_dce_rpc_potential_petit_potam_efs_rpc_call.lucene,sha256=qsee0y8cSa5sSzUkgKeuXTSE2ZzRfU5CBvrDdVVyJ4g,15
src/rules/network__zeek__zeek_dce_rpc_potential_petit_potam_efs_rpc_call.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dce_rpc_smb_spoolss_named_pipe.eql,sha256=OBkselzBcPVBj8N8wbZ8DQM4Oq1LfSBHgeSWfV8IqJw,42
src/rules/network__zeek__zeek_dce_rpc_smb_spoolss_named_pipe.lucene,sha256=azl3Q2PJpFXDw-M1XA6k-rCLBCfxKNq5AmD2IUQxPA0,28
src/rules/network__zeek__zeek_dce_rpc_smb_spoolss_named_pipe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_default_cobalt_strike_certificate.eql,sha256=EGpw0bZ6XL8XP8vQJ-p8bPZAsdFpY1WNp36oVDi0SZ8,39
src/rules/network__zeek__zeek_default_cobalt_strike_certificate.lucene,sha256=NrR1sN7rwQ0ltz25iKTWpVrgzCdEV_EEJJIvuH7F4oY,27
src/rules/network__zeek__zeek_default_cobalt_strike_certificate.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.eql,sha256=pvTC5Pyns3Oq6bnLXsdVn9H6zafMIVfXuYczetFhQno,47
src/rules/network__zeek__zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.lucene,sha256=bfgp1fga_A12Wo8ihZw5noBdTdQApvU9sFjfgR-KlWw,33
src/rules/network__zeek__zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_mining_pools.eql,sha256=fuVmrZI1ydLN_C4GfT_v5BB4p_vgfs2vyZEi6x6JTEY,1365
src/rules/network__zeek__zeek_dns_mining_pools.lucene,sha256=UQ51GWn3FUVDfhswCJnPeph3NUP7-JDzmUwTeGMvmHo,1346
src/rules/network__zeek__zeek_dns_mining_pools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_nkn.eql,sha256=kYg3S526sdTk9DqVS-jxbomzB0I6phQDsXS7RyFW8hY,48
src/rules/network__zeek__zeek_dns_nkn.lucene,sha256=3wkPx6QmCr5qZ_4Zc9gx1heC6y9waMqDMiabeuUhIkI,34
src/rules/network__zeek__zeek_dns_nkn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_susp_zbit_flag.eql,sha256=EdB84dJpyCG0rb3zLsu8-hwuN7q1y-x21KEvE7wuayA,318
src/rules/network__zeek__zeek_dns_susp_zbit_flag.lucene,sha256=9h0Y_qkLP88GPEH-pkovtYTTbrKaFPh-VWsZ4Y8ekZw,291
src/rules/network__zeek__zeek_dns_susp_zbit_flag.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_torproxy.eql,sha256=0IwCW30BZcQAbFwn-D8K2voKh2w9GEd9yKBuelzDPf0,773
src/rules/network__zeek__zeek_dns_torproxy.lucene,sha256=SpRebNuHnkWlTPKeqzpWXY-6A907plRTrLb__aNUR5o,760
src/rules/network__zeek__zeek_dns_torproxy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_http_executable_download_from_webdav.eql,sha256=sPs727tkQThmJmjJuxfeGnwm8iHvQonIuteHaIRRzOk,106
src/rules/network__zeek__zeek_http_executable_download_from_webdav.lucene,sha256=rHf_BOrycDdo0Yd_rUIoT-PU0e6echvRDqCoVnAmIOM,88
src/rules/network__zeek__zeek_http_executable_download_from_webdav.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_http_susp_file_ext_from_susp_tld.eql,sha256=9ys6D6sYPcqifbfo0BapXMdYLpgOB8u73wRd0xp8dso,787
src/rules/network__zeek__zeek_http_susp_file_ext_from_susp_tld.lucene,sha256=ihT5gRcaxjXur9ACxYN5_urvyuO-z1u7J2b8pM9YZZw,780
src/rules/network__zeek__zeek_http_susp_file_ext_from_susp_tld.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_http_webdav_put_request.eql,sha256=iQOu71HDj4Lr9fWyuvWc3yC5qU7bfZwzajmqghofRlg,262
src/rules/network__zeek__zeek_http_webdav_put_request.lucene,sha256=jiklggOKz9q6XrqsPm4nnGeF46BdQlyb0ytZ7Xvuyag,183
src/rules/network__zeek__zeek_http_webdav_put_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_rdp_public_listener.eql,sha256=yEc4jh7rDbNGT9UYGnm3zDr7VSMHPvX_YmEswyM4XHE,368
src/rules/network__zeek__zeek_rdp_public_listener.lucene,sha256=LbRVXDN0-4e3aWK3y8zXAHWuCjjJMpj0Nn7QLVSa4QQ,251
src/rules/network__zeek__zeek_rdp_public_listener.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_atsvc_task.eql,sha256=bD7ho8486K5j1ah8gTpkc2n6UrW_VkwX78vXRSGWP6M,46
src/rules/network__zeek__zeek_smb_converted_win_atsvc_task.lucene,sha256=ynTo_gcTBAIu43fkVfJLYzFR7HftrKPAKQUkCV2pjnE,31
src/rules/network__zeek__zeek_smb_converted_win_atsvc_task.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_impacket_secretdump.eql,sha256=m49Neog7XxZuydWt_pUOYhlMEB_uNyZHNwIjVV6VjtM,85
src/rules/network__zeek__zeek_smb_converted_win_impacket_secretdump.lucene,sha256=sTzx8vUe2HZficekS8PiIQuDgu0nmcLylePPK-KBuj4,67
src/rules/network__zeek__zeek_smb_converted_win_impacket_secretdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_lm_namedpipe.eql,sha256=vEMAapf2nlI6QV7rENqlC4bgpbI-jWzP3tol2Q840ac,274
src/rules/network__zeek__zeek_smb_converted_win_lm_namedpipe.lucene,sha256=RTJn5WzFsXQurap9RCv4ruHtB-xra0RK2oWiDU-YqDc,261
src/rules/network__zeek__zeek_smb_converted_win_lm_namedpipe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_susp_psexec.eql,sha256=ebYFrW0WUc-KSbseLZk1hcAEHEXeg0gX1ST0FVUMLFY,126
src/rules/network__zeek__zeek_smb_converted_win_susp_psexec.lucene,sha256=Yjm-QqFWwTakwqXZF54Nb_KGP3fGgRh2ZFU9_Gg2L7I,105
src/rules/network__zeek__zeek_smb_converted_win_susp_psexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_susp_raccess_sensitive_fext.eql,sha256=64cPPr-e4o8cLepd83w_SamGc1ABwwMXixw0CsCvCNk,123
src/rules/network__zeek__zeek_smb_converted_win_susp_raccess_sensitive_fext.lucene,sha256=_OHHvqOwOwuhuG7iqVlA2L5JUAvizWFOHoFCXe1W20I,105
src/rules/network__zeek__zeek_smb_converted_win_susp_raccess_sensitive_fext.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_transferring_files_with_credential_data.eql,sha256=ilW0CGG8yg9yDbGU4k0DI2rZX-7Qyk1RilnLOe42SVY,135
src/rules/network__zeek__zeek_smb_converted_win_transferring_files_with_credential_data.lucene,sha256=98PAzdyOaz6kN2ujtTi9Os8zpc-gLBQjOTTm5E-FxCM,117
src/rules/network__zeek__zeek_smb_converted_win_transferring_files_with_credential_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_susp_kerberos_rc4.eql,sha256=6k8JfhetbDrczWbooUTmgAeEz7IxaUuh8da7Amox1u8,76
src/rules/network__zeek__zeek_susp_kerberos_rc4.lucene,sha256=jyrFGTlN17F3Fjgb06GYZM5cYXy4o3f7ILVyVRJk1Z0,61
src/rules/network__zeek__zeek_susp_kerberos_rc4.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/web__product__apache__web_apache_segfault.eql,sha256=9QSmMRd07AAfLs6ndaHFhLAZm_YGs0h1Eau25MAHFq8,43
src/rules/web__product__apache__web_apache_threading_error.eql,sha256=JIkA-w95LTfkzWNahlEy12GyEznHIvCIJbt34xEysXI,129
src/rules/web__product__nginx__web_nginx_core_dump.eql,sha256=_hO2OfvYmqPiJrGK471Ntw4g7t8vSI5Z61JTW3LylZE,45
src/rules/web__proxy_generic__proxy_download_susp_dyndns.eql,sha256=1qKEbMRwWqKNnHB2-jJXxL0VtE7iP8mqEYoOjV5Rp2c,1335
src/rules/web__proxy_generic__proxy_download_susp_tlds_blacklist.eql,sha256=zyqebAxoPK4Pd6NMsVeQpy1cB4535wgy1l8JE_QIbCE,756
src/rules/web__proxy_generic__proxy_download_susp_tlds_whitelist.eql,sha256=sdentS5OIdkhiLrK0rIazjl1CmfKGPYc2uI3SmhDmv4,332
src/rules/web__proxy_generic__proxy_downloadcradle_webdav.eql,sha256=fwcXkKy9qQjUOfwNpnqfZzPtk-j2SuK1QWxIHk4dGE0,73
src/rules/web__proxy_generic__proxy_f5_tm_utility_bash_api_request.eql,sha256=tnw-3T31BjEaVJQx_xG3MVDnZCp-C6GdA37Jltyj1AM,59
src/rules/web__proxy_generic__proxy_hello_world_user_agent.eql,sha256=VU3Vq1ZyG0yUCCDFUCiJNYgajqfTX23_cZzoYRY7TNQ,60
src/rules/web__proxy_generic__proxy_hktl_baby_shark_default_agent_url.eql,sha256=AwGlfhPFB4pCVA_xxk7pdefGQdCl3IA3T-EScWdlFiw,37
src/rules/web__proxy_generic__proxy_hktl_cobalt_strike_malleable_c2_requests.eql,sha256=xIBIg9oUYAuE_L32CLjeohfys5LF2i-TBNJwlhnA0qk,955
src/rules/web__proxy_generic__proxy_hktl_empire_ua_uri_patterns.eql,sha256=m3cm0nrQ9DGOFJVQjX9YaZqy5fQ21L7C_ggPnJbCnH8,187
src/rules/web__proxy_generic__proxy_pua_advanced_ip_scanner_update_check.eql,sha256=tpfeSx36aOG_t3tq7EbHmInj-6CLDN3TnGvbDnIzWiQ,197
src/rules/web__proxy_generic__proxy_pwndrop.eql,sha256=uBAeH_JzjnDNwltnpbEUTVaTvgTp4x6PG_M_8ROKNuk,30
src/rules/web__proxy_generic__proxy_raw_paste_service_access.eql,sha256=yY6BrqWLuYv2EKM5FFyMYkCAoWTRhdM3T9WmnkPSQdU,173
src/rules/web__proxy_generic__proxy_susp_flash_download_loc.eql,sha256=HSjvuqQrEV7PrnP3epnMMWhbZzEWnFRRCqIfJBgpfxQ,111
src/rules/web__proxy_generic__proxy_susp_ipfs_cred_harvest.eql,sha256=mC_Xf0JAHrOqVReiEIjlPoFaps8DzVKO-q6-zdzlXtA,74
src/rules/web__proxy_generic__proxy_telegram_api.eql,sha256=_PX4XHSxEPAsIOfM-KjZYFTcCJC8y0GcLw5bFhL1ds8,91
src/rules/web__proxy_generic__proxy_ua_apt.eql,sha256=A7DQ3EhKcuW1eQcbMo54vyM4ZmdZpg7PZUJXxP86-4A,2923
src/rules/web__proxy_generic__proxy_ua_base64_encoded.eql,sha256=saEdxrAIlESz9lcdPghENbrEN8gPmwJn2DE4oZQlnCE,88
src/rules/web__proxy_generic__proxy_ua_bitsadmin_susp_ip.eql,sha256=atbbxT-HUS8foHG-E_3rFeMbP0n2mV-yCGipsbEenqA,116
src/rules/web__proxy_generic__proxy_ua_bitsadmin_susp_tld.eql,sha256=mge0SFfp2bMCTCmkVxIqMyVA4uOBvIz2F4YXPP7sDxc,120
src/rules/web__proxy_generic__proxy_ua_cryptominer.eql,sha256=irSkE01MoGwADJ2qFdmH_jyGrgwbXuGS6wyqZc7dGME,52
src/rules/web__proxy_generic__proxy_ua_empty.eql,sha256=6eod7C2YiqlSBNuQ6HI1oeb3wXt1kceD3homFsVLUuw,26
src/rules/web__proxy_generic__proxy_ua_frameworks.eql,sha256=HR_-xL3X6VYO0r_RDtDuLURIKL2TPfvPUjL-YlhQgOc,1295
src/rules/web__proxy_generic__proxy_ua_hacktool.eql,sha256=UkS-uRWn3069bZuWjxwHcuJcglCxYYyGh4nOzDsL1so,864
src/rules/web__proxy_generic__proxy_ua_malware.eql,sha256=nWQ9IAf2KoWWWy2kHyVtsBV26oUQ2cCaeFgi2-QF8sk,2930
src/rules/web__proxy_generic__proxy_ua_powershell.eql,sha256=edQseHHGCUY__G8GkOhZXGCFKZR-RCf9ga0qW3dwulk,46
src/rules/web__proxy_generic__proxy_ua_rclone.eql,sha256=i751Cbq25QdH5qYuxVQBFu3pgVwBbwcFt6ksLXcbWms,34
src/rules/web__proxy_generic__proxy_ua_susp.eql,sha256=A1n_MpoAvXm9ViWwjK1dKYjKoipLZWYZfjbXQjbp2Bo,653
src/rules/web__proxy_generic__proxy_ua_susp_base64.eql,sha256=cpXlm6ivnJrteH6HjBH6cYOBomx8zd0wiC6nxJjlcQU,27
src/rules/web__proxy_generic__proxy_webdav_external_execution.eql,sha256=rbv3owDsQKokMI8xVZFIl0kvLmFncK6Bs_VCqpFLHwA,506
src/rules/web__webserver_generic__web_f5_tm_utility_bash_api_request.eql,sha256=R_Ghs1xnL-o4NvezwtZ8pr6VeQT0uMhp6m_IGmvy0hE,66
src/rules/web__webserver_generic__web_iis_tilt_shortname_scan.eql,sha256=Ne1azu_WW8Rqi5VTnJRRnjFsv2Wp15VRwwEQcNGSooE,131
src/rules/web__webserver_generic__web_java_payload_in_access_logs.eql,sha256=_hMqq2G-irWdh5M3E466hljR6KT2QjOlGFgPRD9pMxc,189
src/rules/web__webserver_generic__web_jndi_exploit.eql,sha256=3Xx46TvAfl7os1_0IEnYlxWZ1Qjvdv2y9XhBRjR7r1M,677
src/rules/web__webserver_generic__web_path_traversal_exploitation_attempt.eql,sha256=HZeqq82SjjCWsp9cBUYRk_Z4ldSGKE-66ehnYRzBq2c,211
src/rules/web__webserver_generic__web_source_code_enumeration.eql,sha256=1Io2plLikFHTVQpYN1OP6QR5dV63PWDzPX90kWsqdsU,18
src/rules/web__webserver_generic__web_sql_injection_in_access_logs.eql,sha256=z6rMSGVj92FDZ5NpABNpJRN_WveVt5Zz5b14q87cARc,656
src/rules/web__webserver_generic__web_ssti_in_access_logs.eql,sha256=SDio_q8b5QqowByMhQEHPA4hL9IEp7XdtLy8c1W9m2E,268
src/rules/web__webserver_generic__web_susp_useragents.eql,sha256=Naa-U5gXnRP9yWpC0Vt0BAmxtcpQ0pBCphF5exNfN8I,113
src/rules/web__webserver_generic__web_susp_windows_path_uri.eql,sha256=7deHGIYLGsHZ-AbKzIc-4lVd-hOcNBqR3xb2aAm5jMo,156
src/rules/web__webserver_generic__web_webshell_regeorg.eql,sha256=Rtk-0-9Do9YIa1XOGTkSN6GVEiUxP0cbZNX64D2-T1s,198
src/rules/web__webserver_generic__web_win_webshells_in_access_logs.eql,sha256=IgOx6jR0D3NhbHLMbAL2q4nJfWl1NNYHGWxDcibVtMk,557
src/rules/web__webserver_generic__web_xss_in_access_logs.eql,sha256=EAnxIr81ScYIvJPylkqo7Z3SQpwCbHiXCpYBDdRRXLo,330
src/rules/windows__builtin__application__Other__win_av_relevant_match.eql,sha256=gv3WN3q5dy3_xi26n82mKg-UWSmH6ujGmJ3OXttjmgU,1286
src/rules/windows__builtin__application__Other__win_av_relevant_match.lucene,sha256=IC3RyY68cm7zT9TicAXNdb1oLOEIdsdNl_zY5ldFG_4,1286
src/rules/windows__builtin__application__Other__win_av_relevant_match.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__application_error__win_application_msmpeng_crash_error.eql,sha256=Wo7g1jyPHmL7pEuaSppPck4BTm5IHGwGLRa0F2WHxiA,197
src/rules/windows__builtin__application__application_error__win_application_msmpeng_crash_error.lucene,sha256=sGpwAiiu6BGtHVwVD_J3u92DfO2f9-GgPUw7NT9Yu1Q,178
src/rules/windows__builtin__application__application_error__win_application_msmpeng_crash_error.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__application_error__win_werfault_susp_lsass_credential_dump.eql,sha256=O7eoOAEsCuu5Vd0mHN0VG7oNWxKE8tH1-hJ8kA8bPMA,197
src/rules/windows__builtin__application__application_error__win_werfault_susp_lsass_credential_dump.lucene,sha256=3jTlPzyIOQTdZJnZb-W0nomjTdRkRHpG7Mhq3jTJkgo,178
src/rules/windows__builtin__application__application_error__win_werfault_susp_lsass_credential_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse.eql,sha256=i3UsdOYoP-70sEkLjNs1iboZ-gnEfzgoU6PYhX1mT5Q,166
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse.lucene,sha256=GojWHEjoNLHCtuESJpL_5ta5OeKefxkRVmQdLVO4878,142
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse_susp_location.eql,sha256=kgoDdrI9Ctx2eXgO2YIRw33wXbI1KXdl2i8Zn6SQln8,298
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse_susp_location.lucene,sha256=BF3uZ4f4Wu3F1phpBwC89D6-Ixy_dsqIcc99_g49ug0,267
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__microsoft-windows_audit_cve__win_audit_cve.eql,sha256=AMoJhbqPtlBI7zP5hDx9NCBQUKdPNE_VkzdHVo4sfD0,138
src/rules/windows__builtin__application__microsoft-windows_audit_cve__win_audit_cve.lucene,sha256=CFO-Il6dHywHFD3R88d__Olq0wxUl-tKceL-5mYDfKg,120
src/rules/windows__builtin__application__microsoft-windows_audit_cve__win_audit_cve.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__microsoft_windows_backup__win_susp_backup_delete.eql,sha256=T_e53Y0lLUQgwAu7_F2N5Y7va_JceikELLU5zB9gO78,114
src/rules/windows__builtin__application__microsoft_windows_backup__win_susp_backup_delete.lucene,sha256=4JcWj_Yx0YXHBA-k7R5Gj2xE87Cy479FPL0lpAgEZt4,100
src/rules/windows__builtin__application__microsoft_windows_backup__win_susp_backup_delete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__microsoft_windows_software_restriction_policies__win_software_restriction_policies_block.eql,sha256=64XpQJFnjr2jz54bf51LdrE18eZBpHc-NjYPcS6rz-Y,173
src/rules/windows__builtin__application__microsoft_windows_software_restriction_policies__win_software_restriction_policies_block.lucene,sha256=z-HgsUJe_aHTV6Lzy-GjPRH1rFHiuNNneP971EVNjQs,153
src/rules/windows__builtin__application__microsoft_windows_software_restriction_policies__win_software_restriction_policies_block.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__msiinstaller__win_builtin_remove_application.eql,sha256=y4PJZlhuXptYkqPormqKzU4gwGNKPAufLaztB1BWIPY,122
src/rules/windows__builtin__application__msiinstaller__win_builtin_remove_application.lucene,sha256=2JzgJEF8hxahpQsq-t4em-TFABeMjLr7eSI2_nB1gXw,100
src/rules/windows__builtin__application__msiinstaller__win_builtin_remove_application.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_susp_locations.eql,sha256=76ab7mMtlRoUCdQhs4pMh6mTbh_IfvveLoQIRlcpzFA,372
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_susp_locations.lucene,sha256=CZ_ruNgDU0Pu_ng6VLgr_nMhm8B7yoBas_QREKvbumg,331
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_web.eql,sha256=kXDAJhK0EQRD-Oho6dFzxL5ArFR5RQmpCDpIpCWZGFI,156
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_web.lucene,sha256=BXMZVDfysYL4d2AYlhuM3qodCk5XwCRbGUOzYKTyfOE,135
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_web.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__msiinstaller__win_software_atera_rmm_agent_install.eql,sha256=L_0dvct9PWvowNSkrKjvc8RTqVfL9qHwdMiW3gOrWjw,148
src/rules/windows__builtin__application__msiinstaller__win_software_atera_rmm_agent_install.lucene,sha256=uXlAoOPgx22OSey1P_O97-O9vDa5KojKxAkg-e1oJsk,130
src/rules/windows__builtin__application__msiinstaller__win_software_atera_rmm_agent_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_add_sysadmin_account.eql,sha256=NoE57Vf8kqx2XR2YMzGw0CzUOr6Iqjf5CYmLZPGYzDU,235
src/rules/windows__builtin__application__mssqlserver__win_mssql_add_sysadmin_account.lucene,sha256=wTdGJfzhYcdX_0c0kWRzdvhfkRJGJiPRiDnFgS3IOpw,225
src/rules/windows__builtin__application__mssqlserver__win_mssql_add_sysadmin_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_destructive_query.eql,sha256=U8MQgTyOrptOOcgGkvEvwezJwcuB8xh0NcTODGWo5fk,230
src/rules/windows__builtin__application__mssqlserver__win_mssql_destructive_query.lucene,sha256=w636eVJXzog40b40PfM6FYYEHeJwNh5yhDWIUURw9yQ,212
src/rules/windows__builtin__application__mssqlserver__win_mssql_destructive_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_disable_audit_settings.eql,sha256=PDSviwDzGBN3QuSRlL9IE7KHedY8VSgzVTA-nxVpIvM,202
src/rules/windows__builtin__application__mssqlserver__win_mssql_disable_audit_settings.lucene,sha256=GNWjwDedYBbcfI9J-ukGuwgfVCI8TRRgUcSS0Gwj9ho,184
src/rules/windows__builtin__application__mssqlserver__win_mssql_disable_audit_settings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon.eql,sha256=3gMXIGEAZY6Ds6URtoXfMvqMBpPN2y-roiwux6UXCjk,99
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon.lucene,sha256=uwt3y9Sg0HkROCoxg1RrDn2BcEItln7r5LZSPlDANTs,83
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon_from_external_network.eql,sha256=kSrPxu-zla_DdazoQnt6CGFe2utJI6cv9FqxhQDHWHQ,587
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon_from_external_network.lucene,sha256=SN4WsrBks9AdcaJdsIUkXHUCoMrwess_0GYUWiWY3cE,608
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon_from_external_network.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_sp_procoption_set.eql,sha256=pgET3Xbqjz5mgt3uQiItO2-n7Yqw93aOlQ9OgkwE9Xo,204
src/rules/windows__builtin__application__mssqlserver__win_mssql_sp_procoption_set.lucene,sha256=GPBga8CZQBDe2ogOM6BYhKUzrFjfgXIBjWqcwcmMh5o,186
src/rules/windows__builtin__application__mssqlserver__win_mssql_sp_procoption_set.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_audit_log.eql,sha256=L3316CYud-Lq0wm76vb8gpYACQ9jY21YhiIw3vh8Kes,202
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_audit_log.lucene,sha256=mwcDFtrL8v6_6DCipEH81UmtPcm66MFuOFw1EH7YiLM,184
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_audit_log.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_change.eql,sha256=eHqJawnGYP_17WIKIsg3AE9ll481J7Ypd63KEwG-Owg,142
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_change.lucene,sha256=b6Gddef_-9UNCaue6FB6jZrCX6IMlb9HouYJ55PQlN4,124
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_command_exec.eql,sha256=gmMu6pVe7qa0_EcAEF8eyIiE4qcAjbmVdIAV8Cw52NY,161
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_command_exec.lucene,sha256=GzeTTP_qkNJ2oeW-0hN5lXHcjrtIArIM2UJcLyLDBwo,146
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_command_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_file_transfer.eql,sha256=ifSoueQKecWVUhE1YF_fkJ6dTC8OeGeLSjgyM46qmfg,164
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_file_transfer.lucene,sha256=0p4UHpAS_vI5Da1b_0YiOaGxK4qbaHJYdlh3Q5I9tpA,149
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_file_transfer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__windows_error_reporting__win_application_msmpeng_crash_wer.eql,sha256=u0bwjfdwZBEueYN7Fy2HDtzRR3_tHl3u6s4sJaJ_IMY,203
src/rules/windows__builtin__application__windows_error_reporting__win_application_msmpeng_crash_wer.lucene,sha256=mkrrGCr91ZqVBUaWhbp3BiFq3eYW3_xPDDp2ZBeKmz0,185
src/rules/windows__builtin__application__windows_error_reporting__win_application_msmpeng_crash_wer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__applocker__win_applocker_file_was_not_allowed_to_run.eql,sha256=5YcywLjURknG-XicJp3O1N4wgmW91Qg-F_zgaFnt80Q,288
src/rules/windows__builtin__applocker__win_applocker_file_was_not_allowed_to_run.lucene,sha256=U5H5jbPH3q-OAXoIWk8BDGYFHS8kOcqXYjPo3wVK5mc,282
src/rules/windows__builtin__applocker__win_applocker_file_was_not_allowed_to_run.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appmodel_runtime__win_appmodel_runtime_sysinternals_tools_appx_execution.eql,sha256=JeS5nDeK2CRmKi-AJAGUp7lA-ZvnuMP26uSU2fyxuuU,211
src/rules/windows__builtin__appmodel_runtime__win_appmodel_runtime_sysinternals_tools_appx_execution.lucene,sha256=z5zw7WoMpP2UDaFTFpxUL3wmHOJgKH1TpYSEc2Geq40,193
src/rules/windows__builtin__appmodel_runtime__win_appmodel_runtime_sysinternals_tools_appx_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_applocker_block.eql,sha256=gxnuKTh1n94QsaFTNK9zJn6k-62lwRNnRXkQvhLz_nQ,99
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_applocker_block.lucene,sha256=5RSKQAgK0AqOgH3Z5aiDCsCNuSjWnWV4_bYBa7FnKb0,88
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_applocker_block.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_mal_appx_names.eql,sha256=6hWBH5D_zA_TzYRCGu3aJHLSUKLTOS6t85nzW62P3Tk,197
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_mal_appx_names.lucene,sha256=ZzeSuNITtAtYcPE8BU5cBBlbh3eFwtfYbrwwJd-MWtk,182
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_mal_appx_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_policy_block.eql,sha256=FN-dlMMbRVmL2MvjtMZXUDQKzFUL7ZZqOLKJzOyA2oQ,130
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_policy_block.lucene,sha256=C8SB3gXI8wkFC00qqxz01bSBQsSxpv_kTYXoUgUavRQ,113
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_policy_block.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_appx_package_installation.eql,sha256=mwLfqkY5_awI4ZMua5K3kUsUVzKUnjpqijt20QZuNDc,146
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_appx_package_installation.lucene,sha256=Bb5jbPe0xxPbgmMF4fuKWr4ttSTarKVqBde7lvT8qK0,133
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_appx_package_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_domains.eql,sha256=mWfZ-fbYvkT0-tUwnKSiDgwrWfzSqr-4HtvpHuooQOg,711
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_domains.lucene,sha256=hEgkrAZQbDMjoco_Q3mM63hMxpKtJEit7kn5IbFkn1o,692
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_package_locations.eql,sha256=vtMyoTYQyasbqOS8qpFfAwNPe6Rd_KjAir6K7rwppmo,393
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_package_locations.lucene,sha256=UHXz4WFJO6SEU-7kJzTcoA8lYSmWKQkUx9kS5wMHJz4,389
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_package_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_uncommon_package_locations.eql,sha256=k6CgBZB6rNWVMau9-6Kc8QGb8wv1VJX2DbwHvVuR4-U,944
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_uncommon_package_locations.lucene,sha256=NeTjsunu2N72vjeMW_4iw8ciZK3ZwXwbtFCs4SDW2oc,957
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_uncommon_package_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxpackaging_om__win_appxpackaging_om_sups_appx_signature.eql,sha256=6pNsmMbhf1_eTq2KH7eapaGaOYmCiNUR7WnstDOuQf4,307
src/rules/windows__builtin__appxpackaging_om__win_appxpackaging_om_sups_appx_signature.lucene,sha256=Uh2YU-gaxOk9g0tVVH_pCNYZhc3FdkLj3Nkb6pVxSb0,316
src/rules/windows__builtin__appxpackaging_om__win_appxpackaging_om_sups_appx_signature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_bitsadmin.eql,sha256=arQpWlg9NIBRYPfavMS9vm2LjKp_3czNuqZd2oMKMzg,143
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_bitsadmin.lucene,sha256=eev6glo0CfccdlQyAYTgZirnsViTItETekHzWuYKD_M,131
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_bitsadmin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_powershell.eql,sha256=JZB1vXIzKPAmXMnzrECDBOPPWpQYsDt_LO6-3T5cWAo,169
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_powershell.lucene,sha256=XCqEnaEzhQf4K8gfayqjWMPEIN-aixxJna-wBGdgALw,151
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_saving_susp_extensions.eql,sha256=ZrACQQxd52XotAuLVcsaMvl1XGNGwjWdhTx3rVSTBbU,316
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_saving_susp_extensions.lucene,sha256=K9HW_Mel3s_wc86319Kk7ul77i3TmDCM6N2mduWwcU0,293
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_saving_susp_extensions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_file_sharing_domains.eql,sha256=pvyia8r4qaTO446ZJkczxU_hgYwR3uA2-EUPybF7ef0,730
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_file_sharing_domains.lucene,sha256=VG7NBT0DTkxYb0LfVXYSIA0hEFoogZ65ZjjO0TN5QCE,712
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_file_sharing_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_ip_address.eql,sha256=OI73BTu66pRyyJZlArbch0pz6mtQWq8YyCtvxOkX42E,836
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_ip_address.lucene,sha256=ZDs3UqcyKE1fltsF1DkW080N-UmD5MdxXbE1blaGD_M,924
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_ip_address.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_uncommon_tld.eql,sha256=qJROncsdohk9APpNgjcBCMK0a7Q3D5rb8rU0NGDpY4A,258
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_uncommon_tld.lucene,sha256=fKChEh5xR4jwirWvUmPD5fSt72bktHJ5wG-x3meEpVc,246
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_uncommon_tld.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_trasnfer_susp_local_folder.eql,sha256=sVtMXw_awJOEXLu51hIwOrl3DB5LxUWz4Drq8gmdIdc,197
src/rules/windows__builtin__bits_client__win_bits_client_new_trasnfer_susp_local_folder.lucene,sha256=9BJ9Jn9RcKmiPHkbP_wGVwACjzncYH6nq6uqR-DzL2c,178
src/rules/windows__builtin__bits_client__win_bits_client_new_trasnfer_susp_local_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__capi2__win_capi2_acquire_certificate_private_key.eql,sha256=0-QhA4KwZivw_eMNoBgfNhmERBqmmPrJYl-SMbUnJIE,83
src/rules/windows__builtin__capi2__win_capi2_acquire_certificate_private_key.lucene,sha256=QMeeccHkjOIA663zQHCOuu7bMLiHawp3vbLTp8_sQvw,72
src/rules/windows__builtin__capi2__win_capi2_acquire_certificate_private_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__certificate_services_client_lifecycle_system__win_certificateservicesclient_lifecycle_system_cert_exported.eql,sha256=ON3Iti0lsC290FNO9B2h8HUFjCn4H-mnALwQGi96Plw,122
src/rules/windows__builtin__certificate_services_client_lifecycle_system__win_certificateservicesclient_lifecycle_system_cert_exported.lucene,sha256=kMeenfrONoD3iIIH8nJ-5NJUQXcSyYJW6qAhH1Z-Xms,113
src/rules/windows__builtin__certificate_services_client_lifecycle_system__win_certificateservicesclient_lifecycle_system_cert_exported.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_attempted_dll_load.eql,sha256=IJExnREoQHE3DGiYd3rFFE-9E7VwPFJ5_qW4d73f9og,3647
src/rules/windows__builtin__code_integrity__win_codeintegrity_attempted_dll_load.lucene,sha256=z9bHQFfE4hPJazZ5L6mw6UjSbfh3rDtOYWo8zI_ECR8,3534
src/rules/windows__builtin__code_integrity__win_codeintegrity_attempted_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_blocked_protected_process_file.eql,sha256=Z9l4zvnFoQMHFM04kU92loUyygm1-C_XNuE-_hJ0_L0,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_blocked_protected_process_file.lucene,sha256=vm3KrNV5EL-owS27PR7uXRmkqlAnC4SdLpdRSVsjVl0,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_blocked_protected_process_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_enforced_policy_block.eql,sha256=cp1fltSx3vphKhMwRY-jmydMdojSeUT_0QP-OSpEDh8,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_enforced_policy_block.lucene,sha256=vHufDRv6WfcP6IWocqIwoVBgdRkC5DDGeKc8dHE89nc,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_enforced_policy_block.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_blocked.eql,sha256=JqWcmoXOt0xUxvDlPpscYn3PZUiPSMmC-K8TaxHXPWg,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_blocked.lucene,sha256=uTjZ57SjdSZkJ2mFGk83vsvAViSKI93ft5GEivagr8w,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_blocked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_loaded.eql,sha256=BYORvPyZWnIkWtmFEpiAbaVtT2dcIYB-tqEjzi2hfj0,111
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_loaded.lucene,sha256=JyHFzDO-B6eF4bk4-gqrGSm5Vi7xgzEw1A8IkqQmoEA,94
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_blocked.eql,sha256=npSFWIKJPs6E21rt1AzBN7suFzBK27YPDeTr5mwD6L8,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_blocked.lucene,sha256=-EWqiOx2heb6DqdTxP0o6uLbWdZrHNSsVCJtbuFWpc4,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_blocked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_loaded.eql,sha256=atRJr6CI0TqhZwS3yO9e9zXu8qC7JUint3JUHwHUN3E,111
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_loaded.lucene,sha256=NcJiNUfwKEXf_bKanMrQAUo1ODukicKUZ6jsTjTOcYc,94
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_driver_loaded.eql,sha256=f0ZX9wpTfBjaKl3sdzQzHMuwronOnHUkg-DLsOyDEZ4,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_driver_loaded.lucene,sha256=bfVwhvfcJvqPTbuGhCWTev9c-F1prrYf2AzeoeT_HAA,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_driver_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_image_loaded.eql,sha256=JRTX3qcEnIQnavvol1on_oJQOfClSOM4wZM0fzjScKI,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_image_loaded.lucene,sha256=3gW3rrckvuWUW1NC8Ws0cuCwxt0rJw8tmPyOXPwmWpk,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_image_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_whql_failure.eql,sha256=f-RJR2AIWxgbvoFPYT8N1W25zt8iWqOReEf0zIDJfVo,228
src/rules/windows__builtin__code_integrity__win_codeintegrity_whql_failure.lucene,sha256=MGbwKjFj0n4qO_kCccXY2CyecBMI4zNkFE-1GUlFT9s,203
src/rules/windows__builtin__code_integrity__win_codeintegrity_whql_failure.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__diagnosis__scripted__win_diagnosis_scripted_load_remote_diagcab.eql,sha256=qmY6uMpgg4OMgGBdTQyyWlKdPSy5_dlMAyNyQI6K7KE,140
src/rules/windows__builtin__diagnosis__scripted__win_diagnosis_scripted_load_remote_diagcab.lucene,sha256=Tw7H1kM8ZBq-E3BbQGNJFilbO3JPsJO-kM4vtjdQR9U,128
src/rules/windows__builtin__diagnosis__scripted__win_diagnosis_scripted_load_remote_diagcab.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_anonymfiles_com.eql,sha256=VGl1ALf315nU0bOFOSoUt4xKHDdXPRj28mCvMPyz4qU,140
src/rules/windows__builtin__dns_client__win_dns_client_anonymfiles_com.lucene,sha256=jbgiPe8dQ8V1Qn-Wc5Zae4AcwNCe68xuvJW1AcqB4C4,129
src/rules/windows__builtin__dns_client__win_dns_client_anonymfiles_com.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_mal_cobaltstrike.eql,sha256=iweAjA9i0IS4v_kOcRiKUzNa1YKMX6z82SOsIHt0J7A,198
src/rules/windows__builtin__dns_client__win_dns_client_mal_cobaltstrike.lucene,sha256=zq5AOaDHGo7pFT-JRQ-Led6cb35q7joa7_Kg6X4hdiU,179
src/rules/windows__builtin__dns_client__win_dns_client_mal_cobaltstrike.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_mega_nz.eql,sha256=KB2EYvzy_uhZWQ8bdR1Pxa-Y4gLw1FoCHnQF0KJ1H9w,148
src/rules/windows__builtin__dns_client__win_dns_client_mega_nz.lucene,sha256=YI8t830xMNCtCVPFubzGaQ1YHlPiNRdhJnrXc-FFUwY,137
src/rules/windows__builtin__dns_client__win_dns_client_mega_nz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_put_io.eql,sha256=SAUfZ7SYvYhJjx1xhbWITZm3NcjQA-JnaNA5tcBEgUg,165
src/rules/windows__builtin__dns_client__win_dns_client_put_io.lucene,sha256=DqcD6slNpFAyts__T1OXxtdL5l1KsrDJG1dji-pjBnU,148
src/rules/windows__builtin__dns_client__win_dns_client_put_io.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_tor_onion.eql,sha256=ts_spnMvoViA1h1VPyavgFCmUOzI0576X9AF3PUncFw,880
src/rules/windows__builtin__dns_client__win_dns_client_tor_onion.lucene,sha256=aaJ-JeRzYB3iq5r-tPvWeNRi-ipOrsgW7lijXoodLiU,868
src/rules/windows__builtin__dns_client__win_dns_client_tor_onion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_ufile_io.eql,sha256=-kFWwiK7g7e_q12YGjwf6Pyg462DAmoybVNEjXaOChM,134
src/rules/windows__builtin__dns_client__win_dns_client_ufile_io.lucene,sha256=-9GSYr69Kp6KlFYtsjtUUexvt3ShsDf-qZSq9YdqrbU,123
src/rules/windows__builtin__dns_client__win_dns_client_ufile_io.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_server__win_dns_server_failed_dns_zone_transfer.eql,sha256=vVtD8Mix5x7BTZSt1LWTJqPwUeVCjtS1e3kKV0VFuyw,60
src/rules/windows__builtin__dns_server__win_dns_server_failed_dns_zone_transfer.lucene,sha256=KsfvsANzWIPYjinO-94aWlzkDZzbWsAhgN_CSlManTI,47
src/rules/windows__builtin__dns_server__win_dns_server_failed_dns_zone_transfer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_server__win_dns_server_susp_server_level_plugin_dll.eql,sha256=1YMMmSoyjk1BjE7vyc3uIoMieV3m9O8HhNvxGIUBnNY,83
src/rules/windows__builtin__dns_server__win_dns_server_susp_server_level_plugin_dll.lucene,sha256=dt3ycc9PqR2l3ny1hsp86rs86G7sPb-MLp6Bui_tTJQ,64
src/rules/windows__builtin__dns_server__win_dns_server_susp_server_level_plugin_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__driverframeworks__win_usb_device_plugged.eql,sha256=Gixfg36ksXkSD1ZGuYo505NY3KTA08CiNVoOblE13H8,131
src/rules/windows__builtin__driverframeworks__win_usb_device_plugged.lucene,sha256=g64gj4i-zd3WSrQY63lNno1PTdhtSkp-PbK_JU1_1YA,115
src/rules/windows__builtin__driverframeworks__win_usb_device_plugged.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule.eql,sha256=uN4pPGIluBz-QvbtM9BSgC-nqFGa506dGwOQi7Qbh0E,1520
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule.lucene,sha256=J1vtjFUiF0yYpDpdH4Pe09sEPYv-lCaunjWrSTX07w4,1468
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_susp_folder.eql,sha256=TEn2mPsBOTL5MuKT2HQdm6Y756tGpSByN45tX2UPBHA,383
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_susp_folder.lucene,sha256=VOA9iZ0H3kQn5m-yPdIfcy0IVETzje9XV-VxFzyRAYk,359
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_susp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_wmiprvse.eql,sha256=yf6pUmdjGuZsVmISj7Kr-xDFFfREXHegIS6JlMhS7LY,264
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_wmiprvse.lucene,sha256=Ijrcj0EVy1H9TY4nZ6YzkRV8RtaL4C1fkrWnGlwu6Xo,248
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_wmiprvse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_all_rules.eql,sha256=RBLrUwPYTlleOlT65errcTDxZXbq7iYMsw55cQOq6ak,394
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_all_rules.lucene,sha256=QFmF7QPevrXsPszQIU0lUzdLVHKKQumXc_T8_nHvk6A,377
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_all_rules.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_rule.eql,sha256=0ToxvvroDY96BB9fxsslzWY3aXo5Khv805BIUU7FGCY,665
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_rule.lucene,sha256=UI_9RxMee53g-tfc6ljZX1jtf__ohlXaZswgcwQro9o,647
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_failed_load_gpo.eql,sha256=a9j0f59KmyKlrYxzDSgT-KiHIiOL4qcDvnZACvJr7Qs,116
src/rules/windows__builtin__firewall_as__win_firewall_as_failed_load_gpo.lucene,sha256=k2xZ_InE35NgWjSiFF05dSosEKwwoE_4aSDHBlvUpRk,109
src/rules/windows__builtin__firewall_as__win_firewall_as_failed_load_gpo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_reset_config.eql,sha256=Ke3xjGpEQ_xlQd9l8MI8IDJI5uhowH7rk0Jd9RQYznQ,134
src/rules/windows__builtin__firewall_as__win_firewall_as_reset_config.lucene,sha256=U73kad5PyPg2m8i3IPm7kG8n86uaNBFK6k4o6Z7r_q4,121
src/rules/windows__builtin__firewall_as__win_firewall_as_reset_config.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_setting_change.eql,sha256=rxBivfPI270x0YP1MT6EUJ6PjrJhFEEGor4rEsmqJ0I,158
src/rules/windows__builtin__firewall_as__win_firewall_as_setting_change.lucene,sha256=lINUL0ou_TSR8FD9u04dnzP8m9gepy4Z7ev6ygNtLT0,145
src/rules/windows__builtin__firewall_as__win_firewall_as_setting_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__iis-configuration__win_iis_logging_etw_disabled.eql,sha256=_rR1RJ8jRAuonnoVmXAdikinAahLRwNgGH7K-5gw30g,165
src/rules/windows__builtin__iis-configuration__win_iis_logging_etw_disabled.lucene,sha256=XQMfsDoX0ydf-zqZ2P35nFVCyKYHLAQvaGigmmy-wj0,147
src/rules/windows__builtin__iis-configuration__win_iis_logging_etw_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__iis-configuration__win_iis_logging_http_disabled.eql,sha256=RW1g8dfIiY6Mog5nm3flQGeDpZCDqW0HOrBPVoI52WA,141
src/rules/windows__builtin__iis-configuration__win_iis_logging_http_disabled.lucene,sha256=Bn_HPzUnWuahUqXpo_bUhw0BbyCNBma7CLHHzcrkoH4,128
src/rules/windows__builtin__iis-configuration__win_iis_logging_http_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__iis-configuration__win_iis_module_added.eql,sha256=AqeSPqWYKGhj0eiKCvbBTKVSbReTbD8UfEdSl37-H6s,480
src/rules/windows__builtin__iis-configuration__win_iis_module_added.lucene,sha256=0GxVnMKw3v9DgPv6MhexelboAl8E2HH-u95txZUBg-I,460
src/rules/windows__builtin__iis-configuration__win_iis_module_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__iis-configuration__win_iis_module_removed.eql,sha256=gQEF2PKav6wqs9z7RV_Aue0cd8LZHqXsBQpz2LxxeUw,99
src/rules/windows__builtin__iis-configuration__win_iis_module_removed.lucene,sha256=Jx7ngp9X58RsT1jW3nqOpHJOcZ-EMa8sqiBknfMX89s,88
src/rules/windows__builtin__iis-configuration__win_iis_module_removed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__ldap__win_ldap_recon.eql,sha256=NR2h171_rTIaxuec5oFPNH7Fd7fqLnkt1-1W0aGfH-g,2103
src/rules/windows__builtin__ldap__win_ldap_recon.lucene,sha256=5NhYgF8N2-6I0DtqBSMHO8M9FZ_5NbnJ2_OKYL2qz-0,2216
src/rules/windows__builtin__ldap__win_ldap_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__lsa_server__win_lsa_server_normal_user_admin.eql,sha256=GQOrL0wb-H-WPGEcjNFTpAwnD_KtMBMpcsAhKqjzTkI,303
src/rules/windows__builtin__lsa_server__win_lsa_server_normal_user_admin.lucene,sha256=mnsOYlDaoMg_FrfyjN4UD5Xy2uH6KlPZtbk1yaWIXLM,291
src/rules/windows__builtin__lsa_server__win_lsa_server_normal_user_admin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_proxylogon_oabvirtualdir.eql,sha256=R63XECGTx1P2i11sn4fhqQDYEhyyK8SloBUZf9t_LZo,187
src/rules/windows__builtin__msexchange__win_exchange_proxylogon_oabvirtualdir.lucene,sha256=3han6L7f0lUc6VTpUTFEUEndgFiB6eavhLz_rKY8CK4,189
src/rules/windows__builtin__msexchange__win_exchange_proxylogon_oabvirtualdir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_certificate_generation.eql,sha256=NxY--91BnylDwSs6Eoe-QhTNxidu8QpcQtAbR3bcSfc,222
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_certificate_generation.lucene,sha256=h7FaT2ku9wgC3ZUgP6SwL99lix9xLajvmJ8Lyj1c4yE,219
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_certificate_generation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_mailbox_export.eql,sha256=nw4DQIz984a2uCeDMtKPyp7_45y98xuZ4JKv8eO-6po,226
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_mailbox_export.lucene,sha256=3U1__zQfLEGbV-TkZ5558IvJOvn2mMhOUtm7pISBWik,230
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_mailbox_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_remove_mailbox_export.eql,sha256=SCRkAB_wAw2f-xN-T4A150EdcvlGNDlBfJMp4K40sSo,129
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_remove_mailbox_export.lucene,sha256=Qkdmol1Gpy_vzvuIok24_pZgwfhzXIpR9M2-4H-tMOE,125
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_remove_mailbox_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_set_oabvirtualdirectory_externalurl.eql,sha256=NHL_A4Ue_uZ5sfSkvL_YrT4NSNEQ_fT8r4GFX9BnWzY,128
src/rules/windows__builtin__msexchange__win_exchange_set_oabvirtualdirectory_externalurl.lucene,sha256=Q0Myx8hW3W_SN_1mP_j3X-ffxQ6Eti5Zwgkme37oJsQ,118
src/rules/windows__builtin__msexchange__win_exchange_set_oabvirtualdirectory_externalurl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_transportagent.eql,sha256=b9I0gy186sv5sxQBisjjveDhLA53jJ4MWfFvKv230ak,78
src/rules/windows__builtin__msexchange__win_exchange_transportagent.lucene,sha256=bX7Ghrm8bvCldlnlbVnDs35NIzfowDoL_sHuRrKx8Ug,68
src/rules/windows__builtin__msexchange__win_exchange_transportagent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_transportagent_failed.eql,sha256=qRW4fnZfkm0ZhOaicgwZXNSmTxtRw1zLf9f1D3RN22Y,124
src/rules/windows__builtin__msexchange__win_exchange_transportagent_failed.lucene,sha256=vBvfIK1oQvoLNxMnj1aQV-PCQa3McWZE8jtM_7xLhYU,110
src/rules/windows__builtin__msexchange__win_exchange_transportagent_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__ntlm__win_susp_ntlm_auth.eql,sha256=mKy3ma6wI9cXwJHNqZAH2TgKD3Cn6lWmK-ywGGnZV1w,84
src/rules/windows__builtin__ntlm__win_susp_ntlm_auth.lucene,sha256=iED-RpSQVYg_nDZTANadgpTRhaSQpcygGrvqT5W4LXI,73
src/rules/windows__builtin__ntlm__win_susp_ntlm_auth.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__ntlm__win_susp_ntlm_brute_force.eql,sha256=451GU217H4cmPK3t25kE7ga6cdbo0QbSlcN6x6CNhEg,216
src/rules/windows__builtin__ntlm__win_susp_ntlm_brute_force.lucene,sha256=xEZDXTfYWwdITqsXISMh60Sy3uaHa7wLyFOlAfZgB9k,197
src/rules/windows__builtin__ntlm__win_susp_ntlm_brute_force.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__ntlm__win_susp_ntlm_rdp.eql,sha256=qAoWtmWvKLmE7VlS6xTTvBMiqPCG7HWHPsxSDSgi3hA,130
src/rules/windows__builtin__ntlm__win_susp_ntlm_rdp.lucene,sha256=qlcZcdeXB0zUnB-mcAwndnovEV2TAn-sLwe1yoruMLY,117
src/rules/windows__builtin__ntlm__win_susp_ntlm_rdp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__openssh__win_sshd_openssh_server_listening_on_socket.eql,sha256=MR9E9W_0IkSojklPCe3B8H3NtbVXo2AzZ4DkElGXzZs,159
src/rules/windows__builtin__openssh__win_sshd_openssh_server_listening_on_socket.lucene,sha256=i1EJu32eurzwFrMiH2Kfg9ZwzkseCY2PB4hnZznD8bw,145
src/rules/windows__builtin__openssh__win_sshd_openssh_server_listening_on_socket.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_access_token_abuse.eql,sha256=s0VK-7LkZyr_vLRpHQ3Q5nSdixyrMiy4hlxiRGOFRpc,254
src/rules/windows__builtin__security__account_management__win_security_access_token_abuse.lucene,sha256=ohsW_CfUDuMQJjMCuFsrqwdf4MSw6FAaYje4MoIMzqM,232
src/rules/windows__builtin__security__account_management__win_security_access_token_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_admin_rdp_login.eql,sha256=OcWOOHDZrMLAtcbHKO2dPwued-N0axJ_SOXNzz8Y0yo,203
src/rules/windows__builtin__security__account_management__win_security_admin_rdp_login.lucene,sha256=iah9evma6zRqVmIU2FC0SuHWzrUE7YsTQqAko6dPfC8,183
src/rules/windows__builtin__security__account_management__win_security_admin_rdp_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_diagtrack_eop_default_login_username.eql,sha256=4kY0FDE6WImEcO_zEfDRRRVpoJu7oxHvSE2HR46q6Fg,162
src/rules/windows__builtin__security__account_management__win_security_diagtrack_eop_default_login_username.lucene,sha256=yW2S92PCamo-oGgurgwwp7xUK0290RZFVlxS2K7fhI4,144
src/rules/windows__builtin__security__account_management__win_security_diagtrack_eop_default_login_username.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_member_added_security_enabled_global_group.eql,sha256=nplVAVW4U2nSiJKRA4LekZRe372ckbRllK00Iemxa30,75
src/rules/windows__builtin__security__account_management__win_security_member_added_security_enabled_global_group.lucene,sha256=GFXgRb7OJSvDoZhffDyFbFLBGVlDxcFaerch6BY0tYE,55
src/rules/windows__builtin__security__account_management__win_security_member_added_security_enabled_global_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_member_removed_security_enabled_global_group.eql,sha256=7vHpB2_yUQkPw8O9w9iMo0wjXqbWvYQa8F7S7LmDXao,75
src/rules/windows__builtin__security__account_management__win_security_member_removed_security_enabled_global_group.lucene,sha256=7XEdiCgEz-ZhPzV0XP27CwPYsNL4HZvmnyN7UumILuc,55
src/rules/windows__builtin__security__account_management__win_security_member_removed_security_enabled_global_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_overpass_the_hash.eql,sha256=o6kzTjZvqspFArLfWx7FNJIHG03rZ59faMK6ySbarX4,205
src/rules/windows__builtin__security__account_management__win_security_overpass_the_hash.lucene,sha256=mN2To-8HFBln_yrEbtZE1WdJ4CFuk9UadH6gUKuICp4,185
src/rules/windows__builtin__security__account_management__win_security_overpass_the_hash.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_pass_the_hash_2.eql,sha256=meOwQrRMe8-WTMEadMSV7C2einMmmevMX5zSRUyUNIQ,376
src/rules/windows__builtin__security__account_management__win_security_pass_the_hash_2.lucene,sha256=CTyn8vHx5pWniQNxmwSOXR3hLdvQXVz8e7-dzpoP6qE,350
src/rules/windows__builtin__security__account_management__win_security_pass_the_hash_2.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_rdp_localhost_login.eql,sha256=L5iVtNVGcQ87-pX4SG3g6KqFYwnhAFe0miCQEJDwKXE,140
src/rules/windows__builtin__security__account_management__win_security_rdp_localhost_login.lucene,sha256=fm8Zp-evjJVRLfFVZUtlc4MqWFzrvhXvG8CwkNMd3y8,118
src/rules/windows__builtin__security__account_management__win_security_rdp_localhost_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_security_enabled_global_group_deleted.eql,sha256=rnqpwbW-pLIoR6PFHlnLT9WtnkAeo6VwqD8zqBdNP7E,75
src/rules/windows__builtin__security__account_management__win_security_security_enabled_global_group_deleted.lucene,sha256=ra-NkaSAybQX1N0UqYgfTsEjuayzJUl4cxgUSiUuUrM,55
src/rules/windows__builtin__security__account_management__win_security_security_enabled_global_group_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_rdp_login.eql,sha256=pzs5EtG01WxqWQKC2oLWwYUn2f3uXRfCPLzJTN3JuHQ,437
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_rdp_login.lucene,sha256=bm98nAQr46TbFFQ0qDhy1GaMzv2kYk0IGxmhBsR8G6I,322
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_rdp_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_smb_login.eql,sha256=8mgG9EsvFDkwj0fcTCR1sjlbYu_DrJDPhP4r1f18r7A,436
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_smb_login.lucene,sha256=l9LsDD_J5GDCKiACbgrWl_4_wIEvN3NWaPfcHMMLY2U,321
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_smb_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_failed_logon_source.eql,sha256=2Ye8hfNOi2Kg2U2GTrrYU8qAw5bwCtih-tVjtHTqk5Y,400
src/rules/windows__builtin__security__account_management__win_security_susp_failed_logon_source.lucene,sha256=vMUnSjRQmW2SWltTpOAfh0lKbRGpHwbQ6NKAfUGo8hI,287
src/rules/windows__builtin__security__account_management__win_security_susp_failed_logon_source.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_logon_newcredentials.eql,sha256=mNAPyYxzlnzM5udLj48z32gYyqsM9MzvCeYkqXSxpTc,96
src/rules/windows__builtin__security__account_management__win_security_susp_logon_newcredentials.lucene,sha256=L_NyNGInBF_-iEXSPgsNyzZ8o_wXkmpwNfAmUy9czRE,80
src/rules/windows__builtin__security__account_management__win_security_susp_logon_newcredentials.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_privesc_kerberos_relay_over_ldap.eql,sha256=38030Lzspt7-1hrSIaXVISScnrtBlTTM-zSB6T1UU5U,303
src/rules/windows__builtin__security__account_management__win_security_susp_privesc_kerberos_relay_over_ldap.lucene,sha256=fwrimdGWplHUN5WunRtKiUnVcrykcKuQgpvYp9L8vmQ,281
src/rules/windows__builtin__security__account_management__win_security_susp_privesc_kerberos_relay_over_ldap.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_rottenpotato.eql,sha256=WdOOi4mB8_I_q8O8-REpWk7UiOOn4cSVuM-wuiYz4Js,216
src/rules/windows__builtin__security__account_management__win_security_susp_rottenpotato.lucene,sha256=GH-TDkv-Wdrr9OBxQ2sd1zAPprqzPoDVMla1yBHyosU,192
src/rules/windows__builtin__security__account_management__win_security_susp_rottenpotato.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_wmi_login.eql,sha256=CUwulWWZyJXhqnqT5rb5tqZ2dqOf3TYHxkhEvZrHxUk,101
src/rules/windows__builtin__security__account_management__win_security_susp_wmi_login.lucene,sha256=vZKWP06gexTEEeqHpA0QJHipcDgHkO9c4_c0pj5Kotc,85
src/rules/windows__builtin__security__account_management__win_security_susp_wmi_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__object_access__win_security_wfp_endpoint_agent_blocked.eql,sha256=GaYs09j_0roY-VnZcED5okhAYlYS_KsRO0JXDmSOssg,1624
src/rules/windows__builtin__security__object_access__win_security_wfp_endpoint_agent_blocked.lucene,sha256=BS29RXIPBk7KOLLKnBgctCrQgy9xX4jc9y6GF6XqCpU,1605
src/rules/windows__builtin__security__object_access__win_security_wfp_endpoint_agent_blocked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_aadhealth_mon_agent_regkey_access.eql,sha256=07lkc57J1uYK34QVNRLQs0QnPyS0WegIrYPe2olteAI,575
src/rules/windows__builtin__security__win_security_aadhealth_mon_agent_regkey_access.lucene,sha256=iwlDVl8fCe4l3iEG1PhCISNhHeFq6YpasWhhwxV1Zrs,544
src/rules/windows__builtin__security__win_security_aadhealth_mon_agent_regkey_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_aadhealth_svc_agent_regkey_access.eql,sha256=t9Ia_CkYD24TfCjbB2HCnSVrE0xMmOxNQYLfQ_su5w4,544
src/rules/windows__builtin__security__win_security_aadhealth_svc_agent_regkey_access.lucene,sha256=cJKUW8NAcE8i_fhvvAMIOyjcvd1LGu_DquTojaEoiok,512
src/rules/windows__builtin__security__win_security_aadhealth_svc_agent_regkey_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_account_backdoor_dcsync_rights.eql,sha256=-SdrltA_-YjE69slFdThN4UHi7tmjuDmrrHnI9Ff9JQ,391
src/rules/windows__builtin__security__win_security_account_backdoor_dcsync_rights.lucene,sha256=bwn0qIxjPRpzBnmHUZ02_6BdxBB6QWOWrsLmCOPDYNo,371
src/rules/windows__builtin__security__win_security_account_backdoor_dcsync_rights.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_account_discovery.eql,sha256=56Wc5O3q1g8hSHFyum3teZ7cfrjJqK-7a7a4UTFIh3w,321
src/rules/windows__builtin__security__win_security_account_discovery.lucene,sha256=LjFMhtYqXelvZyZBLuDvpLH11xDZlJephu1jJ8j6Ack,296
src/rules/windows__builtin__security__win_security_account_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_ad_object_writedac_access.eql,sha256=u7GkLl05K57odJhwJcwxlGdbr8mMYGZrWm3SjfyRLfM,238
src/rules/windows__builtin__security__win_security_ad_object_writedac_access.lucene,sha256=d707-SPBQaHMn9SzHvvvULU6H2wwxLv1k7Ol9l_hjEs,216
src/rules/windows__builtin__security__win_security_ad_object_writedac_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_ad_replication_non_machine_account.eql,sha256=KMF8MKVTiznpdrF2UsCnTrooZ__dTWFKTXfCtSqkPZc,316
src/rules/windows__builtin__security__win_security_ad_replication_non_machine_account.lucene,sha256=RQh5TrDKmMkWxjojxUQcdkNCwp2Hq3OiC2HkzMRJyT8,296
src/rules/windows__builtin__security__win_security_ad_replication_non_machine_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_ad_user_enumeration.eql,sha256=OAoOL4SDh7TU3onIFIhsRuG6OdiVUaL6IP4-KMtT_-Q,279
src/rules/windows__builtin__security__win_security_ad_user_enumeration.lucene,sha256=m-9uVMG-rxzMixVMOxT_x24PCBxkui5hpzPdPDuZqsk,251
src/rules/windows__builtin__security__win_security_ad_user_enumeration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability.eql,sha256=LXEH55uHi7E2Rrib2ntnnNkVVjmAEqcovi-8e0rRyB0,240
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability.lucene,sha256=q7AmVkGcm_8Bln8icS8SekXlmHKW28KvgVB9uL4ZbMY,220
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability_eku.eql,sha256=-MjkVwp-r54iqUIJhpHHJN88p4OdzJyxOoVOyQyY6ZE,519
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability_eku.lucene,sha256=CzVsJzfA0jwJELSuLxwUYW-1yTExiWmS3kBZv5zN2ik,483
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability_eku.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_add_remove_computer.eql,sha256=Y6gbRO5R_jyUKVvGjvo_DWqUbEYpsgoRGkY7YQfcSVo,76
src/rules/windows__builtin__security__win_security_add_remove_computer.lucene,sha256=NG57v7365dcRFcY_GbSROm0ryfzEQLTEhqdpIY_W4fE,56
src/rules/windows__builtin__security__win_security_add_remove_computer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_admin_share_access.eql,sha256=Lr4s1WyKNBnqWJftUt8ErcVHSiQ9bvmEefHx9A0MhMM,128
src/rules/windows__builtin__security__win_security_admin_share_access.lucene,sha256=Zv9he0K_ksF-_0oXBGGWArqvbAPMfnItS91E6PMesZ0,110
src/rules/windows__builtin__security__win_security_admin_share_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_alert_active_directory_user_control.eql,sha256=JJccERmVjQjm7LN77T1bynbtj71jzteP0Fy-3_4R2dk,128
src/rules/windows__builtin__security__win_security_alert_active_directory_user_control.lucene,sha256=n5Pmgsju0ljCp_LLNyHc2CmNr-sXqNVotkGDYgQF7WU,112
src/rules/windows__builtin__security__win_security_alert_active_directory_user_control.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_alert_ad_user_backdoors.eql,sha256=K-ix_2D9yTa5pKuZbo6he9n0SS5pTQNhZeBMRiF4YKM,568
src/rules/windows__builtin__security__win_security_alert_ad_user_backdoors.lucene,sha256=NZsuZUd3RpSzeAnvcWscfYp09ELwdqflZK7acCf9FBY,540
src/rules/windows__builtin__security__win_security_alert_ad_user_backdoors.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_alert_enable_weak_encryption.eql,sha256=jpEkrRi7VVauFb39jUEGalRyGbufkiYAjGu7XMKZDw8,774
src/rules/windows__builtin__security__win_security_alert_enable_weak_encryption.lucene,sha256=MBcR3thsFu2kv2gBwbGZq6LG-uB9Gb-tOeEmEwfoONw,712
src/rules/windows__builtin__security__win_security_alert_enable_weak_encryption.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_alert_ruler.eql,sha256=5a7ce7pVSlUAyKWuOnQ-LWQjxivK6Oynz7JQQTzjOFw,171
src/rules/windows__builtin__security__win_security_alert_ruler.lucene,sha256=s21W04O4_foyNKhQzc_mDFmVRCVB897K1cJ03hvPJpo,145
src/rules/windows__builtin__security__win_security_alert_ruler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_atsvc_task.eql,sha256=7nqG3lbwzO8MRezdEByIirvBtuSeNHjWOO-chPyq4_A,202
src/rules/windows__builtin__security__win_security_atsvc_task.lucene,sha256=pTCEeqt1XC6ku31k0PsH3WWhV2XCLh0pnGt-pxMhRCs,181
src/rules/windows__builtin__security__win_security_atsvc_task.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_audit_log_cleared.eql,sha256=moFmPjV8YSm_4PcgPV5sRI-91aEGPDTyyzeyioxgtm0,174
src/rules/windows__builtin__security__win_security_audit_log_cleared.lucene,sha256=40_A7Ya6jFWWvHNtnpMCVOXhvQ9wbtiSxzCVcz55Qbs,156
src/rules/windows__builtin__security__win_security_audit_log_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_camera_microphone_access.eql,sha256=tZnbbHaaTsvATubsbcGXG_KfmSC_QG_Q0LD72cAHDac,356
src/rules/windows__builtin__security__win_security_camera_microphone_access.lucene,sha256=Scxcvbt3K_Tuuh1s4FetWM_K6RovbApNG-Sdus1--0g,328
src/rules/windows__builtin__security__win_security_camera_microphone_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_cobaltstrike_service_installs.eql,sha256=cDUUc0MOTLus0qF4nhwfc12LPpBmUe0h8wUhgjWjCO8,713
src/rules/windows__builtin__security__win_security_cobaltstrike_service_installs.lucene,sha256=sYgYX144oeUFWPkHJDvo0ZHla1C5QI1xKUviBc52U9A,686
src/rules/windows__builtin__security__win_security_cobaltstrike_service_installs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_codeintegrity_check_failure.eql,sha256=rBYeaoSxwwQvyle8WBhm8QXUAdSQAxhDx4dZlDiaokI,338
src/rules/windows__builtin__security__win_security_codeintegrity_check_failure.lucene,sha256=vFZvdrxeVBm5iKA9_S7ChNW6pipMchKajgCZZYWJzYI,307
src/rules/windows__builtin__security__win_security_codeintegrity_check_failure.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dce_rpc_smb_spoolss_named_pipe.eql,sha256=Gb832JxzWRCpy556FalosL6sDGS2KQuXDDMyWPjgJpI,157
src/rules/windows__builtin__security__win_security_dce_rpc_smb_spoolss_named_pipe.lucene,sha256=eTFLg41SmFnTOQCf-u4bdJut5mX7mpO3Bgt6gawMYDk,138
src/rules/windows__builtin__security__win_security_dce_rpc_smb_spoolss_named_pipe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dcom_iertutil_dll_hijack.eql,sha256=PRQxskVGOWYOQhbQSbe0eZIhFEHNsjcCdBY16960yYQ,165
src/rules/windows__builtin__security__win_security_dcom_iertutil_dll_hijack.lucene,sha256=roht_gSIQYw7chMtJ7xhmba_t-deGBcTHrCXXvntmDY,148
src/rules/windows__builtin__security__win_security_dcom_iertutil_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dcsync.eql,sha256=isBKQgvourYU1dTyfJAvYZnEl1XPGmDAm65lM-nZfK8,454
src/rules/windows__builtin__security__win_security_dcsync.lucene,sha256=aAFQYd00wtmKMVVSSprV6wTNBvUYb1jaXMlfvNhU_Hs,439
src/rules/windows__builtin__security__win_security_dcsync.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_default_domain_gpo_modification.eql,sha256=1kK1gI-7mLKbVRDKMsMC_9zZzl7nhI4aK4MhGWc5co4,293
src/rules/windows__builtin__security__win_security_default_domain_gpo_modification.lucene,sha256=A622YxiwAYHpzWlWwI9THLm2GLGz4wugHNYNZyQ60fk,287
src/rules/windows__builtin__security__win_security_default_domain_gpo_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_device_installation_blocked.eql,sha256=Aqeos-tt-7pRO4MRgvu7gfGOJX54hvDyeADJw4IdWk0,58
src/rules/windows__builtin__security__win_security_device_installation_blocked.lucene,sha256=MshyPtJYJZRaPvdQGm4M4FqSVd7BVprR658K1XgjpuQ,44
src/rules/windows__builtin__security__win_security_device_installation_blocked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_disable_event_auditing.eql,sha256=NhUn-3ym6o4cN9UtAYKaznG79e1zSwEkCH_RzDgJ-jU,819
src/rules/windows__builtin__security__win_security_disable_event_auditing.lucene,sha256=foR0SIfo-JuLss-zPhMscU0jwYg5x6ptzOHJ_nIZ6cQ,879
src/rules/windows__builtin__security__win_security_disable_event_auditing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_disable_event_auditing_critical.eql,sha256=3XDHGpsTreNsWjD9kFbpTX9C5b1poJgdI-a0VcO4AmA,925
src/rules/windows__builtin__security__win_security_disable_event_auditing_critical.lucene,sha256=xJJGpByNMV51_ixnCwGopoWEeiE_ucLJADW_jzSZe4A,979
src/rules/windows__builtin__security__win_security_disable_event_auditing_critical.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dot_net_etw_tamper.eql,sha256=UaMYbH5QA8NB-xomWlik1N2QEKXBaPPDVGAiz3t0IQ0,419
src/rules/windows__builtin__security__win_security_dot_net_etw_tamper.lucene,sha256=ZI_Cio-D5qmlkpiObNVCHNAW2MCHActM3wPCLYdDtjA,385
src/rules/windows__builtin__security__win_security_dot_net_etw_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dpapi_domain_backupkey_extraction.eql,sha256=c65m5c8kAu2USA_jJNRh2Op0Tad7rvNKgcqO6vDwXSI,193
src/rules/windows__builtin__security__win_security_dpapi_domain_backupkey_extraction.lucene,sha256=8PTBgf2PuLSGacfXABucy1_cdUnGaOptMznYdy6yDVc,173
src/rules/windows__builtin__security__win_security_dpapi_domain_backupkey_extraction.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dpapi_domain_masterkey_backup_attempt.eql,sha256=_xiDizLQuiB0XFh7x3JjhkyVnYOsjaJtB_FLyVua2qs,58
src/rules/windows__builtin__security__win_security_dpapi_domain_masterkey_backup_attempt.lucene,sha256=3bLWYPQO5g_rttTOkgW_CrL06hOW2pCdBs1q4u8XIAw,44
src/rules/windows__builtin__security__win_security_dpapi_domain_masterkey_backup_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_external_device.eql,sha256=Sa7F0qYAGB-k5omOOR5krJcema2g7MXtSd6H1kY3z5E,171
src/rules/windows__builtin__security__win_security_external_device.lucene,sha256=5dkPai70JFcmQS1Zo_t7lTbk-nh2uTEUhs9tyCTMFlk,156
src/rules/windows__builtin__security__win_security_external_device.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_gpo_scheduledtasks.eql,sha256=IpzcFEiJEC3DkOOEK6r-cjReNIASMcfZqiVgxT4gxBw,500
src/rules/windows__builtin__security__win_security_gpo_scheduledtasks.lucene,sha256=jfvOP0tIO2-PgjQFUakfqBKovJDX6z5oZya3smchY94,464
src/rules/windows__builtin__security__win_security_gpo_scheduledtasks.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_hidden_user_creation.eql,sha256=NtOQPDbUcsenuepsUqUXBXuMf1C0eSkr_XAidjaXOXI,164
src/rules/windows__builtin__security__win_security_hidden_user_creation.lucene,sha256=nws_ssPeQKhIBko9mebliZ8jx-vHyaoX2o8i6-stk6o,146
src/rules/windows__builtin__security__win_security_hidden_user_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_hktl_edr_silencer.eql,sha256=eviks58suXpJbt3MmWDL5-jGJmGUZERBZjct_ULG44c,138
src/rules/windows__builtin__security__win_security_hktl_edr_silencer.lucene,sha256=6RixnDxDuK6V9sPkEcmm0bpquPU1BZkuikqO2t5c15s,118
src/rules/windows__builtin__security__win_security_hktl_edr_silencer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_hktl_nofilter.eql,sha256=pcVL8zaakXanQIx4qthzKH1NlzysdtV1v21VVmh6-wY,188
src/rules/windows__builtin__security__win_security_hktl_nofilter.lucene,sha256=ZkgGydsHYG8V8eENv1qzaQ_URGrsgf0_8nBdlQ0neBk,168
src/rules/windows__builtin__security__win_security_hktl_nofilter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_hybridconnectionmgr_svc_installation.eql,sha256=YduO7TBbvKzy_hDzs3ChTvREB6_IikYejVC_pDNsK1Y,169
src/rules/windows__builtin__security__win_security_hybridconnectionmgr_svc_installation.lucene,sha256=Acf1FeB95rnjGnrtcfE8gUg4rkZucgWnfVj3zQl1S2c,151
src/rules/windows__builtin__security__win_security_hybridconnectionmgr_svc_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_impacket_psexec.eql,sha256=tVadgeRTz6mxdbRBS8i3xsmVImAa07WF_4zauPDVRFo,212
src/rules/windows__builtin__security__win_security_impacket_psexec.lucene,sha256=vBtNBKO3DViO6AjKn7GVoPxcuvkNC23Cy2oiS49qz0Q,187
src/rules/windows__builtin__security__win_security_impacket_psexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_impacket_secretdump.eql,sha256=d7q7ncGE8TRtpkTpVP8uAEUOvytjie8x3N_vjG5-lDI,216
src/rules/windows__builtin__security__win_security_impacket_secretdump.lucene,sha256=EwmT_RTH8tWx580xreklmRPf7F6clayAuas_9nHccLU,194
src/rules/windows__builtin__security__win_security_impacket_secretdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_clip_services_security.eql,sha256=jFwZfhrS3XAEU2Cgwu-DeSCin7rF-CuVbc-GM_slBqI,208
src/rules/windows__builtin__security__win_security_invoke_obfuscation_clip_services_security.lucene,sha256=-9QCBZddO1qJRtIzDmc4dMhNvT1OKChY9wiKgal37G0,193
src/rules/windows__builtin__security__win_security_invoke_obfuscation_clip_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_obfuscated_iex_services_security.eql,sha256=d4t7YQBMGvp8asDSXdTvBc9Y5_1vDnrWiH48ItFILBI,462
src/rules/windows__builtin__security__win_security_invoke_obfuscation_obfuscated_iex_services_security.lucene,sha256=Uz_MFaD4MZKkPquctqU9dTqoya_7Q2pR__ur7VBoCsE,1730
src/rules/windows__builtin__security__win_security_invoke_obfuscation_obfuscated_iex_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_stdin_services_security.eql,sha256=wUwQOR81vZ3hKnP4hruFEFXl5xrd9bO2hYucPasMoa8,303
src/rules/windows__builtin__security__win_security_invoke_obfuscation_stdin_services_security.lucene,sha256=Ijd4Ur1eyng4sVR4lj8oULjz-6OdhfMIGwRPR8-UFdg,277
src/rules/windows__builtin__security__win_security_invoke_obfuscation_stdin_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_var_services_security.eql,sha256=1IrJioAu1E6v9uqHR3voBzz6qESohb1to6GC3C4Yyn8,264
src/rules/windows__builtin__security__win_security_invoke_obfuscation_var_services_security.lucene,sha256=yRTzDLlbBkklhsLte9sLTCnIQ-bLwj7BZbm3zTcpxAk,239
src/rules/windows__builtin__security__win_security_invoke_obfuscation_var_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_compress_services_security.eql,sha256=TMSkV2EVK3FuEW8M624foZbsxl53JOMFsYo3Wku-tEI,347
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_compress_services_security.lucene,sha256=4wOHcl0jArSERL4eggbO8zL2TbZYpt1z1UJxxaQPJoA,323
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_compress_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_rundll_services_security.eql,sha256=6z9DjB3NAdFzaPssyFjtIIp-yIyC_qYGeIczn-as5nk,283
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_rundll_services_security.lucene,sha256=ofueh6SlskL4Hn2j8ungj_Iwaol0pfgDaN0VfTIz-xo,261
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_rundll_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_stdin_services_security.eql,sha256=0iQsoaW3FqrlQl094DteDDNASwAR17rsxBC8cTttWLQ,243
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_stdin_services_security.lucene,sha256=r7DEIGiJQ6dybkp2A2kAjlBxp4tnGS6IgsbV31Llmr0,221
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_stdin_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_clip_services_security.eql,sha256=46wfpH2H1qWquHdMKbuz3czKnMXx2tC8Qy6x92QTi0M,115
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_clip_services_security.lucene,sha256=KBobU_Fuw3WumpQ_8gYbjG3ziNJ40FeE_fPyj8TZhB8,101
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_clip_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_mshta_services_security.eql,sha256=Kgd9Olmd4ZJfpirHkaA1RJxETxs9FtmyWY78ibexhIo,276
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_mshta_services_security.lucene,sha256=CWPnHo_G07FrNlXrtJ3w0Y0M49e9lrA4M4XEhkM9Z8Q,255
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_mshta_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_rundll32_services_security.eql,sha256=XlC-JFS5pz8rqutd0B-W0iPteBuwL94hCteyDtqM8GU,363
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_rundll32_services_security.lucene,sha256=mF-fPLHZ8euG3LXF9PKonRg2KpZOmww-_vkrEv48lWg,335
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_rundll32_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_var_services_security.eql,sha256=2jmCh9nkgjDuyEVqljn4cJLO2yk81nublg-CGxtYNg4,347
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_var_services_security.lucene,sha256=beknlXAVaJsFzuchGp6DKRMq5mJPCi-qiwlXew93sBA,333
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_var_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_iso_mount.eql,sha256=GRAAtIk6jBK02DhZC-YL-0vjWumeCycM_1e6NdrvowM,345
src/rules/windows__builtin__security__win_security_iso_mount.lucene,sha256=InVhXa0jakEfCTJbQ5rO68Jig5edlhStjdO-YRoWjYs,317
src/rules/windows__builtin__security__win_security_iso_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_kerberoasting_activity.eql,sha256=kuFDliiJSIyzk-aJ77dIQIun26MU-1zO32WRvgZUJ_U,241
src/rules/windows__builtin__security__win_security_kerberoasting_activity.lucene,sha256=FCrtQoDmBB-j7Rp0EZxwy4xULBCo26ILuOu8vb1PB6c,213
src/rules/windows__builtin__security__win_security_kerberoasting_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_kerberos_asrep_roasting.eql,sha256=uXDhwVlEF5rH1dJqDGy_SEiFXtDoeF6bn3yr2QuMAhI,174
src/rules/windows__builtin__security__win_security_kerberos_asrep_roasting.lucene,sha256=r09WTh3Gg0rm4ITQmIWMwREf9IZICXKLfN_T3JLFzoU,154
src/rules/windows__builtin__security__win_security_kerberos_asrep_roasting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_kerberos_coercion_via_dns_object.eql,sha256=-hEoJuC8VCD2lrQ2eezUwD2P4fSi81X97usnP-6m23Y,437
src/rules/windows__builtin__security__win_security_kerberos_coercion_via_dns_object.lucene,sha256=zzHgR6uEZn9hKLquRjZu3eT3CMH1_hy1JiKceA0jlUE,403
src/rules/windows__builtin__security__win_security_kerberos_coercion_via_dns_object.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_lm_namedpipe.eql,sha256=sT36QSopZF3is2_B8GFHvd-wrDPybOdze5T5QAs70tk,410
src/rules/windows__builtin__security__win_security_lm_namedpipe.lucene,sha256=1RlRPaxf--Rx8lWsqZsRS2sI6OSOv1yp3pbplm-13_0,385
src/rules/windows__builtin__security__win_security_lm_namedpipe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_lsass_access_non_system_account.eql,sha256=fF869Mp4gE9h4yUb6tKYn89o9OIY-qIlP7xFZYpi91M,672
src/rules/windows__builtin__security__win_security_lsass_access_non_system_account.lucene,sha256=mor3fOfNdkonWjczXdwtsMK48Ezy_DfctU7sEq6SSXQ,629
src/rules/windows__builtin__security__win_security_lsass_access_non_system_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_mal_creddumper.eql,sha256=GVqOAItyjGvAAesv8zUroI0QCp2bKkx9n2LOHWkroK8,198
src/rules/windows__builtin__security__win_security_mal_creddumper.lucene,sha256=KLMFoaY5PQYpB7THZRmCsosbHTAG5mrmPrzxxUcC3LA,176
src/rules/windows__builtin__security__win_security_mal_creddumper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_mal_wceaux_dll.eql,sha256=J7pNPu-xmyRXg7UI-j4oH4CfgblwP7coVdFrSYovQiQ,127
src/rules/windows__builtin__security__win_security_mal_wceaux_dll.lucene,sha256=YGgoJxtUzujDYSZr32TvEVmO12k0KXih98wmeiX3fjE,105
src/rules/windows__builtin__security__win_security_mal_wceaux_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_metasploit_authentication.eql,sha256=9P1oGWK4StCK4Q2kGIqv0AZJeYYUQIYpCUHrQ5EKiE0,300
src/rules/windows__builtin__security__win_security_metasploit_authentication.lucene,sha256=KXrVTnOSqJjIpj3ebh0JN9NsevxN8fzfab8dDVOjcK4,416
src/rules/windows__builtin__security__win_security_metasploit_authentication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_metasploit_or_impacket_smb_psexec_service_install.eql,sha256=g6-tDT1WIP63WE1zvZhYsLkOT-7QC05NYISG4sucRj0,338
src/rules/windows__builtin__security__win_security_metasploit_or_impacket_smb_psexec_service_install.lucene,sha256=216asDVTx3PZhSAs-HzpS3CYZ3JdLJLV5jH9KgT_caQ,480
src/rules/windows__builtin__security__win_security_metasploit_or_impacket_smb_psexec_service_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_meterpreter_or_cobaltstrike_getsystem_service_install.eql,sha256=9duj6stsWqhVIAwQ9W_jeeiC2SRWFlRznpJF2d3ySF4,489
src/rules/windows__builtin__security__win_security_meterpreter_or_cobaltstrike_getsystem_service_install.lucene,sha256=cFjsMmSxlQUgL0Ckg6YgxfeGyFfPislQU409vl97aCo,454
src/rules/windows__builtin__security__win_security_meterpreter_or_cobaltstrike_getsystem_service_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_net_ntlm_downgrade.eql,sha256=9OsCKgVZbPM241oM_Luz9E-ZWnQ1AthE2TqibQjD4_0,348
src/rules/windows__builtin__security__win_security_net_ntlm_downgrade.lucene,sha256=OdwW0OdYOe2e4Wa8rcJ88Fdccc8ArcJGx25IGatstWI,320
src/rules/windows__builtin__security__win_security_net_ntlm_downgrade.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_net_share_obj_susp_desktop_ini.eql,sha256=Hm4v-9tIA0uJDwBGC4HqEbBqrDshgkPdnGyLY9epgG0,278
src/rules/windows__builtin__security__win_security_net_share_obj_susp_desktop_ini.lucene,sha256=AMQVSHRfEU3c7V6wiqzIAaASQLG99vYSehcPbi7rBzA,252
src/rules/windows__builtin__security__win_security_net_share_obj_susp_desktop_ini.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_new_or_renamed_user_account_with_dollar_sign.eql,sha256=ju4yWspgJ_4uqqf0sMSE988qncetOvl7geUkpllwnDg,260
src/rules/windows__builtin__security__win_security_new_or_renamed_user_account_with_dollar_sign.lucene,sha256=1N2vetGO9lHS6MnVixO8oU_LVimeGLAa4u8YQeD_EV8,236
src/rules/windows__builtin__security__win_security_new_or_renamed_user_account_with_dollar_sign.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_not_allowed_rdp_access.eql,sha256=Xo_zleFZCYreSMXkS8AiMeUjlWZmOLXb4Yosvx2fAtk,58
src/rules/windows__builtin__security__win_security_not_allowed_rdp_access.lucene,sha256=PArVu9QmFWpAPe-C5birN6zqLIP_m_xZ4pHV4TBFN-0,44
src/rules/windows__builtin__security__win_security_not_allowed_rdp_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_password_policy_enumerated.eql,sha256=T9P2XnW5FJrCihMqVAP2FbGdh7LQSxdYJa4mFdpn9iU,166
src/rules/windows__builtin__security__win_security_password_policy_enumerated.lucene,sha256=xGdx9IiaDmLXWWTT2sNHnesJf3gxRuseSmVQ7-_ceOQ,150
src/rules/windows__builtin__security__win_security_password_policy_enumerated.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_pcap_drivers.eql,sha256=sRF54g6z9s1nuQDQaMtK83kWKtYFJNXDPABwYzvRp9c,209
src/rules/windows__builtin__security__win_security_pcap_drivers.lucene,sha256=VIFdjm4IuewnNOLNiEz8OHqtN7HAH8IXj1f3OQJIg6w,187
src/rules/windows__builtin__security__win_security_pcap_drivers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_petitpotam_network_share.eql,sha256=u4FSYMHkZV2vP4qfyruHV5UkIRH1mZ7OMmQ4k46JcU0,222
src/rules/windows__builtin__security__win_security_petitpotam_network_share.lucene,sha256=_Fvxg7F2DyB5PXtQYpHNnkNNG2q6cuKOnt16IJ_GmFc,201
src/rules/windows__builtin__security__win_security_petitpotam_network_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_petitpotam_susp_tgt_request.eql,sha256=oNhogG-2m4_1x3y_8oOWWvQRad8c7Y2WSjZJTL3_VA0,214
src/rules/windows__builtin__security__win_security_petitpotam_susp_tgt_request.lucene,sha256=sbDwgJWafRgITirhJr2BbNBtfz09UBxHrVpuKklyQT8,194
src/rules/windows__builtin__security__win_security_petitpotam_susp_tgt_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_possible_dc_shadow.eql,sha256=0b8twunj5SimMEyEvW8SXbxm3MTL8cu2nTcB-S_erAo,251
src/rules/windows__builtin__security__win_security_possible_dc_shadow.lucene,sha256=5D7HWHVUKS6fEF3v53eOUmnP3FD9dgpfrWjsPtKSOM8,231
src/rules/windows__builtin__security__win_security_possible_dc_shadow.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_powershell_script_installed_as_service.eql,sha256=0l3uYU_y2cdOi9zhifdit9QlTLEjmntM6UXbKboz680,133
src/rules/windows__builtin__security__win_security_powershell_script_installed_as_service.lucene,sha256=l5JEuikrutN5eK82uiURNRuIIzCNZxTDlJEVgEAFoNI,111
src/rules/windows__builtin__security__win_security_powershell_script_installed_as_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_protected_storage_service_access.eql,sha256=dsqWXP8QaI4qOXt3dE6RqG7jPqb9xsYs9OFAEZn3qzI,161
src/rules/windows__builtin__security__win_security_protected_storage_service_access.lucene,sha256=Xuo30eYHZeX9L18AWCabp_yKa7lyYWg7tJJdbfzOO3o,143
src/rules/windows__builtin__security__win_security_protected_storage_service_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_rdp_reverse_tunnel.eql,sha256=QPjfhmPFZnhivSk1HtLfHUnPr42GzMxwImqoqUC6E-A,325
src/rules/windows__builtin__security__win_security_rdp_reverse_tunnel.lucene,sha256=bzonDFNfe3dEF6KZvYyX60P9OA66OW_2ZhUzWt_VFrs,290
src/rules/windows__builtin__security__win_security_rdp_reverse_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_register_new_logon_process_by_rubeus.eql,sha256=MSN6vGWpAX6Un_R6JgDpGbOa3Y14tOUS0MideCiHSuI,121
src/rules/windows__builtin__security__win_security_register_new_logon_process_by_rubeus.lucene,sha256=OakyOjJeDDF9h5s9f-xgUUy3M2cCHVPnYZL_QcPjexs,105
src/rules/windows__builtin__security__win_security_register_new_logon_process_by_rubeus.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_registry_permissions_weakness_check.eql,sha256=Wqrre_h_6aiaTLQI8u1zIzZzjV59duxC4yQQqZre3lc,214
src/rules/windows__builtin__security__win_security_registry_permissions_weakness_check.lucene,sha256=rgF4Hcu75jNIM9DXC3IrtxahbTWLp9Lgw8imks3RZAk,192
src/rules/windows__builtin__security__win_security_registry_permissions_weakness_check.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_remote_powershell_session.eql,sha256=Hzc-Gqr6cB4q_uokHohHtO1sAHKbBq_dS5cUigjRjns,139
src/rules/windows__builtin__security__win_security_remote_powershell_session.lucene,sha256=0UNabM88SRGOANvOcOOsMVunBeGAKXL4iKpZ1Z0uNEo,119
src/rules/windows__builtin__security__win_security_remote_powershell_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_replay_attack_detected.eql,sha256=puonevdhmcaUNH9bP2eUFxfxxRHw7FWAop_faVAbFfw,58
src/rules/windows__builtin__security__win_security_replay_attack_detected.lucene,sha256=7mgIWA3D5qkmGfMQHep1PzEqyzgxBxsJ0YcF3yr30I8,44
src/rules/windows__builtin__security__win_security_replay_attack_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_sam_registry_hive_handle_request.eql,sha256=zeoeiVSwif_hDLMeOwrfqYGm7B9dBmbpogVDB0uG5gM,141
src/rules/windows__builtin__security__win_security_sam_registry_hive_handle_request.lucene,sha256=MrjpXYp_FUK7LQnL29m-XZKFq_mIEgTMBfO2Bt0JSg8,123
src/rules/windows__builtin__security__win_security_sam_registry_hive_handle_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_scm_database_handle_failure.eql,sha256=Y5GsWAtqtDJB3ubEMRknMtaxrFdychrQtCoOJTgyMsk,242
src/rules/windows__builtin__security__win_security_scm_database_handle_failure.lucene,sha256=vLnxhWPaZTHcNA85fLV9tq9HBP-sV8Q0D5jF350mp-Q,221
src/rules/windows__builtin__security__win_security_scm_database_handle_failure.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_scm_database_privileged_operation.eql,sha256=lYV-_yApvfsnA1cXVtj6Cei4jbHO1sIo6IX-Ubye25w,325
src/rules/windows__builtin__security__win_security_scm_database_privileged_operation.lucene,sha256=Ro6knUPdB5SByw5d1Jfu6S6ylLZ2npvVzUbGbfOOOT4,303
src/rules/windows__builtin__security__win_security_scm_database_privileged_operation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_sdelete_potential_secure_deletion.eql,sha256=ePi0Lpxy3v6vL_ZRFgAlBNRPcGmeu3Z0e9-84846ybk,146
src/rules/windows__builtin__security__win_security_sdelete_potential_secure_deletion.lucene,sha256=49UaD88PxXUGEPgMdwh31XDV1tuChW1oeypEiVC59tg,118
src/rules/windows__builtin__security__win_security_sdelete_potential_secure_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_service_install_remote_access_software.eql,sha256=DJ_KaJb9rhxqrLg5OU0AkSRwH_94kSvspJWwSOs4b70,480
src/rules/windows__builtin__security__win_security_service_install_remote_access_software.lucene,sha256=KTzur-7fnHrNYKqrPxA-0WblUW1ovX9v1K2E6Qx-uD0,458
src/rules/windows__builtin__security__win_security_service_install_remote_access_software.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_service_installation_by_unusal_client.eql,sha256=kesiMz2O41Y1r33B9pKZ1lASXKzxuZ2QaedfCP5Epwo,128
src/rules/windows__builtin__security__win_security_service_installation_by_unusal_client.lucene,sha256=yXzC6Hn9748TAgl3xGcmIyq3_JHyBDZ67ZjBucTr-E0,112
src/rules/windows__builtin__security__win_security_service_installation_by_unusal_client.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_signal_sensitive_config_access.eql,sha256=EbsY9lFg86eas9aqfCd-JJwGBEyUs8-AmTj95eKSN4M,325
src/rules/windows__builtin__security__win_security_signal_sensitive_config_access.lucene,sha256=PQ9yE-tI9caDPyi86Mib39P3mm4XoyrCCnek32p8qds,291
src/rules/windows__builtin__security__win_security_signal_sensitive_config_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_smb_file_creation_admin_shares.eql,sha256=Af9biM5Drd4bFjH2I42oD_udSrnrQ7Y0MqGkq0CBa2A,191
src/rules/windows__builtin__security__win_security_smb_file_creation_admin_shares.lucene,sha256=Itvs_CKwUEsAc9uRqcbSNInp16iKBszozoeZyj1EmNw,170
src/rules/windows__builtin__security__win_security_smb_file_creation_admin_shares.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_add_domain_trust.eql,sha256=KL6z188ozAq3jG59tkH1nYnT-2rAbbB9Tkfby_IiWUs,58
src/rules/windows__builtin__security__win_security_susp_add_domain_trust.lucene,sha256=8vpOeElqMx8pcs3utUpELOJJPS2cdDem8elozniDOTI,44
src/rules/windows__builtin__security__win_security_susp_add_domain_trust.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_add_sid_history.eql,sha256=hvtsDhjryMVnD_BwnZGvRFKzWYcGADoryxgIkKQO6lI,254
src/rules/windows__builtin__security__win_security_susp_add_sid_history.lucene,sha256=Snz_vrMnCQxRXBT_Vkjd_ra4bNijgXepBICnxUGbSFs,228
src/rules/windows__builtin__security__win_security_susp_add_sid_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_computer_name.eql,sha256=x_v9E8G9uKvOMpnesfIvIqkD9f9MFl1-BG5m9FxZVKs,231
src/rules/windows__builtin__security__win_security_susp_computer_name.lucene,sha256=aeEjpCWuWuZ7vAmNtX7Uq7IlQL_OFxd16aBv7RVXdns,213
src/rules/windows__builtin__security__win_security_susp_computer_name.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_dsrm_password_change.eql,sha256=F5U1b7R6q-FQ3zRtltuRYi8cjlVXIjFdoIljYRE0wvE,58
src/rules/windows__builtin__security__win_security_susp_dsrm_password_change.lucene,sha256=s-oucHX6b0rU-P-SA-pCYqa-EFIbJpn0mkdV6nTznb8,44
src/rules/windows__builtin__security__win_security_susp_dsrm_password_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_failed_logon_reasons.eql,sha256=_EzOZ9MDuWH5ZUML7VC8mZ1EuQfUzXfzhTDXr-t6xEM,356
src/rules/windows__builtin__security__win_security_susp_failed_logon_reasons.lucene,sha256=ggJ5ENoYOl1EL1b9uPA7rXUpH0CUFLJCRAFeRuqdxPk,321
src/rules/windows__builtin__security__win_security_susp_failed_logon_reasons.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_group_policy_abuse_privilege_addition.eql,sha256=xEfswCYYCUHHjYTAyKdFQ6WT_r_sZKD89-2em8y-xQk,264
src/rules/windows__builtin__security__win_security_susp_group_policy_abuse_privilege_addition.lucene,sha256=V6uFsxIo4nFMsdzXKIdJOUTG43YjghafLfoIZpN45oA,248
src/rules/windows__builtin__security__win_security_susp_group_policy_abuse_privilege_addition.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_group_policy_startup_script_added_to_gpo.eql,sha256=UJgUerjk2NsADCNoYE8LGvW7vk1Kjg8WvkA52cR6C1Q,578
src/rules/windows__builtin__security__win_security_susp_group_policy_startup_script_added_to_gpo.lucene,sha256=bZTG1WuLJkThlLeDOKncJyMeAHTpW14hK1FR-geZWuw,540
src/rules/windows__builtin__security__win_security_susp_group_policy_startup_script_added_to_gpo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_kerberos_manipulation.eql,sha256=dXmgetaypCSE6gmdsq6f-30wLb6GHNNZSWf5cn_i6XQ,367
src/rules/windows__builtin__security__win_security_susp_kerberos_manipulation.lucene,sha256=mXhC4NpDYMU9JVdEbldcupXukP0iVA1PimwbGegoWd4,339
src/rules/windows__builtin__security__win_security_susp_kerberos_manipulation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_ldap_dataexchange.eql,sha256=_fHGbHdiW1ujuWAogPtPTfHYDx3X-L9U6iEpD9t0Ag0,246
src/rules/windows__builtin__security__win_security_susp_ldap_dataexchange.lucene,sha256=5aQUhh8aOc2Vq5236zHkSxz-ZJHkF6wM-2PsY--4yrI,222
src/rules/windows__builtin__security__win_security_susp_ldap_dataexchange.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_local_anon_logon_created.eql,sha256=RWRbgZsi88vrmVMGtNuSjdk6PNMh-Q9FEPOI8t0qaqk,160
src/rules/windows__builtin__security__win_security_susp_local_anon_logon_created.lucene,sha256=c7liLM7QRg5pm8kpyyvynxhcLeS4QoMMBsGHPQ5sKuk,142
src/rules/windows__builtin__security__win_security_susp_local_anon_logon_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_logon_explicit_credentials.eql,sha256=wIrEv2sJP9gTXPW-3qKgrVBb7qawNJZ6l3xS6LlMRik,339
src/rules/windows__builtin__security__win_security_susp_logon_explicit_credentials.lucene,sha256=AW-YflWky9N9w6uxuN1zYZ1rbXY3MW4MYVvxRw6o344,311
src/rules/windows__builtin__security__win_security_susp_logon_explicit_credentials.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_lsass_dump.eql,sha256=a8RpbTjAWgiEfmLekfFXSJuYElAsSVtv5et1UJUGwjY,185
src/rules/windows__builtin__security__win_security_susp_lsass_dump.lucene,sha256=CpUFyRwToTN_NwG9kYDyfXJFD8Go-JvKqZos6g62xI0,165
src/rules/windows__builtin__security__win_security_susp_lsass_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_lsass_dump_generic.eql,sha256=Qf7lqaqR-H8vvEWd5dh4M-lCxRD4oxyL3rqFVyuGldc,2362
src/rules/windows__builtin__security__win_security_susp_lsass_dump_generic.lucene,sha256=qEHTPnbZEYSI9NnNm8z5m_IDwUhjllg5ptVoa_QA19E,2271
src/rules/windows__builtin__security__win_security_susp_lsass_dump_generic.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_net_recon_activity.eql,sha256=AM06DVSp0LFC7zcwaSYiUiQmI8BIH_2txPpxgglYSgg,273
src/rules/windows__builtin__security__win_security_susp_net_recon_activity.lucene,sha256=Houyd96MAZXtBf_V6TokjdEq_o5oqDCt5nlCFdBzVlw,245
src/rules/windows__builtin__security__win_security_susp_net_recon_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip.eql,sha256=p0yl-id8WP_iNLOapCmxsLzUJcKOjr8N3UWiu8Zj9WI,229
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip.lucene,sha256=NgXGwjc-8LjIua6V7WP3BUh_QmX0-7MB4TwvTHuldaA,214
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_filename.eql,sha256=nK4RLbz4P5JMt3TZoEhbE0Rc8TAm9wnGFYTfUmc3zz8,291
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_filename.lucene,sha256=EXdfKRpreCbEFY9Al6_jUAbCRnUmvjKAfVBZUklDD_A,269
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_filename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_outlook.eql,sha256=fnKBQaWutoj2XYSas9Re69nkFoEwUVlXy_EEz-3tSG8,223
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_outlook.lucene,sha256=DYKLV1nOiu83sqn7ibgpo1ADxv8Sfv3qCQ6o2OJd0s0,208
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_outlook.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_outbound_kerberos_connection.eql,sha256=2L1gpVJLtvlbLyaxIDA3KRhocAZsTJzwJIv-l0jPnJk,716
src/rules/windows__builtin__security__win_security_susp_outbound_kerberos_connection.lucene,sha256=6hxaibi_tW0raax9raoZi9upKlN5tex748yuZ3feaYk,673
src/rules/windows__builtin__security__win_security_susp_outbound_kerberos_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_possible_shadow_credentials_added.eql,sha256=yg_6S7SwbTO8foSiD51ZObtYls4tPdb2zv0yHa4Af8Q,132
src/rules/windows__builtin__security__win_security_susp_possible_shadow_credentials_added.lucene,sha256=4CfJ9hOYcgKmi1uuwgLART8FvQihXxmHzc8cqqc8vtc,117
src/rules/windows__builtin__security__win_security_susp_possible_shadow_credentials_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_psexec.eql,sha256=1BT5te0dMbAsKfvWX03Cfv5G5PYR_C7E8rYmCoAzmW0,252
src/rules/windows__builtin__security__win_security_susp_psexec.lucene,sha256=1ob4LH_Nw6cI427ZpsAK1unVPK03LtNhpVQyxCMAKA8,228
src/rules/windows__builtin__security__win_security_susp_psexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_raccess_sensitive_fext.eql,sha256=wYYNSN5mERVV1ku2VNbyOYwDtLN7PRQTMsNLDdFexok,211
src/rules/windows__builtin__security__win_security_susp_raccess_sensitive_fext.lucene,sha256=c3F3cT0LXSHu1hW4oprBVHurLoncfYqIeIpFiI6CbRg,189
src/rules/windows__builtin__security__win_security_susp_raccess_sensitive_fext.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_rc4_kerberos.eql,sha256=5XYaTaxzTOnPfIUwvLWvLLxJjruWesu0pqi01dckBzo,189
src/rules/windows__builtin__security__win_security_susp_rc4_kerberos.lucene,sha256=oa9ixjMtH3Ewtcv5hiaiu6xQT5cd-focFZwpuyzQFsk,169
src/rules/windows__builtin__security__win_security_susp_rc4_kerberos.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_scheduled_task_creation.eql,sha256=U-_A3MVl8EJaTCORJWqQx0SaPTHrp8hiEIBXKwaWtUM,698
src/rules/windows__builtin__security__win_security_susp_scheduled_task_creation.lucene,sha256=vFTbmoCvLJBIQZZN2jOuf57ae5EIZtUgWIHOe-YPVSs,683
src/rules/windows__builtin__security__win_security_susp_scheduled_task_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_scheduled_task_delete_or_disable.eql,sha256=h_WN8TZnOqgbwi7tjDfEzPQKt69cd4NMnwNyk8ytgrs,467
src/rules/windows__builtin__security__win_security_susp_scheduled_task_delete_or_disable.lucene,sha256=__UWxGx5ch78IrN368leukypQcQ5zShLEA_S6iiE7JE,431
src/rules/windows__builtin__security__win_security_susp_scheduled_task_delete_or_disable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_scheduled_task_update.eql,sha256=zMJu59bFcdu1ZXTngn19IIGGIF9k03TxKv-SftXZiHo,704
src/rules/windows__builtin__security__win_security_susp_scheduled_task_update.lucene,sha256=4neyexb8aiKn2PVInnBj6mD4sx_yvikR3Go6cvsBfLo,689
src/rules/windows__builtin__security__win_security_susp_scheduled_task_update.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_time_modification.eql,sha256=B3GrptfuPXQveo9XpCW2aU9nQM0OpwXfHyWD9tJzeCk,394
src/rules/windows__builtin__security__win_security_susp_time_modification.lucene,sha256=qUtGcZaciPw_ZYf37R_OS97zRQHb6Vc03qJE8WDEP3E,383
src/rules/windows__builtin__security__win_security_susp_time_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_svcctl_remote_service.eql,sha256=yFgfSGWIF4Xuu5RMr45g8jJ2b9KLJtYqhRDv_lxN-08,203
src/rules/windows__builtin__security__win_security_svcctl_remote_service.lucene,sha256=7cDxdrwmJvNqbNx40D7nJLFNTLHtaxd8UoF0dU1jkxg,182
src/rules/windows__builtin__security__win_security_svcctl_remote_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_syskey_registry_access.eql,sha256=FdwMrrDpbQqT_sJgOGF-dAY0lH99mc3lVt2X3G76NJ0,213
src/rules/windows__builtin__security__win_security_syskey_registry_access.lucene,sha256=WVG6fVrLrDUYcb1bqCZ-ihyd2gMgY3ycf1QxKEmnXrY,183
src/rules/windows__builtin__security__win_security_syskey_registry_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_sysmon_channel_reference_deletion.eql,sha256=r-PlcuwdoYtF-EPpzREO83-1C4ovoyHRQ1S2nejqMwY,543
src/rules/windows__builtin__security__win_security_sysmon_channel_reference_deletion.lucene,sha256=kTrhs4qFYA438IJQ4QPibZQRJQXXPKgSTA2NMnTrLJw,523
src/rules/windows__builtin__security__win_security_sysmon_channel_reference_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_tap_driver_installation.eql,sha256=FMCXPhgKa66EBF5HdJQ2A9XSzbCcWIFdd7I0PhF9I7g,110
src/rules/windows__builtin__security__win_security_tap_driver_installation.lucene,sha256=2FDNZgsImKSOGdDFyVa55I9tAzsxv0CotrhIRmuGkxs,94
src/rules/windows__builtin__security__win_security_tap_driver_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_teams_suspicious_objectaccess.eql,sha256=O5eF62cWlvw-wnoyaBgvBFpqpXiZNqZHQ1zmIi8quPo,257
src/rules/windows__builtin__security__win_security_teams_suspicious_objectaccess.lucene,sha256=AhYz0KXBK1mzryR_vGQmoI5RHBeVEDZnml2ZiU6iuqM,234
src/rules/windows__builtin__security__win_security_teams_suspicious_objectaccess.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_transf_files_with_cred_data_via_network_shares.eql,sha256=on1lAlBQY8L0aQIq8MmsKnr7dI7jbCsoYgtBLQjsz7I,384
src/rules/windows__builtin__security__win_security_transf_files_with_cred_data_via_network_shares.lucene,sha256=9gcCfg52oED4jLnbwHfnmqqcmT4sW-vv2j3BheXUNmg,353
src/rules/windows__builtin__security__win_security_transf_files_with_cred_data_via_network_shares.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_added_to_local_administrators.eql,sha256=gTdjmgiyRlGlBY_zUpfOjU0l8kJASC_kjaU8XJKtaZ0,185
src/rules/windows__builtin__security__win_security_user_added_to_local_administrators.lucene,sha256=mqX8pW75uMCYqPmuzuPes_alAOileAoWqHB_fE7i6-c,169
src/rules/windows__builtin__security__win_security_user_added_to_local_administrators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.eql,sha256=94_tgx1bx-Qv5SBW5edIzTOaenC4BjRcTBM7AqNj82s,170
src/rules/windows__builtin__security__win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.lucene,sha256=hkstsWRx110O4rYdgBk0ATJWsnyjcRXg7xp4EIAARhY,154
src/rules/windows__builtin__security__win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_creation.eql,sha256=p1sJbl5d5xBEJvSdSZslu5R8CTUx5K7UcU0Xkmw2lSU,58
src/rules/windows__builtin__security__win_security_user_creation.lucene,sha256=NhSANO081shp3BrBim-S52tnhPN7HQneJeNdTrGW_Ug,44
src/rules/windows__builtin__security__win_security_user_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_driver_loaded.eql,sha256=HRHhG8NVzXRqlWOzeryqf2CGfqcbIY5-nX2UnFjMeCY,1002
src/rules/windows__builtin__security__win_security_user_driver_loaded.lucene,sha256=lJyHGijjErKqCgf2P-Uzr_PSH4a3ztmnQo_IKlXSf1g,974
src/rules/windows__builtin__security__win_security_user_driver_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_logoff.eql,sha256=uv2a25WT30STdKOyRI1zA5uBWqw4w_bMq4ajR0s_ukA,76
src/rules/windows__builtin__security__win_security_user_logoff.lucene,sha256=vT7DlpHoVgn2V2F8_9iXonTjJsmhRtGExbI-UuIpKAU,56
src/rules/windows__builtin__security__win_security_user_logoff.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_vssaudit_secevent_source_registration.eql,sha256=CJbwi4HzTbrWsJWDQ-UrH7y6lExy842foZxiTkMSaGE,127
src/rules/windows__builtin__security__win_security_vssaudit_secevent_source_registration.lucene,sha256=hu-f81V8ShoBk-31uEe8FwZqJcOkEE5fDSSiXIXWsKY,105
src/rules/windows__builtin__security__win_security_vssaudit_secevent_source_registration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_registry_modified.eql,sha256=w0sivMisuEAVhsgzHRzQhe3DBp5sxATcYnCywQ9jPU4,141
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_registry_modified.lucene,sha256=-EaRmeXLpxtDRbS3MUdCdBpbKLuji45Y1Y7V3bCW0UA,125
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_registry_modified.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_write_access.eql,sha256=YBP9ETEVKP7KnkSu0Bx3XZ2U3OzNwQXLFciTncn_hCM,225
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_write_access.lucene,sha256=TkUxYDBd3IZ5p2k_719X089Rp25MY8sloz8H-Nk7F40,195
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_write_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_wmi_persistence.eql,sha256=Dv1VhlnjnPotX8jPoSp7YONvezl7IDPmrPOLfULaaBU,159
src/rules/windows__builtin__security__win_security_wmi_persistence.lucene,sha256=OHbWD2F1L0Wy5QVkA4WCoUPJb1B5t-Ph3vJ1hZFwkA8,142
src/rules/windows__builtin__security__win_security_wmi_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_wmiprvse_wbemcomn_dll_hijack.eql,sha256=9jwV59ANaC7xAkKwJIh0PzuYQbOspihTliYRox7cTqc,152
src/rules/windows__builtin__security__win_security_wmiprvse_wbemcomn_dll_hijack.lucene,sha256=zTxD7GiyTv6wr3zoWOI4CHZ6rp0JGXBl29e1n1SgKrk,134
src/rules/windows__builtin__security__win_security_wmiprvse_wbemcomn_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_workstation_was_locked.eql,sha256=bi6PSU6oqJDIfg6j_4vts79kP0UT49HXHNJrAxvte3M,58
src/rules/windows__builtin__security__win_security_workstation_was_locked.lucene,sha256=UQE0SuGfjD4gpj0s9C6ZGcdegexA4bz4x1LFFHVzPzk,44
src/rules/windows__builtin__security__win_security_workstation_was_locked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security_mitigations__win_security_mitigations_defender_load_unsigned_dll.eql,sha256=MEFL-UD9fRST_sO-wqOcVfBnoifSa26Zs6GDyEyd8Xs,257
src/rules/windows__builtin__security_mitigations__win_security_mitigations_defender_load_unsigned_dll.lucene,sha256=Go194nEaaRgbr_2j1i7ApZFqm4C68UaKH1MGn3XGvZM,233
src/rules/windows__builtin__security_mitigations__win_security_mitigations_defender_load_unsigned_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security_mitigations__win_security_mitigations_unsigned_dll_from_susp_location.eql,sha256=QUOHF1QM3zSlJCgLfzEulo8KtnTW9qVEcxiInxjW61I,351
src/rules/windows__builtin__security_mitigations__win_security_mitigations_unsigned_dll_from_susp_location.lucene,sha256=_E907kQvdkS4N2acNBtAYRYDPLPqn_Oxm-zu6YlWksY,322
src/rules/windows__builtin__security_mitigations__win_security_mitigations_unsigned_dll_from_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__servicebus__win_hybridconnectionmgr_svc_running.eql,sha256=ULLEc4GgbR5vNavVDZ9CtgFZ6uyhEBy6_a7_ido7tDk,200
src/rules/windows__builtin__servicebus__win_hybridconnectionmgr_svc_running.lucene,sha256=1nnDBgHr9NgsnzApbUicYVY9zVL4pjv1pf_4OZ3zJ0U,185
src/rules/windows__builtin__servicebus__win_hybridconnectionmgr_svc_running.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__shell_core__win_shell_core_susp_packages_installed.eql,sha256=rfBitC3QmovYpetSd3hPiCaXoOhkHNd6mlwatcjzWY4,306
src/rules/windows__builtin__shell_core__win_shell_core_susp_packages_installed.lucene,sha256=canNwaVsJdokFgVV1wEpMGbbI1nTgUUaxmj-gnf1D_8,279
src/rules/windows__builtin__shell_core__win_shell_core_susp_packages_installed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__smbclient__security__win_smbclient_security_susp_failed_guest_logon.eql,sha256=hNlaaIqwGqbIl1kF4CBHpoR4b5rk0P6lvw0LvgScTNE,164
src/rules/windows__builtin__smbclient__security__win_smbclient_security_susp_failed_guest_logon.lucene,sha256=lUlAle_nZpO0MFsvIJRvv6akbHCvof0o9KgycYm-FCQ,150
src/rules/windows__builtin__smbclient__security__win_smbclient_security_susp_failed_guest_logon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__smbserver__connectivity__win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.eql,sha256=kqNpmcTwA-_dGeakr6NMdKcduPlNf0tpj_nsWzcyuxw,528
src/rules/windows__builtin__smbserver__connectivity__win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.lucene,sha256=uXZMrou8kZ3spnyGyBNmmvGH_gybXMrU9KVvE6Ww-NM,437
src/rules/windows__builtin__smbserver__connectivity__win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__application_popup__win_system_application_sysmon_crash.eql,sha256=vKmfjpjdUvBwStGfDQrhs-zh3dWOLIS34-vsBAPb2h8,210
src/rules/windows__builtin__system__application_popup__win_system_application_sysmon_crash.lucene,sha256=N3VUSSLroJiyAekw01w1O2azPFskr_xkxhXE8bOy4-k,195
src/rules/windows__builtin__system__application_popup__win_system_application_sysmon_crash.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__lsasrv__win_system_lsasrv_ntlmv1.eql,sha256=hJxdPuvWjOH1-xdK7XWDYnfTCs1Fi9FiKxThH3OjJyI,110
src/rules/windows__builtin__system__lsasrv__win_system_lsasrv_ntlmv1.lucene,sha256=IZOgQEqtqUhiC4XO8g-z9Dz4u20-Lxb9Wjd59oh1fgI,88
src/rules/windows__builtin__system__lsasrv__win_system_lsasrv_ntlmv1.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_Iphlpsvc__win_system_isatap_router_address_set.eql,sha256=P6Ju0hQppmtHrc0N06e5dXpAdcXf6kaorkOGMnxIYMQ,276
src/rules/windows__builtin__system__microsoft_windows_Iphlpsvc__win_system_isatap_router_address_set.lucene,sha256=6TC_Gqe9OFFsOZkKgFpJDlB0mUziHLIsGWVhcw46fos,259
src/rules/windows__builtin__system__microsoft_windows_Iphlpsvc__win_system_isatap_router_address_set.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_certification_authority__win_system_adcs_enrollment_request_denied.eql,sha256=-XhysLeU0nelxrERmtdoSGxUyfQhn3v6d_eLWiB-Ymo,124
src/rules/windows__builtin__system__microsoft_windows_certification_authority__win_system_adcs_enrollment_request_denied.lucene,sha256=Jmyfm0JebvYATxUaV8hW9z5wBy0HfVfVjcp1qj-7jTY,110
src/rules/windows__builtin__system__microsoft_windows_certification_authority__win_system_adcs_enrollment_request_denied.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config.eql,sha256=Yzznhul2xP2CCwnEpdGghIrPywLLicnXVZchfPn6qHo,115
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config.lucene,sha256=z8eBMWSdXoCKU945ZRd9RVQL84UmgEsT34DFut1KaKU,102
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config_failed.eql,sha256=S9UnXJQLb6d3WidOVKvvWOE2NT8FX-Mca8vvgBwKKpc,141
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config_failed.lucene,sha256=uLXDzIJZFa32gHxoGfAlaIM-cUf_MsI-YC1uRet39Sg,122
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_distributed_com__win_system_lpe_indicators_tabtip.eql,sha256=RO-wxjCysoUqZDx1pjCRpDXvogjwYK7lR31KXXPvRJA,329
src/rules/windows__builtin__system__microsoft_windows_distributed_com__win_system_lpe_indicators_tabtip.lucene,sha256=tYN0E13xExC5xItCEQd9mmUcrNTcNYrm-O2sivyoIk4,319
src/rules/windows__builtin__system__microsoft_windows_distributed_com__win_system_lpe_indicators_tabtip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_eventlog_cleared.eql,sha256=35e4bhYpko13m8j0pPaibLWF9qCz49PVNEXU6hftH-w,305
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_eventlog_cleared.lucene,sha256=hGkOqg7ZrO194g2yeBjLcsdiH3A9zJ8POth9Wgs8qOY,291
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_eventlog_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_susp_eventlog_cleared.eql,sha256=KoqVSFhCnqt3o6sYwcwBGI-FrxL_xvWzyxYy_MY8hHg,297
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_susp_eventlog_cleared.lucene,sha256=apLGVsLc1Zt2kLZ7wpoT7fqvMKE3KuWrMkTA3OtH39c,283
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_susp_eventlog_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_cert_use_no_strong_mapping.eql,sha256=bU8oC1BYgVlZPd1f9GX2G5Ig8OXCln9vxkDzNr_5rEc,196
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_cert_use_no_strong_mapping.lucene,sha256=UeH8Ebi0S25H7kCe5LKVxyyKF_CY84w-AdBg2PjxMX8,176
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_cert_use_no_strong_mapping.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_tgs_no_suitable_encryption_key_found.eql,sha256=5PMPQIa_scSW2mbdgJ9eqzUj4KDIpiYA7BJtzaoq2ek,196
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_tgs_no_suitable_encryption_key_found.lucene,sha256=WCSdltvF10Skf3E3R74i9cLBs1i8Ssv0uM9Tat0WM9M,176
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_tgs_no_suitable_encryption_key_found.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_kernel_general__win_system_susp_critical_hive_location_access_bits_cleared.eql,sha256=mccb6QwEVaYyfLBtd2GO8EguzHo2Oyolf1-ZlMti7P8,195
src/rules/windows__builtin__system__microsoft_windows_kernel_general__win_system_susp_critical_hive_location_access_bits_cleared.lucene,sha256=fK--iooxKgpwDZbtKr43_9G8Yqp-2zm859WOK4as1JE,174
src/rules/windows__builtin__system__microsoft_windows_kernel_general__win_system_susp_critical_hive_location_access_bits_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_ntfs__win_system_volume_shadow_copy_mount.eql,sha256=C95rMc4rshdDsKoo6U33ER6NxvpH_doXPt0CA1oTKQU,168
src/rules/windows__builtin__system__microsoft_windows_ntfs__win_system_volume_shadow_copy_mount.lucene,sha256=yy83JkrcKOqyq1HX5GcPJtP9JdiUqe_W1-39YGYPqQI,152
src/rules/windows__builtin__system__microsoft_windows_ntfs__win_system_volume_shadow_copy_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_wer_systemerrorreporting__win_system_crash_dump_created.eql,sha256=gu_JUUu3-32Qs8pk5v7gAjCWCvQKMW3sD2PwrMSPGO0,128
src/rules/windows__builtin__system__microsoft_windows_wer_systemerrorreporting__win_system_crash_dump_created.lucene,sha256=rFHhf8cwV2wrNh9J_HVZgTQoMsYGBUsc-mKOcAehGXg,115
src/rules/windows__builtin__system__microsoft_windows_wer_systemerrorreporting__win_system_crash_dump_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_windows_update_client__win_system_susp_system_update_error.eql,sha256=aIp7psRYE-GkQ_GwrFOekGrvIp9qfeTIE4lOPbvQDuI,157
src/rules/windows__builtin__system__microsoft_windows_windows_update_client__win_system_susp_system_update_error.lucene,sha256=oLLuV150eKdxW_wFBvXm-yNmCcsKzW7PYnvLSwA9Yfg,137
src/rules/windows__builtin__system__microsoft_windows_windows_update_client__win_system_susp_system_update_error.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__netlogon__win_system_possible_zerologon_exploitation_using_wellknown_tools.eql,sha256=R5IFgQ1XCHNddBBguXvEdQN6uelShWZUzlZo4GgRU6s,103
src/rules/windows__builtin__system__netlogon__win_system_possible_zerologon_exploitation_using_wellknown_tools.lucene,sha256=sfvGOJRMCiyCqXysibibClYe1287VfKDJCzW69yA-ck,83
src/rules/windows__builtin__system__netlogon__win_system_possible_zerologon_exploitation_using_wellknown_tools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__netlogon__win_system_vul_cve_2020_1472.eql,sha256=ugl8dtUqXAwxL8BHQucugA_L8VmEZX0xa-gnhtlKuSk,94
src/rules/windows__builtin__system__netlogon__win_system_vul_cve_2020_1472.lucene,sha256=wYBus03B0CnDWDAiclrh0Inxy4uZ9cJjmWHwg3YBPcs,78
src/rules/windows__builtin__system__netlogon__win_system_vul_cve_2020_1472.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__ntfs__win_system_ntfs_vuln_exploit.eql,sha256=OLPt__Ab5842Lerb2kCOiSoN11xl66x9XcjCMNr3DMM,280
src/rules/windows__builtin__system__ntfs__win_system_ntfs_vuln_exploit.lucene,sha256=Q_gb0PrhPxa-MuYUGonYOW3sKn9aHj4auPB2HG2m4TI,270
src/rules/windows__builtin__system__ntfs__win_system_ntfs_vuln_exploit.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_cobaltstrike_service_installs.eql,sha256=6A9KzWAHK_x0H2mrrf83jQWDYugas4CPlM8MWewzg90,722
src/rules/windows__builtin__system__service_control_manager__win_system_cobaltstrike_service_installs.lucene,sha256=eaCgV94fI2iLUOmfOcLAXjEKL5_6XCirZMLRpt6axtw,695
src/rules/windows__builtin__system__service_control_manager__win_system_cobaltstrike_service_installs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_defender_disabled.eql,sha256=TA8HStGEytW5S9hQ4qHWJixEu3Q0hOiyBfj5ygq1dO8,286
src/rules/windows__builtin__system__service_control_manager__win_system_defender_disabled.lucene,sha256=LZAyqCswcReybyOcnv7RK9ly2vFZ-f8Ns2uIelsY7rg,262
src/rules/windows__builtin__system__service_control_manager__win_system_defender_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_hack_smbexec.eql,sha256=sG8JRv8WxCpKUc-r-6IpjULOKTWym3IXPg4jImFnJ54,236
src/rules/windows__builtin__system__service_control_manager__win_system_hack_smbexec.lucene,sha256=FXPkIhFHizduOfbN57wzPKCebtlaHVtvn7yBkXAEA2U,223
src/rules/windows__builtin__system__service_control_manager__win_system_hack_smbexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_clip_services.eql,sha256=G0FiNyzLw0-8k2n3bga7GQTkeiWzISYnG_m_Y6uSRu4,239
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_clip_services.lucene,sha256=53G9rabFVtILZKcEevVq2ScFJ4iFTizk95VDPz5d_5c,224
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_clip_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_obfuscated_iex_services.eql,sha256=-u1L7GmKLHplyAL95TAe0VW66t1A04rbzwcM8ZS7pLQ,454
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_obfuscated_iex_services.lucene,sha256=vWtqbNqhk-fQ0nAb-uC3u7kAkVcMpuZYAFGwmy5rlxU,1722
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_obfuscated_iex_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_stdin_services.eql,sha256=0Gxf0JLtdhZrZMudBuniauQmg9Up29PH5l1LAMdT0Ck,383
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_stdin_services.lucene,sha256=stZTwD8XB8X9pBLDDui5SNVM_gBZrcBLU7ZpMBV8sWU,353
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_stdin_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_var_services.eql,sha256=fTcvB1HkzIlAGClSkhAl06viGJ549xVvwy2Y4LRN9fk,289
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_var_services.lucene,sha256=wfSwAIZ_ovUjh9g3-apc2ieXxVJUXkM6UPmONx-RM38,264
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_var_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_compress_services.eql,sha256=A9Y8OHtAYvn_FPTvzHwBOwCUFYHYrSnpADsBfwAwCbo,373
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_compress_services.lucene,sha256=1-wSzY773CX5oYewTDRKQNcti1UQ1b8j6gG_OygDK8Q,350
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_compress_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_rundll_services.eql,sha256=6ibr4b80nOr21tmWojSG7TjPxuCfXnK9q-SNhaT0iO8,308
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_rundll_services.lucene,sha256=foemRUYRBPe5wjlG52p01apmcNFSrMTXKRxo85RvfoI,286
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_rundll_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_stdin_services.eql,sha256=9YZLpAOWeouojtpSpL2ijKl4fNPwKyaQ6fIlIw15T4Y,271
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_stdin_services.lucene,sha256=IBQMMM3I4R9FQA0bDDfcY5ysU7gPrufGvfcXEoooZxs,247
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_stdin_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_clip_services.eql,sha256=Or9cDG1pK5ZwpCi0HYJq1Nx94xVI-wWmu4kcIDhh-3w,158
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_clip_services.lucene,sha256=eBBbWL3Uykl5BWpfQuMXPayPy61JxgTd95E_UVgR9fc,144
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_clip_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_mshta_services.eql,sha256=a0MN961V4QRgto5xKUQArmfwCcE_zhQcd6bezzZxgRA,211
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_mshta_services.lucene,sha256=rDZA1AwTyNPefQpswd3us8SjcWI5wDe3Mzib8DXaANk,194
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_mshta_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_rundll32_services.eql,sha256=LRjAJd03Rie_FoizfMUJdqB-yFmV6ApVYc7DiQyLTqU,382
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_rundll32_services.lucene,sha256=ALJNhQw__jRgggUyholujGlHFaHMYUQeqx1c0abENPo,354
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_rundll32_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_var_services.eql,sha256=3UC_mYmFDnkB3W0qm04Ha5mxKGjYG1X_BnlpgZ0vWvY,366
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_var_services.lucene,sha256=5aLZd9-tGG_LaBS24eOsvgV65jE1J7IIIFQruUye6DU,352
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_var_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_krbrelayup_service_installation.eql,sha256=SWBMdDpkgjOpBK8PzCfXf6ysgCvUuJ3yWazzrGCAAdI,101
src/rules/windows__builtin__system__service_control_manager__win_system_krbrelayup_service_installation.lucene,sha256=aMXpCCu-uHLNPWiivAYACNWMvrS5ulkD6OVTSy2ic28,85
src/rules/windows__builtin__system__service_control_manager__win_system_krbrelayup_service_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_mal_creddumper.eql,sha256=u75w44Sqdf4J6EIwaeOt6ACi9OzpDFbqnfYsSMNcj4Y,241
src/rules/windows__builtin__system__service_control_manager__win_system_mal_creddumper.lucene,sha256=hPuAEsvCe_aCqskXrOcPG0qOQ0rO2dKaMN41Qx-n2DY,219
src/rules/windows__builtin__system__service_control_manager__win_system_mal_creddumper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.eql,sha256=KOqlEmoWJRwAOFj_viFMaBWQn9R9KL7IxaifBg4Zri0,492
src/rules/windows__builtin__system__service_control_manager__win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.lucene,sha256=I3QGS3lhmhaltYrxMTr7mG_IAYBo2ItyeJ_E89WPlB0,457
src/rules/windows__builtin__system__service_control_manager__win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_moriya_rootkit.eql,sha256=Bn9Oul9Ax50ypyV4Tj5C_gIzytA7Cytf2kCYCS_Vrok,154
src/rules/windows__builtin__system__service_control_manager__win_system_moriya_rootkit.lucene,sha256=0jJtrSJAEDp0SE8AUDymq0Q6_LZN_wAX1p0-hGZzCus,138
src/rules/windows__builtin__system__service_control_manager__win_system_moriya_rootkit.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_powershell_script_installed_as_service.eql,sha256=t1uOml9qJ0L6hD7t1JF3C9h74R2hIzTlWR0oW6AHIHw,176
src/rules/windows__builtin__system__service_control_manager__win_system_powershell_script_installed_as_service.lucene,sha256=blDWXsv8secIoW3HFukoBuW2fpzdvGmuvZfilef4Pr0,154
src/rules/windows__builtin__system__service_control_manager__win_system_powershell_script_installed_as_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_anydesk.eql,sha256=yQwM0OM9tSV8vnUzVRo9p0ZAvx-C6Ig2iTdASiPfzao,250
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_anydesk.lucene,sha256=NkEGli9lxQT6ypniToywhT4CqxmV0Bp9AXfxqJukh5U,230
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_anydesk.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_csexecsvc.eql,sha256=FF21j9isI96sL0pIVM2lr4TwCX-QInTbvoYlK2GsFy8,209
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_csexecsvc.lucene,sha256=Lxb6L85LM5fd1dyjhPrGF2qzhGtR3Ml_qqeUD11z5K4,191
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_csexecsvc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_hacktools.eql,sha256=FG85NcdPJAlvGHwa6UeS9q5NYYifU82NW3S6625YMCY,342
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_hacktools.lucene,sha256=eBQpQq2xVLhxVmWflH4W5g5C17p30eeYge3Ws7fQR80,313
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_hacktools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_mesh_agent.eql,sha256=drC1ZcXc1DKgVACpOBFQ22InlpTlk4vXzmWghnYYYsA,211
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_mesh_agent.lucene,sha256=4lhMLnaFwHJ9AcuakwGUQGgBH5rwOOtSidrFzHNRies,194
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_mesh_agent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_netsupport_manager.eql,sha256=Y44kUJ85eRMf-m47Uim_KK6L5gxpSKRMyZT67Yw1qZ0,228
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_netsupport_manager.lucene,sha256=P0GGu-mzeiW-1dv1krYnW6sAi36XXxkluXkm3NUb2us,211
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_netsupport_manager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_paexec.eql,sha256=FsakYG7H2RUEkBDIeW6JdNccadt77eyGYloUUUSkb0I,213
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_paexec.lucene,sha256=8TIOU6_Nq4mtWifqpjpNMQvPQB9C1du73iQlIYEipQM,198
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_paexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy.eql,sha256=4GvqHuszEgLA_aMWwz2n3KADqwQPRxfMKaf6xaVkk6I,239
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy.lucene,sha256=IFYZ5J4tLIn5o2EGQCAfy2GnA3aXIUPI7ecuNSxrew8,216
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy_runner.eql,sha256=SPV4rqNLR65UZ8v2QjL084T6L_aRpFrvxsyc0o5iWEI,219
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy_runner.lucene,sha256=NSou0XMNm9X5K8i7JfUhK_WwRsJX9IAxfXd25Z_8kCM,203
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy_runner.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pua_proceshacker.eql,sha256=4wmTZAysogSjQeUvHZhxqporCORELO0AnvIAfOJDIo4,188
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pua_proceshacker.lucene,sha256=AgSL-xKVP6xOuuoLFvv5J6MqCV95tiqu4rMHpUNfQno,170
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pua_proceshacker.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remcom.eql,sha256=tKGeWq3f9HTZiE75SjgQqrxCDfL_XnPzD09R3OV43nc,209
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remcom.lucene,sha256=02z6RUpC1WhSPaEifqbm53vwKV-Ks5cvWN8gK0SLp_s,191
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remcom.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_access_software.eql,sha256=r4YVk5CpuNWafO-iQcDlMriHuzotawENxy8vzjb5yJI,551
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_access_software.lucene,sha256=D8e_si1H6oLrXTosV9qBg__L6eppoXH4SHFpgObRQAw,523
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_access_software.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_utilities.eql,sha256=tlxqDxWEu8HvtjbSP5rfL7K9OjQHtWHQ11cuLgeeKGY,269
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_utilities.lucene,sha256=sNJrAmrZYHTT4xwYwqe-dbvWK5z3B-oJa-2SlwjHHb4,254
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_utilities.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sliver.eql,sha256=6AkHrSe4_QLLwriryeQR0pzp_xD5UK3k6a0rZgD_i-0,279
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sliver.lucene,sha256=GEFEYPhlqn_5sZbqKK3pNrBE6qxXqXo39UbS3di8iw4,334
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sliver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sups_unusal_client.eql,sha256=b1YwHcwdlezwP-6yLQmRgchPPEHKRlOloOUmxwAbS3I,127
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sups_unusal_client.lucene,sha256=vZZF1vBufKtVyFmYrLsAc2VgbvIROIjO50Oz9GASE7A,113
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sups_unusal_client.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_susp.eql,sha256=v4tr8mj_S9KqeXVuyKl27-cnfjFvR-BEpH-dP1niVZA,290
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_susp.lucene,sha256=zjDiFwk72RzdwHpdzWxY3KBkNgsBJnpPyJgDEFxnWdE,280
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_susp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sysinternals_psexec.eql,sha256=Ncqm3POgKPWKwnCg9OK0zf3MUUOkKSr_I4lRFCeMp1o,207
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sysinternals_psexec.lucene,sha256=EZ_AcNL7nNMLDbhQRjQ-rAAbvOTj27YnVdP3kNfmMSM,189
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sysinternals_psexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tacticalrmm.eql,sha256=8DmjK9iF5-d_NRovaQZsn4N6aEdNUwjTwISQP3d4bWA,228
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tacticalrmm.lucene,sha256=ZSJFkWQPs65qzv-WPnzNc2QvaE1YX427a92M6WlxnJQ,212
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tacticalrmm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tap_driver.eql,sha256=icuYZ2K1_TJuTHr8Bj3M9-HKkV_K1SFDtNIrJD-Aa1g,153
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tap_driver.lucene,sha256=TZ4n92tqJG6mf-sfLJwqP8Z9NbRCM9ycMObzk8yHBkQ,137
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tap_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_uncommon.eql,sha256=deGrMzrTqTgnOQJlWl7gI1-weTnrR5tvm7fCeQSuUT4,575
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_uncommon.lucene,sha256=HtIFSON7AR2kum4LatZn4mWym4mNj6r8HDsvLGFhGkw,550
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_generic.eql,sha256=fJwUw0gZ2bfp4L2gyvfKgENjepb8KFIfnLrAJaHCAFc,109
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_generic.lucene,sha256=6INOs-cGbK_xgP_1bq6D3pn8YIoEmTaNrImaDUSPH_4,95
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_generic.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_important.eql,sha256=wBVQ20INGE8oxbRg5UKQCB5xe0syF6f-PhW1hGl2pPk,564
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_important.lucene,sha256=D9cd70oX6taPcHkk-bDqc1TbGRA_Yb29YLVvwT7ENxw,546
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_important.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_unexpectedly.eql,sha256=uC33tRBiGr1Cx-EioyngkR1HIoeEzkHfYkgR29YlUb0,243
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_unexpectedly.lucene,sha256=zEm-l4OCSQwoF54lkTTY5ZaDusDu8-FC0snEbclAGT0,220
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_unexpectedly.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_susp_rtcore64_service_install.eql,sha256=mTFAG9KV7cdFPGa-nba22uh_7ObpuDwwbgTS-A4WkCw,154
src/rules/windows__builtin__system__service_control_manager__win_system_susp_rtcore64_service_install.lucene,sha256=IW2hHn8ArkscZJzLDSgp9C_Z9y_ACv6lwHdkBJVYjaA,138
src/rules/windows__builtin__system__service_control_manager__win_system_susp_rtcore64_service_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder.eql,sha256=rhPCfBdafz-eat4VN9LYQqSsc5AuqcNd0ojPPotefvE,366
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder.lucene,sha256=DnssAG_D_l2O3aSu2rXfz9muo1kL9eYZ7iMlCyZEl10,344
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder_pattern.eql,sha256=ZJVGTmQc-AYtiRAgBQAw_MONt2YJKP1DvXoJGdkwLwg,226
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder_pattern.lucene,sha256=2TKgdPELM5XXRQiUY1TiIrZY_ZXmC7b8wzptNHF5Zks,363
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_script.eql,sha256=0kouBygooFXDss3y652BIywNHZOwzR3tcdOwQBAD-1Y,528
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_script.lucene,sha256=67YLGYrN2gz3fjDEzUi_JWV4MKVtys4nZKjbctmjZR4,518
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__taskscheduler__win_taskscheduler_execution_from_susp_locations.eql,sha256=TEkVi1F07EskPeUBcK_gWyJGpoBVbPo3uLy5OC0YojY,260
src/rules/windows__builtin__taskscheduler__win_taskscheduler_execution_from_susp_locations.lucene,sha256=fp6VFQ4QVQE4Z0XvNE69rtWhXXCabKU01KIlMX0jgPQ,237
src/rules/windows__builtin__taskscheduler__win_taskscheduler_execution_from_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__taskscheduler__win_taskscheduler_lolbin_execution_via_task_scheduler.eql,sha256=Cuzv0kl5NXgO7AtOcGVqkcH2sEvS48D0yL5b5XFI8XQ,252
src/rules/windows__builtin__taskscheduler__win_taskscheduler_lolbin_execution_via_task_scheduler.lucene,sha256=50aX103n7dndMxnjO1eomfCfoIUkKe0AmeiV51F-NDw,233
src/rules/windows__builtin__taskscheduler__win_taskscheduler_lolbin_execution_via_task_scheduler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__taskscheduler__win_taskscheduler_susp_schtasks_delete.eql,sha256=m-iNYUWS_P_VcXdaa8qHQBA4XDMSTlpiRvTvKpB9nvY,432
src/rules/windows__builtin__taskscheduler__win_taskscheduler_susp_schtasks_delete.lucene,sha256=k1n-q9cqmGqOpiur986ggYuCe0RbwwXAXusUwb7sun8,402
src/rules/windows__builtin__taskscheduler__win_taskscheduler_susp_schtasks_delete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__terminalservices__win_terminalservices_rdp_ngrok.eql,sha256=7snTk-bWYSwV5JGXnEL99tohIOEh7Enlmzn9dKp8ddk,159
src/rules/windows__builtin__terminalservices__win_terminalservices_rdp_ngrok.lucene,sha256=92K7Yo2yTCQsBLaemOej1F4dPQ1p2mbPU1yW6EQBGxg,147
src/rules/windows__builtin__terminalservices__win_terminalservices_rdp_ngrok.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__win_alert_mimikatz_keywords.eql,sha256=RPed9oRIFsCQZPCIJVEClT55YkLE1rne4Ho7-VjmE00,436
src/rules/windows__builtin__win_alert_mimikatz_keywords.lucene,sha256=bKnTxI_JwMpGs0HTze1AiOjxU8NF20bIfzEp7pCS5Tg,456
src/rules/windows__builtin__win_alert_mimikatz_keywords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_antimalware_platform_expired.eql,sha256=fIfeOgTLjSn_EPOZZjLtS_lCbFXPsCL1MM-Tev0yE8c,96
src/rules/windows__builtin__windefend__win_defender_antimalware_platform_expired.lucene,sha256=Cs1micS2jF7nkp9sAikCtpD6PZAqgXoRFxmJqPQnHjo,86
src/rules/windows__builtin__windefend__win_defender_antimalware_platform_expired.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_asr_lsass_access.eql,sha256=Nb8PTjvLNyLWhmMmSBucedxOV8yztx2J0rJ87IvLcz8,783
src/rules/windows__builtin__windefend__win_defender_asr_lsass_access.lucene,sha256=--B3rll1VgDjnAsY_BmZJiY7xkaRlc9M2HH49eEkQVU,759
src/rules/windows__builtin__windefend__win_defender_asr_lsass_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_asr_psexec_wmi.eql,sha256=wo6bnUMLLlJXPgaxKBlHRYluFkE4WdRdkaCfvxCIqVY,168
src/rules/windows__builtin__windefend__win_defender_asr_psexec_wmi.lucene,sha256=eXIzeYjrRQq6jwMmnLSnTSXcIpnyYugJ-4iNslw-Lww,150
src/rules/windows__builtin__windefend__win_defender_asr_psexec_wmi.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_config_change_exclusion_added.eql,sha256=W8wBP95tpgMKyrFhgIozf5UTyP-0aFVt9kXTT1eqUU0,175
src/rules/windows__builtin__windefend__win_defender_config_change_exclusion_added.lucene,sha256=_qJ-dP3T5IzfSMVLLAR_dJ3W0DZbX9Et0upLUb3NJQc,164
src/rules/windows__builtin__windefend__win_defender_config_change_exclusion_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_config_change_exploit_guard_tamper.eql,sha256=XOXT60g7Otpse4bhcPFDB2cjw-GoiysU6FmwaW4se8Y,543
src/rules/windows__builtin__windefend__win_defender_config_change_exploit_guard_tamper.lucene,sha256=CbzbZjNwY5ms_GpWjbD_gyGVSE_arXdmoOc8d4NO5Bo,524
src/rules/windows__builtin__windefend__win_defender_config_change_exploit_guard_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_config_change_sample_submission_consent.eql,sha256=RSYxVcb-_R2T6HTwAdKmmUVIFf6PM5awYs0mTVgf8y8,184
src/rules/windows__builtin__windefend__win_defender_config_change_sample_submission_consent.lucene,sha256=5FYn1-oDsA4eKnp77Mv3bHkaCtPc1XBkquNCJB1GDYk,177
src/rules/windows__builtin__windefend__win_defender_config_change_sample_submission_consent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_history_delete.eql,sha256=fQWzWZgE7lAgJt3PtewRepFCXn0AZwTyNDBqfmnqS1c,96
src/rules/windows__builtin__windefend__win_defender_history_delete.lucene,sha256=UJBrtW1AZWxd7gBSzkw9blsWc1RPWuEvhw-qm4zo-HU,86
src/rules/windows__builtin__windefend__win_defender_history_delete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_malware_and_pua_scan_disabled.eql,sha256=uKBSNeVmvBo4vLsba2JGz8y0PlSkvabyuj9zBTt7-VA,96
src/rules/windows__builtin__windefend__win_defender_malware_and_pua_scan_disabled.lucene,sha256=lE6A6dfcAWd7xMn4cSI35GXfIzlCyPmjBaBbdRAHcS8,86
src/rules/windows__builtin__windefend__win_defender_malware_and_pua_scan_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_malware_detected_amsi_source.eql,sha256=35IP_1cTt1wGD61ubSXlD40H_MBXNNG0lIQSYpwGb9I,138
src/rules/windows__builtin__windefend__win_defender_malware_detected_amsi_source.lucene,sha256=97ADfdv3DQNq2gw_W2v4Cdq-nOmQgZNxWKgivK0ApJw,126
src/rules/windows__builtin__windefend__win_defender_malware_detected_amsi_source.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_real_time_protection_disabled.eql,sha256=7zNAJc4iJZ_A-PAjn9eEIKR5AVv-8UIMbGoxLelxsRY,96
src/rules/windows__builtin__windefend__win_defender_real_time_protection_disabled.lucene,sha256=pfhBTTb6Ays5hhHB5JTWBUn-ixjuJw10yrSHbCEvalM,86
src/rules/windows__builtin__windefend__win_defender_real_time_protection_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_real_time_protection_errors.eql,sha256=0WhebMl1FwW4QKHKw9Ua6cbi66rvyM758p9nLjwP3yY,223
src/rules/windows__builtin__windefend__win_defender_real_time_protection_errors.lucene,sha256=HhGmpfpccbw-ey-PYxSuy5Xmg2pLvN6klTLydADZtUI,197
src/rules/windows__builtin__windefend__win_defender_real_time_protection_errors.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_restored_quarantine_file.eql,sha256=cA13f_0qV6FSLtQ8-RRizeO8HiIMjfNka0Vsc9c8uLk,96
src/rules/windows__builtin__windefend__win_defender_restored_quarantine_file.lucene,sha256=7tFPiwW8xmYuyZaLtFqt5_G5MJU241WEcU4RBu4lLzI,86
src/rules/windows__builtin__windefend__win_defender_restored_quarantine_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_suspicious_features_tampering.eql,sha256=h9wBV0NZrTQBXKX0_4YxYfR6vHjI8EC7aifbHR09Y-E,427
src/rules/windows__builtin__windefend__win_defender_suspicious_features_tampering.lucene,sha256=Q3cY4vLgxEEXjvKn4OiLcURjJWPz0dkvrqnWvhcLOoo,420
src/rules/windows__builtin__windefend__win_defender_suspicious_features_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_tamper_protection_trigger.eql,sha256=1cuuJA5ggW3N_QihiGbuyQ-jGba7tc7RvVcjEgI8U14,538
src/rules/windows__builtin__windefend__win_defender_tamper_protection_trigger.lucene,sha256=XQjeZdyFRC1sTS9fWJh0DSE3dlWMWaOQcNQfT5-16ms,532
src/rules/windows__builtin__windefend__win_defender_tamper_protection_trigger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_threat.eql,sha256=IVbimNly8j6DC9Gep8ZQEyjrgoPFdrPAtV4xKQqrixg,130
src/rules/windows__builtin__windefend__win_defender_threat.lucene,sha256=65yx3IbDf8SMzL3vfchLQvw2EACMJbSxefZ37V6bCoo,114
src/rules/windows__builtin__windefend__win_defender_threat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_virus_scan_disabled.eql,sha256=ztO0f_Mf0hofrotoQaA4IB_hM6CTcSun5crk4tNrb2g,96
src/rules/windows__builtin__windefend__win_defender_virus_scan_disabled.lucene,sha256=FYUsXZbqlfbd3qrMi8uOKepvzwK7H_xqIM-a3aSDwUU,86
src/rules/windows__builtin__windefend__win_defender_virus_scan_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__wmi__win_wmi_persistence.eql,sha256=Jaj6J5PGxlHb_XO09WOUY47VDGaptyWsPy3EQfdOAL8,411
src/rules/windows__builtin__wmi__win_wmi_persistence.lucene,sha256=TKlO3-Vk_Cz4-Q-pJQhvHzOzQAcviKja_8H620wmYpc,400
src/rules/windows__builtin__wmi__win_wmi_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cactustorch.eql,sha256=BcAyyk-NcGsux31QbJk67Ws3RyODjWyp-7dLHksNBgY,290
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cactustorch.lucene,sha256=1kcLPG1lGQ0fyanO0xpQvAWmjaRH3ye4BQ0lrW4eT3M,272
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cactustorch.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cobaltstrike.eql,sha256=IouUAY2B6Jv_BnMu1937NaKOMm6Z0XgIeml_A1G4NAI,75
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cobaltstrike.lucene,sha256=GhMEo28T-MyA7SFpMBxJbN1psSI46nEdYIyHbaRpIMY,57
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cobaltstrike.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_keepass.eql,sha256=DvpReYxrq10Z242p5PXjgs4GJtNSO2y_Y7si_Cbmj34,57
src/rules/windows__create_remote_thread__create_remote_thread_win_keepass.lucene,sha256=j5wSevqMey0Udjnm_vD4IAM7VkRhyUTMIN6uim0K1Ps,45
src/rules/windows__create_remote_thread__create_remote_thread_win_keepass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_mstsc_susp_location.eql,sha256=sIB6_FVrUB-3anm3nLbTRgQ3ySsT6UP3_vpWX4pGquA,233
src/rules/windows__create_remote_thread__create_remote_thread_win_mstsc_susp_location.lucene,sha256=Lbt-oajTpn1VuWIsTeVY5bz1NHX_RgeTPI6maReTMxU,212
src/rules/windows__create_remote_thread__create_remote_thread_win_mstsc_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_lsass.eql,sha256=15XrChrX-8VWzy8sgTHCBEfmWfHfFQRtjP7uSSVl-dg,123
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_lsass.lucene,sha256=D8jCvscTBaIDfujYF7O5HGj_YEQH_ihJGpIIZ-i86IU,103
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_susp_targets.eql,sha256=BXadfRhQDUi3pjtpORspL8sOWL6ZBJPZQKcVQ8oT8sg,155
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_susp_targets.lucene,sha256=eT5kiWCc0VMYq48WoTzIb9jg0yZ0aO8trCQwRTx7u1Q,129
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_susp_targets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_password_dumper_lsass.eql,sha256=0l2muV-Iw-Tb2f3WLObTlOlvx8-t-uTV_9RxLMjosbc,93
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_password_dumper_lsass.lucene,sha256=vAYSD3kdsGJXQMiNw1HwJJ7T5iPXO7Nblp1NmDKjJH8,80
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_password_dumper_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_relevant_source_image.eql,sha256=LCuOjgH0rwa3PDRceW3E0xBwdILhYnrhLzM38eC5d3I,1842
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_relevant_source_image.lucene,sha256=V7BkHWYZf0WGgIF6BhMBExOfRBs3SMo9igO4VnFIj_A,1801
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_relevant_source_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_source_image.eql,sha256=iym9_PvbRH4vI2_jkfYHVF3uo0CZp0AFX6PE2iN9IWg,3208
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_source_image.lucene,sha256=78BK7rrx_3L_NJS1Yax_dfdtRmSdegWGFVPntmbKZL0,3139
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_source_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_target_image.eql,sha256=qcq6-2d1iYah9SSmzcwkmbD-wD6OHc8v1bPbqx5QhIk,1193
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_target_image.lucene,sha256=p6KgKZgYpuzSdBp6joPD9lurhhxxO0gv11j41l2jsEo,1152
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_target_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_ttdinjec.eql,sha256=4klH7uTCnMCLveDGRk7FFnkPU8X0ztc2PHyOdL5HKVc,48
src/rules/windows__create_remote_thread__create_remote_thread_win_ttdinjec.lucene,sha256=e4EPUxBeQ533gZ90Vn1voW1Ii4_dvW3diev2y704BC4,36
src/rules/windows__create_remote_thread__create_remote_thread_win_ttdinjec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_ads_executable.eql,sha256=HL4OS7ELJLYvTFefP0AQEFJkJuyoR0tF6jV7vvsUNzM,124
src/rules/windows__create_stream_hash__create_stream_hash_ads_executable.lucene,sha256=iJdMtYZbUlgKa1YJJCKlmjLaBLaKA-G0qALzP9sWA-8,112
src/rules/windows__create_stream_hash__create_stream_hash_ads_executable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_creation_internet_file.eql,sha256=lYDF-hv9C-6H4mpJHtDq9TOB8K6wdoQoCOL7MbqNaQY,1845
src/rules/windows__create_stream_hash__create_stream_hash_creation_internet_file.lucene,sha256=uGiwMUohRLrdFl5dlQSMmmoQY3bxaeL_hmJnO7OuILY,1796
src/rules/windows__create_stream_hash__create_stream_hash_creation_internet_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_susp_extension.eql,sha256=JFaR97b01mtnGcTa0mZq5bDWBOwLosLJdtKMSpIliGU,798
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_susp_extension.lucene,sha256=yUpnKB5RNf5tBJzHU4OQ-L156vUB8rran0JVYMDFAUo,781
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_susp_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_unusual_extension.eql,sha256=n3oKSteCFXtPWpTdif3yMWXY_wobRb4YK1mfkTVQSbg,708
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_unusual_extension.lucene,sha256=LyHl-7ZwyGlqDtFnS_aIpES90z-yqEKQfIHj1cdhGQc,685
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_unusual_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_hktl_generic_download.eql,sha256=SvC_v2TTbTC04l41faXD9-v8hPyL2ePwwWRWbpxuV98,4732
src/rules/windows__create_stream_hash__create_stream_hash_hktl_generic_download.lucene,sha256=NaKP5Z7OMzCh2qOvFJdz6aH-MnD193dX1bgxxItGH5M,4816
src/rules/windows__create_stream_hash__create_stream_hash_hktl_generic_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_regedit_export_to_ads.eql,sha256=dGUkHicA1hJGP6Ur0JmQTEtBJIFIi3ZF9ac4tUkmGOs,46
src/rules/windows__create_stream_hash__create_stream_hash_regedit_export_to_ads.lucene,sha256=HjWSgkBumqv2doWsgVJOhavAlM4uJPQ3mXtuQjMRxfE,34
src/rules/windows__create_stream_hash__create_stream_hash_regedit_export_to_ads.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_susp_ip_domains.eql,sha256=KAjV-HguKY_dzljLgjRFAeyyavlXGZ40iaNxs3D7Ymk,295
src/rules/windows__create_stream_hash__create_stream_hash_susp_ip_domains.lucene,sha256=YMtccc9T7Nv6vMxMhkTjnrVjKM24Dg9uW3yOKH0SkO8,420
src/rules/windows__create_stream_hash__create_stream_hash_susp_ip_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_winget_susp_package_source.eql,sha256=epdQhh7xjxFXn_s3AsmTz36mnKX9nvJBd6bI7tQx-pE,280
src/rules/windows__create_stream_hash__create_stream_hash_winget_susp_package_source.lucene,sha256=dBUYpKXvP5yx1E2AGipiBdady4AlQqQdARfBx8GPSdM,288
src/rules/windows__create_stream_hash__create_stream_hash_winget_susp_package_source.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_zip_tld_download.eql,sha256=vtl2E5F979zkfnIIKWgDh52KgH2TM6j9_tQ2iTFvlyA,372
src/rules/windows__create_stream_hash__create_stream_hash_zip_tld_download.lucene,sha256=m0oDEQ7EFop4cmqPHBLahWQiob2WXTmbWvwC8RusYwk,373
src/rules/windows__create_stream_hash__create_stream_hash_zip_tld_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_anonymfiles_com.eql,sha256=0fGMd0-siVsl94N-HmfddKikELRxoRsQ4VFFHLrWzIU,47
src/rules/windows__dns_query__dns_query_win_anonymfiles_com.lucene,sha256=BlkrsHqCbVHXQQCwNvbXtCCBCapAcpwBPzQsSrkLunM,35
src/rules/windows__dns_query__dns_query_win_anonymfiles_com.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_appinstaller.eql,sha256=_j1bgcIGK9Jc-rhkVyDSMRj32HcXnw5H9Ayn_m6VnHY,140
src/rules/windows__dns_query__dns_query_win_appinstaller.lucene,sha256=Dcw5tFMjWhmwr_w5mnxVbRTw_BT76nJga9nDvscHpPY,128
src/rules/windows__dns_query__dns_query_win_appinstaller.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_cloudflared_communication.eql,sha256=jx_ca1dfrU9DRcHj8RuezY8ZrqjchRP11_zosG_buvg,137
src/rules/windows__dns_query__dns_query_win_cloudflared_communication.lucene,sha256=syDmzTCQ5N_skoOxZfyyWioz7dOR0Ui3SMZm25z0LwU,120
src/rules/windows__dns_query__dns_query_win_cloudflared_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_common_malware_hosting_services.eql,sha256=aDQh1YzkHH_WTc_0lCyTixWs2IDQTG-No5nr90HvOyg,166
src/rules/windows__dns_query__dns_query_win_common_malware_hosting_services.lucene,sha256=dmUpdkR_4MMDhgV892Vx8hrZtLPoy8fUIFD2mxvUaks,148
src/rules/windows__dns_query__dns_query_win_common_malware_hosting_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_devtunnels_communication.eql,sha256=yNt8-n2g_Ln6Ab-Kz-n_0qCkJH-utF51MOF5t6XVegM,46
src/rules/windows__dns_query__dns_query_win_devtunnels_communication.lucene,sha256=rWFfCT0-avY3cBceTm_EGx2bSrtgt08ixBTwprX5Ep4,34
src/rules/windows__dns_query__dns_query_win_devtunnels_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_dns_server_discovery_via_ldap_query.eql,sha256=2AO8W03NUgAHYud_mtkP5P82s5-kYLgd_WgDgWfEAa8,534
src/rules/windows__dns_query__dns_query_win_dns_server_discovery_via_ldap_query.lucene,sha256=TzxHfEXKeu0DPH-pyotFiVYpvuGyydbi8ia4rJIJj1k,511
src/rules/windows__dns_query__dns_query_win_dns_server_discovery_via_ldap_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_domain_azurewebsites.eql,sha256=oPRFwEn_C38_ohTurjDQgX3vVL1Yo_VY13f8JPsgH3s,2785
src/rules/windows__dns_query__dns_query_win_domain_azurewebsites.lucene,sha256=zh7iVxZRhMJc5fmzrHvKHgLIqaLhgrZ7SBxMBTN1NYE,2694
src/rules/windows__dns_query__dns_query_win_domain_azurewebsites.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_finger.eql,sha256=U3g8JDPAEUMCke0zLeloPIqSMvIbAT9se42rLTKUltA,45
src/rules/windows__dns_query__dns_query_win_finger.lucene,sha256=5OHpJFh3CLuV744hoCCW-evw4rWLg5oLPGfbRLqUmN0,33
src/rules/windows__dns_query__dns_query_win_finger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_hybridconnectionmgr_servicebus.eql,sha256=8Hwt1G5p68DU6EO5-2mml38TWortewLFMjUYHlzG9HA,106
src/rules/windows__dns_query__dns_query_win_hybridconnectionmgr_servicebus.lucene,sha256=x3zalk0AVcOoY4AXEAl_04WXeXL9qFTPM62BqnbP83U,92
src/rules/windows__dns_query__dns_query_win_hybridconnectionmgr_servicebus.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_kerberos_coercion_via_dns_object_spoofing.eql,sha256=SBDcuPm0OHd82xYLnOn80wmbangL_A-fB9mBIX0EQtw,71
src/rules/windows__dns_query__dns_query_win_kerberos_coercion_via_dns_object_spoofing.lucene,sha256=7GWTNIj6wCh8Px576aVTroA375uREON0NzjL9Jfcnuo,57
src/rules/windows__dns_query__dns_query_win_kerberos_coercion_via_dns_object_spoofing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_mal_cobaltstrike.eql,sha256=hQYfNVxsBCQADZhJFpaX2eax0yUmIflCh8WCuPGU_n8,103
src/rules/windows__dns_query__dns_query_win_mal_cobaltstrike.lucene,sha256=5_-m4KouA9LPo8RSuSk3osGb6OhCWDzzLtbUOdLDLbY,83
src/rules/windows__dns_query__dns_query_win_mal_cobaltstrike.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_mega_nz.eql,sha256=o9ay_HTPkq6a9m1CXoCuqFVH3_vDoPbdrUkXgml3P48,55
src/rules/windows__dns_query__dns_query_win_mega_nz.lucene,sha256=5y3HyhIfroj3miXyzBP0-8phS14THAY0VPh_I5RGHNg,43
src/rules/windows__dns_query__dns_query_win_mega_nz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_onelaunch_update_service.eql,sha256=0XkywsT698l54BBu5F0Jx-kw7gtWDFKIn20aPR_JH4k,93
src/rules/windows__dns_query__dns_query_win_onelaunch_update_service.lucene,sha256=tEurrmAR1aeF88Wp86lt9A5MqYxY4Jrb_lOuUshLFsg,79
src/rules/windows__dns_query__dns_query_win_onelaunch_update_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_quickassist.eql,sha256=Q0vOPzRjqKGwznEn06WrkABGWjMQ9k8rn39rJD4I7Q8,123
src/rules/windows__dns_query__dns_query_win_quickassist.lucene,sha256=u-67lV_0AoRkWzoDr13miSCzKYdlWqThsMnDCJjCCUg,109
src/rules/windows__dns_query__dns_query_win_quickassist.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_regsvr32_dns_query.eql,sha256=kL568i-CmTVofRSs3xWBC-JGmU_QomNZco6KJPE1tTw,47
src/rules/windows__dns_query__dns_query_win_regsvr32_dns_query.lucene,sha256=-VuikHHJhTJjRzaJrz2tsqtUWKy0_LBOp6Huyakz1Fc,35
src/rules/windows__dns_query__dns_query_win_regsvr32_dns_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_remote_access_software_domains_non_browsers.eql,sha256=NA-BhI5CBCkaqnlEFYxYI3bwM978ku8JIwQ2ZgeulEc,3961
src/rules/windows__dns_query__dns_query_win_remote_access_software_domains_non_browsers.lucene,sha256=OS9pkTwjk2Kg9879jaAjgWmo-0pJm-gT9VJ4ulaWBF8,3866
src/rules/windows__dns_query__dns_query_win_remote_access_software_domains_non_browsers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_susp_external_ip_lookup.eql,sha256=KlkbT4EW9g8eBqWM7qfamLFwlmqwa9jAch_Cm9dS2kE,2107
src/rules/windows__dns_query__dns_query_win_susp_external_ip_lookup.lucene,sha256=YPCTq2fJvgm933eujdasgzfi3RCKQXpEqg29y_S-n10,2060
src/rules/windows__dns_query__dns_query_win_susp_external_ip_lookup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_teamviewer_domain_query_by_uncommon_app.eql,sha256=m6kliG4TUT_cxPT8DVtAEAX3Irt1-jeOxgKpvusH7B8,130
src/rules/windows__dns_query__dns_query_win_teamviewer_domain_query_by_uncommon_app.lucene,sha256=jciGj_wlQJEl-rWiAzwzZ8NmTXhMpu9tgrINq7E26j0,110
src/rules/windows__dns_query__dns_query_win_teamviewer_domain_query_by_uncommon_app.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_tor_onion_domain_query.eql,sha256=MPaswXUEZgF8zVfLcN1n-y8H2TA4pu0IR96S6k2sid4,647
src/rules/windows__dns_query__dns_query_win_tor_onion_domain_query.lucene,sha256=4STdh4DwwMYqcXltJpjD0jIoi2z6nbldseyFhyfulmM,634
src/rules/windows__dns_query__dns_query_win_tor_onion_domain_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_ufile_io_query.eql,sha256=s_IcPWl7T2QPagJdYO8_N5sqpbnC5T4yKDNNJ7aQIi8,41
src/rules/windows__dns_query__dns_query_win_ufile_io_query.lucene,sha256=WA4nexTQg0O_lHeh9glk01H5FVv9JxzLYUN1_FWEaEE,29
src/rules/windows__dns_query__dns_query_win_ufile_io_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_vscode_tunnel_communication.eql,sha256=jk4UoQ00I4qjyyLm81f0Ish1HlRF50KablzLUmoYAAE,61
src/rules/windows__dns_query__dns_query_win_vscode_tunnel_communication.lucene,sha256=_SQoTNt28peq5u0qg75CaXXg7JwcSISZ7d-3Kn-pFxQ,49
src/rules/windows__dns_query__dns_query_win_vscode_tunnel_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_mal_drivers.eql,sha256=CgNp1t0bvE_F7YP5TvgYKoCoyRfd7FxfxYTN6ffvYv8,44120
src/rules/windows__driver_load__driver_load_win_mal_drivers.lucene,sha256=YlwXAww0YnaW--2RP8Kbbb6GRlg_XdjvsNimPyYwaXU,44891
src/rules/windows__driver_load__driver_load_win_mal_drivers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_mal_drivers_names.eql,sha256=7jppG2VsBBvVSOae9_-RQW8srt2LXg9HxpJK9Kgq8RU,1641
src/rules/windows__driver_load__driver_load_win_mal_drivers_names.lucene,sha256=-fnaeOwJ1dSoopUBQDQyEQcUlm4-FTAMR-QiGLIT--U,1623
src/rules/windows__driver_load__driver_load_win_mal_drivers_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_pua_process_hacker.eql,sha256=foM5tiNwhHHV0-UWOe8s1O_XJ1uDhGLKWbqTbApz3po,265
src/rules/windows__driver_load__driver_load_win_pua_process_hacker.lucene,sha256=8CHLaHYeUsKjg4dKWDHDQwf1gfX-v0TZPNvMTmk2mXs,249
src/rules/windows__driver_load__driver_load_win_pua_process_hacker.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_pua_system_informer.eql,sha256=nFnzBSI_jMslSCCHwef8XmkmqMaiQVCF6paNWUrrjuA,1082
src/rules/windows__driver_load__driver_load_win_pua_system_informer.lucene,sha256=y67SMxmfUuaFdZtN0QXqX4MTP2okqbe0154hTyei5io,1075
src/rules/windows__driver_load__driver_load_win_pua_system_informer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_susp_temp_use.eql,sha256=fm4b7CvF0TZsqjk03gl_wPYg7LBBsEGWJ5DIOLkWL28,33
src/rules/windows__driver_load__driver_load_win_susp_temp_use.lucene,sha256=NdAhTghqLE9elFdoGcWqRNdIEzwxLvfxdi5777EqZMc,20
src/rules/windows__driver_load__driver_load_win_susp_temp_use.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_vuln_drivers.eql,sha256=Rlce1MTijpLqBe1cP9-uQq0i5y-S-HVgI4s0Ndn4g_Q,245799
src/rules/windows__driver_load__driver_load_win_vuln_drivers.lucene,sha256=GTxJqmGhfqbTPI0iEqI-PnLzOuY61ei_cPqJFWy_F7s,250213
src/rules/windows__driver_load__driver_load_win_vuln_drivers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_vuln_drivers_names.eql,sha256=UNV08uzUS8wrf_ZA2IXqpm-aDQaqzlR11wdrXedXGwg,5228
src/rules/windows__driver_load__driver_load_win_vuln_drivers_names.lucene,sha256=ezaJBE1Pbh6O9CwW6tJBRJEXeUl8LMNVBzLfdAoZZws,5221
src/rules/windows__driver_load__driver_load_win_vuln_drivers_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_vuln_hevd_driver.eql,sha256=tbu0FvHjwB8Dt2Q7n4is6uwEo2TfBrhvsCfEJsCvunI,163
src/rules/windows__driver_load__driver_load_win_vuln_hevd_driver.lucene,sha256=LqkqZEmWVd3kW3P5JgDx2aDGBOtWYaGdNe5xg9WYVaE,145
src/rules/windows__driver_load__driver_load_win_vuln_hevd_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_vuln_winring0_driver.eql,sha256=A6SiikYqaiLaqvbvwM4xmM6HhTaBKZc0Y-NXyyirflM,207
src/rules/windows__driver_load__driver_load_win_vuln_winring0_driver.lucene,sha256=-jgdgSuWbkZEBD5qMjK2IBowHyuWc-9D0E_D2EfoGlc,188
src/rules/windows__driver_load__driver_load_win_vuln_winring0_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_windivert.eql,sha256=oGCCQnboamfa24LFfoLU6GnYIPIPHM2Fup573Y9GHr0,998
src/rules/windows__driver_load__driver_load_win_windivert.lucene,sha256=l9ThqdDH1BW1o6OZwGMgSWo4frVKVxsylfNesk3EQ2U,990
src/rules/windows__driver_load__driver_load_win_windivert.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__etw__custom_rpc_etw_suspicious_activity.lucene,sha256=KnKzZPparkLMYKNbkljZmYVU63_lmg9MAcgd1ybyGgQ,112
src/rules/windows__file__file_access__file_access_win_susp_credential_manager_access.eql,sha256=En62yUU8cleJS9q8SB7onCg64uMcbNe7Lexo3nq_lQo,356
src/rules/windows__file__file_access__file_access_win_susp_credential_manager_access.lucene,sha256=I36BswojYF62QqgWkG4f1SgEJEBe1C0AyUhU6SEtIa4,331
src/rules/windows__file__file_access__file_access_win_susp_credential_manager_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_credhist.eql,sha256=gSnZecvGw8E3QA716v62nOl93L4elQXjkrjKHNgCLM4,254
src/rules/windows__file__file_access__file_access_win_susp_credhist.lucene,sha256=SvjJQ0H1Qw3HXyFEXjSgbY5Pz-XE9Y03fePTxmL5hSQ,238
src/rules/windows__file__file_access__file_access_win_susp_credhist.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_crypto_currency_wallets.eql,sha256=66ofXm1Cyppiyu705sjbCMYe3UrRP3dGUUKndbjAOnk,892
src/rules/windows__file__file_access__file_access_win_susp_crypto_currency_wallets.lucene,sha256=Clgki6CSJ7zb2FqcIiaa0wAwXgfMMAYg4soVJ7B47yM,849
src/rules/windows__file__file_access__file_access_win_susp_crypto_currency_wallets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_dpapi_master_key_access.eql,sha256=zq8vT2UkteoVsbVsrkoxvYiNodr708RgKc6bnXka1HM,252
src/rules/windows__file__file_access__file_access_win_susp_dpapi_master_key_access.lucene,sha256=Cqj8ZJh59bd6j-bWz1SdCXV_seuf90YqmLotx1ycBZ4,237
src/rules/windows__file__file_access__file_access_win_susp_dpapi_master_key_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_gpo_files.eql,sha256=sjzIeh4DN0QJP_iyFJIFMekGOEBQZeZOWUlHJELMYMM,462
src/rules/windows__file__file_access__file_access_win_susp_gpo_files.lucene,sha256=imTnoPs_UZbGGJzqUrHfi2hB88NrOYcOrUEcrg-r744,431
src/rules/windows__file__file_access__file_access_win_susp_gpo_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_process_access_browser_cred_files.eql,sha256=HYK4gJ6QkPLNm9MgbD0tYqbc_kxNEQ6DtOh3N7bS2kA,3510
src/rules/windows__file__file_access__file_access_win_susp_process_access_browser_cred_files.lucene,sha256=31lgsFILwd1GbxkEr5GKIYyMfR_UcRYeCYHRzI_SoPA,3394
src/rules/windows__file__file_access__file_access_win_susp_process_access_browser_cred_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_teams_sensitive_files.eql,sha256=OizZtUsg_Jl2dipmwgowId4bjp50XnIMhcsnMvbt0OI,181
src/rules/windows__file__file_access__file_access_win_teams_sensitive_files.lucene,sha256=RsMEOuuxjiGE8m9nn1ucZ0ylY4eytUkxigB3n4oOg_s,162
src/rules/windows__file__file_access__file_access_win_teams_sensitive_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_change__file_change_win_2022_timestomping.eql,sha256=c6XHI2L9ar1Zo1GGOFKmJpGG00YSmhfrnJFQpBvFlV0,608
src/rules/windows__file__file_change__file_change_win_2022_timestomping.lucene,sha256=e8OqA2wqu7sGQoDDu9ZWddd0Vauw3vl9wdQQrHzx37Y,569
src/rules/windows__file__file_change__file_change_win_2022_timestomping.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_change__file_change_win_unusual_modification_by_dns_exe.eql,sha256=SApLBNZ_aIKl-oLNaBYXA3DYOZAr3pQcsRAn6fDkT7k,75
src/rules/windows__file__file_change__file_change_win_unusual_modification_by_dns_exe.lucene,sha256=f-BbCrDM2mF63pvB3nxTXujwCEYlNB7HJQnz4IVQPi0,61
src/rules/windows__file__file_change__file_change_win_unusual_modification_by_dns_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_backup_file.eql,sha256=GIQTvipW3tk2Iielk_4Z3aGpDm_8jl9kTKgkXtxCfh4,236
src/rules/windows__file__file_delete__file_delete_win_delete_backup_file.lucene,sha256=GCRAv6VKhONbliYZkr3qr1iUmXT2csg_uJGaJow-2Kw,210
src/rules/windows__file__file_delete__file_delete_win_delete_backup_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_event_log_files.eql,sha256=EfYau6rtlSWVe0lWxWOlrY0-FAQnJ28b7G3spOX0t0M,84
src/rules/windows__file__file_delete__file_delete_win_delete_event_log_files.lucene,sha256=JxoHqsOKVaM7WblkO-AWq0-Hg9qSuwzXVx_8YKw6uSo,70
src/rules/windows__file__file_delete__file_delete_win_delete_event_log_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_exchange_powershell_logs.eql,sha256=t-OcI-jIb4MyBjt6NY5XPRMG1Ai9xvewcMnbAISwPqw,100
src/rules/windows__file__file_delete__file_delete_win_delete_exchange_powershell_logs.lucene,sha256=khuagy2HwQeGfu5_Ddy_jDVa27ccNNo9nGWrZsoiN0s,85
src/rules/windows__file__file_delete__file_delete_win_delete_exchange_powershell_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_iis_access_logs.eql,sha256=tYFmNeQtj9BUkAmtl5TCqbnhQU3bcx95TShHGJ5MTrU,74
src/rules/windows__file__file_delete__file_delete_win_delete_iis_access_logs.lucene,sha256=Ohk3IyE39uK1aftphx8kkHonJ2S9AFaSHRpWO29e4So,59
src/rules/windows__file__file_delete__file_delete_win_delete_iis_access_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_own_image.eql,sha256=cFIkYtg_tQ18Wp6RF7xWnw854gAsJvZeI5tPSqN5Znw,106
src/rules/windows__file__file_delete__file_delete_win_delete_own_image.lucene,sha256=2ejejP57rjCOMKfbDta7emiYDoQDJYvp9QwQWKQOJeY,101
src/rules/windows__file__file_delete__file_delete_win_delete_own_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_powershell_command_history.eql,sha256=DAudgtoSmI3wcnZQN-GbvyHy6OoCdYtI0fe_AfEb66c,61
src/rules/windows__file__file_delete__file_delete_win_delete_powershell_command_history.lucene,sha256=yuGVbpt1r4YueXayMf-mhbXANTjjQgdSqbaxayuwtoA,49
src/rules/windows__file__file_delete__file_delete_win_delete_powershell_command_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_prefetch.eql,sha256=oFYzRlTiTUdXulUsqtjIF7vfPFwni3Mn94kwm3Et0Q4,186
src/rules/windows__file__file_delete__file_delete_win_delete_prefetch.lucene,sha256=Bu0RSEOVFw5A6X__R-4dk1wDsSA2JnLiP-cXngTnWqw,163
src/rules/windows__file__file_delete__file_delete_win_delete_prefetch.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_teamviewer_logs.eql,sha256=qUOdv5uMjnQ-8aZwsOL775TfCkcZwPfLA8395yUdXwk,128
src/rules/windows__file__file_delete__file_delete_win_delete_teamviewer_logs.lucene,sha256=OfekFATMlonruf57MBPHrXuIcCkx7ppzqaOsHdCVh8w,113
src/rules/windows__file__file_delete__file_delete_win_delete_teamviewer_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_tomcat_logs.eql,sha256=6myxzC23HDyIKGI4DBMayaFD1Wp9u6NAO769Ut3jVyA,134
src/rules/windows__file__file_delete__file_delete_win_delete_tomcat_logs.lucene,sha256=eFd4iX5T-l2TpjDZUx9Z_QX5bFjqW4cUpQjSfyYPjKg,111
src/rules/windows__file__file_delete__file_delete_win_delete_tomcat_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_sysinternals_sdelete_file_deletion.eql,sha256=i9QMX1pSUZ9KDnOngGu7tuCbxyXkzsQ1sq5YlWj183A,121
src/rules/windows__file__file_delete__file_delete_win_sysinternals_sdelete_file_deletion.lucene,sha256=7IEfMxoPYOQNoj69-gwdWJjYajOGfA4X-4EUi7ufr3I,102
src/rules/windows__file__file_delete__file_delete_win_sysinternals_sdelete_file_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_unusual_deletion_by_dns_exe.eql,sha256=SApLBNZ_aIKl-oLNaBYXA3DYOZAr3pQcsRAn6fDkT7k,75
src/rules/windows__file__file_delete__file_delete_win_unusual_deletion_by_dns_exe.lucene,sha256=f-BbCrDM2mF63pvB3nxTXujwCEYlNB7HJQnz4IVQPi0,61
src/rules/windows__file__file_delete__file_delete_win_unusual_deletion_by_dns_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_zone_identifier_ads_uncommon.eql,sha256=RDmLSYuWZ_Svc34aDK2DxG27K0q7BkFZl1L5hX8-jq4,850
src/rules/windows__file__file_delete__file_delete_win_zone_identifier_ads_uncommon.lucene,sha256=fFTYwkYbAdcS20aLb_IlA9pcxdA_J5xslTcPiHIxAjs,839
src/rules/windows__file__file_delete__file_delete_win_zone_identifier_ads_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_adsi_cache_creation_by_uncommon_tool.eql,sha256=cnOMziKeqJgYK1_xzSMdgJ5v7OAFnEvICMgSHA_YgQA,993
src/rules/windows__file__file_event__file_event_win_adsi_cache_creation_by_uncommon_tool.lucene,sha256=COPUu1Uxh7GoOMyQTOnUsc8zfybCS49wcEwutOmaiKI,967
src/rules/windows__file__file_event__file_event_win_adsi_cache_creation_by_uncommon_tool.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_advanced_ip_scanner.eql,sha256=peOpVRIub6BRWHOhKu38tVA9JMMZmB05nw_0U5W7q_U,70
src/rules/windows__file__file_event__file_event_win_advanced_ip_scanner.lucene,sha256=1QEj1li0zWWTDDNWRLDT_D3Eg3PIKOxxZ0CMl18AAdM,61
src/rules/windows__file__file_event__file_event_win_advanced_ip_scanner.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_anydesk_artefact.eql,sha256=0qWiVVplVm82g8IaJcD9SVHJ9p2V8Fm9wSRVYg9zZpU,117
src/rules/windows__file__file_event__file_event_win_anydesk_artefact.lucene,sha256=3N4oNYAyJllxdAoaC744UYOai0uy0xWokC5C1i6kHnw,99
src/rules/windows__file__file_event__file_event_win_anydesk_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_anydesk_writing_susp_binaries.eql,sha256=qeststwZYfIyEW8tBW4FH92GZHgI6cqin-A-J9Q3o6M,155
src/rules/windows__file__file_event__file_event_win_anydesk_writing_susp_binaries.lucene,sha256=C6pH1hOvztHI2OpFWFbOxLIGiKWTGg3o2LgUCj0XS2A,127
src/rules/windows__file__file_event__file_event_win_anydesk_writing_susp_binaries.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_aspnet_temp_files.eql,sha256=ShlgUazUwaiLC9pOWjJZmIlcjd9lrJKEO5nveXvn5Bg,161
src/rules/windows__file__file_event__file_event_win_aspnet_temp_files.lucene,sha256=qf6x81JnZLZW_df4TI9nsNe54yKaPI5mGTINJT7YJ2Y,143
src/rules/windows__file__file_event__file_event_win_aspnet_temp_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_bloodhound_collection.eql,sha256=AkrC-_Ckfh1_v_PpDCVU4MbDS3YowzwIAG0L6NZTij0,319
src/rules/windows__file__file_event__file_event_win_bloodhound_collection.lucene,sha256=RrmXPXcvR04uJFsmPHSCBAemzFQJreA0_00RFxi6ol4,297
src/rules/windows__file__file_event__file_event_win_bloodhound_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_create_evtx_non_common_locations.eql,sha256=7cjv24M3vb7tY8HaWoq4TXLi3nYx1gjT1upCJIDDWrI,225
src/rules/windows__file__file_event__file_event_win_create_evtx_non_common_locations.lucene,sha256=qQ_NnpcJ0DX7hwGUMT64rzLuoZO5Ib8z8zU7dsBRVTc,207
src/rules/windows__file__file_event__file_event_win_create_evtx_non_common_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_create_non_existent_dlls.eql,sha256=hH3Bn-nxseMSNeZYOjUs-KhirXuhUPFLEyNwzsI-ZBU,293
src/rules/windows__file__file_event__file_event_win_create_non_existent_dlls.lucene,sha256=lufW8BhJxOEPfDj-AxrM0KQgCE56z4KWKwXiI0sxnnA,281
src/rules/windows__file__file_event__file_event_win_create_non_existent_dlls.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_deno.eql,sha256=csVs8hZB5xylE0j9uPbRo1jR5cTgP2UrN5r5pSF3QMU,138
src/rules/windows__file__file_event__file_event_win_creation_deno.lucene,sha256=oyRHgTgNgEY17SX4zDE1Vj1ec5UN2L3elNLFgnDL5L0,113
src/rules/windows__file__file_event__file_event_win_creation_deno.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_new_shim_database.eql,sha256=9IHsSLxVGVQ-1ymvRGnfk4Fmo4hxjOxCvLryfYlEV4U,102
src/rules/windows__file__file_event__file_event_win_creation_new_shim_database.lucene,sha256=nq77uGAvnfPhs3lnmilcosZo9ymkNTawHvUnt2LNbDM,84
src/rules/windows__file__file_event__file_event_win_creation_new_shim_database.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_scr_binary_file.eql,sha256=4jkEw1Gjl8RmZHS1YIYzfnowIve3Ej_nKLTEPwH9L6k,190
src/rules/windows__file__file_event__file_event_win_creation_scr_binary_file.lucene,sha256=yQbBmDoM83pRPphkF2Zeg9-Q_H0vNpIwTo3MPJAgD0g,166
src/rules/windows__file__file_event__file_event_win_creation_scr_binary_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_system_dll_files.eql,sha256=9nVVoV7B6KfIhyTZ0N87XdiLUKBlzAgoyOuHlR8qoBU,287
src/rules/windows__file__file_event__file_event_win_creation_system_dll_files.lucene,sha256=H4e2oVjmdrbjlCnq5oITTd1a_KoYNrC7jkZ4QIM_dt4,262
src/rules/windows__file__file_event__file_event_win_creation_system_dll_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_system_file.eql,sha256=5CDWHwY50sTQa6wYqdQgE8HFmvH4AMXB9n7pVZF0DUQ,2702
src/rules/windows__file__file_event__file_event_win_creation_system_file.lucene,sha256=LKshCvLoA-qHqmZgk1WZAhlaa9j8CR4HdlebuS-QAkY,2637
src/rules/windows__file__file_event__file_event_win_creation_system_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_unquoted_service_path.eql,sha256=i8fcR7czhuNCklgdLYPd00xAIDYLKlu1qRPOsippYXU,38
src/rules/windows__file__file_event__file_event_win_creation_unquoted_service_path.lucene,sha256=Tk6fk6LrVM9PI9Hjpb2wweQnJEbOYl-FU81wfQq5vaA,27
src/rules/windows__file__file_event__file_event_win_creation_unquoted_service_path.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_cred_dump_tools_dropped_files.eql,sha256=dcSutX7IFDdLGkUjF84wf_kF83n2APPz5l8t60I1crg,531
src/rules/windows__file__file_event__file_event_win_cred_dump_tools_dropped_files.lucene,sha256=AduBpqjoxDW8LixTZNIO-FM3nvaYKI0wKmaTtxKcjZo,506
src/rules/windows__file__file_event__file_event_win_cred_dump_tools_dropped_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_cscript_wscript_dropper.eql,sha256=Yy1xT32R-BR2ch1-E28xVXnZUEEGmEr4kj68CEgdR10,200
src/rules/windows__file__file_event__file_event_win_cscript_wscript_dropper.lucene,sha256=rjPZ-yFVo8nxTp3thfea1DKggCOll1eQp5XWQynVNK4,167
src/rules/windows__file__file_event__file_event_win_cscript_wscript_dropper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_csexec_service.eql,sha256=vnc7mGAW1Y2Cu0r0PSnNF63AiUUSM9whk_-9K5pAzA8,39
src/rules/windows__file__file_event__file_event_win_csexec_service.lucene,sha256=CMzGGoND8Or11NnkwWWUO7mMY537tFEh5R--dgpXscU,27
src/rules/windows__file__file_event__file_event_win_csexec_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_csharp_compile_artefact.eql,sha256=BWQ11cUNoWX0BENuloBInjFzr6aYbRIpwhzRzFsSBXM,32
src/rules/windows__file__file_event__file_event_win_csharp_compile_artefact.lucene,sha256=RQF7sZdYmAr5_MOi_SUtV9Kamxxz4IuuE9DcJL_pc0A,20
src/rules/windows__file__file_event__file_event_win_csharp_compile_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_dcom_iertutil_dll_hijack.eql,sha256=z3vZMEN7Vmp92iB40EKMhXjW5pw1oCdPkd6oQResfqk,89
src/rules/windows__file__file_event__file_event_win_dcom_iertutil_dll_hijack.lucene,sha256=lndmBQxLt9uMc7ryk_1XOG1XxwrkvPY7ukB_XjpRItY,76
src/rules/windows__file__file_event__file_event_win_dcom_iertutil_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_desktop_ini_created_by_uncommon_process.eql,sha256=d7hAPSx2iCjBSwcVuqGxxRXj5W43XQdSAoqaUlFRygo,459
src/rules/windows__file__file_event__file_event_win_desktop_ini_created_by_uncommon_process.lucene,sha256=86r574BGqI5_qIjH-iuFrys30YuDo1Wrx8E8I7oXotw,431
src/rules/windows__file__file_event__file_event_win_desktop_ini_created_by_uncommon_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_dll_sideloading_space_path.eql,sha256=AHwKSysforpzSi_RBFkrkfDxTWXR_r6k7LenJLcT30M,126
src/rules/windows__file__file_event__file_event_win_dll_sideloading_space_path.lucene,sha256=lN_lWybPATiAE5wJKdAeqQSEoavze19rBY4EQGCfIG8,114
src/rules/windows__file__file_event__file_event_win_dll_sideloading_space_path.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_dump_file_susp_creation.eql,sha256=TeMIP1hD61xRru_hp-rnLRI0JLC-k-ihEOFiGexx4Zc,192
src/rules/windows__file__file_event__file_event_win_dump_file_susp_creation.lucene,sha256=mW0bwooeJ2T3SSSUfgDbUOmjOn_7uYrZlwyzKhNSbvk,166
src/rules/windows__file__file_event__file_event_win_dump_file_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_errorhandler_persistence.eql,sha256=Fs74Sw9OvjMuqT7AqEW5Db4atJRZ1zbbrCMpdtzR1OE,67
src/rules/windows__file__file_event__file_event_win_errorhandler_persistence.lucene,sha256=DE6OxZyYeRR0rOROGTlCXBQvR1LSJqfpbnPs0LyJt0Y,55
src/rules/windows__file__file_event__file_event_win_errorhandler_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop.eql,sha256=PMUijNaiHzh_aw6N1-8dN-XXTqr5bdTPIuC5dma0GSQ,237
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop.lucene,sha256=qoUSfOwUUGM9OdNyLe7CQt7lYUv_gn4hD_vhJwgJljo,205
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop_suspicious.eql,sha256=SCqA-J-t_z7F5wrDwRB-rBZOTuCDieD0K_byn_ktz3Q,191
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop_suspicious.lucene,sha256=4_b4n08FLQ4a3ideAnN7uUsKYrcVfzNZN6vDkHvGPcs,169
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop_suspicious.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_gotoopener_artefact.eql,sha256=rAOZIoBxC71rfSG7wqXf7A4OvKY2p0oFRjOqPYQENE0,95
src/rules/windows__file__file_event__file_event_win_gotoopener_artefact.lucene,sha256=-Lz_yh1P0QCz79Yxp_oei3IX9XfAJ7xQFcSppNAcfZg,85
src/rules/windows__file__file_event__file_event_win_gotoopener_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_crackmapexec_indicators.eql,sha256=JiAOGYm5kHMLHwWqxRRhcqFjtoEpjCIabY5NAP0spbM,222
src/rules/windows__file__file_event__file_event_win_hktl_crackmapexec_indicators.lucene,sha256=36LeJZ8VI2RfjfbuCkLM8o9nNXEAlfE84dGlal_Nw9A,377
src/rules/windows__file__file_event__file_event_win_hktl_crackmapexec_indicators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_dumpert.eql,sha256=EEIEfSBlItSQZ-7UjUiEl1Sr0sjDxDhRY-Njr-tfm28,35
src/rules/windows__file__file_event__file_event_win_hktl_dumpert.lucene,sha256=pot7RGZtWsV-G0zcnqva2dZ2WDwH5288fP-6u6CrJTo,23
src/rules/windows__file__file_event__file_event_win_hktl_dumpert.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_hivenightmare_file_exports.eql,sha256=PMTVIcgrCJAEqk7DzJU4vgFw5OpM8i9wjN3U0FC3XBY,167
src/rules/windows__file__file_event__file_event_win_hktl_hivenightmare_file_exports.lucene,sha256=LX2OFwV7mnp5kwtwhBRv2PvOlKpaufp--MOxsXr2eyw,155
src/rules/windows__file__file_event__file_event_win_hktl_hivenightmare_file_exports.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_inveigh_artefacts.eql,sha256=Dlm2oEqPlXL3MRA-npWZzKgG4WPDFeHj1MzdOfFb5Wk,293
src/rules/windows__file__file_event__file_event_win_hktl_inveigh_artefacts.lucene,sha256=81HjYWvEPY5duSV9hNIX-o1hx7VK725b4SNXgF69DGg,283
src/rules/windows__file__file_event__file_event_win_hktl_inveigh_artefacts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_krbrelay_remote_ioc.eql,sha256=hWgPwoXEeLraXvG1wmSktpiYuDHca2RwDcY_iyw6PIY,117
src/rules/windows__file__file_event__file_event_win_hktl_krbrelay_remote_ioc.lucene,sha256=ojMxCxbnuCU4tduoOHvy8l7NZv6IXP0GGgDTHtI7BM0,102
src/rules/windows__file__file_event__file_event_win_hktl_krbrelay_remote_ioc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_mimikatz_files.eql,sha256=UbRMlMFOJd22r6oQJ_1dwZPCSo5joXScWDIjWi1ZJhw,54
src/rules/windows__file__file_event__file_event_win_hktl_mimikatz_files.lucene,sha256=0t1F2VY3gy-gasJ6HxwEH1kCFBT6_zSDNeWqHjACkB0,36
src/rules/windows__file__file_event__file_event_win_hktl_mimikatz_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_nppspy.eql,sha256=4ugXK3pXgLBWC51BAVw6CmEyy6yj2U7HvGCQZAH3Nog,61
src/rules/windows__file__file_event__file_event_win_hktl_nppspy.lucene,sha256=W33VKKM91fyB9jW6Jdq8nAZ3A2VjjGw31Qc_uDT1Cks,43
src/rules/windows__file__file_event__file_event_win_hktl_nppspy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_powerup_dllhijacking.eql,sha256=cX1944PgdnE725QsSJOTJYONSpZZpBFWqsSTBqV4Fyg,96
src/rules/windows__file__file_event__file_event_win_hktl_powerup_dllhijacking.lucene,sha256=NsGv_LLf9WErAJSkT_nJyvhkJKig73dI-7Uip5Gvdxc,76
src/rules/windows__file__file_event__file_event_win_hktl_powerup_dllhijacking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_quarkspw_filedump.eql,sha256=FxjaWYmKRd_HbgALAnvWe4df3Q10gfMU_yYmbfgmZN0,76
src/rules/windows__file__file_event__file_event_win_hktl_quarkspw_filedump.lucene,sha256=4tO83AeG7EOyk51CDwCDMWtTD5sDJlxneXgqnYmCCLY,63
src/rules/windows__file__file_event__file_event_win_hktl_quarkspw_filedump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_remote_cred_dump.eql,sha256=rt1kV7Lgg3QwxzrkYDbr4SGuyEv3fkdNwVJ3s612kiQ,118
src/rules/windows__file__file_event__file_event_win_hktl_remote_cred_dump.lucene,sha256=fIVUqjwFemjS1lQG1u9BaKnTbtr0C6FkMpED4Y5gWlo,176
src/rules/windows__file__file_event__file_event_win_hktl_remote_cred_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_safetykatz.eql,sha256=Z6lk38Vb-FpQD7h5sLVWIWkjBKfl_6WGdSCHDzJUWvI,41
src/rules/windows__file__file_event__file_event_win_hktl_safetykatz.lucene,sha256=zryn5OcEvo6nhE646D76IiY3nKiG3ck86vFb036mYAY,29
src/rules/windows__file__file_event__file_event_win_hktl_safetykatz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_impacket_file_indicators.eql,sha256=rfxYpGYVzzcjtKREQiBVgSD9YWt1u2UseqaVe7cJCpE,60
src/rules/windows__file__file_event__file_event_win_impacket_file_indicators.lucene,sha256=rDvZIfA6muDZvmPxENRU4h493cEmirdK0On1xwyV4fI,119
src/rules/windows__file__file_event__file_event_win_impacket_file_indicators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_initial_access_dll_search_order_hijacking.eql,sha256=O7lINsmEb4XS5aFgLKwjy8_35GYLs4vT1mWoKxcch4U,722
src/rules/windows__file__file_event__file_event_win_initial_access_dll_search_order_hijacking.lucene,sha256=RoJ1E3CELO9-oaniBkHu5-0JOMqdyEa2Ck98HOFYm0A,679
src/rules/windows__file__file_event__file_event_win_initial_access_dll_search_order_hijacking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_install_teamviewer_desktop.eql,sha256=lwZ6hs6RqC6ae_cvJvhqdehpaM0W5OVazqEWPb2mnYo,48
src/rules/windows__file__file_event__file_event_win_install_teamviewer_desktop.lucene,sha256=8P9_5P6oKLD9-_aRjcLFnpRD7xdsUAyaZkPohyTI6HE,36
src/rules/windows__file__file_event__file_event_win_install_teamviewer_desktop.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_iphlpapi_dll_sideloading.eql,sha256=1YjpYVmcBYvTLsbSgFRUTYxb8DIt6bNXHw-msZ1gVOo,83
src/rules/windows__file__file_event__file_event_win_iphlpapi_dll_sideloading.lucene,sha256=RYt9BUj1qP3nRHHAdCK4PvvN7eHeOVrgPDnOACyT-eI,69
src/rules/windows__file__file_event__file_event_win_iphlpapi_dll_sideloading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_iso_file_mount.eql,sha256=Dnc7OYBFpI0PpFRKWAz1lm6Q1DJvz5bs0x1QsRuZVW8,208
src/rules/windows__file__file_event__file_event_win_iso_file_mount.lucene,sha256=-3bww7Bz0WLdcfzCRgpYP3PUtftDnxCtILT33it8zXY,185
src/rules/windows__file__file_event__file_event_win_iso_file_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_iso_file_recent.eql,sha256=tNwzhBzQR0MTvdXkiUTDBkGpiDP0bOgBP056rNzNWZQ,131
src/rules/windows__file__file_event__file_event_win_iso_file_recent.lucene,sha256=B-RV-qGnRR9VDNcsyNBkQX5kG8jrhn6rYpFmr1HWRAQ,110
src/rules/windows__file__file_event__file_event_win_iso_file_recent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_lolbin_gather_network_info_script_output.eql,sha256=LFbtKAITkyEKM7Ec9UHd_BSrxWkRkgmYo2pVALp1GXE,163
src/rules/windows__file__file_event__file_event_win_lolbin_gather_network_info_script_output.lucene,sha256=hQAUfnj6wFCui7MYc2ZIwTqndrNwxTKg5YVCGVrVt-A,144
src/rules/windows__file__file_event__file_event_win_lolbin_gather_network_info_script_output.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_lsass_default_dump_file_names.eql,sha256=NM701w9azyuENS9xtE5kzCLsPqSalaBNjU7SNqOy6kc,414
src/rules/windows__file__file_event__file_event_win_lsass_default_dump_file_names.lucene,sha256=vAai33o3luB8VIbATo4XZ4-P8iZ6UGPeejIJy-cMqjs,370
src/rules/windows__file__file_event__file_event_win_lsass_default_dump_file_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_lsass_shtinkering.eql,sha256=XfTPhhw1e0etoDu1DoGIF0D5OtHk076wGSLwm2vwiuo,149
src/rules/windows__file__file_event__file_event_win_lsass_shtinkering.lucene,sha256=F4H0fRVTEzY1uYp2SGQxciQ1De6O_qLFw1wDHroV5qc,133
src/rules/windows__file__file_event__file_event_win_lsass_shtinkering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_lsass_werfault_dump.eql,sha256=h76z4-1807s1FiFOh7Dnh0ZSuKg9WA0_oty7U-61PVw,118
src/rules/windows__file__file_event__file_event_win_lsass_werfault_dump.lucene,sha256=4YXvnJtMaQtJxCkDQNIUWrbmEMbG-09aLcE_1SMV5ZA,99
src/rules/windows__file__file_event__file_event_win_lsass_werfault_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_mal_adwind.eql,sha256=w1FTe9D7VPwgNAeuc-cV6XC2awxlslH1h9h00wYoN_g,139
src/rules/windows__file__file_event__file_event_win_mal_adwind.lucene,sha256=H_ZWSJk-Dule2tDFJv3-pwdBKQfqsDfP35cQ0jagN5Q,121
src/rules/windows__file__file_event__file_event_win_mal_adwind.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_mal_octopus_scanner.eql,sha256=JZX3Mg2606hokW3M0yHJBmzn-JKhFF2PaMN2hxHZO_Y,122
src/rules/windows__file__file_event__file_event_win_mal_octopus_scanner.lucene,sha256=ZpPUvPjL4JiCkv3cUyEJMSoTYiMLiogQ8iXYCKJdJmg,104
src/rules/windows__file__file_event__file_event_win_mal_octopus_scanner.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_msdt_susp_directories.eql,sha256=0HLFEpaJnYyaI4PrSqIMNey-rsIhh0T3MTkOS_hgRkg,190
src/rules/windows__file__file_event__file_event_win_msdt_susp_directories.lucene,sha256=4Oth87rpQ7ziqxzLVwFqij2JXm8kGIusdHo6lj14uVc,169
src/rules/windows__file__file_event__file_event_win_msdt_susp_directories.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_mysqld_uncommon_file_creation.eql,sha256=DrtAvVdNyZ0WNyd0bklvxNqnHpH9n07Ko1hRbC3bSHI,171
src/rules/windows__file__file_event__file_event_win_mysqld_uncommon_file_creation.lucene,sha256=ebZCkysL5xe7p_xWx7AiC5VOWAB7q0WAwydwberX6NY,146
src/rules/windows__file__file_event__file_event_win_mysqld_uncommon_file_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_net_cli_artefact.eql,sha256=ov0KdfSD16E1SexTNoag0LWBijwSPPtvJs6t2L2bHxE,585
src/rules/windows__file__file_event__file_event_win_net_cli_artefact.lucene,sha256=IxtApl-pnQ2Tmpm0JOE3tjKaeiVFAqiYFtTU5yg75s8,559
src/rules/windows__file__file_event__file_event_win_net_cli_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_new_files_in_uncommon_appdata_folder.eql,sha256=iyChbDZi8ffjo5uycTPfqSamdb3jOCh-Q5kveZ31TZI,354
src/rules/windows__file__file_event__file_event_win_new_files_in_uncommon_appdata_folder.lucene,sha256=1jSPPEFZhg9tSX6hwv5uXB9tVBd7Vp6IuZ4RgtewQ80,318
src/rules/windows__file__file_event__file_event_win_new_files_in_uncommon_appdata_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_new_scr_file.eql,sha256=IzC7yijzGA23jlXiMiSLZkiW7lWat_r8M5b-YFsT4JU,195
src/rules/windows__file__file_event__file_event_win_new_scr_file.lucene,sha256=dcAl9wBCWFEoRc01gkYXSJRTYL_PJM--YWP_MN-C6JA,176
src/rules/windows__file__file_event__file_event_win_new_scr_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_notepad_plus_plus_persistence.eql,sha256=dF6nTFrjuFkFfZHYtdW4mmiC0MYFVUk7v7vbNF4m8u4,661
src/rules/windows__file__file_event__file_event_win_notepad_plus_plus_persistence.lucene,sha256=Rin-kA2_Kgxe8X9E9s0QtgEcMtlOG38tt1tmd3SCJTI,639
src/rules/windows__file__file_event__file_event_win_notepad_plus_plus_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ntds_dit_creation.eql,sha256=_Hw663aVjevVlaK14bzjinEeE7QEswPyxUDlQyP0uJc,32
src/rules/windows__file__file_event__file_event_win_ntds_dit_creation.lucene,sha256=CFx59JcHY6zuiVTwec20nojelFdNk9uaaVgt8BpVjCg,20
src/rules/windows__file__file_event__file_event_win_ntds_dit_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_parent_process.eql,sha256=wQ1LLj3Os37ZNYZCWYvG9BZbwRVCSUQ3x-7gJmAmD4E,343
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_parent_process.lucene,sha256=I17cSQ8vZaZy1DFtQ2liBzZ8cmrl_DIdN8o_AP-8Ano,312
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_parent_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_process.eql,sha256=nAs6UUZQ0mvLITZfshNbVLWdDYv7A2XbJjZ8taaMJxI,331
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_process.lucene,sha256=Uh603vv-N-EpjrYJ1q-jrQRmY_kkuAAZUqp4ewd6VxY,299
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ntds_exfil_tools.eql,sha256=LyRJP9YXeeCTt3eCm5fYNDq-r_DmIbjdbdvoF2zBuAc,61
src/rules/windows__file__file_event__file_event_win_ntds_exfil_tools.lucene,sha256=TrF_5R7iarKbDo4x7c3uSusVrBZop0kCpmrVk9gQcTo,43
src/rules/windows__file__file_event__file_event_win_ntds_exfil_tools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_addin_persistence.eql,sha256=XyWqqDh4DCDrn5JC6HUWL4kmEm0bAWBi1O6aUkO5GEo,311
src/rules/windows__file__file_event__file_event_win_office_addin_persistence.lucene,sha256=cRlK1j68JK9OV-CDLbxktBD2sMqJQc6Sqx9HZ6X8su4,275
src/rules/windows__file__file_event__file_event_win_office_addin_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_macro_files_created.eql,sha256=54fQTMun3v7Ic-xqtURX2wOllF9ZXyMArvX9V5J-92E,87
src/rules/windows__file__file_event__file_event_win_office_macro_files_created.lucene,sha256=QrAR_TH68s-Y87lq5K60hTeGNePambT16wZF8iV4DyE,69
src/rules/windows__file__file_event__file_event_win_office_macro_files_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_macro_files_downloaded.eql,sha256=7r4kzxR-8cFjzWrHK2OyXQcw0fOw4exr2_3Lt56iJ4k,546
src/rules/windows__file__file_event__file_event_win_office_macro_files_downloaded.lucene,sha256=BCgJV18YQExTpdADGDCjBxeJAP2nf4n0l1ikBNN6zTk,518
src/rules/windows__file__file_event__file_event_win_office_macro_files_downloaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_macro_files_from_susp_process.eql,sha256=RLglB5BmCaRibnw31YRXHlJsbR3h5V_amVr8THipv3c,341
src/rules/windows__file__file_event__file_event_win_office_macro_files_from_susp_process.lucene,sha256=jBV0NqW2pV4kXn2nQgaNNQr8Ee6GdDTIqDfThiYc-tw,307
src/rules/windows__file__file_event__file_event_win_office_macro_files_from_susp_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_onenote_files_in_susp_locations.eql,sha256=FefzjoVbVtq88x28RDYWk2f073hPwIR7_Wj351YeXaI,278
src/rules/windows__file__file_event__file_event_win_office_onenote_files_in_susp_locations.lucene,sha256=jn7Z5OCCBzPGYNKwfy1t7MW9UiH9jXSkdaEFmUO7PZo,247
src/rules/windows__file__file_event__file_event_win_office_onenote_files_in_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_onenote_susp_dropped_files.eql,sha256=r6c5BZQ4Fyh3Q8O2hiurcNMH5x2up248cbRpgm1mQZc,296
src/rules/windows__file__file_event__file_event_win_office_onenote_susp_dropped_files.lucene,sha256=-bb-nTn8gBLwzuLeZSNEPOIHFudvrdAuITGaDc8gaOU,267
src/rules/windows__file__file_event__file_event_win_office_onenote_susp_dropped_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_outlook_macro_creation.eql,sha256=5o7psm0LVFKdyEjnA1yrOQ63eH4_FVTNKyUr63pRV3o,100
src/rules/windows__file__file_event__file_event_win_office_outlook_macro_creation.lucene,sha256=2YbISkQfhmJl5sDkaxqxdmGNoIR56xOS6_w38oJwBls,86
src/rules/windows__file__file_event__file_event_win_office_outlook_macro_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_outlook_newform.eql,sha256=4x2vGhklZ7q_jxdqYUJ-En3ug5IL21Hr-ZYliU2Dkm8,172
src/rules/windows__file__file_event__file_event_win_office_outlook_newform.lucene,sha256=ilgNK38gOjzEeWQqJd5Ne8YuPD1AcbL162O7j-1a-VA,154
src/rules/windows__file__file_event__file_event_win_office_outlook_newform.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_file_creation_in_temp_dir.eql,sha256=MQEJjYhX5LDXXE9GqtApLNZjsDjkijGnFxqM696mbuI,327
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_file_creation_in_temp_dir.lucene,sha256=t3CnseFtkNqklzt01lBfxopUDdj8O7ZL7zXBOqurnWY,294
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_file_creation_in_temp_dir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_macro_creation.eql,sha256=JOS7CcIA46keepKxeYhAvX51ZpFxFKycLs_v8XGrrio,106
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_macro_creation.lucene,sha256=HMgEHBLDgvso3Xba8EkMXwcS0R5pqUY6MKJfNsSEPJs,92
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_macro_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_publisher_files_in_susp_locations.eql,sha256=rTguZum3suU5pzkm8EgpgH-4EK2TSfowCacK7N2Hrb8,143
src/rules/windows__file__file_event__file_event_win_office_publisher_files_in_susp_locations.lucene,sha256=zRIOQ8N2Apv_OijSk_OG2fyFHmrcagVWVQYGn0NduCI,120
src/rules/windows__file__file_event__file_event_win_office_publisher_files_in_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_startup_persistence.eql,sha256=rKDmi_M5say84FYHJuNdp0byhGJvmRxBS4x_B05jqW4,509
src/rules/windows__file__file_event__file_event_win_office_startup_persistence.lucene,sha256=lQXvX_87stqf-TZDQNaswpF1l5EI4uMlRA_CBEHPt7Y,461
src/rules/windows__file__file_event__file_event_win_office_startup_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_susp_file_extension.eql,sha256=Fij9U37cLzC2KEXvEt_iL5i1N3_L5MWIYxBnE5GoFa8,853
src/rules/windows__file__file_event__file_event_win_office_susp_file_extension.lucene,sha256=Ax0DQ6MyQnh-4Q80xnOxAgvhBviqDibU4z90KhqCZ8Y,790
src/rules/windows__file__file_event__file_event_win_office_susp_file_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_uncommon_file_startup.eql,sha256=cZIyLisX20oD6q4YuAQmVp5HSoLu1Cw-0Ai0ddomp70,833
src/rules/windows__file__file_event__file_event_win_office_uncommon_file_startup.lucene,sha256=V69AJ9ixObrwQZJf8wrFTAzk7zFSK9zKEkHod1q9oY0,783
src/rules/windows__file__file_event__file_event_win_office_uncommon_file_startup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_pcre_net_temp_file.eql,sha256=nFSitYaSTmQtmyr52UgOx_MMY9f-CK_H-lYsPTExS_A,83
src/rules/windows__file__file_event__file_event_win_pcre_net_temp_file.lucene,sha256=HE1Oo7o7IsebBf3B-tRHyCypnA800w9SSK_3ejCvQLA,70
src/rules/windows__file__file_event__file_event_win_pcre_net_temp_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_perflogs_susp_files.eql,sha256=_LRk2nMy9VhoCmfqhYEPdfNmOzUMFKJatLejXip6ZMQ,204
src/rules/windows__file__file_event__file_event_win_perflogs_susp_files.lucene,sha256=IwlnKHo-EzxCc6V4ea3SWC2GsCJTslzuTnzeeBmlwq8,184
src/rules/windows__file__file_event__file_event_win_perflogs_susp_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_drop_binary_or_script.eql,sha256=l74cJ-7KDcVN7iLyofuYeWIMoOH4V2iNgltNNy_Wl68,750
src/rules/windows__file__file_event__file_event_win_powershell_drop_binary_or_script.lucene,sha256=16b6FVUGay2GYiATTcrAB7GgJD6a1HLY5ugUhEQzCGU,685
src/rules/windows__file__file_event__file_event_win_powershell_drop_binary_or_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_drop_powershell.eql,sha256=g1xpZ_WcvzIWAmEgeaYvo4klOK4ZhoYplt6nKD0-Yxg,255
src/rules/windows__file__file_event__file_event_win_powershell_drop_powershell.lucene,sha256=MASOCtaMNwwfhoC-ONCO2DX2KcZWvXzvju_D4KCs-4M,226
src/rules/windows__file__file_event__file_event_win_powershell_drop_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_exploit_scripts.eql,sha256=m6uAw_PJi6CnSj29a_jO_BOsSnhTrBiBgWkY32-jQsU,6317
src/rules/windows__file__file_event__file_event_win_powershell_exploit_scripts.lucene,sha256=pBfKBF8QIFQND2_kOg7mhJ-0VP8lwoz04pwnrlKbLuc,6503
src/rules/windows__file__file_event__file_event_win_powershell_exploit_scripts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_module_creation.eql,sha256=-jQBp3wKqz0nANT_fNkfzNmqNXOLvj5d7XKY_JR37AY,165
src/rules/windows__file__file_event__file_event_win_powershell_module_creation.lucene,sha256=R2bFRM0xPfsS6LNXXzBV3u2hDSTQ3ZnOjw6vK_VdqnQ,137
src/rules/windows__file__file_event__file_event_win_powershell_module_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_module_susp_creation.eql,sha256=ft5_cO8KeYaE-DPP0ZnZ2tZD9dTYV83YHMN7cucl4NA,110
src/rules/windows__file__file_event__file_event_win_powershell_module_susp_creation.lucene,sha256=8vgmnlIm1AyKiPHrV7-YAbW1fnpUPxl2WluEK8Mex9M,90
src/rules/windows__file__file_event__file_event_win_powershell_module_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_module_uncommon_creation.eql,sha256=jzM2AS2hNvWI9LV7gQO09d4jn8tYS-IlPI1eQAzO3a0,692
src/rules/windows__file__file_event__file_event_win_powershell_module_uncommon_creation.lucene,sha256=Tl57ztI-vYEUE1JkNuW6lZbaAZKAT6qc4BM3gNffkw4,669
src/rules/windows__file__file_event__file_event_win_powershell_module_uncommon_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_startup_shortcuts.eql,sha256=oBimeMj-N-w5MtjV5vRo0l2srMOjlCqI0sZ7OHqCIvE,148
src/rules/windows__file__file_event__file_event_win_powershell_startup_shortcuts.lucene,sha256=nSckIKnWvb-309C53FZVZaFbhXg7uem-qFuaMd8bGzg,126
src/rules/windows__file__file_event__file_event_win_powershell_startup_shortcuts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ps_script_policy_test_creation_by_uncommon_process.eql,sha256=HgH_OOiaz0x-dIJ1AiqhCSgvf_mQ7uHXtqOnBmrzypI,902
src/rules/windows__file__file_event__file_event_win_ps_script_policy_test_creation_by_uncommon_process.lucene,sha256=SKTgbdBxt8u6Y0jRxjc5UA2OOK3b5WQXZfouS3jBVcA,880
src/rules/windows__file__file_event__file_event_win_ps_script_policy_test_creation_by_uncommon_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_rclone_config_files.eql,sha256=8yTnOWH_RLLpDOtFqKEp6AGb_Uj6aPX61TQV6s0upuw,73
src/rules/windows__file__file_event__file_event_win_rclone_config_files.lucene,sha256=8GFrPA5VH5rIKK66A6hGKuUVKFZnwZ4mUL2jdd95pmc,58
src/rules/windows__file__file_event__file_event_win_rclone_config_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_rdp_file_susp_creation.eql,sha256=uB5KtEu4vO1gkZeThRUbpk9dfizYkmvabCHTFoS0G9c,490
src/rules/windows__file__file_event__file_event_win_rdp_file_susp_creation.lucene,sha256=uyKpdN-NzT_dS7wg2IzkVV0ZU5UyX7qmspTPGjkpduU,471
src/rules/windows__file__file_event__file_event_win_rdp_file_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_redmimicry_winnti_filedrop.eql,sha256=_I0ddL1X3_NjC7vKo4phzBCv60VMzOu_-26oiz3aDtg,99
src/rules/windows__file__file_event__file_event_win_redmimicry_winnti_filedrop.lucene,sha256=JD18SNSoYQtLSHU4kdQkNX5LXX4pr4wqtQZsD13bdFk,83
src/rules/windows__file__file_event__file_event_win_redmimicry_winnti_filedrop.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_regedit_print_as_pdf.eql,sha256=1BCQBZWDCq1sKvKusHRgRU39pUzOcjegMLqAfBr9GSU,68
src/rules/windows__file__file_event__file_event_win_regedit_print_as_pdf.lucene,sha256=7_DDUbnDaOyhisfyabhYR2RLECrwWEMpuPBewFKq0ak,54
src/rules/windows__file__file_event__file_event_win_regedit_print_as_pdf.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_remcom_service.eql,sha256=-y1tTe6G77WU_mWyaLw-LAdWJVST1qItnhxRJ2WQDDA,39
src/rules/windows__file__file_event__file_event_win_remcom_service.lucene,sha256=oa0_UWSPxw1qcGTUkdOxC8dNymXl_eo9zVDX7S2U1dg,27
src/rules/windows__file__file_event__file_event_win_remcom_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_artefact.eql,sha256=VGV3WSUdHdnjKfyj0yx_m_-5U5MmP80AB3i-AM2098s,46
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_artefact.lucene,sha256=1NAeA9rN8r-Pmvgt5iwurMXjlshC5j-zH6Y2Yaa_tnc,34
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_remote_file.eql,sha256=RWz5-i02QQsJ5yu5u9hFZxq3_ZQUa2STmPqqYlnJvzw,124
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_remote_file.lucene,sha256=OWnDJkzyz4R3NGiQ35emgiHez1N3gW7pZsqvpXEouYw,109
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_remote_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ripzip_attack.eql,sha256=n2_L8ZDTB6AaSamlfJIrTczY4ghvVfGO6XdJxH8D8co,181
src/rules/windows__file__file_event__file_event_win_ripzip_attack.lucene,sha256=xHojH03B-0uO8uHhv21r9j_9NhNqTgubrbKW5T-8ad8,172
src/rules/windows__file__file_event__file_event_win_ripzip_attack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sam_dump.eql,sha256=I2Rx4VlSU03DZx_iVGZ7GFpEpbfDINVzZKTLEQm-K4Y,418
src/rules/windows__file__file_event__file_event_win_sam_dump.lucene,sha256=7o8o9WC0NNlylNmITYdIPvKwzatVy4JJYqg5zBXZ1_A,394
src/rules/windows__file__file_event__file_event_win_sam_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sed_file_creation.eql,sha256=YfvuWbXzmzwyUWtTyWNFsT2c5rjpkeDzMrL-9xLHlFs,202
src/rules/windows__file__file_event__file_event_win_sed_file_creation.lucene,sha256=6ruaoIqpO89rbYY2Ie2Dysau4lTHlJLt4UuJ_W2X5OE,181
src/rules/windows__file__file_event__file_event_win_sed_file_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_shell_write_susp_directory.eql,sha256=c2s6W_Q7BygvXUC_VMacHa4UdTs29xAJTjMZJA_IS_s,475
src/rules/windows__file__file_event__file_event_win_shell_write_susp_directory.lucene,sha256=Jwkc74qzxZOsyZpcpbOgZD8xVuvDX92YjcREtjypc2c,433
src/rules/windows__file__file_event__file_event_win_shell_write_susp_directory.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_shell_write_susp_files_extensions.eql,sha256=D2Ift3hWX3IRWkz3OD7zSS8C-Dkpd_f3Rn36ipuQ6lY,1335
src/rules/windows__file__file_event__file_event_win_shell_write_susp_files_extensions.lucene,sha256=4k_afbhW5l1exXc5R3lMb-QUOVLSKnFy_BCop38-bHM,1254
src/rules/windows__file__file_event__file_event_win_shell_write_susp_files_extensions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_startup_folder_file_write.eql,sha256=seatVQbm4lre-QZj0-y2bI_LoGeDPTlX5s83jkFAYSU,375
src/rules/windows__file__file_event__file_event_win_startup_folder_file_write.lucene,sha256=EoKxwmtsdOK43znTjrep5XPwLTCrUQqVnb8wfwFIJzA,349
src/rules/windows__file__file_event__file_event_win_startup_folder_file_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_colorcpl.eql,sha256=_GGN7VGaDOof8eU7Ec_rfM0ax6zOXMAwRda6ZYPoF1k,115
src/rules/windows__file__file_event__file_event_win_susp_colorcpl.lucene,sha256=4v2v-kgyUjIKm96AkbkTZduDqt393y4uXlQxHz3xlpk,95
src/rules/windows__file__file_event__file_event_win_susp_colorcpl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_creation_by_mobsync.eql,sha256=gps5dlKKfeYc9lJNjKlcxgB78BR-Z1Mb0WogWgEZiOQ,87
src/rules/windows__file__file_event__file_event_win_susp_creation_by_mobsync.lucene,sha256=rvGw83QBXtLZJP3FVEpI3jkfLpnclUneHDBRbLsXQLk,67
src/rules/windows__file__file_event__file_event_win_susp_creation_by_mobsync.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_default_gpo_dir_write.eql,sha256=0ZlVirDUx6TWwDtnBy1vwBNzGUXflS1LYdRzPG9Pl2M,118
src/rules/windows__file__file_event__file_event_win_susp_default_gpo_dir_write.lucene,sha256=WRPkW4mQd0X9ReqdhPZ5TVl2AKjbmfcv7TZd_zEMLBw,103
src/rules/windows__file__file_event__file_event_win_susp_default_gpo_dir_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_desktop_txt.eql,sha256=VxI18M3NWmEJ61YJj1IcOUrnmhfU3Bbty3loyBYEejo,124
src/rules/windows__file__file_event__file_event_win_susp_desktop_txt.lucene,sha256=QfCUoY7jkoZ0aSjxJ5fe1iDwRsxUICRj1vMRAuee49g,104
src/rules/windows__file__file_event__file_event_win_susp_desktop_txt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_desktopimgdownldr_file.eql,sha256=1f6VCDszDBG1yhU3VoKwNkgDFAASq6RNnk9StvE1QSI,201
src/rules/windows__file__file_event__file_event_win_susp_desktopimgdownldr_file.lucene,sha256=wcPw8Fnblxdz20BBwhmQcYPrWDxksWUea7gbj9aBiuI,176
src/rules/windows__file__file_event__file_event_win_susp_desktopimgdownldr_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_diagcab.eql,sha256=lXpnJ0_jmgJTfmYVjBmoJ9bmocVsbjEDX85TakQy0U8,32
src/rules/windows__file__file_event__file_event_win_susp_diagcab.lucene,sha256=snA_uvnzG9Snuzt_h3KNdQCmHPzvmQU2Ekg-YyENmZk,20
src/rules/windows__file__file_event__file_event_win_susp_diagcab.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_double_extension.eql,sha256=v_OVTarmSdRCD3mIxNL2HfXTVKgM_wWhtfcO_MR6QmM,327
src/rules/windows__file__file_event__file_event_win_susp_double_extension.lucene,sha256=K4ak39CIujRYH8MRwSHKVvk6Rf-_nlfx80qTxYYbA0w,293
src/rules/windows__file__file_event__file_event_win_susp_double_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_dpapi_backup_and_cert_export_ioc.eql,sha256=rug_21PN4GW2qFiyXok1dC32eyYJ9tFZlTNldecYK4Y,141
src/rules/windows__file__file_event__file_event_win_susp_dpapi_backup_and_cert_export_ioc.lucene,sha256=OUkLJWZiPavEPYZlna1fL82ZmPesNhnCSKp7vP3qbt0,115
src/rules/windows__file__file_event__file_event_win_susp_dpapi_backup_and_cert_export_ioc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_exchange_aspx_write.eql,sha256=FjQQorxGQ10zM-KB5734i0X1lmQz8U8QFCGRVXoV9qo,109
src/rules/windows__file__file_event__file_event_win_susp_exchange_aspx_write.lucene,sha256=V0K9h6yuVTS2BmtKd2WqlG3foWmUqLGs994b4n5OOEU,89
src/rules/windows__file__file_event__file_event_win_susp_exchange_aspx_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_executable_creation.eql,sha256=0zxEwiN_z6R4KOmXz4rPgs9t__cAsHxOE5X_G7bKH8Q,171
src/rules/windows__file__file_event__file_event_win_susp_executable_creation.lucene,sha256=iTZ2TD3YW9OIi_OYoST_l3-O8-6YYrN-ovF8hkkgTWc,160
src/rules/windows__file__file_event__file_event_win_susp_executable_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_file_write_in_webapps_root.eql,sha256=Ke1gADZndGL5Eg9wQzZuag0ssHEaQM2fTX2UPkW4FFA,194
src/rules/windows__file__file_event__file_event_win_susp_file_write_in_webapps_root.lucene,sha256=gVFmdhKul1I8DDfbtJaztgv_rcNRFMQg_cN0taqXyiA,163
src/rules/windows__file__file_event__file_event_win_susp_file_write_in_webapps_root.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_filewrite_in_sharepoint_layouts_dir.eql,sha256=pqWX41gkF_IKkuvEczVGGRHspMj1JMT86XVtlQErVlk,584
src/rules/windows__file__file_event__file_event_win_susp_filewrite_in_sharepoint_layouts_dir.lucene,sha256=8OBKHpP6baRmLwgIQidhj6HJHO_BKrZqz9x43iwPvMQ,553
src/rules/windows__file__file_event__file_event_win_susp_filewrite_in_sharepoint_layouts_dir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_get_variable.eql,sha256=r-h_qX7UbK1303lrPxAqb1VE1F3gRaNbAiXmVd8mpaw,71
src/rules/windows__file__file_event__file_event_win_susp_get_variable.lucene,sha256=MErl4bmtQu9obzwvtKB1ZpI8X5ooyd71moXuca4hITs,60
src/rules/windows__file__file_event__file_event_win_susp_get_variable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_hidden_dir_index_allocation.eql,sha256=BtuUvrSZI6h2DSV9KbLkQguGlGYN9PZ-OPCm8QKQP7E,44
src/rules/windows__file__file_event__file_event_win_susp_hidden_dir_index_allocation.lucene,sha256=gVl7AxdVdSHyJiUrgXx2ybVW4HRBELZ5lPmYhUPLFnE,34
src/rules/windows__file__file_event__file_event_win_susp_hidden_dir_index_allocation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_homoglyph_filename.eql,sha256=Mb05f6t5vTTa8qFxQbIzm6A8UnT2Bg6Upj4626svbvg,435
src/rules/windows__file__file_event__file_event_win_susp_homoglyph_filename.lucene,sha256=Jfbz8aWhhE9__qQhpuJuWL_VnJs_8JOScaoPswX53Z4,409
src/rules/windows__file__file_event__file_event_win_susp_homoglyph_filename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_archive.eql,sha256=qXT2uvRIisiI4wpkp6UI2YiYT33Oj8VcIEccf9TTyRw,471
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_archive.lucene,sha256=WUFb22ytFxaSnZzOOUb6N9Z-6GiYYUDpJmnNjS87-K0,445
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_archive.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_exe.eql,sha256=vCLF8ecMbbuJ2nn5VAP66MLra9glRSPSXuDsqFCTM88,327
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_exe.lucene,sha256=W50qj-QsMRWzAGuO41eZ9WMj8QGpMyAWS7yk-f70B5E,301
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_script.eql,sha256=Ha4fQECnMp2cvvV8xMErhiAKGO4n3ndfheharohRAAk,354
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_script.lucene,sha256=CUgfVPIPTP53SmHCBnUT5vL2zeCsxLHTR3BMCgg1xQU,328
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_lnk_double_extension.eql,sha256=pzhWeO7hJna8KMkk40UF8JzOpvvuukGosQzjmGMTKzA,669
src/rules/windows__file__file_event__file_event_win_susp_lnk_double_extension.lucene,sha256=kjvVERdPdcMCQEoTvts0UeZHjsho_pd-N6w0ZGwxMZI,623
src/rules/windows__file__file_event__file_event_win_susp_lnk_double_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_powershell_profile.eql,sha256=l8qzXTIT4QPoTthe15QHf3KVQfYTO6-huLa5G81XMBI,299
src/rules/windows__file__file_event__file_event_win_susp_powershell_profile.lucene,sha256=hklp9F1AHyNHtU89xCyFEAQQCSmibyTgkRS15-_A4-Y,284
src/rules/windows__file__file_event__file_event_win_susp_powershell_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_procexplorer_driver_created_in_tmp_folder.eql,sha256=rjQu4svMaMoXNvPWRnVi4OLjrOofpEmfaMO6SdESNvs,201
src/rules/windows__file__file_event__file_event_win_susp_procexplorer_driver_created_in_tmp_folder.lucene,sha256=cp0UfY3-qlurM52vMemJDJGzMzfrR0wh0ZGMsJXlobk,178
src/rules/windows__file__file_event__file_event_win_susp_procexplorer_driver_created_in_tmp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_public_folder_extension.eql,sha256=REY4T8Xas1Py6Tp6_abSYZ7FPrx1c9KlDI7s2IKVlm8,137
src/rules/windows__file__file_event__file_event_win_susp_public_folder_extension.lucene,sha256=64is2XV5Y8fRVWK000hqsLHUWDM9VmGGg3iavsLnW5o,117
src/rules/windows__file__file_event__file_event_win_susp_public_folder_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_recycle_bin_fake_exec.eql,sha256=qKpQl6USwRNUp14QB43Y_H98IV5xf8jS8L9egUeWw8A,142
src/rules/windows__file__file_event__file_event_win_susp_recycle_bin_fake_exec.lucene,sha256=1ZwU7APAzvmZE-GMDwk2t6i3vZjvIjGh1vo5pQOMjnU,112
src/rules/windows__file__file_event__file_event_win_susp_recycle_bin_fake_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_right_to_left_override_extension_spoofing.eql,sha256=bR0hdnBRtt6JMC8lYvnJVm3HtoCN25Kdss3RyjsS40w,274
src/rules/windows__file__file_event__file_event_win_susp_right_to_left_override_extension_spoofing.lucene,sha256=RCZhju72rBrOqEshkmXUieb6AsecANQYt0-8zceFqJA,251
src/rules/windows__file__file_event__file_event_win_susp_right_to_left_override_extension_spoofing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_spool_drivers_color_drop.eql,sha256=Odlhc7iR0p0387Zf_jQKiaE1mTbMiOjOkcETOQ-bD18,120
src/rules/windows__file__file_event__file_event_win_susp_spool_drivers_color_drop.lucene,sha256=SRBJfOLXsNHClwGsdS-spFCGjgScFlI5sLHhyONMTYI,100
src/rules/windows__file__file_event__file_event_win_susp_spool_drivers_color_drop.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_startup_folder_persistence.eql,sha256=9eWnzoCri2H3v1Oc_i_NpduD9d4h2dcalWqe7YA1DQY,244
src/rules/windows__file__file_event__file_event_win_susp_startup_folder_persistence.lucene,sha256=5-qVPMdvfyjrQP6XODvFTtau2gkdfwM6Z9NXaNAE2N0,224
src/rules/windows__file__file_event__file_event_win_susp_startup_folder_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_system_interactive_powershell.eql,sha256=51uk1N-U4OjHNo9whJ5BdNEW2uTQ7CGuO6moECYyXx8,290
src/rules/windows__file__file_event__file_event_win_susp_system_interactive_powershell.lucene,sha256=jCvsruOfglyAitz-RHmjMR14e1MxobJJGpG5SUQe01I,275
src/rules/windows__file__file_event__file_event_win_susp_system_interactive_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_task_write.eql,sha256=W7MjXR2yjUSKMByUtU5SX9d1lOOz40v7m3qMXiVDzDw,166
src/rules/windows__file__file_event__file_event_win_susp_task_write.lucene,sha256=bxId37zNdmpml8E5lby5u39jkrq9avLy6uY4_KoOqbU,146
src/rules/windows__file__file_event__file_event_win_susp_task_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_teamviewer_remote_session.eql,sha256=rdlcX_-3H4965pJCUp-ZVIsqFjvK16DvQyB0nlQEHZo,169
src/rules/windows__file__file_event__file_event_win_susp_teamviewer_remote_session.lucene,sha256=NJX0kINSpKlD0LxS1ag-lIQaFw6OkMgSqcAD7zmaMmI,147
src/rules/windows__file__file_event__file_event_win_susp_teamviewer_remote_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_vscode_powershell_profile.eql,sha256=01UFrWNMKREcn8pOQLToGA00OQG4-Z3L58JxMEWmDVQ,54
src/rules/windows__file__file_event__file_event_win_susp_vscode_powershell_profile.lucene,sha256=ylpBgZJcncmgPLTzqfmvHcaCx_bCwjJJDnPxiUbl10g,42
src/rules/windows__file__file_event__file_event_win_susp_vscode_powershell_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_wdac_policy_creation.eql,sha256=7X_aZQ1WLXWihaCM8Yfnbt2uaCbH4H-ABSD7KcP46xY,1063
src/rules/windows__file__file_event__file_event_win_susp_wdac_policy_creation.lucene,sha256=GLnxmj7BY0rD3lsQyrdRT1D776UuuJedUWiK0iqAFBE,1049
src/rules/windows__file__file_event__file_event_win_susp_wdac_policy_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_windows_terminal_profile.eql,sha256=pVlJwjnx-9EVWeqH9V92xFMgLoTwvtSsy-mfXrtolh8,252
src/rules/windows__file__file_event__file_event_win_susp_windows_terminal_profile.lucene,sha256=_buX3mZdcnXeGlcNlrZcZlAOdW5qqpQ7hKWt2STFRoU,232
src/rules/windows__file__file_event__file_event_win_susp_windows_terminal_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_winsxs_binary_creation.eql,sha256=wWcb4WF54OZf4auPnM_FMjolT_w0DTqCQvuS_EH_Jzg,190
src/rules/windows__file__file_event__file_event_win_susp_winsxs_binary_creation.lucene,sha256=-TsqDXeqKE14CBSZb8YeSo0z5kZgbOm98ORG1lB6kp0,168
src/rules/windows__file__file_event__file_event_win_susp_winsxs_binary_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_adexplorer_dump_written.eql,sha256=u-CEuMevjvyh7d33fgenxI8qY9xyFtv5gyW7QfdcwlY,144
src/rules/windows__file__file_event__file_event_win_sysinternals_adexplorer_dump_written.lucene,sha256=yj0Ru4EN61iElBIVzNZTxajtUlMxnjAA5Y1fWbGwsGM,124
src/rules/windows__file__file_event__file_event_win_sysinternals_adexplorer_dump_written.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_default_dump_name.eql,sha256=O8Zq20T1u4rnOIsKX2bWjOKpDdfmdcbcWt4SYwFWpPQ,46
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_default_dump_name.lucene,sha256=HmZ03Z2mFGV-a-yAipz4Shihu4cMOrOmUIbfwx6M91Y,35
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_default_dump_name.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver.eql,sha256=j7nhJv-ULVtc_y398R3fI2QKmffwyqa8DocEl4I_vIQ,133
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver.lucene,sha256=aLiUDl17mxNaNmLZSqyqq8FIiTi-1yM5BOFxI-Jxvn0,114
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver_susp_creation.eql,sha256=1a1LJTUq9AjzqU1SMNhutNl8W2R9hoNjjFwG1QC-G0s,139
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver_susp_creation.lucene,sha256=TRwGm2qKKmRcc2jOhYi97lXM8xDOFipJHz1qjZ7QK04,120
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_procexp_driver_susp_creation.eql,sha256=1u7MgXSrGWkawwlwJbN3HH9-xbHmf0URrtP3sJvVz98,134
src/rules/windows__file__file_event__file_event_win_sysinternals_procexp_driver_susp_creation.lucene,sha256=rR7-u2bcIED2RN5ppULk6DTYypNPTNKkRJchE26O080,112
src/rules/windows__file__file_event__file_event_win_sysinternals_procexp_driver_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_procmon_driver_susp_creation.eql,sha256=6Hzi2smm0ezOda-CxNPPNM6z53QPIiM9AMBSYcPGxck,134
src/rules/windows__file__file_event__file_event_win_sysinternals_procmon_driver_susp_creation.lucene,sha256=d9T-8Gpk3hoRE9Z3orVHEY1PqWqY_WdqLUS8fWOHTnc,112
src/rules/windows__file__file_event__file_event_win_sysinternals_procmon_driver_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service.eql,sha256=ifZQBtD5tHrDxP3KBsBX23KjAOLPgxAriQ7L4xECOg0,38
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service.lucene,sha256=I-f6iaxMvev-np9AtxcoIueM-U-8SA30yt9Thd5ZBgM,26
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service_key.eql,sha256=7OyMAT48o7rUqG5MGgnemICcR0FDFmznI0FrK-p3I9g,66
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service_key.lucene,sha256=aS2_UkdhO3yrJLzo4cacQbfmoJK8dL7Vg9AWF0fson4,54
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_system32_local_folder_privilege_escalation.eql,sha256=KNOH8okjtTXN3gHWNlJbLwUs7ioFaRxm0bDrMekAVrQ,287
src/rules/windows__file__file_event__file_event_win_system32_local_folder_privilege_escalation.lucene,sha256=M8tPrVCtqz4aURsx4fgJILNB8IiBJREPiEXdRitoUDc,272
src/rules/windows__file__file_event__file_event_win_system32_local_folder_privilege_escalation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_taskmgr_lsass_dump.eql,sha256=j_lIG0tBlnMh6nClmt8phflTS0AvusBA6HYHTzXDrh0,208
src/rules/windows__file__file_event__file_event_win_taskmgr_lsass_dump.lucene,sha256=KSX2-dpQkoLAZW4AyVb3j6GYIyWYdbFcDtAXAldb3gU,185
src/rules/windows__file__file_event__file_event_win_taskmgr_lsass_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_tsclient_filewrite_startup.eql,sha256=iY1jOoCpc2j10uDgyU9xTZ6RZ9jgmLyghGj9YvRMF6I,116
src/rules/windows__file__file_event__file_event_win_tsclient_filewrite_startup.lucene,sha256=GV6zOOshTOrMjLszsyaPupOTJFdMT1jXGEWe7X4cPrY,102
src/rules/windows__file__file_event__file_event_win_tsclient_filewrite_startup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_consent_comctl32.eql,sha256=lJmW5waex-5tc5KYSlBG6iWYldywFKhiXB1_qyuQGI8,92
src/rules/windows__file__file_event__file_event_win_uac_bypass_consent_comctl32.lucene,sha256=qT6rvAY-PDV4ckUCDnka_IxJ_MkFmycLVceTzto6X-M,79
src/rules/windows__file__file_event__file_event_win_uac_bypass_consent_comctl32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_dotnet_profiler.eql,sha256=EJ8zjZEXe_Y74prhKjobKJtRlEdIRCP63PeBLK3M6h0,86
src/rules/windows__file__file_event__file_event_win_uac_bypass_dotnet_profiler.lucene,sha256=7w-EB-a3RCn5jLT4B3zEUoVvKeanlVE_Z_o8h4dVekc,72
src/rules/windows__file__file_event__file_event_win_uac_bypass_dotnet_profiler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_eventvwr.eql,sha256=-78D-25l5WVWdHotjZb0NOdUEHaIxrEpDZow-TMwPOE,205
src/rules/windows__file__file_event__file_event_win_uac_bypass_eventvwr.lucene,sha256=Fh4YqSDiDPY6zI_fwyvkl9D0ao6PbHZUK74FN5BUyUg,181
src/rules/windows__file__file_event__file_event_win_uac_bypass_eventvwr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_idiagnostic_profile.eql,sha256=QTwvlBFjVRMC3PVjnclSJNZGtDXIYWlHr4_vKVchLhg,109
src/rules/windows__file__file_event__file_event_win_uac_bypass_idiagnostic_profile.lucene,sha256=UhRXskfAdkdDcYhqbszpNa24l2EuBO3mvoQ9hP5Dy2s,93
src/rules/windows__file__file_event__file_event_win_uac_bypass_idiagnostic_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_ieinstal.eql,sha256=WJYef1YURVNLUuVUBS12q5JfxHKQ6QAa1R1wdTFBZho,183
src/rules/windows__file__file_event__file_event_win_uac_bypass_ieinstal.lucene,sha256=wnFnzR4-Ra5o9rzLmAeHGY5Vwg-rI3ZuZsBgDsqT6bI,167
src/rules/windows__file__file_event__file_event_win_uac_bypass_ieinstal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_msconfig_gui.eql,sha256=l69_5AQ_KipjFKZ58IhfNAOT65Q-Gm0qOVzV0w9o3Xk,87
src/rules/windows__file__file_event__file_event_win_uac_bypass_msconfig_gui.lucene,sha256=gbA7-A0dkrsSLdx5nvJBWRt1TX_febr-vh6sQYMc08A,73
src/rules/windows__file__file_event__file_event_win_uac_bypass_msconfig_gui.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_ntfs_reparse_point.eql,sha256=6gYF2FEK17K8eoEOdJ5PKJzhaTct8EXJ-u4Kytb4JbY,115
src/rules/windows__file__file_event__file_event_win_uac_bypass_ntfs_reparse_point.lucene,sha256=qKzRu-hbabWjN-yz2L4_OMfdFjlrkvCIfY4kbWbknLo,107
src/rules/windows__file__file_event__file_event_win_uac_bypass_ntfs_reparse_point.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_winsat.eql,sha256=GVgGQrrEn4Z_mNscodECDWv404UMrPMVMWe1I1ntUyQ,155
src/rules/windows__file__file_event__file_event_win_uac_bypass_winsat.lucene,sha256=Q3RGdXrrprVZdPxULPimkaE6skRfR4cd65_898p8Gqs,135
src/rules/windows__file__file_event__file_event_win_uac_bypass_winsat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_wmp.eql,sha256=NEn_UXjRyp6RK7Px5OyRHieNVZW4qT6FCNrE1WWaaQI,219
src/rules/windows__file__file_event__file_event_win_uac_bypass_wmp.lucene,sha256=lczM4msK1_Q-GbXPW_fJd5k4cQ003erc-gI2tmsTl1w,206
src/rules/windows__file__file_event__file_event_win_uac_bypass_wmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_vhd_download_via_browsers.eql,sha256=LTIQF5TVeZThZHOk_dHwhiZDA9sW_dlgzIqDMOhsVuM,302
src/rules/windows__file__file_event__file_event_win_vhd_download_via_browsers.lucene,sha256=zGm3s6TSXawRtteHKpB3BNunyqpmQLx6bAkgsOVNNc8,282
src/rules/windows__file__file_event__file_event_win_vhd_download_via_browsers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_remote_creation_artefacts.eql,sha256=EB7NtyV-KpSOOLkNlHuo1YNVZPWxowYWgA4cLsofjsc,155
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_remote_creation_artefacts.lucene,sha256=PbgfKPwQClK1off-KDH4faoNpYwxSiDt5kIBmxgjB0M,140
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_remote_creation_artefacts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_renamed_execution.eql,sha256=dFKyMgbHoZvVxt3WBVJcStTbyUOwOpbK_wVU42mVAUs,117
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_renamed_execution.lucene,sha256=BmRd5fepz0ts2WVFpQNRdM7rV0BkocqtQ1EWyz_VcaI,98
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_renamed_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_webshell_creation_detect.eql,sha256=JFO8XhIi63aJvzx3mrFRI-_csCPkt23EMqJ0swI1Owk,342
src/rules/windows__file__file_event__file_event_win_webshell_creation_detect.lucene,sha256=Y-EBpMI7LZ8K4dl5eSs9E2rbYXUN1C7FcpNS9sor6so,294
src/rules/windows__file__file_event__file_event_win_webshell_creation_detect.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_werfault_dll_hijacking.eql,sha256=afHjM_rmolAkTvVwEYFh32QAdq1A5n8O6M0J5BEn6EY,243
src/rules/windows__file__file_event__file_event_win_werfault_dll_hijacking.lucene,sha256=c0yNFnxfVLgnMzj54h0xjnj7aWY64W8tY2c72a3oucw,217
src/rules/windows__file__file_event__file_event_win_werfault_dll_hijacking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_winrar_file_creation_in_startup_folder.eql,sha256=QJ7ZhrjACysX5FDRTVQihOtaa7xqNfuqdbe8heMf_Cw,121
src/rules/windows__file__file_event__file_event_win_winrar_file_creation_in_startup_folder.lucene,sha256=v848tTfRjYDnDWE3y3TbrjF9EByrYn4ksOyowpQalIY,101
src/rules/windows__file__file_event__file_event_win_winrar_file_creation_in_startup_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_winrm_awl_bypass.eql,sha256=ipIyTtX50sPEopFylsUwdjp0_h79ZowAPXwKBSde0mc,144
src/rules/windows__file__file_event__file_event_win_winrm_awl_bypass.lucene,sha256=4lkDCFxuuvSthktQt_O7WjuQr_Y19FnLbb7i-nrrXhc,118
src/rules/windows__file__file_event__file_event_win_winrm_awl_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_wmi_persistence_script_event_consumer_write.eql,sha256=EBr8C1frP8hif0uFfs1S_kXYG-IML39LHKwXFlgNZz8,72
src/rules/windows__file__file_event__file_event_win_wmi_persistence_script_event_consumer_write.lucene,sha256=r-KH0S-mWgM12ba5O4Pb87DghztZk3gKh72gQVP5Kmg,61
src/rules/windows__file__file_event__file_event_win_wmi_persistence_script_event_consumer_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_wmiexec_default_filename.eql,sha256=7ej3TfQdV1klLxsOB3Q-NIJl1BsiOBSDIsYNOCBSHTY,130
src/rules/windows__file__file_event__file_event_win_wmiexec_default_filename.lucene,sha256=TxqWbQ6F2Vii_ylfkNR5IkcA_9y2jq7P-2ilwZEURko,341
src/rules/windows__file__file_event__file_event_win_wmiexec_default_filename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_wmiprvse_wbemcomn_dll_hijack.eql,sha256=L-7YiA4ttTNlWX1GdsZMtwCQSGG7G2ybkrsVZEBxuqs,76
src/rules/windows__file__file_event__file_event_win_wmiprvse_wbemcomn_dll_hijack.lucene,sha256=LSe_otauM760ld5qapQmZTYWjn6HugAEQVxsc7LJW4I,62
src/rules/windows__file__file_event__file_event_win_wmiprvse_wbemcomn_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_wpbbin_persistence.eql,sha256=3G0UqyaddJDup8SyIasGv2D6FKrBs1D1WCKs5Ws_RDc,56
src/rules/windows__file__file_event__file_event_win_wpbbin_persistence.lucene,sha256=FOtTW59x-YVNs7l9YDWWjMvD_MNqkNlaSGkq3zfCK3Y,45
src/rules/windows__file__file_event__file_event_win_wpbbin_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_writing_local_admin_share.eql,sha256=Ru1S-cSGwLXTySfSK1FReIcMTEIPhRhtOMHVd5p1-RE,63
src/rules/windows__file__file_event__file_event_win_writing_local_admin_share.lucene,sha256=FgpgNrS3i7XkdfRXcpOz_iz3nbQhNvbIoaLl2juo6cc,48
src/rules/windows__file__file_event__file_event_win_writing_local_admin_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_executable_detected__file_executable_detected_win_susp_embeded_sed_file.eql,sha256=pJU89VSU2EyMASAg9WhrkY81c5nYAh0lMMxPaTcL5SM,28
src/rules/windows__file__file_executable_detected__file_executable_detected_win_susp_embeded_sed_file.lucene,sha256=iXtAFLzwjpR1qkh11b2A0-CTccV0UPvboWX-I7d_29M,16
src/rules/windows__file__file_executable_detected__file_executable_detected_win_susp_embeded_sed_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_rename__file_rename_win_ransomware.eql,sha256=vr90IlfYNoTymg6I7nkyG7SOZmTVBcioiIqwpRrVwzE,466
src/rules/windows__file__file_rename__file_rename_win_ransomware.lucene,sha256=CJtn_w1GUcYGn-epWCIzRtYjwwYlHFsOXleqXjRTmuU,429
src/rules/windows__file__file_rename__file_rename_win_ransomware.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_clfs_load.eql,sha256=rEpiWREcdFUqroGBaLj_XYUqTDpJxGm3Z01rRLcRD6k,481
src/rules/windows__image_load__image_load_clfs_load.lucene,sha256=hKB0m4Y60mvHaiLnNQgGXnHdqTURKz7vqEZaRl_BouE,441
src/rules/windows__image_load__image_load_clfs_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_cmstp_load_dll_from_susp_location.eql,sha256=z27qQp6FANuvVnDxHt6ykt_36ixFOFpRCEWjqAZtOzQ,201
src/rules/windows__image_load__image_load_cmstp_load_dll_from_susp_location.lucene,sha256=nPjnf-X9OBog5h1q0dQz-i6IpiSZrrNbqNOs1G1DxCA,169
src/rules/windows__image_load__image_load_cmstp_load_dll_from_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_amsi_suspicious_process.eql,sha256=ZQAAOPeuI1gk0DOJozWVXrE7ZEzF5kLLHZD37l9vdUE,124
src/rules/windows__image_load__image_load_dll_amsi_suspicious_process.lucene,sha256=37dZw-skcvZ6-HPZfjVtDkWYdNT9z90kW7K9h8cE58k,104
src/rules/windows__image_load__image_load_dll_amsi_suspicious_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_azure_microsoft_account_token_provider_dll_load.eql,sha256=5zHbKIQJgxta3_62tgc_ZdaezH3LHxbUqU2nhAI90xw,1225
src/rules/windows__image_load__image_load_dll_azure_microsoft_account_token_provider_dll_load.lucene,sha256=QSlD7dKJlMNXUoJr7FMSD8x7RXhcct4PRjV4AWd-D04,1193
src/rules/windows__image_load__image_load_dll_azure_microsoft_account_token_provider_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_comsvcs_load_renamed_version_by_rundll32.eql,sha256=Msa1g-2yYL-CSGPqEqf_Fkqr_X7rkqqKlo0zp-yXUq4,354
src/rules/windows__image_load__image_load_dll_comsvcs_load_renamed_version_by_rundll32.lucene,sha256=QX4R6YGrihJzvNQyS2azEWnXYLZESwk6VxPncAZp0PY,337
src/rules/windows__image_load__image_load_dll_comsvcs_load_renamed_version_by_rundll32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_credui_uncommon_process_load.eql,sha256=9VqpCf-z6K4hSJgcipZD_Ok-08Bh1X7TP5IrGrxsviY,837
src/rules/windows__image_load__image_load_dll_credui_uncommon_process_load.lucene,sha256=tabPbzEQpgottsOUeAl1odDw6YwULeFOWBn0XscotGo,781
src/rules/windows__image_load__image_load_dll_credui_uncommon_process_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_dbghelp_dbgcore_unsigned_load.eql,sha256=SUrhpE7Tsodu67R-8ItPRmAbaGcXO1AFktxj_SzGnDg,104
src/rules/windows__image_load__image_load_dll_dbghelp_dbgcore_unsigned_load.lucene,sha256=E31wWvzeJqCm5sQJxxMu8OCHaYm_IUrZT8nx52uE-R0,84
src/rules/windows__image_load__image_load_dll_dbghelp_dbgcore_unsigned_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_pcre_dotnet_dll_load.eql,sha256=nFSitYaSTmQtmyr52UgOx_MMY9f-CK_H-lYsPTExS_A,83
src/rules/windows__image_load__image_load_dll_pcre_dotnet_dll_load.lucene,sha256=HE1Oo7o7IsebBf3B-tRHyCypnA800w9SSK_3ejCvQLA,70
src/rules/windows__image_load__image_load_dll_pcre_dotnet_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_rstrtmgr_suspicious_load.eql,sha256=-aorQJUSlSerp87dDt6b-ssaUA3CNBshoaVBlEwrp7k,430
src/rules/windows__image_load__image_load_dll_rstrtmgr_suspicious_load.lucene,sha256=XAMfzem-iHIIKmqg0cHSL_sF3tGGXrs8eY9WoJW-vJI,394
src/rules/windows__image_load__image_load_dll_rstrtmgr_suspicious_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_rstrtmgr_uncommon_load.eql,sha256=IwHy2Yq6F4ErMI-XhjWXIIsmoKpoPzsdBsbwsh6x6TE,814
src/rules/windows__image_load__image_load_dll_rstrtmgr_uncommon_load.lucene,sha256=UWMrGNt_yeitBZ5Kphlnl4d1dQR9bpppUHORIkh49E4,798
src/rules/windows__image_load__image_load_dll_rstrtmgr_uncommon_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_sdiageng_load_by_msdt.eql,sha256=Q9w1cbmRwzaMYQwkSjPW0aK-9noKbomx-S7UPe1bmKA,75
src/rules/windows__image_load__image_load_dll_sdiageng_load_by_msdt.lucene,sha256=3snfnheUDR_NFmtN59hKUWOT3O-4KTTNENQZJ1LjRVI,61
src/rules/windows__image_load__image_load_dll_sdiageng_load_by_msdt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_system_management_automation_susp_load.eql,sha256=ryWZ9sC9Klyq5rmwBsZBxrGW_y7jaEs5b_vsTxq6TZw,2442
src/rules/windows__image_load__image_load_dll_system_management_automation_susp_load.lucene,sha256=BqYGL-S20zHj4DeZmgxWI-iPOApXfsixRMuxfj5dfg4,2401
src/rules/windows__image_load__image_load_dll_system_management_automation_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_tttracer_module_load.eql,sha256=aQ9oP7mB75H7vXd2lvpzPUKsGuNa7jDEvc7QmAAkxcw,87
src/rules/windows__image_load__image_load_dll_tttracer_module_load.lucene,sha256=LN_HQnJdR_BrXtSsKLJqUZbF4-jSqe8XDyY4j1gHA9g,69
src/rules/windows__image_load__image_load_dll_tttracer_module_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_unsigned_node_load.eql,sha256=xoxdLYuV-turZsQ_3365EXA5_EIFsHZnyqcJNgUT1ws,295
src/rules/windows__image_load__image_load_dll_unsigned_node_load.lucene,sha256=ilYipWx_Ez8Nmy6D-8kADxnvCyzpt_HCnO4m3zdwpGQ,269
src/rules/windows__image_load__image_load_dll_unsigned_node_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_vss_ps_susp_load.eql,sha256=ngRnq1ex-5A5a9b9T9z8hqVZ03mlc6cJGtma_6c5PAo,801
src/rules/windows__image_load__image_load_dll_vss_ps_susp_load.lucene,sha256=bNo7kWCmDBDEd5Gdfd0qdRjMPEX8Wusy2S0WdoafXc8,777
src/rules/windows__image_load__image_load_dll_vss_ps_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_vssapi_susp_load.eql,sha256=yQUAUYdV2mp3nDTB0Y9Z6x4KFj7kX48gxmHxVd1F5hQ,622
src/rules/windows__image_load__image_load_dll_vssapi_susp_load.lucene,sha256=TQ-V0QPWojVfsbSLyOxRwiAAEblOaoU_f4hHFivT3S8,594
src/rules/windows__image_load__image_load_dll_vssapi_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_vsstrace_susp_load.eql,sha256=2gbafbI7JYoNqoTLN54O-M86oykuiJq_BLRx8Ort5G4,656
src/rules/windows__image_load__image_load_dll_vsstrace_susp_load.lucene,sha256=SCxy68smmCBWiS80lNjVxMFFWTcnN1LUb7kvNw_1SX4,630
src/rules/windows__image_load__image_load_dll_vsstrace_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_hktl_sharpevtmute.eql,sha256=HKIPTUwITJIKlJVWzqMCE2e5fwEg85U9mSe5pfPDQu4,80
src/rules/windows__image_load__image_load_hktl_sharpevtmute.lucene,sha256=LFcWyWmcSooGjA-wvO1XnKo-LZ1_bSXDEpU-eNF6Y2I,69
src/rules/windows__image_load__image_load_hktl_sharpevtmute.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_hktl_silenttrinity_stager.eql,sha256=_AmWhUcNydc1lwIxwvfr88jW8jau4wNCM-qnnQRSMhA,44
src/rules/windows__image_load__image_load_hktl_silenttrinity_stager.lucene,sha256=T75KyXXOgjXKUjBsDvvs2LD-N2yBk5Tb3XMBDGizziU,32
src/rules/windows__image_load__image_load_hktl_silenttrinity_stager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_iexplore_dcom_iertutil_dll_hijack.eql,sha256=TURYz41XJlqG683bZyUe2oGpSFwEYJjDFlh_TWZLn9U,117
src/rules/windows__image_load__image_load_iexplore_dcom_iertutil_dll_hijack.lucene,sha256=pA1F1oatJAOR1-9U8FLO6hFUMshtj_Y3hwg_X9IvcuE,105
src/rules/windows__image_load__image_load_iexplore_dcom_iertutil_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_lsass_unsigned_image_load.eql,sha256=oD02kFznZ6IRqWgT2OG9RR-rsd5suRMi8DF7Lf86ZXM,83
src/rules/windows__image_load__image_load_lsass_unsigned_image_load.lucene,sha256=1fi4g26Mcxtewigld-UhsP6sfFQReDNPZd5wG6rNDOA,69
src/rules/windows__image_load__image_load_lsass_unsigned_image_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_dotnet_assembly_dll_load.eql,sha256=62_20JoLN7vRB9sM4Y2w2F0sMCEd-ChxVLKHcrV1QLk,204
src/rules/windows__image_load__image_load_office_dotnet_assembly_dll_load.lucene,sha256=CR5dIm2l9_TpArMj99OVGPRfPlfxVkll-vMJseaCVDc,184
src/rules/windows__image_load__image_load_office_dotnet_assembly_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_dotnet_clr_dll_load.eql,sha256=a3kAAP8yWiFq35YEddF-6CpMy8-10Yc42IBQmo-a85o,191
src/rules/windows__image_load__image_load_office_dotnet_clr_dll_load.lucene,sha256=V7ZAlQgCXef_SKI5_fej316nirqAI2ld6hSAj1i_zZE,171
src/rules/windows__image_load__image_load_office_dotnet_clr_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_dotnet_gac_dll_load.eql,sha256=A69ykKEJYMMEX58Im88W3Y0ULiFsJ_SO4fcWqcaEtWI,227
src/rules/windows__image_load__image_load_office_dotnet_gac_dll_load.lucene,sha256=zzDvv1zxuMnIBXmLdujdDeUzckHn6vbG-RrkNZRfAWE,208
src/rules/windows__image_load__image_load_office_dotnet_gac_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_excel_xll_susp_load.eql,sha256=JTVuyHuoNk1jo8VDCmr1o3yar1yOq9qkDqkod79BuU4,204
src/rules/windows__image_load__image_load_office_excel_xll_susp_load.lucene,sha256=YRaW10TT3bEYcbYYoG63h2mpUjihhN8NS1kVqx7jh8g,176
src/rules/windows__image_load__image_load_office_excel_xll_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_outlook_outlvba_load.eql,sha256=U9D12QQrzn0lQC6qXOEz5ndXKho3wFlngsOc5i-O3yw,77
src/rules/windows__image_load__image_load_office_outlook_outlvba_load.lucene,sha256=v6kvDqpuXTuR76KfpFZOM9dH3_-cqFnGWt2LvnkcoRU,63
src/rules/windows__image_load__image_load_office_outlook_outlvba_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_powershell_dll_load.eql,sha256=dnqm0UODDzGVMkd5JUYur7atRSmal1VFivFm4sxoKUk,269
src/rules/windows__image_load__image_load_office_powershell_dll_load.lucene,sha256=1qTsn7PVsAIygJlfYX1OoCdE3h4gC_xXzprs48aTJAs,243
src/rules/windows__image_load__image_load_office_powershell_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_vbadll_load.eql,sha256=ZZ-2whjE_r_S7LyFHuth7QEsQR8w391dFKu0fvElUUc,236
src/rules/windows__image_load__image_load_office_vbadll_load.lucene,sha256=6SHF4EhnOE6Xy_iaahrEbL08QVmprKO_YmfV6wintiw,210
src/rules/windows__image_load__image_load_office_vbadll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_rundll32_remote_share_load.eql,sha256=V-QPyWwDStk5lvd1CVuQYr3BcqxiOagLoTZvAg2oEN4,67
src/rules/windows__image_load__image_load_rundll32_remote_share_load.lucene,sha256=bCsqb3J4hqXwG-USH3_af2KxjYjjFf-MF-V_wnNcQks,53
src/rules/windows__image_load__image_load_rundll32_remote_share_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_scrcons_wmi_scripteventconsumer.eql,sha256=WQ3hlvYjcOfjIgTBoDTyzKvHaUMa3bY0RLb1tEuxAV4,140
src/rules/windows__image_load__image_load_scrcons_wmi_scripteventconsumer.lucene,sha256=Tg-laiX1LBKtLdROrzZIiHdIwT6_TYqiazUvD_Nvfj4,120
src/rules/windows__image_load__image_load_scrcons_wmi_scripteventconsumer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_7za.eql,sha256=HYswonK7mUhzuTPLf7SAorwefuVqKnItwauxWz4piGQ,204
src/rules/windows__image_load__image_load_side_load_7za.lucene,sha256=AiJmFxeNZ33Cdg66Oc2bUy5w46Y8AZVUWHzdWV7qWaU,186
src/rules/windows__image_load__image_load_side_load_7za.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_abused_dlls_susp_paths.eql,sha256=XRDAUxslmDe4TYpLkJPrqRZROQX8CtiDbNvN7R-qOlw,488
src/rules/windows__image_load__image_load_side_load_abused_dlls_susp_paths.lucene,sha256=KjeW6ZwYslaaNneSxDFD7CSrce7Livw-jSski4owsSI,442
src/rules/windows__image_load__image_load_side_load_abused_dlls_susp_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_antivirus.eql,sha256=G54IfMNoxvqp_oW78LTnuVMsVeHe1Xx3YdAMGNh1C-k,1822
src/rules/windows__image_load__image_load_side_load_antivirus.lucene,sha256=XV6xsSExH3cjPsTeD4RvoHD_regwYIaHo_163U869Ms,1781
src/rules/windows__image_load__image_load_side_load_antivirus.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_appverifui.eql,sha256=7_CqWteWN7J0hiHZW9cdNshjhPqC4OlqCb19cEbV5sc,263
src/rules/windows__image_load__image_load_side_load_appverifui.lucene,sha256=PaThV2-QALXjjVjn8pl1Uystp6_vVgZbBV9dmcGrjm0,237
src/rules/windows__image_load__image_load_side_load_appverifui.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_aruba_networks_virtual_intranet_access.eql,sha256=9GRe8W49yYpucIYH2JVgcd_6Gpo4zqYHYHpw1DukixE,456
src/rules/windows__image_load__image_load_side_load_aruba_networks_virtual_intranet_access.lucene,sha256=1CvLMYIuc6Njgz09bAqRakamsKYN0QFassAuxzXiVgk,428
src/rules/windows__image_load__image_load_side_load_aruba_networks_virtual_intranet_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_avkkid.eql,sha256=gXLFXTjNvsvlzPDN53BZyRRuwO_SN0xbjqHl9VGluxM,280
src/rules/windows__image_load__image_load_side_load_avkkid.lucene,sha256=aQRNk9rdIa6Tsx_jU9HeRNhWh8PvcB-L56HuPIZFWNk,264
src/rules/windows__image_load__image_load_side_load_avkkid.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_ccleaner_du.eql,sha256=6ypACT7p1ML-6M_129bivl1ZFr-pA3iAFGTPbUTeB9E,226
src/rules/windows__image_load__image_load_side_load_ccleaner_du.lucene,sha256=M6dGpivUdxaHUvIXJxNeY1syrHjNhLRdaYdlRmpUqAQ,203
src/rules/windows__image_load__image_load_side_load_ccleaner_du.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_ccleaner_reactivator.eql,sha256=6RES1vUF_HIUJIGoYAjVH78pwSYDj-fqP5kdtX0IS6g,215
src/rules/windows__image_load__image_load_side_load_ccleaner_reactivator.lucene,sha256=euMmOnfWh5l47f8eSJMh_TWUbE56p3MgHy_GjgdCO_I,198
src/rules/windows__image_load__image_load_side_load_ccleaner_reactivator.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_chrome_frame_helper.eql,sha256=h61f4Pb5yCpRl-dFJ6zvkTxUwhZmRiVaO0onPPva2MQ,262
src/rules/windows__image_load__image_load_side_load_chrome_frame_helper.lucene,sha256=G2Dc2nFjPqYFg6loiclxsD94y0S2GVKUDfGOexVLIYs,244
src/rules/windows__image_load__image_load_side_load_chrome_frame_helper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_classicexplorer32.eql,sha256=wCFUn9hIHclB0XSX9D7I4v-_Na9JFS2PQB4BhBNiaIw,105
src/rules/windows__image_load__image_load_side_load_classicexplorer32.lucene,sha256=bO9BdX8lgblaAlMenAH4RTUVE0YZiskxXUirTm1ePes,93
src/rules/windows__image_load__image_load_side_load_classicexplorer32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_comctl32.eql,sha256=1j853DfaIMI4WqO3kDOxjgyqIBDpzZBrLABhugWsZiw,297
src/rules/windows__image_load__image_load_side_load_comctl32.lucene,sha256=aQkIdE1FGOo_niZmJH3NbXkn295jQ5seYr4LtSF_tkc,277
src/rules/windows__image_load__image_load_side_load_comctl32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_coregen.eql,sha256=z0-OUavWaI1G36pexLSJ_7icP30UCxvi5kuw5g8HjRk,231
src/rules/windows__image_load__image_load_side_load_coregen.lucene,sha256=ePaN8TxxnngNR201nKR_0IXFIDOQH4ITj6ZJQQ-7_7E,218
src/rules/windows__image_load__image_load_side_load_coregen.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_cpl_from_non_system_location.eql,sha256=vUYjFbxcvE5EOxko019mKU2Qh0_CU7raqXlHd9wfEj8,174
src/rules/windows__image_load__image_load_side_load_cpl_from_non_system_location.lucene,sha256=f_1Twk2zHG5u7xkSEwJeRLOk-maxq8W_39mv_ldEyP4,148
src/rules/windows__image_load__image_load_side_load_cpl_from_non_system_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_dbgcore.eql,sha256=gCoJHupNcwqFHgtBzvaVl6B7oZUjAVhVFOeyGEsLqJg,445
src/rules/windows__image_load__image_load_side_load_dbgcore.lucene,sha256=f3f3u-PBHVYgnlipIwdI92nT_d7Plvuo3Uo2bzBa4Ow,426
src/rules/windows__image_load__image_load_side_load_dbgcore.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_dbghelp.eql,sha256=Q53cTivWiqnVPayQCGSTkFcHqIPonIOeYygW1hQU0kc,722
src/rules/windows__image_load__image_load_side_load_dbghelp.lucene,sha256=MgT-NIrePCzEKpUj2mDvnR7mWuU3bPr8W-smqgEZjzY,693
src/rules/windows__image_load__image_load_side_load_dbghelp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_dbgmodel.eql,sha256=EvJ53OmSUDJ57CHUIPUOfOFaIUMNGri8PbaeRdnzXxc,328
src/rules/windows__image_load__image_load_side_load_dbgmodel.lucene,sha256=lNmcwF-qpRwt_-y3NQyjfQberinTIZ4GouXGFcC5D-4,307
src/rules/windows__image_load__image_load_side_load_dbgmodel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_eacore.eql,sha256=arQughII5jYsGHzXcDWLWkVXakz76FeyOLelVpfKCuA,234
src/rules/windows__image_load__image_load_side_load_eacore.lucene,sha256=BsG88x8qj4hhCAcma6xvGcw9x1qVWNlaYIGusnvxqQA,222
src/rules/windows__image_load__image_load_side_load_eacore.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_edputil.eql,sha256=5MedwwfrVne0bSBNXPJKUqAj1mqnX9GgHhWEYPDIB8U,147
src/rules/windows__image_load__image_load_side_load_edputil.lucene,sha256=tZ3ZuW1TsN2vEye83XrDTorTtXMbZBtTJerqoaJNqpE,126
src/rules/windows__image_load__image_load_side_load_edputil.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_from_non_system_location.eql,sha256=WFRcw14MAhEF7aqZ5A3FqRqjMEXmZfcKgDt-EYqcFs4,10108
src/rules/windows__image_load__image_load_side_load_from_non_system_location.lucene,sha256=hk8B6AyiTkvy1Zw_t1W99gbLtq7JcpH9HQZDUTIW9lU,10035
src/rules/windows__image_load__image_load_side_load_from_non_system_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_goopdate.eql,sha256=1yGn0ytTeW265EzzH5SI2O_Z8ZWqXT0LieulfiOUm54,551
src/rules/windows__image_load__image_load_side_load_goopdate.lucene,sha256=mzZUMBoBuciS9A8XMddkLbmesIk0TFMIPUXOS25grgQ,512
src/rules/windows__image_load__image_load_side_load_goopdate.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_gup_libcurl.eql,sha256=c81iCCmmUph5yhFU9fnlRhNYkYfSLRyAIw6CeR4jEVY,137
src/rules/windows__image_load__image_load_side_load_gup_libcurl.lucene,sha256=VMa03iFrVtE6w3_bF7KLLRh4tZPZIJTpHY4IP-p6wyM,123
src/rules/windows__image_load__image_load_side_load_gup_libcurl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_iviewers.eql,sha256=BgIS9LWjv4tlrHSjrm-uamd7ArEjObeBo1AeVABwlZo,149
src/rules/windows__image_load__image_load_side_load_iviewers.lucene,sha256=SYj3D7aXIAixMktNSZK0EvdDwKxzZ_HwUkq3fojcPDo,136
src/rules/windows__image_load__image_load_side_load_iviewers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_jli.eql,sha256=DUsxUp187-PlV05-tWkd8U5PYWjo3ghcB3OSK3UUYQM,333
src/rules/windows__image_load__image_load_side_load_jli.lucene,sha256=3eYevUAwBlkgr5fWGPBYl3qTbQJjc-9Mhj6WzETZAVQ,311
src/rules/windows__image_load__image_load_side_load_jli.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_jsschhlp.eql,sha256=1WnkjyB9SNlOd39XSDdk9swUPSNeV9iayhb2iESsuxU,115
src/rules/windows__image_load__image_load_side_load_jsschhlp.lucene,sha256=IUdQmxyG34tCXiz9tBRDSsGITuFBdVD9MriVASFtNTs,103
src/rules/windows__image_load__image_load_side_load_jsschhlp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_keyscrambler.eql,sha256=HEqYAbmlxJZdm93CaMbDogSKAKmv2Z63MRRwPGl6Fx8,461
src/rules/windows__image_load__image_load_side_load_keyscrambler.lucene,sha256=lLZl41ip0IP9LeZ5NEVmvLIQPmRoRmWU-U3PqP4mwzs,433
src/rules/windows__image_load__image_load_side_load_keyscrambler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_libvlc.eql,sha256=Ig0hqDyrn16QXMTpzrfeUyV53VnMagW-pKIhGjibNpU,149
src/rules/windows__image_load__image_load_side_load_libvlc.lucene,sha256=KUFX7-laKJMxLJthpbjqRP3eyORkGj4mrft3KMmr3L0,134
src/rules/windows__image_load__image_load_side_load_libvlc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_mfdetours.eql,sha256=y7weiCQaNYPM5FRlB-VwBITi47jdK-YKc3aW9ve6Avs,111
src/rules/windows__image_load__image_load_side_load_mfdetours.lucene,sha256=Q6rWZm7slj9d7XIl66HBSEZA4txRntfVMONcKO3iNzw,102
src/rules/windows__image_load__image_load_side_load_mfdetours.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_mfdetours_unsigned.eql,sha256=atifkovPM_vPTnCdfl4jp87_yJKhBw1ldHJ1gXlpNL4,152
src/rules/windows__image_load__image_load_side_load_mfdetours_unsigned.lucene,sha256=HYC0G-5iTARdo4wNfg6TJx17SYSOm2D0UeGwiPNOFow,141
src/rules/windows__image_load__image_load_side_load_mfdetours_unsigned.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_mpsvc.eql,sha256=P9i4RBhTFUwwysZs1EaZiaFCTpP55kQL46l_FskVJhQ,193
src/rules/windows__image_load__image_load_side_load_mpsvc.lucene,sha256=xSUkzEj4OBM-lANzKstVvTjm-syldYP1HmX7gn5xdoA,176
src/rules/windows__image_load__image_load_side_load_mpsvc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_mscorsvc.eql,sha256=oRBrSasM7-oZ__4PpISi0dS9xqggvoWo-u4CeFdEJVM,279
src/rules/windows__image_load__image_load_side_load_mscorsvc.lucene,sha256=Xy16vdLEobBDc2UZk3hQOYH-MMtlVi7IjMea_kwVN-M,259
src/rules/windows__image_load__image_load_side_load_mscorsvc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_non_existent_dlls.eql,sha256=NLCUJdUWxF8tidq6ytMbPcg9s9FI8w4CPEvCNgskXMc,412
src/rules/windows__image_load__image_load_side_load_non_existent_dlls.lucene,sha256=TFyILPVPnMaRqU5gMDAecO2FlOq2W2YxzzHiwCwyTqE,395
src/rules/windows__image_load__image_load_side_load_non_existent_dlls.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_office_dlls.eql,sha256=_5XoDbzaxKZWJOWHHdAAliZd9Ki3a2KjTTgarNFN5io,282
src/rules/windows__image_load__image_load_side_load_office_dlls.lucene,sha256=9poZ6n-hJDTx0hId7oyhl8dWTVXhJGpFCzdn2TZDffg,280
src/rules/windows__image_load__image_load_side_load_office_dlls.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_python.eql,sha256=-vVzfc9mRUYI5i74eaOLc1VwjCpr2Pf0VHPVuAAPEWE,686
src/rules/windows__image_load__image_load_side_load_python.lucene,sha256=tPJ7jA0G6BLiFeb4yBpTPBHDdgiTtgslEtKfVQaycw4,645
src/rules/windows__image_load__image_load_side_load_python.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_rcdll.eql,sha256=_In8h4iwAVW30JLKiW472DHHiGKXU-_27g4x2PaK4jU,163
src/rules/windows__image_load__image_load_side_load_rcdll.lucene,sha256=h5dcyxwuV84_mT7y9LUqi8vJLVbRM_t45lkJEBIpwoA,154
src/rules/windows__image_load__image_load_side_load_rcdll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_rjvplatform_default_location.eql,sha256=0I9Zn8O5T_e07pdJYrfyRSttShgvJZlv8vnMe8aNF1M,164
src/rules/windows__image_load__image_load_side_load_rjvplatform_default_location.lucene,sha256=g_ogpIPTglh8dNBYvqO1-n1jpjyFyYAI_XEsqtqiCwU,152
src/rules/windows__image_load__image_load_side_load_rjvplatform_default_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_rjvplatform_non_default_location.eql,sha256=nFavVbcjw171QEaWKK8cQ7B8lyDxXQquVQREPgG0GXQ,171
src/rules/windows__image_load__image_load_side_load_rjvplatform_non_default_location.lucene,sha256=dHyTiL0KzRj_u5FeGZVJ9VCrzX9-Q0YMN_3ewJH8uQA,155
src/rules/windows__image_load__image_load_side_load_rjvplatform_non_default_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_robform.eql,sha256=ThhEuEJkeTFgdFvrq37a2xhDsTBK6Rao6x4kEVOc8hs,311
src/rules/windows__image_load__image_load_side_load_robform.lucene,sha256=oN5009nAEcWVp9pEq4yTXvHD2Pn88q-vyrB_h4k9a_E,290
src/rules/windows__image_load__image_load_side_load_robform.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_shell_chrome_api.eql,sha256=9NymrJrPSFMHLL5rP8OgfgRnjc2YKYcEsXvg0U2Z9WA,44
src/rules/windows__image_load__image_load_side_load_shell_chrome_api.lucene,sha256=EUFerXIshwuHlp3Lbt9D3-CWNRKTLLoYe8-QFgoCsXU,32
src/rules/windows__image_load__image_load_side_load_shell_chrome_api.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_shelldispatch.eql,sha256=0VhRAnBke46CzYrPN4H8b1oZZqdQcmdkt-HCyOoMK8c,161
src/rules/windows__image_load__image_load_side_load_shelldispatch.lucene,sha256=NgH5wFx023fXxGM4dJbcfx1Veq2Rj31PFbwAoa_R7xI,142
src/rules/windows__image_load__image_load_side_load_shelldispatch.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_smadhook.eql,sha256=dReEVgPI9uXwhqHDlL-0h54nd9LxRTIsEFgf-haCzy4,418
src/rules/windows__image_load__image_load_side_load_smadhook.lucene,sha256=EWYGNZBktIwUum94-q64pnV7QuWNTnu0IQLZxSlmJOc,403
src/rules/windows__image_load__image_load_side_load_smadhook.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_solidpdfcreator.eql,sha256=Lt9UY1AhLwKbDoXolvpbDVffETVEUQrWNL8ZKkhdmCo,244
src/rules/windows__image_load__image_load_side_load_solidpdfcreator.lucene,sha256=xcflXI1hIr-247rglo82wLXmAQBEVaxgLB-YGv3onA8,227
src/rules/windows__image_load__image_load_side_load_solidpdfcreator.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_third_party.eql,sha256=YIKXI3TyBGxkB-XLve95apsn_iQmg4AORhG0CeZjAqw,438
src/rules/windows__image_load__image_load_side_load_third_party.lucene,sha256=VC465zpyFGpGIRTUt107_W93DN9SfN9gEembXGy9qVc,421
src/rules/windows__image_load__image_load_side_load_third_party.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_ualapi.eql,sha256=wqYffoQJffGUWopxErnPNxZSA92Qwp4zMDmB-9hKj2Y,120
src/rules/windows__image_load__image_load_side_load_ualapi.lucene,sha256=OFCyHfKosUjfBnfBW9vhwtg51kHScZLPV6Kk5L53FEE,104
src/rules/windows__image_load__image_load_side_load_ualapi.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vivaldi_elf.eql,sha256=I91OqroOm8k0jBfd9c1MWBBfCLzdvn4j8-jjrzJfBnk,154
src/rules/windows__image_load__image_load_side_load_vivaldi_elf.lucene,sha256=MMXh08t58ZIm4dvDqD56ZZmZCoS0aaPsE3S7SfjMDn8,137
src/rules/windows__image_load__image_load_side_load_vivaldi_elf.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vmguestlib.eql,sha256=iKVvyYf9wJCgry6ppjHkftrlRegTM88UtF1nbFJeihQ,220
src/rules/windows__image_load__image_load_side_load_vmguestlib.lucene,sha256=ZGtP4pGjtdJAS-Y_ar_KyfLojENKAMQDSVoC99qxXnA,203
src/rules/windows__image_load__image_load_side_load_vmguestlib.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_signed.eql,sha256=o7pc405UHGFEQhg-a2yzAty0emER9kV3Qbzoez7LxjI,155
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_signed.lucene,sha256=mM73mF3npTGt2rsDaoYTEDiGMbDam0A0sVVviJz4dEI,134
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_signed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_unsigned.eql,sha256=LHru0L6p_DPB5-5pLpPWbtPeZtInB6p3s1Sqnfr4kMY,163
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_unsigned.lucene,sha256=Kkxqicc7XlO57vXRcE3gr4TJZZsmO9BqKQGnwQhIBv8,142
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_unsigned.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vmware_xfer.eql,sha256=pwn4t07l6F4kS3-bYyLczL4TfXehRkwkWg991aErU9E,138
src/rules/windows__image_load__image_load_side_load_vmware_xfer.lucene,sha256=Wz6ddP1kPuo0pdF5MaHWUKxvoHUkZIfu9F8zIQ5oX2I,124
src/rules/windows__image_load__image_load_side_load_vmware_xfer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_waveedit.eql,sha256=Dy3biR9RYLsYQ6mS10OmUFbX3u5cAKsbP4OTdrfPK50,367
src/rules/windows__image_load__image_load_side_load_waveedit.lucene,sha256=Tr59uf0wgR7Dy9gtHRbzHRKl5hkDYTBKBVeO65DazFs,359
src/rules/windows__image_load__image_load_side_load_waveedit.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_wazuh.eql,sha256=6f3_hsXRPX3gF8ZA-S71imqgeHFTH4P9khQYoeqbnkc,292
src/rules/windows__image_load__image_load_side_load_wazuh.lucene,sha256=vGx3qKECSs0L656pPhgivfGADJRX2nA1ZpKB4jGIuIg,261
src/rules/windows__image_load__image_load_side_load_wazuh.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_windows_defender.eql,sha256=resvhI0-fGVb8xpRaTrctVbzKx_cecVQOpab1e-756Q,374
src/rules/windows__image_load__image_load_side_load_windows_defender.lucene,sha256=V9Ara7SESdRPwAyHe7sYxFEllzrs7ww-2MeLd4D7Uss,357
src/rules/windows__image_load__image_load_side_load_windows_defender.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_wwlib.eql,sha256=YcFidctznFIOe-OXZL586Ol5BKYMxHlM4emomdGCNlk,318
src/rules/windows__image_load__image_load_side_load_wwlib.lucene,sha256=7zq1r7aPRulehiepVSXm9dYsXYHWV_P5ewkGu42RMkY,302
src/rules/windows__image_load__image_load_side_load_wwlib.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_baaupdate_dll_load.eql,sha256=sQsbzkbLYG3vmpWqWh_nzfwiZA4BD9ZiTrYkqcRn0SE,409
src/rules/windows__image_load__image_load_susp_baaupdate_dll_load.lucene,sha256=WuLmiJOJXe6GTC9bmFZLQp3E2M_G5EnpICmN3Z6XEAo,378
src/rules/windows__image_load__image_load_susp_baaupdate_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_clickonce_unsigned_module_loaded.eql,sha256=9knQiOue5KbF4jOliQYQ_gVRhdTP2Dr0egZb4pXJ9cE,144
src/rules/windows__image_load__image_load_susp_clickonce_unsigned_module_loaded.lucene,sha256=xxzy5nOZaOenZRDqPG9BpKuUZ1g9CBsqyI1LOM5vitc,127
src/rules/windows__image_load__image_load_susp_clickonce_unsigned_module_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_dll_load_system_process.eql,sha256=F6hyUyM8DYygsN-DQtlGDdkUh7dItFMdG0-oXfnq0a0,112
src/rules/windows__image_load__image_load_susp_dll_load_system_process.lucene,sha256=b7Wq0eajEshMlTHxJEDy9CpFJ7Ck-GNkGcmFAp4r2T4,92
src/rules/windows__image_load__image_load_susp_dll_load_system_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_python_image_load.eql,sha256=6iOVtlhCQ8vhhDuZPN8_pywcB-GV48gJ7m13SzPAlQA,284
src/rules/windows__image_load__image_load_susp_python_image_load.lucene,sha256=I5Wlzq6GKwtQ0TCstgaI3WP0hXTxEXCERB6mAQkFW60,271
src/rules/windows__image_load__image_load_susp_python_image_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_script_dotnet_clr_dll_load.eql,sha256=PM1h3vI1YRAW2uUuanqvkvcRnSZZHlTe1FddA_U4mgk,230
src/rules/windows__image_load__image_load_susp_script_dotnet_clr_dll_load.lucene,sha256=dd-FSxNfBMCp_XGtGEMoYTJph_Qi13sycCwO9Uz9N7w,204
src/rules/windows__image_load__image_load_susp_script_dotnet_clr_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_unsigned_dll.eql,sha256=MuEcqWUC-UZspgR3ecLK0BEgKenzzUBTlqTVjJkONcY,1304
src/rules/windows__image_load__image_load_susp_unsigned_dll.lucene,sha256=7gLg-9Vnz-5AWg97_3MClDIY_DRNGH6mfDKRX2nnlRc,1243
src/rules/windows__image_load__image_load_susp_unsigned_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_thor_unsigned_execution.eql,sha256=e-hFS3lx20CnAVgL8o8fw6kLy1Sa1tWVl0qfuUqHJHA,267
src/rules/windows__image_load__image_load_thor_unsigned_execution.lucene,sha256=9cETDVavWfYAawv4F13buHOzEZAaDiATQdgiDsqs3Uc,237
src/rules/windows__image_load__image_load_thor_unsigned_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_uac_bypass_iscsicpl.eql,sha256=LsVqa2_o622j5TGo7RZ4ULQJcGoVuTr8SR2bj7XsBus,172
src/rules/windows__image_load__image_load_uac_bypass_iscsicpl.lucene,sha256=asvvcZoh6_dDaby7NfUjjXqyxEG-W4TeI_9e1D2fr4Y,155
src/rules/windows__image_load__image_load_uac_bypass_iscsicpl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_uac_bypass_via_dism.eql,sha256=g4KVauuMh3flV7ExsxbIYJA46F1Ti_oW54q-vSCZxiE,141
src/rules/windows__image_load__image_load_uac_bypass_via_dism.lucene,sha256=QrM06su6OgXV_tT5f2fXSJ7K6cKiGz1ogFuGHW6drYs,126
src/rules/windows__image_load__image_load_uac_bypass_via_dism.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_win_mmc_loads_script_engine_dll.eql,sha256=C7ed5MfYw9UeFz4N5p-_E8Fomr5lqDfvAhN4iYdmrU4,121
src/rules/windows__image_load__image_load_win_mmc_loads_script_engine_dll.lucene,sha256=R8XkMlT2Ff1uopr5WV-WxYwJq7dKBiSm2alz6C4F9d0,101
src/rules/windows__image_load__image_load_win_mmc_loads_script_engine_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_win_susp_dbgcore_dbghelp_load.eql,sha256=S1rwdlxZWvtqtbfu5PFk4wDzaECPZO34YDBD-JLZ0uw,427
src/rules/windows__image_load__image_load_win_susp_dbgcore_dbghelp_load.lucene,sha256=K-yJfdL-5r9erTYCbBAf-xEzNtsUG7zfy6yedy0tf6U,389
src/rules/windows__image_load__image_load_win_susp_dbgcore_dbghelp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_win_trusted_path_bypass.eql,sha256=zXqgwdFMlFD6BregDgp8BZXTkQyQBlf5WD5f0v_R2VE,85
src/rules/windows__image_load__image_load_win_trusted_path_bypass.lucene,sha256=7j1kT91MvqrqtFzYLLFeGpzmf_EsR6chN9grP00KohE,69
src/rules/windows__image_load__image_load_win_trusted_path_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_win_werfaultsecure_dbgcore_dbghelp_load.eql,sha256=fXN3OFdbhL4CF1qmbvh_poiMyiZJbSh0qZNyGSdRRzI,112
src/rules/windows__image_load__image_load_win_werfaultsecure_dbgcore_dbghelp_load.lucene,sha256=iQ7yUqvXXtGpi2fqnx75WkFPr6xfXVBYa6rmCxbsv_4,92
src/rules/windows__image_load__image_load_win_werfaultsecure_dbgcore_dbghelp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_wmi_persistence_commandline_event_consumer.eql,sha256=00iZNpclsLeutaiVIsfrJy8wxt1nv49Tig3raacULVE,105
src/rules/windows__image_load__image_load_wmi_persistence_commandline_event_consumer.lucene,sha256=o2qfiO9yi1NlopD3VnjeQXnXTkGzE6FpleNJMAUCge4,92
src/rules/windows__image_load__image_load_wmi_persistence_commandline_event_consumer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_wmic_remote_xsl_scripting_dlls.eql,sha256=kIzzydOBFRKeYYGH3Uaxk0jlkLl6ystPHkLfyVpcNxc,103
src/rules/windows__image_load__image_load_wmic_remote_xsl_scripting_dlls.lucene,sha256=p2Gox-pkHmcCcrUPE-C_p1FFcCeQhS8_SSOve6nx0QA,83
src/rules/windows__image_load__image_load_wmic_remote_xsl_scripting_dlls.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_wmiprvse_wbemcomn_dll_hijack.eql,sha256=s0sAFerL-dphBc6DW4M-1OY0LtGL12hXf9iLS9hm0oI,85
src/rules/windows__image_load__image_load_wmiprvse_wbemcomn_dll_hijack.lucene,sha256=w7fAzbGHsjZIj81YJpN_lJuPgFSOK6BwgypjNzuqmzU,71
src/rules/windows__image_load__image_load_wmiprvse_wbemcomn_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_wsman_provider_image_load.eql,sha256=BLzta0T8qKfakCEp8MGMk0FZ5aJjZeuC48q4WhYPgH4,1698
src/rules/windows__image_load__image_load_wsman_provider_image_load.lucene,sha256=XtbWRNSjv18f3V0z7gvwurvP0UvoVJH8Kz5cus-Q18A,1680
src/rules/windows__image_load__image_load_wsman_provider_image_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_addinutil_initiated.eql,sha256=ZLGk8-sLuVJDsrgtd4JZ41FOmnxwuFZfuvG7ZHscouA,77
src/rules/windows__network_connection__net_connection_win_addinutil_initiated.lucene,sha256=5HMMwJehcB2KX4u6sW4qz5-7KE5NvYV4ujLuSG_YwlU,63
src/rules/windows__network_connection__net_connection_win_addinutil_initiated.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_adws_unusual_connection.eql,sha256=H3HHQECKI_yJHPHMTeojJb30NFrPi2oj6djvJ5O-9Cc,428
src/rules/windows__network_connection__net_connection_win_adws_unusual_connection.lucene,sha256=xu1ONnJ9jpHwneAoRf0cRgYIrQMksLvDLzmSQNpQ95Q,414
src/rules/windows__network_connection__net_connection_win_adws_unusual_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_certutil_initiated_connection.eql,sha256=3xhEyyOa1Tj03GSd7lJ1z7x49BQMsL5Tv09rX48ue-4,125
src/rules/windows__network_connection__net_connection_win_certutil_initiated_connection.lucene,sha256=xrtoCd-ch6Te9CWY6NtozZ1IzlfU2wppuF5p409lWzM,111
src/rules/windows__network_connection__net_connection_win_certutil_initiated_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_cmstp_initiated_connection.eql,sha256=cKdNlUR5V2CA2IeINLo5Z9oxMgPqCbPTPcQQmXEeONg,434
src/rules/windows__network_connection__net_connection_win_cmstp_initiated_connection.lucene,sha256=LemuuY4q1WIY3rJhulY1rj8TOxtbadnaCXSxp5lrWyY,322
src/rules/windows__network_connection__net_connection_win_cmstp_initiated_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_dialer_initiated_connection.eql,sha256=fTfJ1Q_SbT9xjf9Cnkz6NaIcUiDYPSK98_Unl88G7tw,455
src/rules/windows__network_connection__net_connection_win_dialer_initiated_connection.lucene,sha256=bIfBYNW8gjP_tNcd5S4tsDDMuw_BBMtrprDyTqd249s,344
src/rules/windows__network_connection__net_connection_win_dialer_initiated_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_azurewebsites.eql,sha256=tto_1OXo7CnFDgCPjFlkNLYlNQJkFzPbuT1aZFWkvRU,3693
src/rules/windows__network_connection__net_connection_win_domain_azurewebsites.lucene,sha256=Q59_DAdqjUcL55R6_e20VaPt6dHhW8pttNLImYTJVoA,3591
src/rules/windows__network_connection__net_connection_win_domain_azurewebsites.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_btunnels.eql,sha256=ytm06Uder_2r6yW4r3FjLwHzuWapJsFCvdU3QPUJdvU,76
src/rules/windows__network_connection__net_connection_win_domain_btunnels.lucene,sha256=wVunRqE5XCwjRe7bQmiZMss_K1gJjCdLTQlT7bcySsw,62
src/rules/windows__network_connection__net_connection_win_domain_btunnels.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_cloudflared_communication.eql,sha256=YPrRxLL77g3iWleSaIZVyus3ppJ3E7HbbOTYef6Of_Q,169
src/rules/windows__network_connection__net_connection_win_domain_cloudflared_communication.lucene,sha256=6jXMxvM6oPdUKs4NWtODzAiuTAdS0SCuQV4eaXXvTHw,150
src/rules/windows__network_connection__net_connection_win_domain_cloudflared_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_crypto_mining_pools.eql,sha256=4qZbFr4soKiworyik-NLCq3_lYdiCVpnyMA5sVlrKHw,4891
src/rules/windows__network_connection__net_connection_win_domain_crypto_mining_pools.lucene,sha256=XVECG76LO7_puf0CZVe1YNFs5yOVxOph9gXpxcUyHc0,4932
src/rules/windows__network_connection__net_connection_win_domain_crypto_mining_pools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_dead_drop_resolvers.eql,sha256=B1h4bbei_lmRp_WffTZXaHZVNUeDJV7HV_RWvD530wg,5893
src/rules/windows__network_connection__net_connection_win_domain_dead_drop_resolvers.lucene,sha256=PhU6VKzUa_mYeL3Jg1ncvRAGtAq-AR2wlAgrknyRigc,5724
src/rules/windows__network_connection__net_connection_win_domain_dead_drop_resolvers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_devtunnels.eql,sha256=1r4Hlpk26jWFn4GOgFdFIXJawOT2vfoTVvr6JiU6v6k,76
src/rules/windows__network_connection__net_connection_win_domain_devtunnels.lucene,sha256=BWn1p6wnfBzGmZa3mkmsAeGEvqlvQTymFPcoSaUH408,62
src/rules/windows__network_connection__net_connection_win_domain_devtunnels.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_dropbox_api.eql,sha256=b3fHOspxqGBibI-y0J9LCjZYNRk0_J0EadZrgRFWKCs,162
src/rules/windows__network_connection__net_connection_win_domain_dropbox_api.lucene,sha256=n4VpsUS6oMHyS8qg6YgR28B80qFZcAWJK0qeNKUdZtM,140
src/rules/windows__network_connection__net_connection_win_domain_dropbox_api.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_external_ip_lookup.eql,sha256=6BAsoC8RZlJyRL6a2WMTqXOsIWF0UW-4agfr4YGs4Ls,2109
src/rules/windows__network_connection__net_connection_win_domain_external_ip_lookup.lucene,sha256=doJU6g5sgYeazUha-urbrHAMqNklgi2Ve9c57U_5itg,2062
src/rules/windows__network_connection__net_connection_win_domain_external_ip_lookup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_google_api_non_browser_access.eql,sha256=0rdAs5YOT9jf8c2G1CJeXUlIMFnnVjdGrY8PZDAnCus,1654
src/rules/windows__network_connection__net_connection_win_domain_google_api_non_browser_access.lucene,sha256=pKlQQa8sEMTwTaU-N8zH_NEXas0hTJfsAtkKhoh01w4,1607
src/rules/windows__network_connection__net_connection_win_domain_google_api_non_browser_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_localtonet_tunnel.eql,sha256=4ZSjAdrIY9DMAMFaIpAXccXkDUs7LRxOqGEC0nHMrzs,104
src/rules/windows__network_connection__net_connection_win_domain_localtonet_tunnel.lucene,sha256=5FUvfZ5u--AZXzM9zhMdwprygwX1nEZberfGELi3zAM,84
src/rules/windows__network_connection__net_connection_win_domain_localtonet_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_mega_nz.eql,sha256=KkR4PD2NOP8-XiOqGnR2FRlfNtcEhgf7l4_Ei_FY6sQ,94
src/rules/windows__network_connection__net_connection_win_domain_mega_nz.lucene,sha256=TkaYRgiJ3XWykLtt_lAKzsOVflfEliHQ4nWPijjxMRY,74
src/rules/windows__network_connection__net_connection_win_domain_mega_nz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_ngrok.eql,sha256=OnF4lj4MTS9MoghyqKJdc-ZEB8SDuOxss5yCUGxwsr0,151
src/rules/windows__network_connection__net_connection_win_domain_ngrok.lucene,sha256=B1PuJFnhMdiOorbs9JuWjkOVA2kBne32v2NGcc7vRf0,133
src/rules/windows__network_connection__net_connection_win_domain_ngrok.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_ngrok_tunnel.eql,sha256=m71U14mNRJpIV-q1VsRHB7Wvfrij1pJgPioQfojcbzI,211
src/rules/windows__network_connection__net_connection_win_domain_ngrok_tunnel.lucene,sha256=3v4XR9UnT-9-B8nXnKGIcyv4VgnUngIapJapObdcDNU,193
src/rules/windows__network_connection__net_connection_win_domain_ngrok_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_notion_api_susp_communication.eql,sha256=bwEqJuZCSC4yt6kmqZsWh0eZ0suFhp6EH4T3cJTY1PE,1356
src/rules/windows__network_connection__net_connection_win_domain_notion_api_susp_communication.lucene,sha256=6oWqL1DH8rZ1MSZUvZJlXB2zUxL2yLUaH9E1X10Rw7s,1317
src/rules/windows__network_connection__net_connection_win_domain_notion_api_susp_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_portmap.eql,sha256=SIjlaITh5uj31QYe9xn22t68fsbtmic1FAAcR3wfvwE,73
src/rules/windows__network_connection__net_connection_win_domain_portmap.lucene,sha256=KMe86MXkArLEgbSJaWv3XvvphPYU6U24PDuyhf4SVpE,59
src/rules/windows__network_connection__net_connection_win_domain_portmap.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_telegram_api_non_browser_access.eql,sha256=5mkVNucM2-gXXxjJWaiuKqamZumfmHI9kiF3A3m-My0,1286
src/rules/windows__network_connection__net_connection_win_domain_telegram_api_non_browser_access.lucene,sha256=wViNEMTVYytNouRv1vlx4merW5CPV6_iyI9K8eSlzJA,1249
src/rules/windows__network_connection__net_connection_win_domain_telegram_api_non_browser_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_vscode_tunnel_connection.eql,sha256=dC16Yud-Qmkp7g0NmAdI8aED_pDfRcflsBfsiT3M8tY,91
src/rules/windows__network_connection__net_connection_win_domain_vscode_tunnel_connection.lucene,sha256=dB62Dqm5hrMUfk7zkcpijRb0pAjSylLJa4vyO-l8xfc,77
src/rules/windows__network_connection__net_connection_win_domain_vscode_tunnel_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_eqnedt.eql,sha256=MiewbYzmjPTfMw924UzXFc91edKF0PAPZ8GkxqFe1ts,47
src/rules/windows__network_connection__net_connection_win_eqnedt.lucene,sha256=iObZisq0IAvy9hwQDBz9REUp9YCBEclHnXjvtnYeoP4,35
src/rules/windows__network_connection__net_connection_win_eqnedt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_finger.eql,sha256=Qmhcp0GlFxh5rE8tFB2BMyk8SI4usl8jG6xQlOaSc3w,74
src/rules/windows__network_connection__net_connection_win_finger.lucene,sha256=SpwpIPv-HxHbqR3CU98w5rE3Oh2iGb4ZF7DRw3ezZmk,60
src/rules/windows__network_connection__net_connection_win_finger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_imewdbld.eql,sha256=4Z2edzYgH9x7jMcWcNk7fwx1I6gjLoiB7vsY4-uMsoM,76
src/rules/windows__network_connection__net_connection_win_imewdbld.lucene,sha256=0CdW3kakSxSY8_j9iMa7cJetqZE8zzqkCsaXHpuyjBA,62
src/rules/windows__network_connection__net_connection_win_imewdbld.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_notepad.eql,sha256=II2t05RrJ5WL8nRTnIx0yZrowXb-qoK9sqHNzDg6PjE,78
src/rules/windows__network_connection__net_connection_win_notepad.lucene,sha256=ZGgozmojY-FAEd3nWJiluUp5tMP_rhAYwoDdiiM7Hgw,66
src/rules/windows__network_connection__net_connection_win_notepad.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_office_outbound_non_local_ip.eql,sha256=kYiLyeiuoIkGzULCC8PR6hXUirZS4h6_llZeVfg7kSA,8596
src/rules/windows__network_connection__net_connection_win_office_outbound_non_local_ip.lucene,sha256=YziCSzvh1lCd0-8XqQTc1-UuGAcvTRb6RWZ5obeoyeg,6732
src/rules/windows__network_connection__net_connection_win_office_outbound_non_local_ip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_office_uncommon_ports.eql,sha256=EZlwu75K26DSKthlZqvJEgwE3etxSYw2TdChZTAJn6g,391
src/rules/windows__network_connection__net_connection_win_office_uncommon_ports.lucene,sha256=kOl-Q9-YJc1w9YsZNjgddsYO2uqzL_x5anUUPLYi32k,377
src/rules/windows__network_connection__net_connection_win_office_uncommon_ports.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_python.eql,sha256=sldwxgTxmwiDsO2RGqWixNMHc0s5vEdAl_mOtQdLu0o,669
src/rules/windows__network_connection__net_connection_win_python.lucene,sha256=nL7PCkJybSnbEHFLfduiFtYayr8lLpUrG1ea2gvu0U0,640
src/rules/windows__network_connection__net_connection_win_python.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_rdp_outbound_over_non_standard_tools.eql,sha256=ijtgJN7mkF8L6pZdbVarR3Y8yzJ-U56Y0YYMYainq7A,1449
src/rules/windows__network_connection__net_connection_win_rdp_outbound_over_non_standard_tools.lucene,sha256=jP3qDTnMQts4uRyC18oyVKsgB2g0-m9lUSUc040c4-s,1404
src/rules/windows__network_connection__net_connection_win_rdp_outbound_over_non_standard_tools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_rdp_reverse_tunnel.eql,sha256=yxGgY1tgbmdEYRAYibjdwMDPGGDFtCZ48iWlzvqWH_o,185
src/rules/windows__network_connection__net_connection_win_rdp_reverse_tunnel.lucene,sha256=TcXDEiXO8ZjsyC6pedZQH0yOeBtpnLI865aSc8hBK_Y,147
src/rules/windows__network_connection__net_connection_win_rdp_reverse_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_rdp_to_http.eql,sha256=2_8KNCwEcAWcv_Nt8ipSgwxR2ivVQtFP2iwL9triewI,135
src/rules/windows__network_connection__net_connection_win_rdp_to_http.lucene,sha256=_bKStts1hHP7cG3YqNTC9EDgtNx6MCu-fpHL902znFY,117
src/rules/windows__network_connection__net_connection_win_rdp_to_http.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_regasm_network_activity.eql,sha256=j7dBHZULc66Y9uHsU8oOM_t6x2EwZuHt-jpOS1Rz2c8,435
src/rules/windows__network_connection__net_connection_win_regasm_network_activity.lucene,sha256=euN8n2MDo9pvMAMs-8et2wRKLsKbg_2asxPzSIbxfxg,323
src/rules/windows__network_connection__net_connection_win_regasm_network_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_regsvr32_network_activity.eql,sha256=Z8t4SGrI4FdbrWcKC7BY1LALzONFcIEtjG8CJPiJUBE,76
src/rules/windows__network_connection__net_connection_win_regsvr32_network_activity.lucene,sha256=ixBMSv-rAnZRw5GVZPmmcJoWYEvJszHTRiU4e8ogyhE,62
src/rules/windows__network_connection__net_connection_win_regsvr32_network_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_remote_access_tools_anydesk_incoming_connection.eql,sha256=8jNxCggMjDikq8Sw_CoQFcxvtuwQS6a4Hn2Pf1EUx8w,107
src/rules/windows__network_connection__net_connection_win_remote_access_tools_anydesk_incoming_connection.lucene,sha256=9u667h0qFST_2nxO3uTpLNeZWzllQrYWVXMMFVLJ9ZA,87
src/rules/windows__network_connection__net_connection_win_remote_access_tools_anydesk_incoming_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_rundll32_net_connections.eql,sha256=ysgtcgwuKNpEUE-PHkC_SfZCeyHb2_v9gFMDZiG0kXY,833
src/rules/windows__network_connection__net_connection_win_rundll32_net_connections.lucene,sha256=U496yxgUE7X907elnMWnNUFXdhjAfIdFUDVwsiZ2zIo,664
src/rules/windows__network_connection__net_connection_win_rundll32_net_connections.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_silenttrinity_stager_msbuild_activity.eql,sha256=0ubQOsTd2KBj8kj2Ag7rFWXMNezfWkUKzHlWSSdCpFE,116
src/rules/windows__network_connection__net_connection_win_silenttrinity_stager_msbuild_activity.lucene,sha256=sQnZTStN4msV-rDsJzNcBps3cuwapPry0GxxGCcgvo8,98
src/rules/windows__network_connection__net_connection_win_silenttrinity_stager_msbuild_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_binary_no_cmdline.eql,sha256=CKw-Yd3QzsD_xZV51zQ4LolPQNvlL1GSX-FfWqlqPtg,329
src/rules/windows__network_connection__net_connection_win_susp_binary_no_cmdline.lucene,sha256=MWGzLV5L5vBYil4C-UgE0ASJeTBLxc7IcWtPOdxRYfM,300
src/rules/windows__network_connection__net_connection_win_susp_binary_no_cmdline.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_file_sharing_domains_susp_folders.eql,sha256=48pZmW9HL4EEnhTkGtg9cFKXyyVQ95LkAy5JExCEhPY,993
src/rules/windows__network_connection__net_connection_win_susp_file_sharing_domains_susp_folders.lucene,sha256=MjNYvQMz0477tqhHV7cW4mi9bx2C0yJ3X-yNIkNAwqg,963
src/rules/windows__network_connection__net_connection_win_susp_file_sharing_domains_susp_folders.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_initiated_uncommon_or_suspicious_locations.eql,sha256=ABbo2rVK9nFIyuQwfehbL5TH7XPkcu-N3od7AQZXCII,1054
src/rules/windows__network_connection__net_connection_win_susp_initiated_uncommon_or_suspicious_locations.lucene,sha256=WUZIGT4qHCUZagesFDSF9xdKfXEq-Lg4A2e-LJX0Y4s,1019
src/rules/windows__network_connection__net_connection_win_susp_initiated_uncommon_or_suspicious_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_port.eql,sha256=_MIsv71qV7JA7_Ucio3pDJ78wPF6EaLWrD-wLf3a6_w,837
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_port.lucene,sha256=dMxfkKZkFVnQJa0xD9ar1__s9G-i624LiJFC7dWwjPU,820
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_port.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_ports_uncommon.eql,sha256=65HORIUoFVcdpCBmnX24ou-JbQZKjMxeCv_1FN24JpU,530
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_ports_uncommon.lucene,sha256=xRqzi3Sa_QtaS7XbsX2PJnZS9_ZoDbvlip9STPJEFUI,413
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_ports_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_outbound_kerberos_connection.eql,sha256=__bT7nEYCJloFKqPao02IUPo1LDtyvp92YfpA-C_EmY,486
src/rules/windows__network_connection__net_connection_win_susp_outbound_kerberos_connection.lucene,sha256=ZpLWexVPNK_F_-5i8wmgBglZh1ZjTAwCIuTTxIJUZEc,471
src/rules/windows__network_connection__net_connection_win_susp_outbound_kerberos_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_outbound_mobsync_connection.eql,sha256=_GigEjBF8rBMUNA05c0446TUuTd0gRvBcxBgxRlaB1M,405
src/rules/windows__network_connection__net_connection_win_susp_outbound_mobsync_connection.lucene,sha256=FDEaSRj3sFqWzlZm97Q8gdk-jwCGSxnL5LoXmvGS4GQ,295
src/rules/windows__network_connection__net_connection_win_susp_outbound_mobsync_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_outbound_smtp_connections.eql,sha256=laM4iFNsn6smpCiqqO1Kj1fjhLQIBjy8RUUiO4in2VQ,374
src/rules/windows__network_connection__net_connection_win_susp_outbound_smtp_connections.lucene,sha256=kLyhCsOUpmTC3bQgtsXD5fycvMpsL-dWq9xrzGIP4Kw,352
src/rules/windows__network_connection__net_connection_win_susp_outbound_smtp_connections.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_remote_powershell_session.eql,sha256=YEdnmiy1Q2suMOWlGO8G2pCNm6NFo2RghmVfBMbjDSM,543
src/rules/windows__network_connection__net_connection_win_susp_remote_powershell_session.lucene,sha256=9h30tjbBT8oFY4w2fAzbYtOJWkgIDssSSaIqwTX19L4,508
src/rules/windows__network_connection__net_connection_win_susp_remote_powershell_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_winlogon_net_connections.eql,sha256=xFifLouGeBgxH636cDHZ7k634okJXr4g2gU6iIc85P4,437
src/rules/windows__network_connection__net_connection_win_winlogon_net_connections.lucene,sha256=u8EwTuWAcfj_7qk2ikgV-UPdw9-M7MPB9iV3nMdR93U,325
src/rules/windows__network_connection__net_connection_win_winlogon_net_connections.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_wordpad_uncommon_ports.eql,sha256=1TqQKYYjVvGpp8SwBJcFuoUiYI4ED46mb3y1wUlAqFo,152
src/rules/windows__network_connection__net_connection_win_wordpad_uncommon_ports.lucene,sha256=EX0Npens5o138HRCL14_RQeelXeZkrmfe_ZUCmW1imQ,146
src/rules/windows__network_connection__net_connection_win_wordpad_uncommon_ports.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_wscript_cscript_local_connection.eql,sha256=v9Mb5xGVxsWhICibSwLdz_1GV_mL1XeSb6hYHMDl2AI,456
src/rules/windows__network_connection__net_connection_win_wscript_cscript_local_connection.lucene,sha256=rF5o2guTTriyXXoWa_nnWevF3lJfJFv7zP4K9wRmbNY,338
src/rules/windows__network_connection__net_connection_win_wscript_cscript_local_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_wscript_cscript_outbound_connection.eql,sha256=6J6E8Lckwrloz1txgs2IQjV3XdkAFyTer_cmP5-gNSw,510
src/rules/windows__network_connection__net_connection_win_wscript_cscript_outbound_connection.lucene,sha256=Kmd9LC7GtHDXK9_KTY0kuv4ixHjxK95t_MLTob40iBQ,379
src/rules/windows__network_connection__net_connection_win_wscript_cscript_outbound_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_wuauclt_network_connection.eql,sha256=y8OvgFr24RXyWo5qGK4GXhT-AGUSFNYmA1UqCdK_kwI,1205
src/rules/windows__network_connection__net_connection_win_wuauclt_network_connection.lucene,sha256=fyjMM4hzzZCTmHZ8ePqCCXPszlbQX3iPUfdzTGKAA2E,1003
src/rules/windows__network_connection__net_connection_win_wuauclt_network_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__pipe_created__pipe_created_adfs_namedpipe_connection_uncommon_tool.eql,sha256=uzwUyjukAoVLb0ZgY7i_eLdcGgjuZADXPFrDidqSTis,514
src/rules/windows__pipe_created__pipe_created_hktl_cobaltstrike.eql,sha256=bgPinGVOu1-YNmfzTAR_yKTr0KYadeIJ37va_EXVkzM,325
src/rules/windows__pipe_created__pipe_created_hktl_cobaltstrike_re.eql,sha256=NW1DKVfHlsRfMm5iIzR0-0vEenFbFVYRTTjfaSQpSGc,660
src/rules/windows__pipe_created__pipe_created_hktl_cobaltstrike_susp_pipe_patterns.eql,sha256=gIvUiWhKij8LVJ7M-cCKFyLT5YXjFgWzOQlQWxKVxEc,845
src/rules/windows__pipe_created__pipe_created_hktl_coercedpotato.eql,sha256=5_5rwM54nf-vsRh7pLEKAUs-Dy9Rc1_rQW8qhGqPqOk,36
src/rules/windows__pipe_created__pipe_created_hktl_diagtrack_eop.eql,sha256=vylWKSZ7l-3bKCLLCaTUUT1bQC96tB7spqojWD0VzzE,35
src/rules/windows__pipe_created__pipe_created_hktl_efspotato.eql,sha256=HF0gIoUmfu5a5YBE_4KDVkIHwOjQLOX8VicdGLsajc8,121
src/rules/windows__pipe_created__pipe_created_hktl_generic_cred_dump_tools_pipes.eql,sha256=8mug91m9bEWe3KNYQZEgCxiRWlWcuFch97KEFAMbXb4,81
src/rules/windows__pipe_created__pipe_created_hktl_koh_default_pipe.eql,sha256=OQtvnrFNttaGDra842jVO3gokurqVQ8g5YkPZT-J3l0,65
src/rules/windows__pipe_created__pipe_created_powershell_alternate_host_pipe.eql,sha256=wqcQLGqp_HENZd13amBRPr2yFya8vx5M8VlUDNigKaU,1502
src/rules/windows__pipe_created__pipe_created_powershell_execution_pipe.eql,sha256=R__dMEwSY4Ynu_1p7yIoWvOEju1i7kQKa2R-4YMPNCQ,32
src/rules/windows__pipe_created__pipe_created_pua_csexec_default_pipe.eql,sha256=mITOSngKjBad76-FsrmSnhw7a8ZXKKsIKJtzWtRY5ig,36
src/rules/windows__pipe_created__pipe_created_pua_paexec_default_pipe.eql,sha256=3cXkl5CQaUmaMJLHLvvdqIoHq4dCJ3h8aJHYa20ky5I,32
src/rules/windows__pipe_created__pipe_created_pua_remcom_default_pipe.eql,sha256=E3nX9zWcWPZVrIRPWGPu5nqU0JNxzH9M4F2Pbx6E9IY,33
src/rules/windows__pipe_created__pipe_created_scrcons_wmi_consumer_namedpipe.eql,sha256=jcK2tmwNrgMG-rIzjiLbotsmJVuLxdA18XCKKuhDHcE,46
src/rules/windows__pipe_created__pipe_created_susp_malicious_namedpipes.eql,sha256=CAD2xKc4xqMlnFmK905HitfXdcTo8kG1q8t-9WFRdkw,551
src/rules/windows__pipe_created__pipe_created_sysinternals_psexec_default_pipe_susp_location.eql,sha256=94a91hE977lp6Q3H0i6gF-y9z7tuZsHu_wAf611_UwM,179
src/rules/windows__powershell__powershell_classic__posh_pc_abuse_nslookup_with_dns_records.eql,sha256=E0aIxiuTQuxq4pzmAw3q8rTnvZxKYTyzK6xE_EPIOaY,223
src/rules/windows__powershell__powershell_classic__posh_pc_abuse_nslookup_with_dns_records.lucene,sha256=FG2jeBH1-xPdvc3JrdFEGWGVdXe6SZ4A_ljVKWHC9hw,210
src/rules/windows__powershell__powershell_classic__posh_pc_abuse_nslookup_with_dns_records.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_delete_volume_shadow_copies.eql,sha256=DgTwZEtKNYpBmjYtQoEn95js4MjY3ZoKXen46hxEreM,173
src/rules/windows__powershell__powershell_classic__posh_pc_delete_volume_shadow_copies.lucene,sha256=XsoBvqYyWXFApsvr-Te8YAseGStziM0n5g5vmZKz05Q,155
src/rules/windows__powershell__powershell_classic__posh_pc_delete_volume_shadow_copies.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_downgrade_attack.eql,sha256=IDi0C3X5poT6iM-yE3eMC2oevNIUDBIJQmq1-e964wE,106
src/rules/windows__powershell__powershell_classic__posh_pc_downgrade_attack.lucene,sha256=Y5h0_z8xzyo6tM3Hl9jq1UDn4KPHxPpVaZCc52toghc,94
src/rules/windows__powershell__powershell_classic__posh_pc_downgrade_attack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_exe_calling_ps.eql,sha256=bnvWAF7VCm-tNoDyam-Za_x2dvD3u1CEu9cd4k1Ek68,154
src/rules/windows__powershell__powershell_classic__posh_pc_exe_calling_ps.lucene,sha256=DFet-S-QAW35_C6u9zfNOvTMvU89hOOY27-X3nk3Sc4,138
src/rules/windows__powershell__powershell_classic__posh_pc_exe_calling_ps.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_powercat.eql,sha256=8P7PZMu1RWkyelNNmOKtV-rLMM1wsH_iIeMTFYKpt7g,73
src/rules/windows__powershell__powershell_classic__posh_pc_powercat.lucene,sha256=y2-c3NWTCMzVIYqLimx89Gtsu6bYm7KhPmffLkhyfpU,56
src/rules/windows__powershell__powershell_classic__posh_pc_powercat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_remote_powershell_session.eql,sha256=3Tm-zz2xsVbtG9db7NRpRbZuHsxkaM1sqv6auL2DgMg,110
src/rules/windows__powershell__powershell_classic__posh_pc_remote_powershell_session.lucene,sha256=_bRboJg2pdZSZjIYvr8xXwX8hJY9LamgD9ZM6rVb7E0,97
src/rules/windows__powershell__powershell_classic__posh_pc_remote_powershell_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_remotefxvgpudisablement_abuse.eql,sha256=atOx9O8emxA4gjyp097NDTwVhMGscsVYJqAQ-YMnFbA,138
src/rules/windows__powershell__powershell_classic__posh_pc_remotefxvgpudisablement_abuse.lucene,sha256=0jbzfnxWWqh5hVeSQPA_CaJMPSCXOJe1ZwEghg0aXWY,130
src/rules/windows__powershell__powershell_classic__posh_pc_remotefxvgpudisablement_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_renamed_powershell.eql,sha256=44HvHV5Phpi79h0FYFl1KUeAqGC4YBrvu2f4H_SVrMM,689
src/rules/windows__powershell__powershell_classic__posh_pc_renamed_powershell.lucene,sha256=6KqHVBNGSBhgAALMYscEsC4N0vUNSHe7uZZLD_Tex_g,767
src/rules/windows__powershell__powershell_classic__posh_pc_renamed_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_susp_download.eql,sha256=DanKciHqMIBrmQ8WiTWivgJhMpDMEkWSO7Gh0lSKAtg,129
src/rules/windows__powershell__powershell_classic__posh_pc_susp_download.lucene,sha256=ANxtszAJAdZ4IYiPt7peguJs71QAAqCZC34ZCAhb7No,111
src/rules/windows__powershell__powershell_classic__posh_pc_susp_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_susp_get_nettcpconnection.eql,sha256=9sbAuShY1TKg6Y4fntf8d900ql2HE8A5gP0Bxm2Y0VQ,58
src/rules/windows__powershell__powershell_classic__posh_pc_susp_get_nettcpconnection.lucene,sha256=0Y1vWzvZqSEBDvVgFzUkm2rK-gCi-_iuytrhwxTr06M,47
src/rules/windows__powershell__powershell_classic__posh_pc_susp_get_nettcpconnection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_susp_zip_compress.eql,sha256=Sw2kU9O05Efzs3mPW0yhFLRTSD3lUQI8erBYwS0nMms,271
src/rules/windows__powershell__powershell_classic__posh_pc_susp_zip_compress.lucene,sha256=WJDjju7J5Q7nApWa-5lN18Wdwyr7gb2z6g-oWtBjV2o,265
src/rules/windows__powershell__powershell_classic__posh_pc_susp_zip_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_tamper_windows_defender_set_mp.eql,sha256=N3CQy-yBboVXGHZr7sVoV2bGk2cEKzwhR-8RICsskyk,1571
src/rules/windows__powershell__powershell_classic__posh_pc_tamper_windows_defender_set_mp.lucene,sha256=-81qvcQHNqbRl4BeDIyYopDHawETy-9mB58FUlhicPw,1640
src/rules/windows__powershell__powershell_classic__posh_pc_tamper_windows_defender_set_mp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_wsman_com_provider_no_powershell.eql,sha256=j6NVlwKcp4ZsN6ymTkFBqIhCFGL0xVjS88j3F92HMVk,668
src/rules/windows__powershell__powershell_classic__posh_pc_wsman_com_provider_no_powershell.lucene,sha256=M5FeqLCqtMth9w1r-wLHUvkWKmDk8L8bow8ZvP21zDU,742
src/rules/windows__powershell__powershell_classic__posh_pc_wsman_com_provider_no_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_active_directory_module_dll_import.eql,sha256=ZXE4g6qBs9DMRn_i5bXFWkJ93-L9DAPQ372RYGfAtAU,167
src/rules/windows__powershell__powershell_module__posh_pm_active_directory_module_dll_import.lucene,sha256=OrxwrVbRrzFlCbeCPD-boG2vzV8ebtbqyEKTlvk2IXo,150
src/rules/windows__powershell__powershell_module__posh_pm_active_directory_module_dll_import.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_alternate_powershell_hosts.eql,sha256=QU1VXV00VnJ0tfJek_VOvXLz5QEvRbIKPjpF6bMYlMc,915
src/rules/windows__powershell__powershell_module__posh_pm_alternate_powershell_hosts.lucene,sha256=fg4_Een4XpsVYpXhRXpybM49xpvMmurLf41TdMFzEA0,923
src/rules/windows__powershell__powershell_module__posh_pm_alternate_powershell_hosts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_bad_opsec_artifacts.eql,sha256=oea0_2AGPzj9L2h01jJ6boT7nxDPk1iKzWKBE6xCLCU,141
src/rules/windows__powershell__powershell_module__posh_pm_bad_opsec_artifacts.lucene,sha256=Z5zT6um3owPbzZ-dgmDxqSNfW5bpbaud2aQZv4e0omA,123
src/rules/windows__powershell__powershell_module__posh_pm_bad_opsec_artifacts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_clear_powershell_history.eql,sha256=29QG04eBHKS5ieNdaykZbvz9qXPlFFUFHB8lCABj908,530
src/rules/windows__powershell__powershell_module__posh_pm_clear_powershell_history.lucene,sha256=DA_dG_o_Beo5oGDXSJicEufpR90bVGZ_CFaFGSPMOjQ,505
src/rules/windows__powershell__powershell_module__posh_pm_clear_powershell_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_decompress_commands.eql,sha256=VYwv-IDZ9M7q2jqIZzhA5giWyqd-2NUB6DGWB1sTzYU,63
src/rules/windows__powershell__powershell_module__posh_pm_decompress_commands.lucene,sha256=p_dI-2JoniW3IspTU1pZuftnHJWZk9VQLjfpvmsLijg,52
src/rules/windows__powershell__powershell_module__posh_pm_decompress_commands.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_exploit_scripts.eql,sha256=bLMY-iNGRTC40TJhg5NyP-PJxvQlKYs01BEh82eByzE,6064
src/rules/windows__powershell__powershell_module__posh_pm_exploit_scripts.lucene,sha256=PB1nyOKHTgquw4XTRr8-Oa5-ZaSFBkrE0eR1bN4YD4E,6249
src/rules/windows__powershell__powershell_module__posh_pm_exploit_scripts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_get_addbaccount.eql,sha256=MIhJVyK8J1eKxEgcJPjLytjD3C-VuzVqgH3gBuVLsGw,171
src/rules/windows__powershell__powershell_module__posh_pm_get_addbaccount.lucene,sha256=8OmWOM2WesGdDVTedqBU5GnfikOAgHoXG0ihOevWudY,158
src/rules/windows__powershell__powershell_module__posh_pm_get_addbaccount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_get_clipboard.eql,sha256=BToRMbL9prd09CGEzun6MqnoWZnNs-mkpeTKhbCbxhM,62
src/rules/windows__powershell__powershell_module__posh_pm_get_clipboard.lucene,sha256=B2uNJN9jZiWHU3kW6CXvXNqTgwRCf0oE1UMK5oVaObQ,51
src/rules/windows__powershell__powershell_module__posh_pm_get_clipboard.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_hktl_evil_winrm_execution.eql,sha256=B5ZKK1X8fpNJCQfDM1rI-qhMiF1U69HnpAeGoYUu4bM,925
src/rules/windows__powershell__powershell_module__posh_pm_hktl_evil_winrm_execution.lucene,sha256=2w2RbM1DCD3s6BO-SmbmrrF_MbLajJt068BgVROn5Yw,981
src/rules/windows__powershell__powershell_module__posh_pm_hktl_evil_winrm_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_clip.eql,sha256=eVl5aS1qdGltbtrQTdAbyvqUJu0pAE4E1xQAsHyFbv4,140
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_clip.lucene,sha256=nlV1CiSGuXhCLz-YRjGwp2NcWY0cJ7yN6QxmpaFJctM,351
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_clip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_obfuscated_iex.eql,sha256=3k7oNnCFKl7vsbmRytOmK4iMQyte57c4SBSKJ1tVoG8,405
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_obfuscated_iex.lucene,sha256=vPUpwVu2DZTrrraEczmgi64iewFxLRyXc7FpkU-L-P0,1678
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_obfuscated_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_stdin.eql,sha256=ft7VFrOXEyxLqxKdz4irZRCRAGhkhlhwIeC5TIl9HO8,117
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_stdin.lucene,sha256=nOmgrbULjEaEk3WTjJHvenaStOM7FfkMXg3ONQfveMk,363
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_stdin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_var.eql,sha256=dXglRvxezHJ2llQQtZY0QoIPIxXlHSCgfq6MgQTVWNM,153
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_var.lucene,sha256=k25ujZZOlHFrXl71zeHJtzDsYdS8Io-NDeWz0KAZfQo,585
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_var.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_compress.eql,sha256=TOuTWkOi2PtXyyOtLUr7xnOTWrEKv1qvVMeKD9ZFZnY,292
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_compress.lucene,sha256=xLWoXOw6Xy7wNCdGcHf_Upowy_QfdLA_PZlDatQgRs4,272
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_rundll.eql,sha256=RpEXsV_ojSRsu9V3dO6KvQvIv62iBorEfr_uRyq8vyw,227
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_rundll.lucene,sha256=5q0mX-YHUEMZeXAOpoePMfZ4v5di5uG1qI8YV3_z5CQ,209
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_rundll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_stdin.eql,sha256=iBHH1AEo9RWa-3NDnM-krYIGtTVtNUXLQBX_d_mAd1s,122
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_stdin.lucene,sha256=uT72TcXwuU1BbKbr2WKQELGfu0CLR5FoEI5QS6fsCxo,532
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_stdin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_clip.eql,sha256=cdXKiOJZrkEfzbFp6_DoVqwV4KNWyRwVYrQalhwpsZs,107
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_clip.lucene,sha256=lAI97MKEbQQfwq0ID2NqR4nBQ8-KblXE8wzS18pKr7Y,601
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_clip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_mhsta.eql,sha256=ZbBuQGAdGtNKzyA6vtbCqQtHaNRA4hLnodc3naCaLr8,313
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_mhsta.lucene,sha256=CUKJUEKv0w_mXMTPbAssBA7fNUZV2SkWjbH5ansHW9Q,296
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_mhsta.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_rundll32.eql,sha256=O324PGzLXd47TVN1tE6gLCN7mRkkyz2sH18xg0OnWZI,309
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_rundll32.lucene,sha256=5IK8IoL4llYsbs1PU8wpmc3DvYgjJbmSbSesQ_RLyRo,285
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_rundll32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_var.eql,sha256=plSt_IRwg8W2QjLr1DJr5WZ81VaYU1M_18sbqZqeQOA,110
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_var.lucene,sha256=a88bgfuTybEFXSRf2aeF9T7LnJ941edE3L5AVcDAeO0,434
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_var.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_malicious_commandlets.eql,sha256=o_WNz0j8hV7FugJHKkdmfnmYGgI4y0RLTlEW176QHzY,4558
src/rules/windows__powershell__powershell_module__posh_pm_malicious_commandlets.lucene,sha256=kx41eSHUWN164vamKfz7X5J1blOAZnJEXhcrkOkUgLE,4732
src/rules/windows__powershell__powershell_module__posh_pm_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_remote_powershell_session.eql,sha256=qCakF2TXkLuGwoML6b-i7zXCvwVpAuBUYghh2pcFLno,284
src/rules/windows__powershell__powershell_module__posh_pm_remote_powershell_session.lucene,sha256=CJR_3t6PVTdVJVMRfBU6LpaC-IwgPPTGUisIb_Wjarg,272
src/rules/windows__powershell__powershell_module__posh_pm_remote_powershell_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_remotefxvgpudisablement_abuse.eql,sha256=Mz0OJ3FirDXhYP249CFD0p3L-E9rsGExo0lzXBdnn3E,109
src/rules/windows__powershell__powershell_module__posh_pm_remotefxvgpudisablement_abuse.lucene,sha256=RYDGMa289OftVYsNZEdFHgFjVo2jXWEv7uNnedmtch4,102
src/rules/windows__powershell__powershell_module__posh_pm_remotefxvgpudisablement_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_ad_group_reco.eql,sha256=nWU9eu6Mxmph5BZJtEQL7d1RDRxqPh_htmN116JoTfE,557
src/rules/windows__powershell__powershell_module__posh_pm_susp_ad_group_reco.lucene,sha256=LSUlSfLwcPfBgqCP6HoshptD9zLzWT2tA59O8vzftuc,539
src/rules/windows__powershell__powershell_module__posh_pm_susp_ad_group_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_download.eql,sha256=K1JlimVDtcbZoO9CfsMGBQkcL2xWTSoQN8hBPwSC8GY,150
src/rules/windows__powershell__powershell_module__posh_pm_susp_download.lucene,sha256=mutaCOzW_SxulDweg97H9BOUHtyH-0NuIbtyRkYGJCc,132
src/rules/windows__powershell__powershell_module__posh_pm_susp_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_get_nettcpconnection.eql,sha256=1rzVJFsKzSfK3Ofysefyr1rJFdoKwoMIf3uoHAtlw2s,65
src/rules/windows__powershell__powershell_module__posh_pm_susp_get_nettcpconnection.lucene,sha256=2x8qSCV3MQPZkSrQ2rILBEfxyWVxWB9svf7k7KosDn8,54
src/rules/windows__powershell__powershell_module__posh_pm_susp_get_nettcpconnection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_generic.eql,sha256=8QXSTMm0E7uq3gRhoHwENBbwHxd9chRAv8HsYenpmRw,295
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_generic.lucene,sha256=YxUIu1M9DCExcrN8olphv-qLl9aV3EWdLTP8IY7k1NE,292
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_generic.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_specific.eql,sha256=ZwSHNmdA9bQd42-8EdluFW9GBxQgW9nTj_xh-nXKDV0,1879
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_specific.lucene,sha256=oMehJjSxmsfWWvurotpTXNvlaLwWWMYGirZ49hMFrqk,1830
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_specific.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_local_group_reco.eql,sha256=UKBIxVp4UBlCK4Nug6LvDvpDq9FOgKmJuhfEvKHq_2U,609
src/rules/windows__powershell__powershell_module__posh_pm_susp_local_group_reco.lucene,sha256=s7437lAh6eIcgHFtUuHSX0Q02VFDO9Ju9_snQbd16QY,583
src/rules/windows__powershell__powershell_module__posh_pm_susp_local_group_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_reset_computermachinepassword.eql,sha256=mavp0D1Gnlwl87TYCR_2iv8OV6aE4QWQTQG9N9i1Ijc,74
src/rules/windows__powershell__powershell_module__posh_pm_susp_reset_computermachinepassword.lucene,sha256=RUFj1m4IEbA5ai6U3BFgRJEaNID-lRMnmVQZP8qWPNA,63
src/rules/windows__powershell__powershell_module__posh_pm_susp_reset_computermachinepassword.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_smb_share_reco.eql,sha256=tb5Wa0D_guzlKXtkDNmLb7BjB1k_j-YYa2yk0q1wQdo,111
src/rules/windows__powershell__powershell_module__posh_pm_susp_smb_share_reco.lucene,sha256=D7IwuJm5BBz0KpHuyuUJcViYBVChUUeRmWizmF8HHWo,99
src/rules/windows__powershell__powershell_module__posh_pm_susp_smb_share_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_zip_compress.eql,sha256=1vJ0LGdqbrmB6wsL6N_pNW9Ie5oU1MhihTRZSbg2Naw,294
src/rules/windows__powershell__powershell_module__posh_pm_susp_zip_compress.lucene,sha256=XrUYDf1gRgSYySER0F5sP47cArcroapqV8BKbaiflxc,291
src/rules/windows__powershell__powershell_module__posh_pm_susp_zip_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_syncappvpublishingserver_exe.eql,sha256=3CEh0clRZLZqlNTK_H-1RTuYKa7Df5ZuVNG01-5EH5g,73
src/rules/windows__powershell__powershell_module__posh_pm_syncappvpublishingserver_exe.lucene,sha256=rHftQy4XcX9R1zZFhkF3avnBPS58W8gVrEey44hllUI,61
src/rules/windows__powershell__powershell_module__posh_pm_syncappvpublishingserver_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_aadinternals_cmdlets_execution.eql,sha256=llEU0ie0kuDYcdLJTH--jZEALX3n7jHLJ72K6TWaptQ,553
src/rules/windows__powershell__powershell_script__posh_ps_aadinternals_cmdlets_execution.lucene,sha256=oRuO-KWuuymClDKsddmk4u3JvsI-jfcpE8YJphos0GU,562
src/rules/windows__powershell__powershell_script__posh_ps_aadinternals_cmdlets_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_access_to_browser_login_data.eql,sha256=mr0I8TszD2eKJHEn2huPaqQVYmN6NdBHlZVQSqmA_Lg,407
src/rules/windows__powershell__powershell_script__posh_ps_access_to_browser_login_data.lucene,sha256=dTcx47CMwPQ8XeGF2OcSNsS-sA8WrBH8dMpVF9YGMUU,397
src/rules/windows__powershell__powershell_script__posh_ps_access_to_browser_login_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_active_directory_module_dll_import.eql,sha256=JncIKXcmIdFtb_upUNT64k5aDDCuZAIfZ1Eu233VPP8,235
src/rules/windows__powershell__powershell_script__posh_ps_active_directory_module_dll_import.lucene,sha256=S_OwRnU9kWFnwmHelU2X4z2Y9HIQgGbYKh2urj_zlww,222
src/rules/windows__powershell__powershell_script__posh_ps_active_directory_module_dll_import.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_add_dnsclient_rule.eql,sha256=eS8da1XWKu762Fni6h5hYX5XeNEw4MG42MH0K3ipoIE,170
src/rules/windows__powershell__powershell_script__posh_ps_add_dnsclient_rule.lucene,sha256=v6azfGPUlfa7L6DeGbL2DUaQhhw3_1pIdSIidg68tIc,157
src/rules/windows__powershell__powershell_script__posh_ps_add_dnsclient_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_add_windows_capability.eql,sha256=u71vrOQ31lg-oQ5gqKDQJXJrbXL2bREomLkaH8I1rdc,128
src/rules/windows__powershell__powershell_script__posh_ps_add_windows_capability.lucene,sha256=-1VpWt6cxgO8bOXgJvpJumzc0BdIdcRhSt_3NGMP0Po,118
src/rules/windows__powershell__powershell_script__posh_ps_add_windows_capability.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_adrecon_execution.eql,sha256=_emOFVolQV49bk-zgep0HmKJ-Dz_6p7k1CeB1OGva1I,153
src/rules/windows__powershell__powershell_script__posh_ps_adrecon_execution.lucene,sha256=P6_MOToAhQ6o5xh0GB1Rn0qSZUtcskqFmTf1DmGQfzw,140
src/rules/windows__powershell__powershell_script__posh_ps_adrecon_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_amsi_bypass_pattern_nov22.eql,sha256=QzyXL3NmqhoW-qChmdMrujGMHoCVjoHm8cP_ydZaJiM,194
src/rules/windows__powershell__powershell_script__posh_ps_amsi_bypass_pattern_nov22.lucene,sha256=tA_zy2Dffa5YXNTzJERGSqD_p-YH5s9MBlAdsAqKRNs,182
src/rules/windows__powershell__powershell_script__posh_ps_amsi_bypass_pattern_nov22.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_amsi_null_bits_bypass.eql,sha256=Avikf2z7UAvw53LTURLS_L-EIKWcFyJHJgHVaNOVedg,104
src/rules/windows__powershell__powershell_script__posh_ps_amsi_null_bits_bypass.lucene,sha256=ECSmgC4S9TaoGgFh3sSpDtrcj45J3nsrZkR76p2R63M,108
src/rules/windows__powershell__powershell_script__posh_ps_amsi_null_bits_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_apt_silence_eda.eql,sha256=uFkOh8zizDtnMnqBO6-CLJMtim02amRuj8VMMLepqAw,794
src/rules/windows__powershell__powershell_script__posh_ps_apt_silence_eda.lucene,sha256=j9kQlGela_b2IIpTn6G1VOkMSURmyGMd2IoXz0k-ows,792
src/rules/windows__powershell__powershell_script__posh_ps_apt_silence_eda.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_as_rep_roasting.eql,sha256=8IXqKYcepWby4jHn7flHF66SkAEnuuJEoBWegKleGJ4,268
src/rules/windows__powershell__powershell_script__posh_ps_as_rep_roasting.lucene,sha256=jv8HaG7V4E8ofi6LbH7vCT3E4jjR2kGDM2DrIxR8k48,251
src/rules/windows__powershell__powershell_script__posh_ps_as_rep_roasting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_audio_exfiltration.eql,sha256=nK7HeC15-IAWCl4fpDCOXOC-lL_u6XYILUCMUnN5Dhg,557
src/rules/windows__powershell__powershell_script__posh_ps_audio_exfiltration.lucene,sha256=42sQMyJznWlzMhfGdSzK5U5oag7P1WspLX6u-Gtnfgw,533
src/rules/windows__powershell__powershell_script__posh_ps_audio_exfiltration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_automated_collection.eql,sha256=9uHiyyVHdJ92UiPulNeUOSWN5szDKXe4HcP7BjookXU,310
src/rules/windows__powershell__powershell_script__posh_ps_automated_collection.lucene,sha256=UjNtNMzDimPK3UsUnT1ice5SjOsUdmqVtpnqfxvqWwE,293
src/rules/windows__powershell__powershell_script__posh_ps_automated_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_capture_screenshots.eql,sha256=OolIcym86Y5nSi2FJ4R63TTwBh1fzN0QXXIQ8IGshAI,64
src/rules/windows__powershell__powershell_script__posh_ps_capture_screenshots.lucene,sha256=2pJDNV05Rs08XtTpJbgx9Kl820N83yqeEoWYtuQxy-k,52
src/rules/windows__powershell__powershell_script__posh_ps_capture_screenshots.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_clear_powershell_history.eql,sha256=29QG04eBHKS5ieNdaykZbvz9qXPlFFUFHB8lCABj908,530
src/rules/windows__powershell__powershell_script__posh_ps_clear_powershell_history.lucene,sha256=DA_dG_o_Beo5oGDXSJicEufpR90bVGZ_CFaFGSPMOjQ,505
src/rules/windows__powershell__powershell_script__posh_ps_clear_powershell_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_clearing_windows_console_history.eql,sha256=VgFcFSeSkHub4alfHX6gJwn7hrzdEA3-zsoYx_b2vfc,255
src/rules/windows__powershell__powershell_script__posh_ps_clearing_windows_console_history.lucene,sha256=MonXW4rqndxcgfZHCXvLlvnj-z7oR92xp2ZuAGNK-2E,232
src/rules/windows__powershell__powershell_script__posh_ps_clearing_windows_console_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_cmdlet_scheduled_task.eql,sha256=oFfCzFRt3R0xfg1dgyE8VVbomWXC8iMjUSnaiDi0Ekw,799
src/rules/windows__powershell__powershell_script__posh_ps_cmdlet_scheduled_task.lucene,sha256=QT-JntTb4mEwoSX4GrlQ8nO8yMtqiEgRkWEwB7cez9M,775
src/rules/windows__powershell__powershell_script__posh_ps_cmdlet_scheduled_task.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_computer_discovery_get_adcomputer.eql,sha256=gJxGfYoCuB7bGd6eQkOq8Ad5FQoPU7-woEO5NkCA3Qk,232
src/rules/windows__powershell__powershell_script__posh_ps_computer_discovery_get_adcomputer.lucene,sha256=3u6Uird-zmSbnxZptcROEzCjAlYWvf3ipGBkityzy6A,221
src/rules/windows__powershell__powershell_script__posh_ps_computer_discovery_get_adcomputer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_copy_item_system_directory.eql,sha256=Sk1Tg14gCAMuMAX9ie0ilUtq_FzEso5YZvxzxOd6JsY,133
src/rules/windows__powershell__powershell_script__posh_ps_copy_item_system_directory.lucene,sha256=UqvZ8gL8sp5OvDI5ug0ZSXPK9QHaqdTK6Q2xdOn2zVA,201
src/rules/windows__powershell__powershell_script__posh_ps_copy_item_system_directory.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_cor_profiler.eql,sha256=WjD3CINWEIF2ucxEWpoVfO85S720copslIDuCEK0qi8,199
src/rules/windows__powershell__powershell_script__posh_ps_cor_profiler.lucene,sha256=_GrjZc9a1SzIGH0hV5dlGL3iCZLhphFkRn1QWEC81KM,186
src/rules/windows__powershell__powershell_script__posh_ps_cor_profiler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_create_local_user.eql,sha256=lRqCGamoD5ApDFQjrQF0Ub-ZZdnvcGkaLQYgOs3-4Dw,62
src/rules/windows__powershell__powershell_script__posh_ps_create_local_user.lucene,sha256=7VI4v5fBdg1Fj0eU2m-ZI1TVxqPhB2TI7KFbt7jEs9o,51
src/rules/windows__powershell__powershell_script__posh_ps_create_local_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_create_volume_shadow_copy.eql,sha256=whj0paCJbXrUHiegkCVI11bvI_ByMHWof6Yqoc3BitM,176
src/rules/windows__powershell__powershell_script__posh_ps_create_volume_shadow_copy.lucene,sha256=qCJtDGWluQOqb7uVMxewwny596wuGpWBq-fl-CueHmE,162
src/rules/windows__powershell__powershell_script__posh_ps_create_volume_shadow_copy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_detect_vm_env.eql,sha256=NOOZNvzDHcUDBoabKmhnru9vI48TzKwBnWHOi_6nbRw,190
src/rules/windows__powershell__powershell_script__posh_ps_detect_vm_env.lucene,sha256=Q-3u0wqFETLvy2QUGeQvJyutylaNYaDMiINnagT2TBA,165
src/rules/windows__powershell__powershell_script__posh_ps_detect_vm_env.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_directorysearcher.eql,sha256=2WAmJL6jLoeTik8KYSI4w02Z0Mz2tes2Yyx2LZNuFpM,320
src/rules/windows__powershell__powershell_script__posh_ps_directorysearcher.lucene,sha256=vaAp462IKplWe8Ct_anemZNOjtB_j7yY5h6cCWG5L0U,304
src/rules/windows__powershell__powershell_script__posh_ps_directorysearcher.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_directoryservices_accountmanagement.eql,sha256=q-1u4umYVFI0za4TBb0KKTey8c88vmbWXtbqTPocl5E,91
src/rules/windows__powershell__powershell_script__posh_ps_directoryservices_accountmanagement.lucene,sha256=aMubTtxGB_dny51u2WQePTDuQWdhmHDzomEXfQ0wfpw,79
src/rules/windows__powershell__powershell_script__posh_ps_directoryservices_accountmanagement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_disable_psreadline_command_history.eql,sha256=v7tqrWcr8lVMqmgIVAAZzHtjvc36_Jgh58uRRQ3oJQ0,115
src/rules/windows__powershell__powershell_script__posh_ps_disable_psreadline_command_history.lucene,sha256=3WslvsAyQW8VhOUEE4v5g3fpM7K10ArJFf6iyq8yjc4,102
src/rules/windows__powershell__powershell_script__posh_ps_disable_psreadline_command_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_disable_windows_optional_feature.eql,sha256=BDbE1y7XcN7gnOkBqSw8x3LqolCgJhJgOHdH1cT6tyw,351
src/rules/windows__powershell__powershell_script__posh_ps_disable_windows_optional_feature.lucene,sha256=0ZGbxjkyHolOay1lV5tWcA-RogQecWPqDiO5oafJ_-M,337
src/rules/windows__powershell__powershell_script__posh_ps_disable_windows_optional_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_dotnet_assembly_from_file.eql,sha256=OxGQFlzme9Ug2us05ueSlz5ryJr-E67EkHbPP3sZZjI,76
src/rules/windows__powershell__powershell_script__posh_ps_dotnet_assembly_from_file.lucene,sha256=tDu151SoolhFmi8KQZl3CC5gX0onfqbfTONGMjbWjA4,68
src/rules/windows__powershell__powershell_script__posh_ps_dotnet_assembly_from_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_download_com_cradles.eql,sha256=P2vzi6z-rdjk9bgZ99t6pFC0S-kFKNOrHMIp7s076uM,541
src/rules/windows__powershell__powershell_script__posh_ps_download_com_cradles.lucene,sha256=G3pcr0-YyFucHkyqxy_ibAplILCMTd-fCd2HDqi28Kc,566
src/rules/windows__powershell__powershell_script__posh_ps_download_com_cradles.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_dsinternals_cmdlets.eql,sha256=ZsTUctrw9wu2grS3AV2LEfB9A6IPpQlLG5NIMBDxjK0,1682
src/rules/windows__powershell__powershell_script__posh_ps_dsinternals_cmdlets.lucene,sha256=qsNxMAWBPpkmLnQKMQBwfO1g7YMzSud0EsO2fdzPNjM,1727
src/rules/windows__powershell__powershell_script__posh_ps_dsinternals_cmdlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_dump_password_windows_credential_manager.eql,sha256=qz9XEcpHPQ0PR4DTj08e3jeRvyvoRHCtvelY-hvjvak,647
src/rules/windows__powershell__powershell_script__posh_ps_dump_password_windows_credential_manager.lucene,sha256=9RBz-DgcHi6Mjf5JdDae_Zf6Kx46UPfsjw1Jjzv_yWI,626
src/rules/windows__powershell__powershell_script__posh_ps_dump_password_windows_credential_manager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_enable_psremoting.eql,sha256=olqHR5q5ZxjDWkRikWq_m3T70DJA-XwjBCRkZNeWcO8,67
src/rules/windows__powershell__powershell_script__posh_ps_enable_psremoting.lucene,sha256=QcY1OjOY4lEIBFAkVncWX02j42Ccm_0A-PQoWeY2KGI,57
src/rules/windows__powershell__powershell_script__posh_ps_enable_psremoting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_enable_susp_windows_optional_feature.eql,sha256=k-nOEy684nwht6QObfQ--ZvdNRlaoqQUt2t_p3o5ytU,374
src/rules/windows__powershell__powershell_script__posh_ps_enable_susp_windows_optional_feature.lucene,sha256=E1SiSLY8mQzdYLso1__oEAWbIVpV9jqRmb_5Q74tEuY,360
src/rules/windows__powershell__powershell_script__posh_ps_enable_susp_windows_optional_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_enumerate_password_windows_credential_manager.eql,sha256=IVzfW7A5r1ikwk6GcqwR6XN-am--nWSTwjmltbE464s,206
src/rules/windows__powershell__powershell_script__posh_ps_enumerate_password_windows_credential_manager.lucene,sha256=emPlzD6Jt4YZLoUMHAUj3QNAPp_Tc5DG8CxjgM8JyEg,188
src/rules/windows__powershell__powershell_script__posh_ps_enumerate_password_windows_credential_manager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_etw_trace_evasion.eql,sha256=wBtB0FbIcXnCjK88sS6MpbV6Mm0K_2EWdu7o5zxVGuU,185
src/rules/windows__powershell__powershell_script__posh_ps_etw_trace_evasion.lucene,sha256=lUjkwyM0hJ6P6LwtH_0Fsf6hBmvRN718IAQmClaoxds,173
src/rules/windows__powershell__powershell_script__posh_ps_etw_trace_evasion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_exchange_mailbox_smpt_forwarding_rule.eql,sha256=bKA512JUU2hBOYBSIlZH3Kyr3WuUMJN_0Xg0-4NdW-o,200
src/rules/windows__powershell__powershell_script__posh_ps_exchange_mailbox_smpt_forwarding_rule.lucene,sha256=qKufySOYnFk8RDsYul3vWevFGR1Nq-9uLe7QKyUqvqM,192
src/rules/windows__powershell__powershell_script__posh_ps_exchange_mailbox_smpt_forwarding_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_export_certificate.eql,sha256=JuimX8noR7cLq25U_fPVrlbGlJf3faADY0NDgYtXvfA,173
src/rules/windows__powershell__powershell_script__posh_ps_export_certificate.lucene,sha256=lhnlcHTbwKcxJown_N9H4S-TVSPR4gXIgVwwZ8EdNvU,159
src/rules/windows__powershell__powershell_script__posh_ps_export_certificate.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_frombase64string_archive.eql,sha256=mbxCbRBMbuu8BENbBcVnwqyWDht0srljIgaq4WI_Ry4,167
src/rules/windows__powershell__powershell_script__posh_ps_frombase64string_archive.lucene,sha256=uzShXC-Iop4OrivLEIYwvz-1hzXTnrL-bE4tB40M3B8,151
src/rules/windows__powershell__powershell_script__posh_ps_frombase64string_archive.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_acl_service.eql,sha256=YsWiZsJ5ZyaFxyUmwv3_MniB-z2KrDL98CFgGV1NfCM,152
src/rules/windows__powershell__powershell_script__posh_ps_get_acl_service.lucene,sha256=KPXhVo0HRrjkaQN379jGx_T03rTwRuv-jnrukP6W0EM,140
src/rules/windows__powershell__powershell_script__posh_ps_get_acl_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_adcomputer.eql,sha256=ItIqN75VIZWS0kbvXlNDD7QyLVFGKYazhM5hP0U1nZA,161
src/rules/windows__powershell__powershell_script__posh_ps_get_adcomputer.lucene,sha256=9IhKvEfMP8uTyALW9txyMFg8qHoHFHje5JspmqklfuQ,149
src/rules/windows__powershell__powershell_script__posh_ps_get_adcomputer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_adgroup.eql,sha256=7iR0tFJPSvc8--TwjF7fcxYue9BtwJZcPeXF2Bhstss,111
src/rules/windows__powershell__powershell_script__posh_ps_get_adgroup.lucene,sha256=q0oSK8nP3oKlYamT0jpDVjWoiUZebGiGOo33tiS-QxE,100
src/rules/windows__powershell__powershell_script__posh_ps_get_adgroup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_adreplaccount.eql,sha256=tIdC6tlzyvh6rrZkI80KD9HShNo3bFU6MvsHCr15A_Q,165
src/rules/windows__powershell__powershell_script__posh_ps_get_adreplaccount.lucene,sha256=R44zG3hLdlO3Uf1qdtLrTsr__XVRE9eyEAC8_bvQpUQ,154
src/rules/windows__powershell__powershell_script__posh_ps_get_adreplaccount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_childitem_bookmarks.eql,sha256=61F6Rlz-uSbLJOqGzFdkXLvBJcTbRIvAUhhhOsK1n9o,349
src/rules/windows__powershell__powershell_script__posh_ps_get_childitem_bookmarks.lucene,sha256=ZywZGDocmUNQsGAMbdLLemFHCN1fjf4VZqDVK2yDhOk,342
src/rules/windows__powershell__powershell_script__posh_ps_get_childitem_bookmarks.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_process_security_software_discovery.eql,sha256=uug2_5GAQlu_CFxR49wPzeNvkRtsEYqfRK-BXrmxwd4,496
src/rules/windows__powershell__powershell_script__posh_ps_get_process_security_software_discovery.lucene,sha256=sp27FQnvZH1g5gboJqaEgIZg634x5FX45MxYtFQgWKk,466
src/rules/windows__powershell__powershell_script__posh_ps_get_process_security_software_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_hktl_rubeus.eql,sha256=kMa9_9-NYm87IjSw8TIHOgOFYGqykrafVWT5Y0XKbas,359
src/rules/windows__powershell__powershell_script__posh_ps_hktl_rubeus.lucene,sha256=6eMm4O3ui0xjgUVr7A-avVuoTLMIsoVqea-qZPBM818,382
src/rules/windows__powershell__powershell_script__posh_ps_hktl_rubeus.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_hktl_winpwn.eql,sha256=3tXPZ2KH_NLmvKPr6qH9px9Nr_8YQB7__oZ1eVJjQFQ,116
src/rules/windows__powershell__powershell_script__posh_ps_hktl_winpwn.lucene,sha256=1U4s-ZGVv4UddQ628xRdd6Rl05kiS0yreCPrAji_kRU,99
src/rules/windows__powershell__powershell_script__posh_ps_hktl_winpwn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_hotfix_enum.eql,sha256=Jf2MzCV-2rWa0JH6L0nLmWr_DbdKlIuOC9Gk9dC1-yY,125
src/rules/windows__powershell__powershell_script__posh_ps_hotfix_enum.lucene,sha256=7N2NhqWh7lMkQyasZ2smEm2d46GjF8zatBI5w4aBZVA,111
src/rules/windows__powershell__powershell_script__posh_ps_hotfix_enum.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_icmp_exfiltration.eql,sha256=WjE6EstSbp_KATvQLu5Hz5LVBLH61RFM0kz6stcJ2gc,185
src/rules/windows__powershell__powershell_script__posh_ps_icmp_exfiltration.lucene,sha256=kRYCQov1Tuz4fw5GWaUVZ3eUcLcsvIDjfJl9bcAAPpk,171
src/rules/windows__powershell__powershell_script__posh_ps_icmp_exfiltration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_import_module_susp_dirs.eql,sha256=BXKtXkTt7D9VxhfKUf0ubGJm9Bh5craakRvori1Gq4g,468
src/rules/windows__powershell__powershell_script__posh_ps_import_module_susp_dirs.lucene,sha256=jYq7ISrU_3u3rJMaDzh2Ld_IA_eFq_ba3yq2IE9T2ns,471
src/rules/windows__powershell__powershell_script__posh_ps_import_module_susp_dirs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_install_unsigned_appx_packages.eql,sha256=z7UXrlxvec9fg3fwD5B0FcmCn3b_SI6a-F0LiZjOilI,154
src/rules/windows__powershell__powershell_script__posh_ps_install_unsigned_appx_packages.lucene,sha256=WaB9oCpjd0tysSRBhhaRmdB0rDMytSjw2Cr-KrhnYIk,140
src/rules/windows__powershell__powershell_script__posh_ps_install_unsigned_appx_packages.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_command_remote.eql,sha256=EGQAgW5fgj9lACz_GHwl6t8A5vp8hu-29WK7QguSrkQ,122
src/rules/windows__powershell__powershell_script__posh_ps_invoke_command_remote.lucene,sha256=Dk2gKKT_uiGXjuMX0xNmsh7Zcn0EwnGxd2SWEELOrMw,113
src/rules/windows__powershell__powershell_script__posh_ps_invoke_command_remote.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_dnsexfiltration.eql,sha256=vq5s5xwaQftI46hwnwv-C7voWINhTsDo0BcH01tjdVc,308
src/rules/windows__powershell__powershell_script__posh_ps_invoke_dnsexfiltration.lucene,sha256=oK85jaYCuPA5UJ0txQCR0yzt9NYROe9jbKb1Vz5v-XU,302
src/rules/windows__powershell__powershell_script__posh_ps_invoke_dnsexfiltration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_clip.eql,sha256=eVl5aS1qdGltbtrQTdAbyvqUJu0pAE4E1xQAsHyFbv4,140
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_clip.lucene,sha256=nlV1CiSGuXhCLz-YRjGwp2NcWY0cJ7yN6QxmpaFJctM,351
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_clip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_obfuscated_iex.eql,sha256=H1gvMx5jDOaOde76C1K-3K9oQ2BkoDpI6b8vx3A3OF0,364
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_obfuscated_iex.lucene,sha256=0kzTNpOgHVfO-BAsTUftrXOtJxcS5chYPCZC-7saBbs,1521
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_obfuscated_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_stdin.eql,sha256=961Xu6PCwCNij3RvKmQEEuVmbC-vbsBYL73sJGQBZN4,118
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_stdin.lucene,sha256=d6xrw0Xz4uZusAJX76apzzr0vRVMfm0wrhFwBLJvibM,408
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_stdin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_var.eql,sha256=dXglRvxezHJ2llQQtZY0QoIPIxXlHSCgfq6MgQTVWNM,153
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_var.lucene,sha256=k25ujZZOlHFrXl71zeHJtzDsYdS8Io-NDeWz0KAZfQo,585
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_var.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_compress.eql,sha256=TOuTWkOi2PtXyyOtLUr7xnOTWrEKv1qvVMeKD9ZFZnY,292
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_compress.lucene,sha256=xLWoXOw6Xy7wNCdGcHf_Upowy_QfdLA_PZlDatQgRs4,272
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_rundll.eql,sha256=RpEXsV_ojSRsu9V3dO6KvQvIv62iBorEfr_uRyq8vyw,227
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_rundll.lucene,sha256=5q0mX-YHUEMZeXAOpoePMfZ4v5di5uG1qI8YV3_z5CQ,209
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_rundll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_stdin.eql,sha256=V5gbxRex2ZmffcBIcgXCzLlUZ8JUXip1UDMGox4f0lM,121
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_stdin.lucene,sha256=y8qSn9uTAVK4CSJ9u0N6fbcKYtuV9JiuekMLQzGpwK0,487
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_stdin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_clip.eql,sha256=cdXKiOJZrkEfzbFp6_DoVqwV4KNWyRwVYrQalhwpsZs,107
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_clip.lucene,sha256=lAI97MKEbQQfwq0ID2NqR4nBQ8-KblXE8wzS18pKr7Y,601
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_clip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_mhsta.eql,sha256=ZbBuQGAdGtNKzyA6vtbCqQtHaNRA4hLnodc3naCaLr8,313
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_mhsta.lucene,sha256=CUKJUEKv0w_mXMTPbAssBA7fNUZV2SkWjbH5ansHW9Q,296
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_mhsta.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_rundll32.eql,sha256=O324PGzLXd47TVN1tE6gLCN7mRkkyz2sH18xg0OnWZI,309
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_rundll32.lucene,sha256=5IK8IoL4llYsbs1PU8wpmc3DvYgjJbmSbSesQ_RLyRo,285
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_rundll32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_var.eql,sha256=plSt_IRwg8W2QjLr1DJr5WZ81VaYU1M_18sbqZqeQOA,110
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_var.lucene,sha256=a88bgfuTybEFXSRf2aeF9T7LnJ941edE3L5AVcDAeO0,434
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_var.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_keylogging.eql,sha256=yP2_RUdklQD39vk6GFzo_lWzsyaV3uNxCLUsbb0lHyk,239
src/rules/windows__powershell__powershell_script__posh_ps_keylogging.lucene,sha256=sLpIvX01Qnwbj97Zkz4-wVwftOAJXVEOcS9v43MVFrM,230
src/rules/windows__powershell__powershell_script__posh_ps_keylogging.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_localuser.eql,sha256=uG66YuNceQs6FqXmSu0UYbcmaTnpf7FIwj-WnCTOcwM,197
src/rules/windows__powershell__powershell_script__posh_ps_localuser.lucene,sha256=DvLBqDYamgJUuNSJFCmG1zHaGMsYuiflVPOzKCVmS5U,186
src/rules/windows__powershell__powershell_script__posh_ps_localuser.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_mailboxexport_share.eql,sha256=kgxiNYb3Kgc5S6_2OMkedxouM0w7kLr0CFCsCJHIqqk,182
src/rules/windows__powershell__powershell_script__posh_ps_mailboxexport_share.lucene,sha256=yfXlj0Y55njb_W-XpOdUoLWpmqu_CoVE9dre2l9ZGIc,173
src/rules/windows__powershell__powershell_script__posh_ps_mailboxexport_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_malicious_commandlets.eql,sha256=BF78ZUvDsGDi-bNMIpDArHUWlmuIbmfYON-9g5XJ3Oc,4355
src/rules/windows__powershell__powershell_script__posh_ps_malicious_commandlets.lucene,sha256=MVAiPONRVqvdxPEoV72_-XR-U-0ndXJoMTGTeKtmv38,4507
src/rules/windows__powershell__powershell_script__posh_ps_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_malicious_keywords.eql,sha256=1IKfcY0zmTyRQAZbRgEtPZG5oghhwkH1HwDPDGU-Xow,521
src/rules/windows__powershell__powershell_script__posh_ps_malicious_keywords.lucene,sha256=XSo5V7-YDfBGcV0XvyhfjPrp4f9Bj07atXhy50Smx9I,503
src/rules/windows__powershell__powershell_script__posh_ps_malicious_keywords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_memorydump_getstoragediagnosticinfo.eql,sha256=iyEMzD9Fu6lVvLNcCpLAG_OboAL4SyYrLS_b69WfDiw,133
src/rules/windows__powershell__powershell_script__posh_ps_memorydump_getstoragediagnosticinfo.lucene,sha256=bshxaeQImF4Ze-9Ndj0tUPV2JhmmeGsd9BKvb6iDw1A,121
src/rules/windows__powershell__powershell_script__posh_ps_memorydump_getstoragediagnosticinfo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_modify_group_policy_settings.eql,sha256=ycxSQirHro-pU4z938etW6O2MA01YN7zC_W7Tw8iRek,322
src/rules/windows__powershell__powershell_script__posh_ps_modify_group_policy_settings.lucene,sha256=anuH76k4Dx8S2Mt-Sb4uc1mfi0lICdS_2NhMGaQtLec,302
src/rules/windows__powershell__powershell_script__posh_ps_modify_group_policy_settings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_msxml_com.eql,sha256=nhjTwMUKqEqCIoj_VmlZEqp0nd-7FrhK5ydL4u0YmMo,212
src/rules/windows__powershell__powershell_script__posh_ps_msxml_com.lucene,sha256=n_amLeojRA5DtPoLFbRBD3v2ymW9QJsc11Hc-gufEB4,196
src/rules/windows__powershell__powershell_script__posh_ps_msxml_com.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_nishang_malicious_commandlets.eql,sha256=3CrWZXioQ2PjR9kXM-jCtUKg6tjYY_mxKAiFXafH_Ws,1556
src/rules/windows__powershell__powershell_script__posh_ps_nishang_malicious_commandlets.lucene,sha256=tJlP43rf-mL6IxOX3IH3BzFqS_LQ4w9N_1nA_VhIKj8,1595
src/rules/windows__powershell__powershell_script__posh_ps_nishang_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_ntfs_ads_access.eql,sha256=ChEAEH53GYRTe3wmfaZQNmVLo0Yo2gnIeXgToajGX9w,137
src/rules/windows__powershell__powershell_script__posh_ps_ntfs_ads_access.lucene,sha256=zEUePhrnEuaVYydIv77LRWBpj_00_UmKyJRItaEhH78,120
src/rules/windows__powershell__powershell_script__posh_ps_ntfs_ads_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_office_comobject_registerxll.eql,sha256=76whAN8Kpw5IxnHx-3_Kp3-t7GPEydpCj_898WtrAj8,224
src/rules/windows__powershell__powershell_script__posh_ps_office_comobject_registerxll.lucene,sha256=AvPBXf9ZrRQl8bOD80X-h9ddqwoUTMEY6Ie9UMTFsZY,210
src/rules/windows__powershell__powershell_script__posh_ps_office_comobject_registerxll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_packet_capture.eql,sha256=jRktIMbBuCfKN-VnZtihv7m_vTmJRNEnXv99e231e6w,70
src/rules/windows__powershell__powershell_script__posh_ps_packet_capture.lucene,sha256=-Iml4sDOr_pG9u3YzVVtDx3PW3HpKMksbLk0eAJRnAc,59
src/rules/windows__powershell__powershell_script__posh_ps_packet_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_potential_invoke_mimikatz.eql,sha256=zPVUGC0yC9o1qc0MxAElz0Ddm5Q_EwJ-dkXpyXFYmnA,316
src/rules/windows__powershell__powershell_script__posh_ps_potential_invoke_mimikatz.lucene,sha256=le5b8vJXWWXzODN2ODlDES3MiCAZARwoOF_-NGMGll4,300
src/rules/windows__powershell__powershell_script__posh_ps_potential_invoke_mimikatz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_potential_unconstrained_delegation_discovery.eql,sha256=TawZQAnjuxV5M9P1KlhbvobkzG8sf6klo-yNFFKFu9g,298
src/rules/windows__powershell__powershell_script__posh_ps_potential_unconstrained_delegation_discovery.lucene,sha256=jd3Pzos5BawrvIYFH6jBJwgstEdHThu9X4mkcN6Z6ss,291
src/rules/windows__powershell__powershell_script__posh_ps_potential_unconstrained_delegation_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_powershell_web_access_installation.eql,sha256=0Ie72mT-F0RJguVLSz81J4IQIpVLnQqj6pMdYjsDwsY,345
src/rules/windows__powershell__powershell_script__posh_ps_powershell_web_access_installation.lucene,sha256=YfLuuVGPjqLSHv_BsxmKvIrcBkUCXy61t28qYargZmU,333
src/rules/windows__powershell__powershell_script__posh_ps_powershell_web_access_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_powerview_malicious_commandlets.eql,sha256=pSDXGU8fI4CqK_Ayy9q5clqDSvulnOOXgmEuH2OqMA0,1416
src/rules/windows__powershell__powershell_script__posh_ps_powerview_malicious_commandlets.lucene,sha256=An1ipcSRk_JlT6N008yf3_5vb50JFaECzTB64elfo5U,1450
src/rules/windows__powershell__powershell_script__posh_ps_powerview_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_prompt_credentials.eql,sha256=Y2aWcX5IPDP_ncoG4utliEHuiRYvV0h7LnszkKGC54Q,68
src/rules/windows__powershell__powershell_script__posh_ps_prompt_credentials.lucene,sha256=luuXycRgCBVdof4X--Y9LK9O503O_nebgXcntbxChGM,56
src/rules/windows__powershell__powershell_script__posh_ps_prompt_credentials.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_psasyncshell.eql,sha256=6Iz2sb_VzEHoOrslGAZxQuk5h7z1VT6Fp1AQV3NEU7E,61
src/rules/windows__powershell__powershell_script__posh_ps_psasyncshell.lucene,sha256=vJ-Ylz6UNbVnYgJ3ymF9QeCsDCbSjQmufasq6zKm6b8,49
src/rules/windows__powershell__powershell_script__posh_ps_psasyncshell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_psattack.eql,sha256=gaqlsXGupco2ko12n799ymWEz4DE_HF29MK-ztT55MQ,61
src/rules/windows__powershell__powershell_script__posh_ps_psattack.lucene,sha256=XqcXcV47KRFuAgvMfLPna27R9PAp25pPqfjA0UaYTTM,53
src/rules/windows__powershell__powershell_script__posh_ps_psattack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_remote_session_creation.eql,sha256=i_qQlee9lPACXLIUp-wm-XTbkRDFJXucBvvRRIdvW9E,119
src/rules/windows__powershell__powershell_script__posh_ps_remote_session_creation.lucene,sha256=fvbl-SzNed1BHv1fe7wU2U2hoDz5GRSlV6uAn5wz_Us,108
src/rules/windows__powershell__powershell_script__posh_ps_remote_session_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_remotefxvgpudisablement_abuse.eql,sha256=12--xXIj8fjXz-mixSUxsAh9nP77PpkB3iBwPGPMY_0,93
src/rules/windows__powershell__powershell_script__posh_ps_remotefxvgpudisablement_abuse.lucene,sha256=i0dr9XDYgK0vEfYlN7dQBmBY_oNaO-i63Gnn7pVgXoI,85
src/rules/windows__powershell__powershell_script__posh_ps_remotefxvgpudisablement_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_request_kerberos_ticket.eql,sha256=90WYOu3gHmBrcURWVuZuorFgaQyoG44ZPFPlZWfC1bI,163
src/rules/windows__powershell__powershell_script__posh_ps_request_kerberos_ticket.lucene,sha256=v5_UtDsPKBzIMivQ83a5UeMpmdQ_fIQPQjJXU5X9M8o,151
src/rules/windows__powershell__powershell_script__posh_ps_request_kerberos_ticket.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_resolve_list_of_ip_from_file.eql,sha256=XsoSTlqpUxqT4MXbHtnkbvUIVUD2Zw325AbkyMxjFSA,235
src/rules/windows__powershell__powershell_script__posh_ps_resolve_list_of_ip_from_file.lucene,sha256=wVwktCHMeZh7ZPcjg51aOzFD_K2cVGPPauLwChSnnec,224
src/rules/windows__powershell__powershell_script__posh_ps_resolve_list_of_ip_from_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_root_certificate_installed.eql,sha256=tDJQ3q_4Lqfr-QKjYGqeSSjzY2M7Orz5rJIhFFdpJeg,258
src/rules/windows__powershell__powershell_script__posh_ps_root_certificate_installed.lucene,sha256=tB5W-IYtT54xSz5lGkIrRF4RtlbgvhrWpH91QqEGGCg,244
src/rules/windows__powershell__powershell_script__posh_ps_root_certificate_installed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_run_from_mount_diskimage.eql,sha256=vLm4IukzoPf1VgxmdfDUMS8I6eMcU3RXJBfDigK5hRI,329
src/rules/windows__powershell__powershell_script__posh_ps_run_from_mount_diskimage.lucene,sha256=L4F8aGFi5IdQscnbWBcjdyTZigzbbx4eCrTKzt6-rWg,315
src/rules/windows__powershell__powershell_script__posh_ps_run_from_mount_diskimage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_script_with_upload_capabilities.eql,sha256=ZjrDGfRR5MNPVWraH6_PPkJLgg_XIlhgi_75tZ0bSc8,283
src/rules/windows__powershell__powershell_script__posh_ps_script_with_upload_capabilities.lucene,sha256=zbmXT2NbuYDF2D02P85Eihhyo5oqZ06WDoQkoviwQf4,273
src/rules/windows__powershell__powershell_script__posh_ps_script_with_upload_capabilities.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_sensitive_file_discovery.eql,sha256=gKQbwgC96cG6i9YpFeqtXWUwvnkNfFDkzgItD3wMJro,219
src/rules/windows__powershell__powershell_script__posh_ps_sensitive_file_discovery.lucene,sha256=x4khKbvSBzvUlK2YJqbvOgd0xSc6hRLT4D7vr9fq1DQ,193
src/rules/windows__powershell__powershell_script__posh_ps_sensitive_file_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_set_acl.eql,sha256=XrxQhVMEdZCgShGsD5OeOiILZSpTgD-fNr99xh7Id4g,160
src/rules/windows__powershell__powershell_script__posh_ps_set_acl.lucene,sha256=HMRPSrXVwbXO8Uum3xPusqP1d7cAEn1LGH-mpukLPPE,150
src/rules/windows__powershell__powershell_script__posh_ps_set_acl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_set_acl_susp_location.eql,sha256=2xZYG1hMGTmURQg1EJfd4lgnqNCbOIdiJy5hfQapMew,448
src/rules/windows__powershell__powershell_script__posh_ps_set_acl_susp_location.lucene,sha256=1JCo8E-1xR2owGDnSW6ZEBwJ_AlYFEYA3YcdwCPoNqU,452
src/rules/windows__powershell__powershell_script__posh_ps_set_acl_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_set_policies_to_unsecure_level.eql,sha256=ONT0-26AUJYr20ZOp_kUp7j5yzWsEIbvNzMYLk8pWPc,394
src/rules/windows__powershell__powershell_script__posh_ps_set_policies_to_unsecure_level.lucene,sha256=srv3qEEuCXiAqTaslpw8Vmf1ajn9ax1hgGQR3jg8nc8,387
src/rules/windows__powershell__powershell_script__posh_ps_set_policies_to_unsecure_level.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_shellcode_b64.eql,sha256=-vTKyaKsYvNF6W3Fx3XsnLTr77kGRW6moBF0neqduQA,87
src/rules/windows__powershell__powershell_script__posh_ps_shellcode_b64.lucene,sha256=Qo2QxORTMamEd1VQj2ZBfhU1A1EQdtUBpob_3KIDO0Q,69
src/rules/windows__powershell__powershell_script__posh_ps_shellcode_b64.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_shellintel_malicious_commandlets.eql,sha256=a_BngbUCA5QMX6vI0w8AbO-X-u1rColXKyC_4WCRo2A,116
src/rules/windows__powershell__powershell_script__posh_ps_shellintel_malicious_commandlets.lucene,sha256=iQqttgELrQrKcCKhiweK_vbxSycQ6vY1B5_1iySz2kw,101
src/rules/windows__powershell__powershell_script__posh_ps_shellintel_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_software_discovery.eql,sha256=GnpEb834ESWZPdWHqXcTavywHwMrZ_Kzb_sITKH4Khk,231
src/rules/windows__powershell__powershell_script__posh_ps_software_discovery.lucene,sha256=DLNtlyKn6160tFzCr2lwXgkpWKfkcBpJMfw6jC5i19Y,215
src/rules/windows__powershell__powershell_script__posh_ps_software_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_store_file_in_alternate_data_stream.eql,sha256=Z66OtBjTGEyo7X1mv8t8TDeO6nboyI4k0Jgz14Qd_B4,233
src/rules/windows__powershell__powershell_script__posh_ps_store_file_in_alternate_data_stream.lucene,sha256=lDLc3NA3z8nfLoMKxC_oZF48l4sCMwmFVn9HRBobKKo,223
src/rules/windows__powershell__powershell_script__posh_ps_store_file_in_alternate_data_stream.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_ace_tampering.eql,sha256=0rntt37TLBTsw_VuctqKcQKreHbddSxxCuiqA-fvRIk,399
src/rules/windows__powershell__powershell_script__posh_ps_susp_ace_tampering.lucene,sha256=ebEKHsq7OHL2xhpqx9faU9XhGmlIJr1NjQE0FuGEQAM,371
src/rules/windows__powershell__powershell_script__posh_ps_susp_ace_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_ad_group_reco.eql,sha256=tcFRRXDEQzhAGKfbw6uF6pN7CcQrycrpKRV2qahs6WA,290
src/rules/windows__powershell__powershell_script__posh_ps_susp_ad_group_reco.lucene,sha256=uSB_cihD5xvKVIbRJOcpIAUztwoOteRYZknygorSGeA,276
src/rules/windows__powershell__powershell_script__posh_ps_susp_ad_group_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_alias_obfscuation.eql,sha256=ILmi9gX1fSSgssWSgwq1A0ZasMOlmeD9pIEcQMA9hb4,113
src/rules/windows__powershell__powershell_script__posh_ps_susp_alias_obfscuation.lucene,sha256=_P1PqfZijKV3UCoCVfn8cK0Of-6VPZe8P2KTxzRGSMM,106
src/rules/windows__powershell__powershell_script__posh_ps_susp_alias_obfscuation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_clear_eventlog.eql,sha256=9JuKnaCHr95CSmsPiwjmixIRH3vb5UeAFr1OH5J5s4Q,376
src/rules/windows__powershell__powershell_script__posh_ps_susp_clear_eventlog.lucene,sha256=FJsPZsEvb7LPqxB7cUL7DwkF5jM0d7E1dMj4IkSM63o,358
src/rules/windows__powershell__powershell_script__posh_ps_susp_clear_eventlog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_directory_enum.eql,sha256=S88-LaQYvewmrpjLmj1WGKQ7BEVfMX3GYzw6Rx5GGmA,378
src/rules/windows__powershell__powershell_script__posh_ps_susp_directory_enum.lucene,sha256=28bRZ8fnB7RJWHuCwrz4GjkUanerw-IXP0jQYQ_CBTs,362
src/rules/windows__powershell__powershell_script__posh_ps_susp_directory_enum.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_download.eql,sha256=W4jPuXUT_4Nttz7YOARecm74s9-Zn_OR82Zc-3OGfFM,210
src/rules/windows__powershell__powershell_script__posh_ps_susp_download.lucene,sha256=nbsCyQNFgrB-oiIs3rm6bfcSIKZsaZVHKVz7_rPfoE0,194
src/rules/windows__powershell__powershell_script__posh_ps_susp_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_execute_batch_script.eql,sha256=xZRYl-gYnknwZXzOrsTpR98TGIneEc-xpYEou0LCMbM,129
src/rules/windows__powershell__powershell_script__posh_ps_susp_execute_batch_script.lucene,sha256=ORWatb6f983ffHDx4UAZNsG-304cGm7X1Z4lazMrU5U,110
src/rules/windows__powershell__powershell_script__posh_ps_susp_execute_batch_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_extracting.eql,sha256=QZWXk5pcn58ZReL__hWTAWRExIAz2Yj2KgWrOKUKoz4,206
src/rules/windows__powershell__powershell_script__posh_ps_susp_extracting.lucene,sha256=k7p3WFvD3UBTf9DKskAU3T5uc8iVD591jGgGp2afYsQ,194
src/rules/windows__powershell__powershell_script__posh_ps_susp_extracting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_follina_execution.eql,sha256=aVGjcWqGLKnBHa_teWp6567PFRMkcjY7fIqnxNdVxns,263
src/rules/windows__powershell__powershell_script__posh_ps_susp_follina_execution.lucene,sha256=ea9uz3q5VlaBA97YWjWmLRStvOnZa4kAMGypeXPqhJg,249
src/rules/windows__powershell__powershell_script__posh_ps_susp_follina_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_addefaultdomainpasswordpolicy.eql,sha256=z7mYYJEH5ktNvfgWViGRZTOzXAWowia2T0rOiRpJzrs,82
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_addefaultdomainpasswordpolicy.lucene,sha256=CbfI5OtypnAZ3_rK0MDid7ijiZmX7FIXVLFLbiq5kkk,71
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_addefaultdomainpasswordpolicy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_current_user.eql,sha256=vhgPrHuDiC60h_oGWA9auPwPiaFcNnc_o15w7I3f75w,169
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_current_user.lucene,sha256=Itb8QjVLhDm10wYJ0ueFE0DSAljJotw-88Dx8mtdT6w,162
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_current_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_gpo.eql,sha256=epb8c_5clIqNbpnQmw61JOvvyCd25pjONdir4XRN16A,56
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_gpo.lucene,sha256=9j3S6Ohk_1Addtv_npjBMkxjaQTREQseNsbUGg6mz4c,45
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_gpo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_process.eql,sha256=Qb9trEQ1gms9BPM3lODT7vEZXeKzHXF6RRwKrYj7fnk,60
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_process.lucene,sha256=UagL16IVtS77hZK2j1vQqOCmfpRK0THwl-G5rwKuD8o,49
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_getprocess_lsass.eql,sha256=HYSojpxzqU1YAKNk_zWTLqn7kR2v0ytXWlZ6D5KoMn0,66
src/rules/windows__powershell__powershell_script__posh_ps_susp_getprocess_lsass.lucene,sha256=T8pWkYuerajpTZgSI5h6veps0kSZHajLUiSY3nhhAaM,56
src/rules/windows__powershell__powershell_script__posh_ps_susp_getprocess_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_gettypefromclsid.eql,sha256=AiiaCoHrGnNT9SXT-VKk4XABDqHedUbuyHc3dFd3R7E,125
src/rules/windows__powershell__powershell_script__posh_ps_susp_gettypefromclsid.lucene,sha256=VM8ieEwmFwZ9s5s1gp3E1CSVXbcfrbiRwPVZH_aY934,115
src/rules/windows__powershell__powershell_script__posh_ps_susp_gettypefromclsid.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_hyper_v_condlet.eql,sha256=GWUhaCS6ZSfTqtlRiGw4TKnkVcNJ8jn9hX_g8mJSHCA,97
src/rules/windows__powershell__powershell_script__posh_ps_susp_hyper_v_condlet.lucene,sha256=2xM75DVNBASoTtup-0r07TD8eCI2cXo1xFgf8BTV4Hg,82
src/rules/windows__powershell__powershell_script__posh_ps_susp_hyper_v_condlet.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_generic.eql,sha256=CkS5GAYhUdSf_PPE-oSMn4rKzdTpeoMgD0IvVpH78Ks,307
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_generic.lucene,sha256=gwHLkYG6V5UFka7z4Mdhbt9xJ9xB269w7BpyZ4B8xHU,304
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_generic.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_specific.eql,sha256=twqmb7tqA1KWcDKefwiCUfaja4nAHqUe_1nyvNwQYeM,2103
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_specific.lucene,sha256=kRXxQxmn4C9jl6OzU6Zc40SbM3maWCe_IDBAKSz3Ht0,2064
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_specific.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_invoke_webrequest_useragent.eql,sha256=we8M_hwRWNZ8KA8suUWcq_oEJFCSsSz8vtTlMXGjPBA,174
src/rules/windows__powershell__powershell_script__posh_ps_susp_invoke_webrequest_useragent.lucene,sha256=1bISIOWl022DH4-XGhB64F0LGktuyrSON-ZNAkHqOyY,161
src/rules/windows__powershell__powershell_script__posh_ps_susp_invoke_webrequest_useragent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_iofilestream.eql,sha256=hju6LaEWl_bDuEvhxcm1MdNSAU24eYMLS4h6WKoY0yo,163
src/rules/windows__powershell__powershell_script__posh_ps_susp_iofilestream.lucene,sha256=qm42-ceZxrGnXt2NMNlxFxp64yqGt0Nz14gYFtOoxk0,147
src/rules/windows__powershell__powershell_script__posh_ps_susp_iofilestream.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_keylogger_activity.eql,sha256=V7mr3NVUpKfSd47m1J3SjRtV7dR0BBYRmzFimEBoykw,113
src/rules/windows__powershell__powershell_script__posh_ps_susp_keylogger_activity.lucene,sha256=TsGx9KE8YObE9U6XnElAmA1qz8G7rn8lBeZjaw2onBg,110
src/rules/windows__powershell__powershell_script__posh_ps_susp_keylogger_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_keywords.eql,sha256=IN_S2ABIa1DrAPibsfcBB_CcUrlJ1NMl9Wsr6p_7YF0,414
src/rules/windows__powershell__powershell_script__posh_ps_susp_keywords.lucene,sha256=ZfiFD9IY90nIQF_os8XKTvrYmoUiJTa1wTe1P7SYl9k,407
src/rules/windows__powershell__powershell_script__posh_ps_susp_keywords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_local_group_reco.eql,sha256=Mka0zFBjYkZCdDX6Tzcf0wzQgtRRB-5G8CGOiSH0hrM,267
src/rules/windows__powershell__powershell_script__posh_ps_susp_local_group_reco.lucene,sha256=4ky3vm0WLcTQt1rci6DKnBzgQRe7HPt4m4qpzcMjrmM,249
src/rules/windows__powershell__powershell_script__posh_ps_susp_local_group_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_mail_acces.eql,sha256=ahRCJr2SdxpK67hptq6bDoMktulPla7yaMgLiBUQ7To,199
src/rules/windows__powershell__powershell_script__posh_ps_susp_mail_acces.lucene,sha256=aer-ia8t36vuCccwhGEakYB275KS7v83L7yFCdVpD-E,184
src/rules/windows__powershell__powershell_script__posh_ps_susp_mail_acces.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_mount_diskimage.eql,sha256=4f9xKf9xzmmr-Syyxh7nXQxvUU_ZFwlF0OxaWE_RNXg,119
src/rules/windows__powershell__powershell_script__posh_ps_susp_mount_diskimage.lucene,sha256=__hjUjtkKYudzA155JI-417N9_fP8LgyKmGOFGh9gw8,109
src/rules/windows__powershell__powershell_script__posh_ps_susp_mount_diskimage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_mounted_share_deletion.eql,sha256=4SMXnX4SmJrtUwLSWE7xjz89Q9gX1RDVniorPUf6mlQ,472
src/rules/windows__powershell__powershell_script__posh_ps_susp_mounted_share_deletion.lucene,sha256=j-taI7IBNrJRTc_wraCbM6OmZ_BFBxbuFnxHyK31e6E,451
src/rules/windows__powershell__powershell_script__posh_ps_susp_mounted_share_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_networkcredential.eql,sha256=EpeTbXr_T4XSRCqo1Lq6SlE9JAj2FEMG9JzZJcJwvwM,204
src/rules/windows__powershell__powershell_script__posh_ps_susp_networkcredential.lucene,sha256=m2zj-C0qam5MSl-De0qOm8Avwnxi81pCD8dC37LVoUI,186
src/rules/windows__powershell__powershell_script__posh_ps_susp_networkcredential.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_new_psdrive.eql,sha256=dqjb8z98wVP51eZzbcNJBo1KDeHnnBZ9BlWoNl_BBdE,306
src/rules/windows__powershell__powershell_script__posh_ps_susp_new_psdrive.lucene,sha256=Bn-gp0ydAYi2L57bGUg7NRD0MaT6puqCcHMFCcAkAX8,289
src/rules/windows__powershell__powershell_script__posh_ps_susp_new_psdrive.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_proxy_scripts.eql,sha256=Rec8jaqrb0NH-ZwSoavZKIiyzaKU6QPC_m-LDHEAjQM,207
src/rules/windows__powershell__powershell_script__posh_ps_susp_proxy_scripts.lucene,sha256=h5PR-OfadZkiH-N0LJa4SYZn1QZAaEUxqF8DwaUwLN4,193
src/rules/windows__powershell__powershell_script__posh_ps_susp_proxy_scripts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_recon_export.eql,sha256=ZTzt6NK_QGQKJL0HkL9Y919fczXrW6HlaM91KT6u4S4,165
src/rules/windows__powershell__powershell_script__posh_ps_susp_recon_export.lucene,sha256=1r1mTRM15OQMr1UOObmqviLWb8UW-kzjqQyTNPLEais,153
src/rules/windows__powershell__powershell_script__posh_ps_susp_recon_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_remove_adgroupmember.eql,sha256=bUHujoxCsnCJyyDRpb6WCEoOtPGCfyPAYOt38w1PZGM,174
src/rules/windows__powershell__powershell_script__posh_ps_susp_remove_adgroupmember.lucene,sha256=Tzvq9MCQIt4-SjQcZfScmh8uH7_DcmVN64zbKzN0E2I,163
src/rules/windows__powershell__powershell_script__posh_ps_susp_remove_adgroupmember.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_service_dacl_modification_set_service.eql,sha256=oPy01_okCNumUi92wkkAKALgADIKyk82kzktmwrfwpk,300
src/rules/windows__powershell__powershell_script__posh_ps_susp_service_dacl_modification_set_service.lucene,sha256=CI6-y-h5zhs1UNQ-eLhz5oJYrZ8VLiSBJH5v2rMT8c4,276
src/rules/windows__powershell__powershell_script__posh_ps_susp_service_dacl_modification_set_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_set_alias.eql,sha256=JfrFsoqlfCQanL76g7D4AWyU7HjbwQ4VkurA52uIa1w,1414
src/rules/windows__powershell__powershell_script__posh_ps_susp_set_alias.lucene,sha256=O6VDmVlM_0mQYgaWJUDnAhKKpX_x2cmdNJpwiDI5HEk,1572
src/rules/windows__powershell__powershell_script__posh_ps_susp_set_alias.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_smb_share_reco.eql,sha256=vyr0RTo0lFHivlmNlwcrIKCmPqfvGv95E74rGgdf3Rg,61
src/rules/windows__powershell__powershell_script__posh_ps_susp_smb_share_reco.lucene,sha256=T9NN8OzI70M8To3ZVTwjh6HiFqIoojGkAOx5yl7W02U,50
src/rules/windows__powershell__powershell_script__posh_ps_susp_smb_share_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_ssl_keyword.eql,sha256=oujVN2vmINIcwexNCucebIRn8KwhaWT1vIp5vsSfAes,233
src/rules/windows__powershell__powershell_script__posh_ps_susp_ssl_keyword.lucene,sha256=YAbGBDD3YrqI9JU2XpZvnQ_mwbb9lBgrtv869p8R0QA,217
src/rules/windows__powershell__powershell_script__posh_ps_susp_ssl_keyword.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_start_process.eql,sha256=ntbjrQX9HBw7b3ChatHDeV2YzyCHw4WhMff5RY3iQH0,168
src/rules/windows__powershell__powershell_script__posh_ps_susp_start_process.lucene,sha256=FrYwXjrr3F3PGIUFfSmtmXHGFIHHbfCkT0GyQZDtUCg,157
src/rules/windows__powershell__powershell_script__posh_ps_susp_start_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_unblock_file.eql,sha256=flYvrWi0hn50_baxdHP-3NmheiHi1P1Y8HKUv1TBjOA,111
src/rules/windows__powershell__powershell_script__posh_ps_susp_unblock_file.lucene,sha256=rjU9a75dg9eo1OnM_g-UgL_ubGZH4fF_1xgu_Dl791s,101
src/rules/windows__powershell__powershell_script__posh_ps_susp_unblock_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_wallpaper.eql,sha256=0Qa2a-NBIlwnzWwiKsyJuC0_-E1FOWWaiEEuqUiI6_Q,330
src/rules/windows__powershell__powershell_script__posh_ps_susp_wallpaper.lucene,sha256=2XZYAh9RkvQ5kNYw2jZe7Ik2igPNTFWc7ti9WAt-W54,315
src/rules/windows__powershell__powershell_script__posh_ps_susp_wallpaper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_pnpentity.eql,sha256=PNIVuWvSJJZG0O6QfUx82iH4nwoW4PNfEpWKrZza1Jo,64
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_pnpentity.lucene,sha256=19ojaXzCzB63KPf4_YyuQ0jiRmB1Apyl-g4EKvVGXJ8,52
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_pnpentity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_shadowcopy_deletion.eql,sha256=aNayHrIhwkI6NAq7jFEuXgmwlTi1Ca1hkSOanl1BnpU,300
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_shadowcopy_deletion.lucene,sha256=Z41oOiYTw5XSPhIAQjOlq86Yw8UlR7hnXI7-mbDpjug,278
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_shadowcopy_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_windowstyle.eql,sha256=7_Pza6EMbhxPmDpLk1htZYyQv1U6qzTNxyh2d-SgjgU,378
src/rules/windows__powershell__powershell_script__posh_ps_susp_windowstyle.lucene,sha256=aAI3mzcAK7-nePvc1ZNwHMJyvAh82X1PvsXZGJizkO0,359
src/rules/windows__powershell__powershell_script__posh_ps_susp_windowstyle.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_write_eventlog.eql,sha256=WdCin0CkzjVYiv-cORsh8SZt6IDCO1pIk9lIUlxs4yk,115
src/rules/windows__powershell__powershell_script__posh_ps_susp_write_eventlog.lucene,sha256=wiTP-RaiOHiA-E0e7rQBlk0BiPoqG0AXyXbsrSQfD5U,104
src/rules/windows__powershell__powershell_script__posh_ps_susp_write_eventlog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_zip_compress.eql,sha256=c_iSxIQe9ZJdu6uzjsKi-NL1YUFNuUagFpu1rfalV28,240
src/rules/windows__powershell__powershell_script__posh_ps_susp_zip_compress.lucene,sha256=BITAkutvPD-F1CjXBNGi1mPVgOnVY9BqZQ1qMHdivRk,235
src/rules/windows__powershell__powershell_script__posh_ps_susp_zip_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_syncappvpublishingserver_exe.eql,sha256=k4GWFR5NMStzA0jZr76VX2pbGO67CX1cL83MNs_kFEQ,77
src/rules/windows__powershell__powershell_script__posh_ps_syncappvpublishingserver_exe.lucene,sha256=68HffwzerQDK0xm22BvO_lUpEta9sUTMpkYD4W3qK60,65
src/rules/windows__powershell__powershell_script__posh_ps_syncappvpublishingserver_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_rem_mp.eql,sha256=uxpi7nRIVCIumaoAM4kgIb6GgSB5mVv-xzByPgr8OJI,286
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_rem_mp.lucene,sha256=kshWDBcE61DJ8wVYk5csVi7tVtRVYuhItj4FlZ_xKag,275
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_rem_mp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_set_mp.eql,sha256=E1Z3I87_gs5jsVEHBCY__US_x8q9BOqUdx7-j6Cef9E,1665
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_set_mp.lucene,sha256=7HjWr176s6yX3hRhuvD0vkYWDZL9Aj66qrKMMMWLaUI,1733
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_set_mp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_test_netconnection.eql,sha256=BCQGhfm2SCm8adQb4YB0hMokSi4FCRgAd8jt8OQGIqA,249
src/rules/windows__powershell__powershell_script__posh_ps_test_netconnection.lucene,sha256=hS5scP_YjaAR2dzYIjuVl7-qtFJeRkH80sB_WMI7PiI,234
src/rules/windows__powershell__powershell_script__posh_ps_test_netconnection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_timestomp.eql,sha256=vlK4CjcyKNLHQJEpCeY9ycfMEK3wxdWYg87Bxq52roU,216
src/rules/windows__powershell__powershell_script__posh_ps_timestomp.lucene,sha256=qJpTaYh1fK39E3R01BLnl41RM_pXx6LIb5Qofx8Jfmg,216
src/rules/windows__powershell__powershell_script__posh_ps_timestomp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_user_discovery_get_aduser.eql,sha256=W-cgRd7xWBbEzhG58a8hB9F4uucPIOwzVmAzw1SxDjk,237
src/rules/windows__powershell__powershell_script__posh_ps_user_discovery_get_aduser.lucene,sha256=JUhSyoCVN8nlRfap_X5spIlU46KLNaEcudHIfHK9lak,229
src/rules/windows__powershell__powershell_script__posh_ps_user_discovery_get_aduser.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_user_profile_tampering.eql,sha256=Gpj-zmsTrQPEO05P7EEjmc8HTXNna76UNrBbU3Tfrnc,334
src/rules/windows__powershell__powershell_script__posh_ps_user_profile_tampering.lucene,sha256=MkF339qtg7MzRC7uB-Jeo8_bWhXU7xR9g3D-4wg9b54,340
src/rules/windows__powershell__powershell_script__posh_ps_user_profile_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_using_set_service_to_hide_services.eql,sha256=uLN7EzMgLXvPOB9IPQ6gV4vrbrS-fA4z_HUJ6eOkhlg,203
src/rules/windows__powershell__powershell_script__posh_ps_using_set_service_to_hide_services.lucene,sha256=YqZa0bg-jaO0t-gU-YfLNIegy2gmqAAQxNC-5yZ_Zfc,187
src/rules/windows__powershell__powershell_script__posh_ps_using_set_service_to_hide_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_vbscript_registry_modification.eql,sha256=gb0hpgGLAf8MZJgqHBg8HTBeGdlBczhZ6kuPW4svtII,169
src/rules/windows__powershell__powershell_script__posh_ps_vbscript_registry_modification.lucene,sha256=xgflLcBnSVdXapgXRx4D8pzGgg36DXTlsr_CdPXoyUU,153
src/rules/windows__powershell__powershell_script__posh_ps_vbscript_registry_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_veeam_credential_dumping_script.eql,sha256=xMux5rjAU8z_z-1Qzux7_hkk1ZJqMc5TwQdnD-0hzMo,286
src/rules/windows__powershell__powershell_script__posh_ps_veeam_credential_dumping_script.lucene,sha256=bbMk6qUzW_KCnrBD2jbH2NyHUYPbU-LQfK9elt8AIqM,278
src/rules/windows__powershell__powershell_script__posh_ps_veeam_credential_dumping_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_web_request_cmd_and_cmdlets.eql,sha256=Aerz0EZpI-Z1-QZT4h0uKrv5fo7t5lQxA5RpXPjuowM,370
src/rules/windows__powershell__powershell_script__posh_ps_web_request_cmd_and_cmdlets.lucene,sha256=3BlVjm_E4pf5ZkH0FfE9FsJQ4MKNnD6NO8BUUfWzjZc,363
src/rules/windows__powershell__powershell_script__posh_ps_web_request_cmd_and_cmdlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_win32_nteventlogfile_usage.eql,sha256=TfHB-L_riSNxpH1lSHYHXQyUzzapI7IfiKfQNM5OsGA,315
src/rules/windows__powershell__powershell_script__posh_ps_win32_nteventlogfile_usage.lucene,sha256=OwGVi1o1LPfpdkbj72DLQCTxVryBKX69OuF3Q66tpmo,304
src/rules/windows__powershell__powershell_script__posh_ps_win32_nteventlogfile_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_win32_product_install_msi.eql,sha256=LUVVFp9YGmf5UiHTKly8wn3tKkXqFm5R7EnRlhkG2-0,279
src/rules/windows__powershell__powershell_script__posh_ps_win32_product_install_msi.lucene,sha256=XVS7l1ZvEPOFRCTbE5ewzPnm7MaLPjhbwImJCHSyHJA,266
src/rules/windows__powershell__powershell_script__posh_ps_win32_product_install_msi.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_win_api_susp_access.eql,sha256=dGWmYjjXyp5sQXI54HJ4aAVqxPeh1P2yU_Rj0lfgPyM,830
src/rules/windows__powershell__powershell_script__posh_ps_win_api_susp_access.lucene,sha256=tth-beHTuKfezDYL-YKfwJFC6uesRX8gWRZb5bZwhL4,792
src/rules/windows__powershell__powershell_script__posh_ps_win_api_susp_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_win_defender_exclusions_added.eql,sha256=vN9ivOuNSAGUgMEercvD9_M1QmJJVMX1F9HCXeDNiyU,247
src/rules/windows__powershell__powershell_script__posh_ps_win_defender_exclusions_added.lucene,sha256=F_m8cLr6VElXh7L33lN8oYoG54kH2HPMP601LElZaYE,237
src/rules/windows__powershell__powershell_script__posh_ps_win_defender_exclusions_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_windows_firewall_profile_disabled.eql,sha256=706rAurO2zs7Yqv7TwT_UYnRLMEBqRSlJvZDAPND-9s,272
src/rules/windows__powershell__powershell_script__posh_ps_windows_firewall_profile_disabled.lucene,sha256=zyw6C8cIKaHq4HVYg38dO_NzlGMUNOvRjhk_0kQRkiE,257
src/rules/windows__powershell__powershell_script__posh_ps_windows_firewall_profile_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_winlogon_helper_dll.eql,sha256=NaBQQb3skVr3WGbntRpQFGaUtkhg4kaxlY9uCdc-QtE,156
src/rules/windows__powershell__powershell_script__posh_ps_winlogon_helper_dll.lucene,sha256=xHEBv7DMAB6x1MlUAImAJ5LaPRwuZK5Tz5Np8DZTMvw,138
src/rules/windows__powershell__powershell_script__posh_ps_winlogon_helper_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_wmi_persistence.eql,sha256=0C8xL9xKG57fhDDL7I7RtRSOgpisZZo1gFqwlpE3YDE,524
src/rules/windows__powershell__powershell_script__posh_ps_wmi_persistence.lucene,sha256=1FXEOZEVMVE86Tz90zeBYEDdNHYC5_fPySDfhY3FlEk,520
src/rules/windows__powershell__powershell_script__posh_ps_wmi_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_wmi_unquoted_service_search.eql,sha256=2Ms5n8pJJ-kYG2TgN1_ojTXInHwP9oR6hpN2JTdIfwE,348
src/rules/windows__powershell__powershell_script__posh_ps_wmi_unquoted_service_search.lucene,sha256=KFVKNR4ILAC4gZqoyd6_zyK4hCUKzOZM-QtjLpU3jaI,325
src/rules/windows__powershell__powershell_script__posh_ps_wmi_unquoted_service_search.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_wmimplant.eql,sha256=lg0DGdtKclCfZIzqZ-b2Vf8y08CbqnuncR4bl5dEW6Q,397
src/rules/windows__powershell__powershell_script__posh_ps_wmimplant.lucene,sha256=Azb93IXZqkKhrbix95ch09UZ_OWEGLlqRKZFeLcXFnI,413
src/rules/windows__powershell__powershell_script__posh_ps_wmimplant.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_x509enrollment.eql,sha256=bhzs0Z38eU2Ceo_tjodtvakcAKaE-TZenyQl3pfE44w,130
src/rules/windows__powershell__powershell_script__posh_ps_x509enrollment.lucene,sha256=pLNrUHzztYXYlyIPnFAs1fbffO0Th0oXynZ3ag7xTz8,116
src/rules/windows__powershell__powershell_script__posh_ps_x509enrollment.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_xml_iex.eql,sha256=B2p3hXpsNcmn8a0hTxg-klh1ShYMS2XEMWPkvTbuDSw,287
src/rules/windows__powershell__powershell_script__posh_ps_xml_iex.lucene,sha256=JeVlluxUfoPas3l79TkmSjB-Cp8JFyAI7orrpcb0YS4,271
src/rules/windows__powershell__powershell_script__posh_ps_xml_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_cmstp_execution_by_access.eql,sha256=fHNcaTRzCGg__azj6LGeOZK2K0yAlT-1C-gyWuM7_jU,52
src/rules/windows__process_access__proc_access_win_cmstp_execution_by_access.lucene,sha256=KwsMO8EwclWT-s33lowx1nDjR0MIEo5ICN8dszEZ31A,40
src/rules/windows__process_access__proc_access_win_cmstp_execution_by_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_cobaltstrike_bof_injection_pattern.eql,sha256=XcdnzvO5HJDG5XppM8UHbhm6kdElINehgH407zNxFZ8,265
src/rules/windows__process_access__proc_access_win_hktl_cobaltstrike_bof_injection_pattern.lucene,sha256=OnKlvaFbzYl8R2aQYrxv9zeoYWLNdYKQ4VHRj7_uRSE,337
src/rules/windows__process_access__proc_access_win_hktl_cobaltstrike_bof_injection_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_generic_access.eql,sha256=Xw8QgUG98p5Z2MkakmHln80_14CLa2zAAVHkwSAA4ZM,1953
src/rules/windows__process_access__proc_access_win_hktl_generic_access.lucene,sha256=zoQAVYoqVR2x-69DwtRdI6jDl1ptz0n_7M7HvcgYMRQ,1928
src/rules/windows__process_access__proc_access_win_hktl_generic_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_handlekatz_lsass_access.eql,sha256=UFKR1DcB71OkV2EthH_k7wuQvQtNaDSNGEalXetEkRQ,252
src/rules/windows__process_access__proc_access_win_hktl_handlekatz_lsass_access.lucene,sha256=F7uq3Gd9TGgZ_FAEd3kG2fP8F4x8kg7pGB7mlZ1IslQ,237
src/rules/windows__process_access__proc_access_win_hktl_handlekatz_lsass_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_littlecorporal_generated_maldoc.eql,sha256=FnuGIsBWzSW8VRrRiZYwxDUk9Jct_PAGER7JWrruZTE,172
src/rules/windows__process_access__proc_access_win_hktl_littlecorporal_generated_maldoc.lucene,sha256=RsIzfErwBLrbCY7LJ3KzrkuCunUTPilpNxUxyhgdnM0,157
src/rules/windows__process_access__proc_access_win_hktl_littlecorporal_generated_maldoc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_sysmonente.eql,sha256=jLCE3lbBzkA2voHN2hykiKhnV6CqK_gWfPcgOmTS44o,468
src/rules/windows__process_access__proc_access_win_hktl_sysmonente.lucene,sha256=YRPF02vWGSGGYpD5tRpyZiSiwKWYANy0isW1ihqpYZs,442
src/rules/windows__process_access__proc_access_win_hktl_sysmonente.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_dump_comsvcs_dll.eql,sha256=DT9f6vdhwYjsRBEC3mf2anAmz4bkOXi1_Mv7F9t3DEo,144
src/rules/windows__process_access__proc_access_win_lsass_dump_comsvcs_dll.lucene,sha256=vVahN3Pjp4dE77sKy3tCsVfES5mXh2h_F5sAB029tLY,128
src/rules/windows__process_access__proc_access_win_lsass_dump_comsvcs_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_dump_keyword_image.eql,sha256=7RSL4s2LPOmguN9SwdUVJqD_DFcuIBBHxNFTU9oXtuI,318
src/rules/windows__process_access__proc_access_win_lsass_dump_keyword_image.lucene,sha256=PlB7WlzU05D58vgfkoWqeM2N486r-zuQsyezqt2z6MM,296
src/rules/windows__process_access__proc_access_win_lsass_dump_keyword_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_memdump.eql,sha256=uh3yt6rbN0voKgbLrtSoCabRmqBfA8D0q72F0Y0dibA,634
src/rules/windows__process_access__proc_access_win_lsass_memdump.lucene,sha256=ku1dDiVLhd-SDfsb_TjTKxDHwNUk0Kcta-fe4pzSc0E,593
src/rules/windows__process_access__proc_access_win_lsass_memdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_python_based_tool.eql,sha256=2vD0tywCJd6_464c3eSsBs1_TOmy5ZltzD7MOpcYFo8,375
src/rules/windows__process_access__proc_access_win_lsass_python_based_tool.lucene,sha256=TLzqm5z1aWoL6D-SPJ4VycKBTmt6sfeigwpTfa9ONuA,354
src/rules/windows__process_access__proc_access_win_lsass_python_based_tool.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_remote_access_trough_winrm.eql,sha256=X7O1sEu6tAXFEkXcSCZ7u4EJ9b7aU8nbS12zQEGoyuU,176
src/rules/windows__process_access__proc_access_win_lsass_remote_access_trough_winrm.lucene,sha256=JQbjggLsgi0hW73-u11c6bS6v-5l2mX1LzT8mVazlC8,161
src/rules/windows__process_access__proc_access_win_lsass_remote_access_trough_winrm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_seclogon_access.eql,sha256=yo_Y-Qy0NqMCRMTmOimD42k5mtw-rte0dzniN8AQAeo,189
src/rules/windows__process_access__proc_access_win_lsass_seclogon_access.lucene,sha256=K2e4o8B_ltLxyuWL4yxkfHQd62YEbccj60xnIevhoKs,171
src/rules/windows__process_access__proc_access_win_lsass_seclogon_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_susp_access_flag.eql,sha256=L7X7RAoAQZjSghUrD7P6pIXaE3DtVFnG-uqCLT53nQc,2067
src/rules/windows__process_access__proc_access_win_lsass_susp_access_flag.lucene,sha256=De3bc5wQfNUZDCxuQ0Gu21qzI6LF1D3P078BG3Zu1_M,1988
src/rules/windows__process_access__proc_access_win_lsass_susp_access_flag.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_werfault.eql,sha256=u8iSfAJZgUiewXtYNyQE6a2vR2Mfeh6kyjmH4JHsTcA,143
src/rules/windows__process_access__proc_access_win_lsass_werfault.lucene,sha256=Z0LISsph7-wkk-Rb7li10zCxpg8iJV5NvePQmbzlpAA,127
src/rules/windows__process_access__proc_access_win_lsass_werfault.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_whitelisted_process_names.eql,sha256=Qys0Pc_9aKVMthIg7u2moayxAw9ayrPdrTfdVMAta5I,382
src/rules/windows__process_access__proc_access_win_lsass_whitelisted_process_names.lucene,sha256=-a0a2iTtb0lve82ZSiewOcrLHwIr5Rv9Ut4ZW0WbZJ4,354
src/rules/windows__process_access__proc_access_win_lsass_whitelisted_process_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_susp_all_access_uncommon_target.eql,sha256=1LCoHD8j2eyLUTEkE5MjeoW1is63phMfdX2jtxW_7-w,217
src/rules/windows__process_access__proc_access_win_susp_all_access_uncommon_target.lucene,sha256=_o-JgUg8zF4eYjCcWmaGhOGbzLxIwRoM_tZ68oKcTq8,197
src/rules/windows__process_access__proc_access_win_susp_all_access_uncommon_target.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_susp_dbgcore_dbghelp_load.eql,sha256=NVhsgbmpJCC1DtW6ngy3vBQCDlds0btHYmlrDFy64ko,543
src/rules/windows__process_access__proc_access_win_susp_dbgcore_dbghelp_load.lucene,sha256=ZiLtMgjGT8m-HvXXVQu7Rnvzj3Dt-wnWnE5Xz9Owcts,501
src/rules/windows__process_access__proc_access_win_susp_dbgcore_dbghelp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_susp_direct_ntopenprocess_call.eql,sha256=GvlpwHFmw-QnvMXLRUqHZvo_F_bdNcUSdnFtQbTwgh4,2000
src/rules/windows__process_access__proc_access_win_susp_direct_ntopenprocess_call.lucene,sha256=Bls4uYtvC5-b0MbPcADIhvNkYB9dOvS4_NuWGFIFovA,1950
src/rules/windows__process_access__proc_access_win_susp_direct_ntopenprocess_call.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_svchost_credential_dumping.eql,sha256=FsF6dqkUWOugnb-FJYxa1Lo4k8lHvpPRn_1s06V_gZ4,179
src/rules/windows__process_access__proc_access_win_svchost_credential_dumping.lucene,sha256=KuoFuibul_qMY2Nw7kVQLA7Z4V5XC7XAbqqcjs8fcdk,157
src/rules/windows__process_access__proc_access_win_svchost_credential_dumping.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_svchost_susp_access_request.eql,sha256=iCxGeuP5Vvu-2WftIvvXRUI4phl3XZt-T-sXEp46eis,400
src/rules/windows__process_access__proc_access_win_svchost_susp_access_request.lucene,sha256=FkJ1cmIaFvbnd4ZJxLQTaZIigEOk9ldv68QmGGMQP5M,376
src/rules/windows__process_access__proc_access_win_svchost_susp_access_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_uac_bypass_editionupgrademanagerobj.eql,sha256=J-it4oHbhsT3hL2ZEFqbEo7DhTMPM6a98Ac6B1dRjlY,71
src/rules/windows__process_access__proc_access_win_uac_bypass_editionupgrademanagerobj.lucene,sha256=H5j-Qf-5XK3on82bXyFfLbn8Txkmv8Lf6SIbi3mSIq8,59
src/rules/windows__process_access__proc_access_win_uac_bypass_editionupgrademanagerobj.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_uac_bypass_wow64_logger.eql,sha256=MaW0-tIy5JYgZ5-evgn9fqWEEPtOUJz2IylQJzMomEk,191
src/rules/windows__process_access__proc_access_win_uac_bypass_wow64_logger.lucene,sha256=GUt7YsaG1K9cxpmJzhHUhWbfBZ4c9_MEpxp40t-pWiM,181
src/rules/windows__process_access__proc_access_win_uac_bypass_wow64_logger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_werfaultsecure_msmpeng_access.eql,sha256=MTA_s39858afQUh9JXNgz76UwDd6a7N2n_0meex3RUY,183
src/rules/windows__process_access__proc_access_win_werfaultsecure_msmpeng_access.lucene,sha256=Bn_QG1WNfsRu6AsmD3txoYLvoUkTaliRumPRJPH4ptg,161
src/rules/windows__process_access__proc_access_win_werfaultsecure_msmpeng_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_7zip_exfil_dmp_files.eql,sha256=32vvUglGA_FYZTgupEhNXO4D1qxXuQh1Di8LQ4UPOFk,246
src/rules/windows__process_creation__proc_creation_win_7zip_password_compression.eql,sha256=E9puGB0SK73oKzWvkW8Mdbj7bykne4skuggK7PE4kA4,265
src/rules/windows__process_creation__proc_creation_win_acccheckconsole_execution.eql,sha256=p8Z26mhUWLVYBx6F6Bzw2wZJnUZMJoS9Wn1W8jDq5oU,188
src/rules/windows__process_creation__proc_creation_win_addinutil_suspicious_cmdline.eql,sha256=4u4bOdZH3VmLhHBwNjVWnlL2PkKzGxwdmBRhy2r6lhc,592
src/rules/windows__process_creation__proc_creation_win_addinutil_suspicious_cmdline.lucene,sha256=slMVD3nL05Ke-nIsmtJSa-IY6yhmLxJfhVl_OXjla7w,548
src/rules/windows__process_creation__proc_creation_win_addinutil_suspicious_cmdline.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_child_process.eql,sha256=ikSdV3d4w8y28_zABw1xfmMaUPAT8PSQBBAD8QaVHmU,209
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_cmdline.eql,sha256=pJShVnTcawRUiQXn2MTYgLyR13pfAmAsR7O-gO0OKD4,534
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_dir_exec.eql,sha256=Kt9pdEM_tfu3DYnXEX1CPMjr_Vx6ubxcaDeJBlxZ4Vo,349
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_dir_exec.lucene,sha256=uymP0PBp44jAkc9eWh_vUr6S-e2vk2uUvalHigYPW90,327
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_dir_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_adplus_memory_dump.eql,sha256=6okPZvSegDeSRUY6pBLDLdbCEdG-InEpjpBzFL92PFw,205
src/rules/windows__process_creation__proc_creation_win_agentexecutor_potential_abuse.eql,sha256=Y_Y_nMBbXRTCNYWwCTw1POf47nnqr1W-1CBbqTfCn3U,279
src/rules/windows__process_creation__proc_creation_win_agentexecutor_susp_usage.eql,sha256=jzAsYw0kAIkWzKYxx-8gnAD9qZRNPssdoPpt1oDyZRE,423
src/rules/windows__process_creation__proc_creation_win_appvlp_uncommon_child_process.eql,sha256=Qkkm2nCW4npcxi29RL8xCoFqlaPfO8TlXIfNmNv2dCw,529
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_exectuion.eql,sha256=fIZTuaC_4dIvSmKMGVFQArNTPXBo2QQ5Je0s-zv3OvA,272
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_exectuion.lucene,sha256=GDTyJHtt_G_mTOecBAyiqwCIhgV9A1HG2H7uLNB4ASE,252
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_exectuion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_susp_child_process.eql,sha256=ueL-kRsdYkt9uKvryL2dbfQeq5ZjZN7IJgssbYprqCQ,344
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_susp_paths.eql,sha256=R5ZV2PSMkEf2383xSiFL9pD8644yPA4EwHgDNC9gkZg,491
src/rules/windows__process_creation__proc_creation_win_at_interactive_execution.eql,sha256=wMENX3qZVFFkk8XELuAXt8NeIgRgdWB87aX1cbLpm64,82
src/rules/windows__process_creation__proc_creation_win_atbroker_uncommon_ats_execution.eql,sha256=ede5Xj7gPo1By8tDfCqPDpfysYCaHQmTdAv6FUxbUXM,813
src/rules/windows__process_creation__proc_creation_win_atbroker_uncommon_ats_execution.lucene,sha256=ORAMkBBZ6y8A6z5DNbm4ZNW6rXXguH2lRBW1hxqudd8,787
src/rules/windows__process_creation__proc_creation_win_atbroker_uncommon_ats_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_attrib_hiding_files.eql,sha256=VTuTo0QILTk6sIQCIPAQCKSbVcvLXazfF1uTT3iQq3A,340
src/rules/windows__process_creation__proc_creation_win_attrib_system_susp_paths.eql,sha256=9VTyGDZMVbgupJQR4fGF1ZX8tJwqEn71Yf7cy790UpA,473
src/rules/windows__process_creation__proc_creation_win_auditpol_nt_resource_kit_usage.eql,sha256=lMLUhEryk55ylzdSsBU6tu67UvI6wL-Fidp1A1ql-Zc,164
src/rules/windows__process_creation__proc_creation_win_auditpol_susp_execution.eql,sha256=oIhwANmtu1kfRs4HwsV8JCo4CqisflK3OBOXtPiHU0E,180
src/rules/windows__process_creation__proc_creation_win_autorun_registry_modified_via_wmic.eql,sha256=zGXKf6g5coOtGnCgA6Kk6yxxFmIaAlZOTIf_pfclMoQ,913
src/rules/windows__process_creation__proc_creation_win_baaupdate_susp_child_process.eql,sha256=TtaaebdSbBUyFSphTv5Z7HNodmnS8Ido1qsU1GpmyR0,291
src/rules/windows__process_creation__proc_creation_win_bash_command_execution.eql,sha256=NFfRbRlbABCTwabTlsZpdgS51y7zarPfZSRq81fYjLY,188
src/rules/windows__process_creation__proc_creation_win_bash_file_execution.eql,sha256=4hyN9_oLCeHnQMXpwf1SfCWIKcSj4pDqGQBj4vj-UEo,380
src/rules/windows__process_creation__proc_creation_win_bash_file_execution.lucene,sha256=X0Ow4rk65NgkuekmYLGol_O1Z3_XJhp8w9BPEa9FifQ,352
src/rules/windows__process_creation__proc_creation_win_bash_file_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bcdedit_boot_conf_tamper.eql,sha256=HQwnmqqaFw-FEZvRCts1qqtyaa9LwA6RVLlL88xKSzo,303
src/rules/windows__process_creation__proc_creation_win_bcdedit_boot_conf_tamper.lucene,sha256=HJytNAecaM_6cw4bM8ZjDUxNg3SRsp9SFHELkshuUmY,279
src/rules/windows__process_creation__proc_creation_win_bcdedit_boot_conf_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bcdedit_susp_execution.eql,sha256=0tR-aP7hzX550dqXhWU744pNuZXVHjhZ3DSbV3Hrlq0,197
src/rules/windows__process_creation__proc_creation_win_bcp_export_data.eql,sha256=dvC8O2CXE9hd4d5edxx2RN7dk9bkXjJ8RIdGBMM7jWA,148
src/rules/windows__process_creation__proc_creation_win_bginfo_suspicious_child_process.eql,sha256=Y9WQLckeUQniOENDhGSAFbaeSnFsO-JXSQwbbGuaC0o,413
src/rules/windows__process_creation__proc_creation_win_bginfo_uncommon_child_process.eql,sha256=9ZIFzjAb0QRI4eWrwXmkr__629hg_eGO8Akv2eQDlDg,79
src/rules/windows__process_creation__proc_creation_win_bginfo_uncommon_child_process.lucene,sha256=9AMLtPl3d_1Zgh9_9EbtQkKlDKiKgwC0IvgBgQkIZ5w,61
src/rules/windows__process_creation__proc_creation_win_bginfo_uncommon_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bitlockertogo_execution.eql,sha256=Vrm01hstvm2qsVJ3kjGV8eoddHVZPuZ_MqtXkAxW1Zw,52
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download.eql,sha256=J_7NP0xoBz1Not1qwxrqLIy4KROueRebHRk2tZpC6DY,242
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_direct_ip.eql,sha256=yz24EUKf0Fo7QAzju5OfLw_Nm0Ly5uXnerdDq-xFIMI,348
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_direct_ip.lucene,sha256=9A2ufQmzh0gxt-zXjx5fY7C-m7HenDje52GkzC25zIM,356
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_direct_ip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_file_sharing_domains.eql,sha256=G2e2o7LZL3ccdTb3PzmB8S3zs0wg_A_RosEmhlFSHA8,773
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_file_sharing_domains.lucene,sha256=gkMr08xUhqyKubKVJpEIdc-Do2EODDvu8W6tfsSxfnM,752
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_file_sharing_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_susp_extensions.eql,sha256=lzpUMGPiS2nU5A8Jrl8iFBQDtmz0oNMxiOiPa036fqE,541
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_susp_targetfolder.eql,sha256=EFKnTG-N2m4MaLX-S4-nHbCFYhg142IuX9jW0SewzqQ,417
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_uncommon_targetfolder.eql,sha256=5_tuiFDfZNnXH_QdIN--atgZxwyNFhYywreClH2yUNc,302
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_uncommon_targetfolder.lucene,sha256=T8frkPn2D3l56KhVdek5p5NOpc4AJAq1wS7YLJJ82nI,280
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_uncommon_targetfolder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bitsadmin_potential_persistence.eql,sha256=R6uN64GXzCJVguXvS7wHdvdSpwcHw2tbYueQiFE7IJM,347
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_debugging.eql,sha256=ZiYM9AauHvLFLPfL2IqhlFDzwybYa-3bsjoL5AV3Utk,140
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_exec.eql,sha256=0gxKzKJhnEOvi8Ka70JWhGa5NJCUIIYZCdHKLrNOZp4,162
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_exec.lucene,sha256=iWAqxuRPjC1Ne5JZbO2sM6RkneiiLkWZYZeByXpjXsI,144
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_file_download.eql,sha256=0Ao2TNsYZCK5Kq3_dlgPT-ylokStb9VOjS--Krb6UXs,1298
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_load_extension.eql,sha256=p_AanphjieQFJZpmUhj6f-MDnDR9w8EiSHSXJ4JqbiA,169
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_mockbin_abuse.eql,sha256=lyYyGDeAD9ZQEVvlDS-64bTNYNLqtWpfd5wW75qFmlk,230
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_susp_load_extension.eql,sha256=YrpQWAHOoXX5lPOPlc1CgFeOIc-scrHwAkChyO2aj80,348
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_susp_load_extension.lucene,sha256=0aNBaKCRgZmn6_1DzNshOcG_fHiRD1aZ0Cip5LtJNRk,324
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_susp_load_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_browsers_inline_file_download.eql,sha256=X5f1pd-Zq7aiZGDlQFg7J9fFnyblfIlYTzQpvc0IqWY,444
src/rules/windows__process_creation__proc_creation_win_browsers_remote_debugging.eql,sha256=AVTthyoN7tJ0WBdyYGsXgT3XXp1y-2AIaZ5jPpoFQ4U,150
src/rules/windows__process_creation__proc_creation_win_browsers_tor_execution.eql,sha256=VxdhFze83TdltQvRybBTl9jZNq6IQUqAd2lNheyVOlQ,168
src/rules/windows__process_creation__proc_creation_win_calc_uncommon_exec.eql,sha256=wdLKdiY_XxPZxJEgNgCZQ9Ke6NU4ykYrz34_siAKDYc,205
src/rules/windows__process_creation__proc_creation_win_cdb_arbitrary_command_execution.eql,sha256=T6qJ6nEbvOvNAhaAfGEqhlfKy3QJmYJKE-Z_WYm3rdc,142
src/rules/windows__process_creation__proc_creation_win_cdb_arbitrary_command_execution.lucene,sha256=jNYlSZP2LrT95e8iUiy9_ct_h7sSV8GDhOdwV6poC84,126
src/rules/windows__process_creation__proc_creation_win_cdb_arbitrary_command_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_certmgr_certificate_installation.eql,sha256=_VpPB1RYRQ9XH-9EmQqMLn8cJD1OL-b_j-rK9pmyeDM,165
src/rules/windows__process_creation__proc_creation_win_certmgr_certificate_installation.lucene,sha256=GvkUHaaCSqg0xccqrEwxIuu9j4J9PLrwl5u4vSLkYcE,148
src/rules/windows__process_creation__proc_creation_win_certmgr_certificate_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_certoc_download.eql,sha256=nz1ZiGtI2Z7FCAjdpLeG8L_gGWIpvN3QlTAqxFKOahs,169
src/rules/windows__process_creation__proc_creation_win_certoc_download.lucene,sha256=QzUfvIxrNJkJYjc22ecwVo2P3Y3WkyNsWVtYabWNUyA,152
src/rules/windows__process_creation__proc_creation_win_certoc_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_certoc_download_direct_ip.eql,sha256=936M5Cd9NQA2LwOPlwxAZfp5zYWg96QGyDd-LWZXR4c,220
src/rules/windows__process_creation__proc_creation_win_certoc_load_dll.eql,sha256=Gn3r84LLd7dm5IA-QXJQFL-AeA70Dl9663QmDez1yOw,211
src/rules/windows__process_creation__proc_creation_win_certoc_load_dll_susp_locations.eql,sha256=tj9M_WafrQNyWpJyk-CO4g_3-CyqGTy7L3X_zncdqus,385
src/rules/windows__process_creation__proc_creation_win_certreq_download.eql,sha256=QZnxosrGY2fnyYewo0OM91U-EpF7Sj8nD3MJyacyyLo,325
src/rules/windows__process_creation__proc_creation_win_certutil_certificate_installation.eql,sha256=GgvZyjO8Lnq6g_8xVz1JIDBuZuSPC8FjAKpZiHiteSY,244
src/rules/windows__process_creation__proc_creation_win_certutil_certificate_installation.lucene,sha256=qOcF87rcFqkYXyzp1IJlaI09BTpaOYbmtZNW8vIcsXk,222
src/rules/windows__process_creation__proc_creation_win_certutil_certificate_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_certutil_decode.eql,sha256=8vQHrZt0g-GCHbVKZvELJEX0M2JDLtdaUnGl-yADjWo,329
src/rules/windows__process_creation__proc_creation_win_certutil_download.eql,sha256=hjZ7w0VDVtByty_uGDmGNy7xT2apdVmk56daIB7eRL0,206
src/rules/windows__process_creation__proc_creation_win_certutil_download_direct_ip.eql,sha256=WVe_qWvUyfdL3ikVBU1Zkt_1X_-Tk1NfO_Ox7KOKD9g,339
src/rules/windows__process_creation__proc_creation_win_certutil_download_file_sharing_domains.eql,sha256=uGCpARPt7nT5FwGUOcW7RHVyp9H8nEJgsP3uy9F3AG0,780
src/rules/windows__process_creation__proc_creation_win_certutil_encode.eql,sha256=tW9jF2KZpJMMFdfHxnKZpZEO8ct8qxSMCAeCe2I3o9U,200
src/rules/windows__process_creation__proc_creation_win_certutil_encode_susp_extensions.eql,sha256=H6NuRfi6SpRhAOiq9oswpd63jG5jnq2GK2qVLApu7fQ,365
src/rules/windows__process_creation__proc_creation_win_certutil_encode_susp_location.eql,sha256=BbK3T0UcUnQMicgJsn2Q8XYjxttqAbkq4JKf5B62xgo,380
src/rules/windows__process_creation__proc_creation_win_certutil_export_pfx.eql,sha256=Z57Nuk05zZuL_o3s5dsAKPtaC-GbRfN4QeYWm1spRtk,220
src/rules/windows__process_creation__proc_creation_win_certutil_ntlm_coercion.eql,sha256=X2NjVNX35S2H7pqBdo6c-8RkkSLgj-jnmz0s6wNnIQY,175
src/rules/windows__process_creation__proc_creation_win_chcp_codepage_lookup.eql,sha256=5cR3JlpiTrNYX6ihyBev1fwn1c2iADrR2YHgcZIT9nI,435
src/rules/windows__process_creation__proc_creation_win_chcp_codepage_switch.eql,sha256=NzKlmiGANoz4-qe4JdfW_pGZ6PvlVi9ISfg-HL54M8Y,96
src/rules/windows__process_creation__proc_creation_win_cipher_overwrite_deleted_data.eql,sha256=yFnZl7ZCZF_MDU_yvNXiq8W8StISr_FphLWTWogzNyI,127
src/rules/windows__process_creation__proc_creation_win_citrix_trolleyexpress_procdump.eql,sha256=PHWKGr5K0KdKUBzgirafwOT9m0XzIJldaB0n_4gUlnM,392
src/rules/windows__process_creation__proc_creation_win_clip_execution.eql,sha256=4bJLYSQ3Ix6p-m8gaktpwbYgwK2jqJnKdk1snzKLJ9E,87
src/rules/windows__process_creation__proc_creation_win_clip_execution.lucene,sha256=x8_xb2moHcvSoXf_fmx6gtmOW5ntRCBEM6YCbTDQRf8,73
src/rules/windows__process_creation__proc_creation_win_clip_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cloudflared_portable_execution.eql,sha256=DCVfKNr7r29X2qHATv1_W2-qoev_cTPdVuF3HZvErkc,168
src/rules/windows__process_creation__proc_creation_win_cloudflared_portable_execution.lucene,sha256=KwCb4TjrLFq26NcSSP5E9tW7B1pk-av5wCyurMWkiVI,153
src/rules/windows__process_creation__proc_creation_win_cloudflared_portable_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cloudflared_quicktunnel_execution.eql,sha256=g0TnktN5fczLJsZLYwk5u7JZGGHJ7dmPYngo5C-6Fv0,3314
src/rules/windows__process_creation__proc_creation_win_cloudflared_quicktunnel_execution.lucene,sha256=07x8s7ufyPFev5U-sKHM6MA5OOd91aUK9Y8cFevK0fQ,3323
src/rules/windows__process_creation__proc_creation_win_cloudflared_quicktunnel_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cloudflared_tunnel_cleanup.eql,sha256=W9fBs1_mfbPihRp6_BPleBqRbcNPg7dbBmgLq3YcPUs,152
src/rules/windows__process_creation__proc_creation_win_cloudflared_tunnel_run.eql,sha256=JPWOZGjfxLQnvwVZ1_RnSZ-q8KIS9F_0lBWG5VMWxbc,194
src/rules/windows__process_creation__proc_creation_win_cmd_assoc_execution.eql,sha256=TCJRy8VJhS-n1a8kQUrut4Ua9avVl0s1l84Ejpz3wOI,122
src/rules/windows__process_creation__proc_creation_win_cmd_assoc_execution.lucene,sha256=qoduvefRh-ihkpiEAvcyp-S7y4SjVqJp4agulL4FU3A,106
src/rules/windows__process_creation__proc_creation_win_cmd_assoc_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_assoc_tamper_exe_file_association.eql,sha256=SrXh2wYTBl2JBQrr65eu3OtKDXvU9gCqVIvyViFq3Cw,212
src/rules/windows__process_creation__proc_creation_win_cmd_copy_dmp_from_share.eql,sha256=nKZcjbYb_HtSUXQO0emb7SRu3RNToSDMT3eTWopY4QA,225
src/rules/windows__process_creation__proc_creation_win_cmd_copy_dmp_from_share.lucene,sha256=y_tE1VAQSdtRvKuc0yhKJi2fN75RE_De0NQLaice4SA,201
src/rules/windows__process_creation__proc_creation_win_cmd_copy_dmp_from_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_curl_download_exec_combo.eql,sha256=9Y9pBBzKcQNff5Xh7gNOl9nFpkT5iZOo8uY4RLs4EpI,228
src/rules/windows__process_creation__proc_creation_win_cmd_del_execution.eql,sha256=vwrE1t0oBwKlQjdAdS5OG9pn3Y21YVKoxK33NqgWPH0,392
src/rules/windows__process_creation__proc_creation_win_cmd_del_greedy_deletion.eql,sha256=Bb60l-gSut3MHaSfnK9mrIJVnenA1Rb52Znv4I-_Kek,228
src/rules/windows__process_creation__proc_creation_win_cmd_dir_execution.eql,sha256=VjE4UGpagtqYrxKvIMSx3eGRsQunFhF6pPVCKfmDc1o,185
src/rules/windows__process_creation__proc_creation_win_cmd_dosfuscation.eql,sha256=qkibOacMG9nzSdOA58v1mV54Ejb71qjmAD0r6pIacvU,205
src/rules/windows__process_creation__proc_creation_win_cmd_http_appdata.eql,sha256=YhTTdb1UTwT2oo9SkPMIXI8_kqUxIWb7rStpvsP2FsA,150
src/rules/windows__process_creation__proc_creation_win_cmd_mklink_osk_cmd.eql,sha256=aEw3ZOWr43f8Qqd2IJjBh0K986fdWJxHFtBRVAYN0i8,203
src/rules/windows__process_creation__proc_creation_win_cmd_mklink_shadow_copies_access_symlink.eql,sha256=YhNGAiUPruIhNEyYes8MwGMtoK_dSinbyLkrb8IaCRo,96
src/rules/windows__process_creation__proc_creation_win_cmd_net_use_and_exec_combo.eql,sha256=cY04jg3k5hyazS7eYRq1goUI0blsvZoXyKDfJWu9PHY,307
src/rules/windows__process_creation__proc_creation_win_cmd_net_use_and_exec_combo.lucene,sha256=VXZEbHQgnvTjaUXaVyfDrppqLRTM1S03qqy3rG6mJLA,291
src/rules/windows__process_creation__proc_creation_win_cmd_net_use_and_exec_combo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_no_space_execution.eql,sha256=RgSyarAKBdamUKAkCJAkXHi-vfHn3vEMAvoegaYw0Ho,751
src/rules/windows__process_creation__proc_creation_win_cmd_ntdllpipe_redirect.eql,sha256=3Ib1cZ-EXOpgJRMy1ECOGZyfbiE6NDp07VjVgP4ZaXo,196
src/rules/windows__process_creation__proc_creation_win_cmd_path_traversal.eql,sha256=dbmf22rRC7I3H9j7MW01UhMvhaskPoNF3L6QMD-n03g,418
src/rules/windows__process_creation__proc_creation_win_cmd_path_traversal.lucene,sha256=_ak_SeVpLBZlh5deQGPfI7tWLuus1kZ0BfVBHKR6xfc,395
src/rules/windows__process_creation__proc_creation_win_cmd_path_traversal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_ping_copy_combined_execution.eql,sha256=ga3RSHd-zjIZKc_DC1NA18lrqJWidlb_QU8kiy8FARE,334
src/rules/windows__process_creation__proc_creation_win_cmd_ping_copy_combined_execution.lucene,sha256=f6KvDox1u8txaCAOVHprlLSWSxTTdz6OzpmINAT-Lm8,325
src/rules/windows__process_creation__proc_creation_win_cmd_ping_copy_combined_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_ping_del_combined_execution.eql,sha256=3bmz5K8x1EmJp6DTz-JYBQK2RA7X8gK-FVh-Tyqj4gc,374
src/rules/windows__process_creation__proc_creation_win_cmd_redirection_susp_folder.eql,sha256=xtS2IbPNUiiXtCnW6-VqWP4CgTOj8Wfs2eKh9mv1gIk,444
src/rules/windows__process_creation__proc_creation_win_cmd_redirection_susp_folder.lucene,sha256=fLgSkWNQYLBxxhEELi0vEOl9GTdG--e6e0jz6u6e9Mw,417
src/rules/windows__process_creation__proc_creation_win_cmd_redirection_susp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_rmdir_execution.eql,sha256=3bjuEUNK1ngwWuDS2DUumVeVJK5YA6mNU2GUBrprW5U,172
src/rules/windows__process_creation__proc_creation_win_cmd_shadowcopy_access.eql,sha256=2TYYR_17Qg0Fq6JWBrdqtptu34_zSVdfjVVIkYc5u3Y,122
src/rules/windows__process_creation__proc_creation_win_cmd_stdin_redirect.eql,sha256=QN--5NVUSNVmh-YtMbCh9nHbqaGnMeBsPz-bKx2bvuM,118
src/rules/windows__process_creation__proc_creation_win_cmd_sticky_key_like_backdoor_execution.eql,sha256=iHSHQ8R2q3Mt-2kDtaLonZ5pdQT2GvPgOHDOKEOstdo,376
src/rules/windows__process_creation__proc_creation_win_cmd_sticky_key_like_backdoor_execution.lucene,sha256=ErCE1nG9Jb3CzpUKoUZRqvwiLnsUl4qF6lumAqJ5hS8,348
src/rules/windows__process_creation__proc_creation_win_cmd_sticky_key_like_backdoor_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_sticky_keys_replace.eql,sha256=NGWu75O1G2tcL8yGn2P8aqyZ4Cseg4HT8S5e5lK_GHU,167
src/rules/windows__process_creation__proc_creation_win_cmd_type_arbitrary_file_download.eql,sha256=DXWv5NvbL-VhEr3cI7-bfJ0uaIA9EsmezGIXX7I-Bng,149
src/rules/windows__process_creation__proc_creation_win_cmd_unusual_parent.eql,sha256=qG4itU-PTxqlpDjnFPP3qqKQnj4llHKb7FfmE1ogdwo,546
src/rules/windows__process_creation__proc_creation_win_cmdkey_adding_generic_creds.eql,sha256=CdvYQqibGiHGSUq6RayCqFX75QUoUoa0lI_AU84IdnA,342
src/rules/windows__process_creation__proc_creation_win_cmdkey_recon.eql,sha256=gK3hWKK_tP7WQ_y01i6MJi3wrpFLZ-89fBfmQeNDm-Q,176
src/rules/windows__process_creation__proc_creation_win_cmdkey_recon.lucene,sha256=if3SfuTh3M0nHksfU4Gf9KYwjTFztq20xvf4GD859Mo,161
src/rules/windows__process_creation__proc_creation_win_cmdkey_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmdl32_arbitrary_file_download.eql,sha256=jBN8c9RmylUUzwkB8GYu6DULa-N2pgqHx7yVMoE1q3I,163
src/rules/windows__process_creation__proc_creation_win_cmstp_execution_by_creation.eql,sha256=i9zskmco9u3DbEPSGZkyn7Ntlu2oAf78uyeCynIK5zo,51
src/rules/windows__process_creation__proc_creation_win_configsecuritypolicy_download_file.eql,sha256=AYObkxrfC6Hx5QE4LB9TYtSxhdKPFQerCVzmGZuT-Fs,247
src/rules/windows__process_creation__proc_creation_win_configsecuritypolicy_download_file.lucene,sha256=u-0U2sCx4ebI3jy2v5oKntkgMxt1t2h_mv8cQogVcYw,232
src/rules/windows__process_creation__proc_creation_win_configsecuritypolicy_download_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_conhost_headless_powershell.eql,sha256=WLcpQTb9QXBV1AlO763mwMOt4vTD20Llr-0r-lhIXVc,177
src/rules/windows__process_creation__proc_creation_win_conhost_legacy_option.eql,sha256=Tf8s53HV2DGgyEcNhD9CI4tsRQwgPSLKiSeA5Ojk0cM,197
src/rules/windows__process_creation__proc_creation_win_conhost_path_traversal.eql,sha256=aw3SP6g9Tvqhx84o80NvELKUMebgr1B6aAu1S5CgGzA,87
src/rules/windows__process_creation__proc_creation_win_conhost_susp_child_process.eql,sha256=tBhYQggyyuwgkN0FQ4ESqMTUVV86L3j5dHx8WJ2FFho,246
src/rules/windows__process_creation__proc_creation_win_conhost_susp_winshell_child_process.eql,sha256=VN6GZqhrMTJASrC6rbGNuyaDdNLaLTv4-IjwYfBzYyk,397
src/rules/windows__process_creation__proc_creation_win_conhost_uncommon_parent.eql,sha256=E5FwzVYTO6-NAi3VahiWU492tNk_Yv3LnlUNhR427p8,827
src/rules/windows__process_creation__proc_creation_win_control_panel_item.eql,sha256=z6gZQDGS-sXAg2iUUb4EveIrWTW5J7x0bn8BNz5bMGQ,441
src/rules/windows__process_creation__proc_creation_win_createdump_lolbin_execution.eql,sha256=w0Zqb8u_FuUrHF6g2j4vniIUE_N_8wVdQV3ITiWWMbE,203
src/rules/windows__process_creation__proc_creation_win_csc_susp_dynamic_compilation.eql,sha256=1CX0m6rP7WRaz9ji7ps1o2bt6ecI7qihJoYMjnC8qAc,1767
src/rules/windows__process_creation__proc_creation_win_csc_susp_parent.eql,sha256=NYAl0JBxVWxNoite2xCHlqkxZQ7gUweyCXQYOlkiQ0k,2125
src/rules/windows__process_creation__proc_creation_win_csi_execution.eql,sha256=BC72hOvcFwK40gLGfS2Jijl5ym3KGxrnGX5Q1hFYiyw,181
src/rules/windows__process_creation__proc_creation_win_csi_use_of_csharp_console.eql,sha256=iJX0Q0jwzXvTzkDM5QBYbR4VoSFaJzX1D8nMZlbf2aw,186
src/rules/windows__process_creation__proc_creation_win_csi_use_of_csharp_console.lucene,sha256=IbmyOq8BTwjSbvz7XunYGN5TsZ0nm_qPkwJXDFpzsrw,164
src/rules/windows__process_creation__proc_creation_win_csi_use_of_csharp_console.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_csvde_export.eql,sha256=L2gygH4uM0L5FZfMSJ_9WPblpqRvNQvJ3HW2v3EWCw4,165
src/rules/windows__process_creation__proc_creation_win_csvde_export.lucene,sha256=WC-NYDIziwBClwKZqTgeYQ7QVqaUc1TFQv0UslYPhyU,151
src/rules/windows__process_creation__proc_creation_win_csvde_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_curl_cookie_hijacking.eql,sha256=FLn-39IsMDLJ3V5TFM_bGhDOj4h9ZFgFQu7Znuv7yqw,136
src/rules/windows__process_creation__proc_creation_win_curl_custom_user_agent.eql,sha256=GgEU3ezHDTJayzo2uZ8-q_JwUorQq1cr-4i1gFfuohc,175
src/rules/windows__process_creation__proc_creation_win_curl_download_direct_ip_exec.eql,sha256=WNsEiCbJNyQumGji_qscnZtkndSXduvIkTQnk4hxLrc,754
src/rules/windows__process_creation__proc_creation_win_curl_download_direct_ip_susp_extensions.eql,sha256=iHlDQxwpLl55wad2gKyQWCOLOLne6EpL7PYz8B6SxdY,746
src/rules/windows__process_creation__proc_creation_win_curl_download_susp_file_sharing_domains.eql,sha256=6xtf7gkhAJbuL1Yox9o75HYlr1GU0M24j2LyiiQaO70,1164
src/rules/windows__process_creation__proc_creation_win_curl_download_susp_file_sharing_domains.lucene,sha256=ixc87F92ru-m6TMHameWRVeEEgzWdPyYj-eARice6AI,1131
src/rules/windows__process_creation__proc_creation_win_curl_download_susp_file_sharing_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_curl_insecure_connection.eql,sha256=Qc1ZWoDSlTvQ2Yafzzu2HQiQNeZ791F9kfuytEBihnY,136
src/rules/windows__process_creation__proc_creation_win_curl_insecure_porxy_or_doh.eql,sha256=FtYgWTx9DMvPEE2YdnyPbF7METNw8mLQhP-zzMJvOLs,165
src/rules/windows__process_creation__proc_creation_win_curl_local_file_read.eql,sha256=eA8MeeCo3U460542lFahqNhSfIsAXjZmQIN8ZCCIxZA,127
src/rules/windows__process_creation__proc_creation_win_curl_susp_download.eql,sha256=sC2wpv4yhmXEM5VL_C9KiHvrgPqWaGw2wGr40ye_dj0,736
src/rules/windows__process_creation__proc_creation_win_customshellhost_susp_exec.eql,sha256=WD0MHomB-X-N6rsAQvKh3hfTjHMpQpD2XvW-5fKpPzg,118
src/rules/windows__process_creation__proc_creation_win_dctask64_arbitrary_command_and_dll_execution.eql,sha256=-do37oh0Q5JstjVzaEyGbBIFXZG5sJP_iVEHpFjBqbY,358
src/rules/windows__process_creation__proc_creation_win_defaultpack_uncommon_child_process.eql,sha256=_bDMfMgaA7HZCIXhj-sk0BGLa5eHUzCFq_6Qx_IVjPI,57
src/rules/windows__process_creation__proc_creation_win_defender_default_action_modified.eql,sha256=uKgq6mS-retlxzl23_xcarAfQEqakdemmXfpfxHwdbo,344
src/rules/windows__process_creation__proc_creation_win_defender_remove_context_menu.eql,sha256=SDjk4Yi_UKKNpVLxAQI-KifAmx_uCCuVDblzIL4imnE,354
src/rules/windows__process_creation__proc_creation_win_desktopimgdownldr_remote_file_download.eql,sha256=gW27Dx29Gbobbqy6LhpjikCeXNR1W0mXQ5Uc5ALqJJo,162
src/rules/windows__process_creation__proc_creation_win_desktopimgdownldr_susp_execution.eql,sha256=9J4DmCb_ip4RhOtdt84J23Q_PU28RHzdCD8MDWkXawI,216
src/rules/windows__process_creation__proc_creation_win_device_credential_deployment.eql,sha256=j0C3SObAh6EuUqf21oPBmshyeBATiqzXjeww66t8JIQ,65
src/rules/windows__process_creation__proc_creation_win_deviceenroller_dll_sideloading.eql,sha256=mxo5KjA8zIncO_3MWLt9OqBeovk5hghnd56ippaBqtU,153
src/rules/windows__process_creation__proc_creation_win_deviceenroller_dll_sideloading.lucene,sha256=eDY_pONjNUaz1L10AZfqe-NdprJ9i5uNylAk7F3G71M,138
src/rules/windows__process_creation__proc_creation_win_deviceenroller_dll_sideloading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_devinit_lolbin_usage.eql,sha256=bHlEKf9oH3jYWk-Puqj8ZFIuAIBc5CmPzhIDt4kcoDQ,90
src/rules/windows__process_creation__proc_creation_win_dfsvc_suspicious_child_processes.eql,sha256=31LVsMxHS5I3gDu6tB73Ec8RuRCpId0SBYTmaIAje24,392
src/rules/windows__process_creation__proc_creation_win_dirlister_execution.eql,sha256=A587rXp09j2HbITVJfreJJLuhBcTtRa2f8YMcjzWtTA,97
src/rules/windows__process_creation__proc_creation_win_discovery_via_reg_queries.eql,sha256=wQhrvW8d0e4n9DK-fVOk6H-2i7YiV7SmJ9rLVqtS_5E,601
src/rules/windows__process_creation__proc_creation_win_diskshadow_child_process_susp.eql,sha256=2Z1agkniVZUp6qXTGDCh9H8en14tycyoFYgaRiCMlvw,233
src/rules/windows__process_creation__proc_creation_win_diskshadow_script_mode_susp_ext.eql,sha256=Y8vRRHXeGU_-1NzWuLuPbghXySPNJ2cjBrXZL64fVKc,226
src/rules/windows__process_creation__proc_creation_win_diskshadow_script_mode_susp_location.eql,sha256=JeOwHtuQaRFoJJAxSxAmNw7UH0aycRx6wgn5m1-OElo,351
src/rules/windows__process_creation__proc_creation_win_dism_enable_powershell_web_access_feature.eql,sha256=9kC2tPhXoeyLnrFhn9nJ65-G9ImEztGjJ1Z3XOTlH7w,229
src/rules/windows__process_creation__proc_creation_win_dism_remove.eql,sha256=P7bELZQCYYQg4xz2HLzLE3f36Pz8Cbx3_KlkTqwfUVs,271
src/rules/windows__process_creation__proc_creation_win_dism_remove.lucene,sha256=1388z6pDWNFXAbts5KKpJpTD44TqLpLKGnK7eT5Bofg,255
src/rules/windows__process_creation__proc_creation_win_dism_remove.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dll_sideload_vmware_xfer.eql,sha256=5mDAyIir6B0sTtm1GKWUvZSh6UxU_yWbp79RcHe6Mxg,113
src/rules/windows__process_creation__proc_creation_win_dllhost_no_cli_execution.eql,sha256=BigMoZXuu-fMtqCRBHpxwkcbiyfuMBKO9FIyc9fCbUA,190
src/rules/windows__process_creation__proc_creation_win_dllhost_no_cli_execution.lucene,sha256=vkko0qoe_B_u6m-5tdmFozhWF45Dham2uhOE8uFKXKM,173
src/rules/windows__process_creation__proc_creation_win_dllhost_no_cli_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dns_exfiltration_tools_execution.eql,sha256=vMwbrO1jF2S4-5eaZvnm5NVNGvHL_tR2SV5mgvrrqE0,68
src/rules/windows__process_creation__proc_creation_win_dns_susp_child_process.eql,sha256=keXiXA7jIcEFU3oVF6fy0MXMOafXlNIZDqDWSbqkfmg,95
src/rules/windows__process_creation__proc_creation_win_dns_susp_child_process.lucene,sha256=5QC00NxXSutoUuncYM7FoCkgSrcduVuCQpkenhmg52I,81
src/rules/windows__process_creation__proc_creation_win_dns_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dnscmd_discovery.eql,sha256=pZJWN-UQzUxp1-fAIjMXDGMCDTg_pDYXCQfUF_IGKnQ,140
src/rules/windows__process_creation__proc_creation_win_dnscmd_discovery.lucene,sha256=D7-ROfamSlY9ApCagSpBF134ZDt6xduVko6a7Rry4Qg,124
src/rules/windows__process_creation__proc_creation_win_dnscmd_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dnscmd_install_new_server_level_plugin_dll.eql,sha256=-lIUY8rvACAad9VbbBZep2XRmWsxDYYZVVI03nHSxs0,135
src/rules/windows__process_creation__proc_creation_win_dnx_execute_csharp_code.eql,sha256=Ob-k3wkukRz-QpR1ec07xPzCK3LnD3kRjA26CsqfKV8,42
src/rules/windows__process_creation__proc_creation_win_dnx_execute_csharp_code.lucene,sha256=0xsF9ugiHkWbQzln6mYD26QH4WNb6MShycmiAof8dGo,30
src/rules/windows__process_creation__proc_creation_win_dnx_execute_csharp_code.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dotnet_arbitrary_dll_csproj_execution.eql,sha256=ptRW-xKiTSUb-f8Tdtk9riin1SV9tITarD0PBxbWwKs,498
src/rules/windows__process_creation__proc_creation_win_dotnet_arbitrary_dll_csproj_execution.lucene,sha256=DyUlt15BdOsUXQpkqDCWrWe-x1R1WkBkCoEB8IOpY58,481
src/rules/windows__process_creation__proc_creation_win_dotnet_arbitrary_dll_csproj_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dotnet_trace_lolbin_execution.eql,sha256=Zx0EE5YUoa6w0sMD_L81771Ql4um-XyI-S9ne0fpDbs,177
src/rules/windows__process_creation__proc_creation_win_dotnet_trace_lolbin_execution.lucene,sha256=-d3orA5zYdX4Iv6y0o4ruZFDce6Btbwf9c_ehEtRSk8,164
src/rules/windows__process_creation__proc_creation_win_dotnet_trace_lolbin_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dotnetdump_memory_dump.eql,sha256=ZVdRH6fxaoFz4ezrMD1AXU5BPEpcIK78euptbUO2Rpo,140
src/rules/windows__process_creation__proc_creation_win_dotnetdump_memory_dump.lucene,sha256=xJ3aGxTQZcKy734E_hWQqHkZLt0sI5pnwP3JclQ1Kf4,126
src/rules/windows__process_creation__proc_creation_win_dotnetdump_memory_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_driverquery_recon.eql,sha256=NNTS2DJwDx9hJmDJctiOq-0WvBzj24bXHNgn2iZd0x0,335
src/rules/windows__process_creation__proc_creation_win_driverquery_usage.eql,sha256=nP66pV4uLl-PFLYJcHeCymXouv3yCbXvN89VrQZyr48,341
src/rules/windows__process_creation__proc_creation_win_dsacls_abuse_permissions.eql,sha256=HJwx7i5hEtFFL88vFeMTD0XI7v7PHQhnz8ck9MdFTdU,209
src/rules/windows__process_creation__proc_creation_win_dsacls_password_spray.eql,sha256=M085aOsE6lscmxVN0dF4BbqYMHN7F2dPbI702A4CyPk,169
src/rules/windows__process_creation__proc_creation_win_dsquery_domain_trust_discovery.eql,sha256=587bxB3TQqBo2KfE4xZljIKUIYzb6egj-Cx5VOUpfrk,138
src/rules/windows__process_creation__proc_creation_win_dtrace_kernel_dump.eql,sha256=Ao0UN7iTm4itg85pJk1zLr8WMxUHCHWmwxu10mC50Ro,164
src/rules/windows__process_creation__proc_creation_win_dump64_defender_av_bypass_rename.eql,sha256=hlFJcWKmq3faAbgWY87ODSk5aPPMGisZG6PjqaKQBTw,247
src/rules/windows__process_creation__proc_creation_win_dump64_defender_av_bypass_rename.lucene,sha256=WMhEx3mRGPmYmmTy4lzrLptZROCZxCw26hDkeRXOGUg,230
src/rules/windows__process_creation__proc_creation_win_dump64_defender_av_bypass_rename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dumpminitool_execution.eql,sha256=BPWh3URfhuiMnY8q63MYpujsM5binJlQ5okUINzV0fI,302
src/rules/windows__process_creation__proc_creation_win_dumpminitool_susp_execution.eql,sha256=pG1h80vcUdvrMFGHs9iq-aLwuIwX_m6GQtXo042lVLo,475
src/rules/windows__process_creation__proc_creation_win_dxcap_arbitrary_binary_execution.eql,sha256=DTuV4fYu9Uvr2M2BJs9Yx33yWwgHsJ4T5oQCe0tLVEg,125
src/rules/windows__process_creation__proc_creation_win_esentutl_params.eql,sha256=RMMDTJmtU_SAt9luHGQO60fnrbR8TGIVU_ah376CACk,77
src/rules/windows__process_creation__proc_creation_win_esentutl_params.lucene,sha256=WYpU55NrRPQzylKc4jqulKYsRfa_RjyosO6riVA1GGo,65
src/rules/windows__process_creation__proc_creation_win_esentutl_params.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_esentutl_sensitive_file_copy.eql,sha256=PLREVW-zlbkl7kJAgi31KbAM6hIuxo6cSakKNFpZhc4,605
src/rules/windows__process_creation__proc_creation_win_esentutl_webcache.eql,sha256=PqR4vgX9VxmWdzNttHln066S0n5wFvEVaKVKvxSCv9Y,224
src/rules/windows__process_creation__proc_creation_win_event_logging_disable_via_key_minint.eql,sha256=UoK_CETf3uiSfRH2grUqdl_SS1eHk6q_VpwWWAJaB-s,500
src/rules/windows__process_creation__proc_creation_win_eventvwr_susp_child_process.eql,sha256=OrG4Su8zPLUrvU0T-HqhUhWklvJKkEcbHWzT8SGSqzM,204
src/rules/windows__process_creation__proc_creation_win_eventvwr_susp_child_process.lucene,sha256=rlCJ5Qs7xtWyA_rlM6DkEqOH1f23oNIznlIdCwGEFRY,187
src/rules/windows__process_creation__proc_creation_win_eventvwr_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_expand_cabinet_files.eql,sha256=-Kr5I0v9UsiJFw7rer5ivXmOIZNzeeHXZtnKWcHXpg8,794
src/rules/windows__process_creation__proc_creation_win_explorer_break_process_tree.eql,sha256=h3j5RUQOom66TClc9KDLBbSP8rib5frlyl_XDsIQA50,229
src/rules/windows__process_creation__proc_creation_win_explorer_break_process_tree.lucene,sha256=sK0E43bnPmHgorsF7K6PG-3MIcteU3YqP6Bh9XXNimA,221
src/rules/windows__process_creation__proc_creation_win_explorer_break_process_tree.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_explorer_folder_shortcut_via_shell_binary.eql,sha256=g77Of-nhng7QwcIuiLjPdlbyF4tQhAdmYJ989X4VFbY,188
src/rules/windows__process_creation__proc_creation_win_explorer_folder_shortcut_via_shell_binary.lucene,sha256=JVBkaymyFI7-xn6QWIEU6IA51iSgaKAR_naev0r1Jog,167
src/rules/windows__process_creation__proc_creation_win_explorer_folder_shortcut_via_shell_binary.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_explorer_nouaccheck.eql,sha256=V1O_kFaAAiH_VCw0c36zD5LJ-fV70-HfnRPCvaxlwoo,259
src/rules/windows__process_creation__proc_creation_win_findstr_download.eql,sha256=7wX48RwgbPirFIX8WKS1jJWTasqmNPMcnXmfuWerpKI,339
src/rules/windows__process_creation__proc_creation_win_findstr_gpp_passwords.eql,sha256=nvV7eZYl3uxAV396Uu7yjIA6nGEb1NGTWh1_gVxBw6Y,257
src/rules/windows__process_creation__proc_creation_win_findstr_gpp_passwords.lucene,sha256=wU42EFBRAFIwZrjAeV3A1OnArESRqPUsyNpDrVqh4Vo,224
src/rules/windows__process_creation__proc_creation_win_findstr_gpp_passwords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_findstr_lnk.eql,sha256=txsk0B68DOvPfxdgqrc_wMSv2ugBLYyay6cgBbKkPmI,206
src/rules/windows__process_creation__proc_creation_win_findstr_lsass.eql,sha256=573uMElejZwVdKdZI0h5yU6vUplDRuV9HcKJPgwcudY,647
src/rules/windows__process_creation__proc_creation_win_findstr_recon_everyone.eql,sha256=P0DVodAyoau_gQrwr4rxjSnyKvV_ussyTFnaFZFBB80,362
src/rules/windows__process_creation__proc_creation_win_findstr_recon_pipe_output.eql,sha256=iKYzSIArRl3mnPr-J9S-9zpOF9n9C6GxZpVbOOgv6HY,365
src/rules/windows__process_creation__proc_creation_win_findstr_recon_pipe_output.lucene,sha256=W0Y3qvjr0FjJmR5mdsbJpKv36t0KytD8a3a1eohgqDk,354
src/rules/windows__process_creation__proc_creation_win_findstr_recon_pipe_output.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_findstr_security_keyword_lookup.eql,sha256=Ob49Wu7qmoax5Xwot0KA-1xpvMFDs435DpfcFVFMYQo,450
src/rules/windows__process_creation__proc_creation_win_findstr_subfolder_search.eql,sha256=rtEc2oc3K2bmC9ChguqwGl2AkiP76jloJM0iA1sT4ZE,307
src/rules/windows__process_creation__proc_creation_win_findstr_sysmon_discovery_via_default_altitude.eql,sha256=lSS1xIza4gIejRVXrZcXEF11cEb6-MRBXnlW3k3nniY,179
src/rules/windows__process_creation__proc_creation_win_findstr_sysmon_discovery_via_default_altitude.lucene,sha256=SOvBJR7z0Gn-v9x91jU1XjThQeNG_ERkaSzzF3vhgrE,152
src/rules/windows__process_creation__proc_creation_win_findstr_sysmon_discovery_via_default_altitude.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_finger_execution.eql,sha256=ORDbDH3JfElCEvmbkZ76yw543y73zl3fbJYowMBzsIk,91
src/rules/windows__process_creation__proc_creation_win_fltmc_unload_driver.eql,sha256=O15F2q12HevlIuL-ZwSw9p9pCN69Nc0vOpefVOtQrhY,546
src/rules/windows__process_creation__proc_creation_win_fltmc_unload_driver.lucene,sha256=GjS-jOVKluzxUeAHGy6jywQssS1X8o04d96-htxiZ-o,518
src/rules/windows__process_creation__proc_creation_win_fltmc_unload_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_fltmc_unload_driver_sysmon.eql,sha256=vnXsUVMIjyc8LALVz0El0JC3nV4LaiL1-NOkyz5lZO0,165
src/rules/windows__process_creation__proc_creation_win_forfiles_child_process_masquerading.eql,sha256=gRvlBJdSRXg-f51dhTBv9CsWkIba6t9XzqwZ-TVXiWg,419
src/rules/windows__process_creation__proc_creation_win_forfiles_child_process_masquerading.lucene,sha256=wUfjWOBOxIKQInN_tnWBG1gkfszqxp6CvmeILpKgGMg,380
src/rules/windows__process_creation__proc_creation_win_forfiles_child_process_masquerading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_forfiles_proxy_execution_.eql,sha256=EPIahA4VCV1JGo7Agaqy9u0KiQ4rFMqYrw0aeaGgzhE,185
src/rules/windows__process_creation__proc_creation_win_forfiles_proxy_execution_.lucene,sha256=stbjurDxaKwQKzruFoljsOeU0hpyDstu_lrGC4IvFrc,175
src/rules/windows__process_creation__proc_creation_win_forfiles_proxy_execution_.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_format_uncommon_filesystem_load.eql,sha256=YCUYJT1PqSRjhUezU1SloiWRsTVXgjFKccQoMuvOLPg,190
src/rules/windows__process_creation__proc_creation_win_fsi_fsharp_code_execution.eql,sha256=nmp2MRUhV0arDYL6MnGrlo8eGrE9IhMjQMV46GpAfRo,142
src/rules/windows__process_creation__proc_creation_win_fsutil_drive_enumeration.eql,sha256=VheQCwpfOYuo04wfCdVexVrm8OCadKt_KdDY0T_qZHg,129
src/rules/windows__process_creation__proc_creation_win_fsutil_symlinkevaluation.eql,sha256=C7Lq7UtL5kP5ekxf6c9mImjnvVh0r9SURjcbA4F9ncI,396
src/rules/windows__process_creation__proc_creation_win_fsutil_usage.eql,sha256=HuOfMlCTITNSq-1Y6ZW9dPvFk7mv4cTJobKzuXWj6Hg,182
src/rules/windows__process_creation__proc_creation_win_fsutil_usage.lucene,sha256=6xkcc8iTxFhzPuxkkVIuJjs8h_9d9vKnnp6GRnY4ouI,160
src/rules/windows__process_creation__proc_creation_win_fsutil_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ftp_arbitrary_command_execution.eql,sha256=lHQ1aplDAV1k3rmsIHKWc6W1WQT_VyiuAbPlX7qp-JU,214
src/rules/windows__process_creation__proc_creation_win_gfxdownloadwrapper_arbitrary_file_download.eql,sha256=zxqykwreRNIGagYFZpoV-LKERr8MRPcborXmLtn6xsk,186
src/rules/windows__process_creation__proc_creation_win_git_susp_clone.eql,sha256=m-SwYU7lR0zWi42fHlxrMml6tp3EZ_1f3iIROkGiJKs,426
src/rules/windows__process_creation__proc_creation_win_github_self_hosted_runner.eql,sha256=_WImYQ9nySXEhKfiv_MgIk_gx2JgG7CdB6oCrg0CY_8,314
src/rules/windows__process_creation__proc_creation_win_googleupdate_susp_child_process.eql,sha256=4PgeLimJ2EEYr0XfQJWmTXV8TaLSqfIV86atwpSiLAw,272
src/rules/windows__process_creation__proc_creation_win_gpg4win_decryption.eql,sha256=B6FY0TWU_ydxN4UTI-x5orEqCF45xIFLhx5AZRgKaAM,196
src/rules/windows__process_creation__proc_creation_win_gpg4win_decryption.lucene,sha256=wSg_i84-3maLEtS-P5ghyNN5Ec6d9eV1UnDpU62nQec,177
src/rules/windows__process_creation__proc_creation_win_gpg4win_decryption.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_gpg4win_encryption.eql,sha256=R9f1vFxnIRe0V8q3s9I0KZ7TrkeLKPHCoNICbC4pA38,196
src/rules/windows__process_creation__proc_creation_win_gpg4win_portable_execution.eql,sha256=fEKPmq6l9-hdqNszVqptj69FQGAAxYudH2EL1a2OI9M,382
src/rules/windows__process_creation__proc_creation_win_gpg4win_portable_execution.lucene,sha256=uO3aBwZ93qZJq4xQLHzeSegij7FnVj2Eorchh_pjpcg,372
src/rules/windows__process_creation__proc_creation_win_gpg4win_portable_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_gpg4win_susp_location.eql,sha256=6p5mfAo-29NWfweSvNowMv-gtr58nCVTBqcgwNJizY0,383
src/rules/windows__process_creation__proc_creation_win_gpresult_execution.eql,sha256=IB--qs9sfyOO1mDtHDwCoFcG9Xpu18ZhCtFTeKmkrHM,97
src/rules/windows__process_creation__proc_creation_win_gup_arbitrary_binary_execution.eql,sha256=zAHx__wHEsr2I_O32Pa8SPEzrAdu2fHtDutnoyrCdLM,330
src/rules/windows__process_creation__proc_creation_win_gup_arbitrary_binary_execution.lucene,sha256=I3P69vu5vwzX8nKdUkwqd-6K1oRemW8UfwVFYAZlrUg,318
src/rules/windows__process_creation__proc_creation_win_gup_arbitrary_binary_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_gup_download.eql,sha256=aBllJ04OpyfACFcNKROUXPWTwgcrJW51OcIKaE7vLgo,220
src/rules/windows__process_creation__proc_creation_win_gup_suspicious_execution.eql,sha256=OUH-PSIAyN--2VotHcCGm03lQddft51JFgbm-nLtHJI,358
src/rules/windows__process_creation__proc_creation_win_hh_chm_execution.eql,sha256=yEo6A5FaBp5DXNkDoI7-ref6qqhGsL_Iu5euY0BO9Ng,119
src/rules/windows__process_creation__proc_creation_win_hh_chm_execution.lucene,sha256=cBj6EeLpCJcBCQtOIUl-GNlMGi78vPr94LH13CtB140,103
src/rules/windows__process_creation__proc_creation_win_hh_chm_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hh_chm_remote_download_or_execution.eql,sha256=VFsoYKKYYKUT1kv5b6BDRwDsafXAko-7kB9j4Gpi33M,154
src/rules/windows__process_creation__proc_creation_win_hh_chm_remote_download_or_execution.lucene,sha256=OKkfFjZmUl1xg_IWOrWGZhkCuVvfHWrQSltx8MUj0bE,138
src/rules/windows__process_creation__proc_creation_win_hh_chm_remote_download_or_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hh_html_help_susp_child_process.eql,sha256=GociWCTGrBrGNet7jkv4GGDSoHyddvxTYYPQgTN6dws,349
src/rules/windows__process_creation__proc_creation_win_hh_susp_execution.eql,sha256=-DcP1_yHaCrJcByIZ8b9rHvA0jJMO7XCoYVoboY17pY,257
src/rules/windows__process_creation__proc_creation_win_hh_susp_execution.lucene,sha256=M3TjevkXOo9dPH_xkhPAKU-0B_MyXUwRkeTzLFia3Hs,230
src/rules/windows__process_creation__proc_creation_win_hh_susp_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_adcspwn.eql,sha256=IF5a4P6K6lzRG_dKwGmJNvsHs1DiDhwbyEVG8lHhyUc,82
src/rules/windows__process_creation__proc_creation_win_hktl_bloodhound_sharphound.eql,sha256=XOHglwmAzd-VR63gjQ8yHc0CeRLvuNbyUtDx0b6YFBM,615
src/rules/windows__process_creation__proc_creation_win_hktl_bloodhound_sharphound.lucene,sha256=ysoeLvtL-Vxu74mA9byufXE3wtsJRaI1H5RNLpH4UoI,610
src/rules/windows__process_creation__proc_creation_win_hktl_bloodhound_sharphound.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_c3_rundll32_pattern.eql,sha256=vpMlg23kRveb9AeyYGhm2gAxutDmqU_087illnj4OTQ,126
src/rules/windows__process_creation__proc_creation_win_hktl_c3_rundll32_pattern.lucene,sha256=wdUPE-WWPw9CrzTErkk-5QEJluauItV8IwQN_-1Y8qw,110
src/rules/windows__process_creation__proc_creation_win_hktl_c3_rundll32_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_certify.eql,sha256=5uFTQgq6FbwDrRiwSBMU7zR4y_S0zoJxKXqYKvWt3ho,384
src/rules/windows__process_creation__proc_creation_win_hktl_certify.lucene,sha256=pWB-som8Mi1_BiibTY2xEg0Z6sWMXBZEMWEdCKZAmkw,379
src/rules/windows__process_creation__proc_creation_win_hktl_certify.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_certipy.eql,sha256=pftzxEwZRv0ZNRnF9C-k6EHZuJTgDk21_CxrPF_Pkd4,539
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_bloopers_cmd.eql,sha256=HL6MG314t0ctsSl__U1FzTLlZ4CicRJITG3ePbyaQ38,356
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_bloopers_cmd.lucene,sha256=5lftDCGw_YyzhRlpHINAxTSm3P9mUopLpIztAppY4jA,330
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_bloopers_cmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_bloopers_modules.eql,sha256=kAUV1nrM-DBWSKVxZDZLU8-iYV_oN7K9z_Kd9tY2eBw,267
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_load_by_rundll32.eql,sha256=B2Z4u8p4ZU21d7pAsXKw4Ye9jcEiTJwbZxd3XoDS72I,257
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_process_patterns.eql,sha256=eFffeXmC_xPd3LmW-eKKISqPxpmXCIfp97C57xN_MIQ,532
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_process_patterns.lucene,sha256=wviXH7RnPTqLFl3ziFzd0eaE20ZLni-X1HAg5YwMJ8w,518
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_process_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_coercedpotato.eql,sha256=AD2T-06b8xqEWet-HFC0X7xd8mt-tY8s-O_0vr2XhEg,269
src/rules/windows__process_creation__proc_creation_win_hktl_covenant.eql,sha256=Kb0xNWNtaKQWm7gZbd9SLrwoNeQqfbr5-5l3joYbW8c,367
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_execution.eql,sha256=8hU0e2ggNzTii05KSyA8QsBVrWZm-GHdDrJIKp4kIuY,1078
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_execution_patterns.eql,sha256=gzqvtrYQ_LIEZXkXRTPqj28rkTpz5RCTANaIle0lKE8,245
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_execution_patterns.lucene,sha256=O6dc4daYbRTfDAPs0yMANkpf85Y9LqecVcDyqbe-J6s,274
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_execution_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_patterns.eql,sha256=iUrOKrJQzNxuT7h9s5N13bFl4reB4A0iiJjw6QxDgd4,583
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_powershell_obfuscation.eql,sha256=eqqshaSBQs3sd61li97WCC3cCYd7DImydzCsirJtTEA,367
src/rules/windows__process_creation__proc_creation_win_hktl_createminidump.eql,sha256=zoMrjt5ss2Z5tM4Y1H0OUXGZVH68fY1prvMfsAJ76V0,126
src/rules/windows__process_creation__proc_creation_win_hktl_dinjector.eql,sha256=NJEkHj5IsAXbMc09YI_diabvKGP_JJpGJUas10oxe5E,82
src/rules/windows__process_creation__proc_creation_win_hktl_doppelganger.eql,sha256=Uov6eDuR2qHX6Gl8qXkKpUinhWSTWjcUvVNo0k0OhtA,180
src/rules/windows__process_creation__proc_creation_win_hktl_dumpert.eql,sha256=9HWQccvM3vRwjDlbINUvGva7LKGWWdahrXxZL35b9Gw,116
src/rules/windows__process_creation__proc_creation_win_hktl_edr_freeze.eql,sha256=gtgLK5VEuxjGUyrNCSnbJLBpvH2BltKxZ0bOdvOnttg,511
src/rules/windows__process_creation__proc_creation_win_hktl_edrsilencer.eql,sha256=EYbLstW9eA-c_ylZW7p2Z5usPN4IO3oKn03CxvScWsA,143
src/rules/windows__process_creation__proc_creation_win_hktl_empire_powershell_launch.eql,sha256=5VRxMfU2Kmm73fz3YEwien7IKlOXYBkq4h7Qf8bT0i4,219
src/rules/windows__process_creation__proc_creation_win_hktl_empire_powershell_uac_bypass.eql,sha256=0bvqK7MjNWLS5cjGnGypDO_fm64X08UXh3AcaPTsHn8,207
src/rules/windows__process_creation__proc_creation_win_hktl_evil_winrm.eql,sha256=uw2EPEDNqY4mmAlQzeqFfcxjjidvV5vd7NnOVGCWYJE,144
src/rules/windows__process_creation__proc_creation_win_hktl_evil_winrm.lucene,sha256=OTeb63z5G5U_OFV4u9sq_snTbQOCEnnrcG_yflgjaRE,132
src/rules/windows__process_creation__proc_creation_win_hktl_evil_winrm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_execution_via_imphashes.eql,sha256=vWYRb0hw_eqYI4evy_N6RSVy0h_LS_1kMC3nK-PDoCM,4090
src/rules/windows__process_creation__proc_creation_win_hktl_execution_via_pe_metadata.eql,sha256=Ds_FEcGF9CMGwhg6bBPvEaom5ex6m_1zCw_w_0m7pSw,39
src/rules/windows__process_creation__proc_creation_win_hktl_gmer.eql,sha256=W76UVrIyFnYkEDIEC_AsuIYTE7r-z1ZqLJLXNab_8BY,250
src/rules/windows__process_creation__proc_creation_win_hktl_gmer.lucene,sha256=FHfg7kIhUnWqGFmvfUkCkxWi1amTDH41Cq_O1IcFxLA,233
src/rules/windows__process_creation__proc_creation_win_hktl_gmer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_handlekatz.eql,sha256=47I_hwWvKNZmOblummT_o5t-PVAW7LkCmVTJtVCtV1Q,366
src/rules/windows__process_creation__proc_creation_win_hktl_hashcat.eql,sha256=HXVTZ2hHr5vXUNsxOn4yHufnXn1eewO1JcXmSDhaa_Q,151
src/rules/windows__process_creation__proc_creation_win_hktl_hollowreaper.eql,sha256=W3xDn2TDwIH3kmiipd15w25uDM__KJLJH-mcu5jf7no,51
src/rules/windows__process_creation__proc_creation_win_hktl_hollowreaper.lucene,sha256=uZW-3iQjOIjED7JzRYqnM0pt-LJOULS1lhSU8KmmBFg,39
src/rules/windows__process_creation__proc_creation_win_hktl_hollowreaper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_htran_or_natbypass.eql,sha256=iHtXP_4bkpTSxG4UCgFCdDufSrs1PUDSKHnjvuRvz0A,136
src/rules/windows__process_creation__proc_creation_win_hktl_hydra.eql,sha256=esTjLHPZsGfxtk2Rj5yA-AG90guFUw6jmhMCrHeLlLE,132
src/rules/windows__process_creation__proc_creation_win_hktl_hydra.lucene,sha256=OSYhiydnesLsxdgacpPBzkSysVL_vLDH8cRYyuu5muE,118
src/rules/windows__process_creation__proc_creation_win_hktl_hydra.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_impacket_lateral_movement.eql,sha256=HLbEjbKrj9B_LFnx_5yCFqme1X8WfQBiKhhssGHCnqI,531
src/rules/windows__process_creation__proc_creation_win_hktl_impacket_tools.eql,sha256=DfH_V7rUx9Wwuwbn8X3PzePTEdLjrhEyiwTbSeBks_8,900
src/rules/windows__process_creation__proc_creation_win_hktl_impersonate.eql,sha256=ZLrSIpKaMaFERD4fPrhy5rQvfg1zG8UvAQ1YF33f20A,328
src/rules/windows__process_creation__proc_creation_win_hktl_inveigh.eql,sha256=nPPdXbhIsc1-G1MwT50QDY1uepAOXusqAunGauEiYCU,287
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_clip.eql,sha256=YALDQApSO6lmpYyf0sImcRJE_IS7jFoOYcr6WvKaJvU,197
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.eql,sha256=IXhac9L3lG3s4jIZlcNhvA_ISHzA-QdX6cqeNv4RTBs,392
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.lucene,sha256=R5H-1yBftQIgduW0DWQ03UtlK_U9PD8PU9IPQeZ20Go,1665
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_stdin.eql,sha256=NbtlHVB2p0nWRd1IiZ0nT8m4GreayuvYfoiWQAvPZ6k,106
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_var.eql,sha256=VlPR8nFRKctbZQhYrr2rC_RvnH1Mv_szRy1x3LlANVo,126
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_compress.eql,sha256=tq1-oIXXlNceqpgkQqjnJT4JfWUO9SKGmjUy0NSkynY,218
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_compress.lucene,sha256=MB39ZpThyLr3SlNCSVlJsydo7KXCGo71-gTEwZ8zA0g,201
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_stdin.eql,sha256=zQMvjYajaZa0kR2a-2tUCz0ffxLxFLqcwOOmZ5O1RSw,111
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_use_clip.eql,sha256=Icy4pYugHYe6EOTUfAqQ-DgPEC-Cpu0mHK4DLjsYUls,94
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.eql,sha256=l56puTvScZWXl-0Rpt8JaBczOR2LKNVmSdEGCR3MLPU,235
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.lucene,sha256=KcZMk41VcXUz7-aAisv0ECJefS0tOvzPr6Sm70nDh0o,218
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_var.eql,sha256=LEQuB-ehxxZyr-N-T0LCTTFHVrL-jrlAccWvMa9nu28,228
src/rules/windows__process_creation__proc_creation_win_hktl_jlaive_batch_execution.eql,sha256=LzCCji27miBq36_Fq-OrOf4fElvqlLGT2ukaIoDgevk,478
src/rules/windows__process_creation__proc_creation_win_hktl_jlaive_batch_execution.lucene,sha256=nc-jKILQ1TCQy1hROMqwzfch4xcYlKrj4T1o6MuTovM,446
src/rules/windows__process_creation__proc_creation_win_hktl_jlaive_batch_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_koadic.eql,sha256=AhFcWbzKtnCHjtXWhuv0UB8zXMIutxVhqOLDrfEia8M,187
src/rules/windows__process_creation__proc_creation_win_hktl_krbrelay.eql,sha256=ophfTmteUahjkmO_e5bMhP61a99r2eJQgTUPrIa7XVw,427
src/rules/windows__process_creation__proc_creation_win_hktl_krbrelay_remote.eql,sha256=3-i05fHvdFGNOrnIX8F4USmSJt5cWTvd6YbKad-tjD0,731
src/rules/windows__process_creation__proc_creation_win_hktl_krbrelayup.eql,sha256=ZNexvbFt0iGs_TR0OVZ3kuWW5px4RnKWDX0HfldOsSU,439
src/rules/windows__process_creation__proc_creation_win_hktl_lazagne.eql,sha256=HV2oPJ007MFW2ygk76Hgyt-VM9EbSRHhexWTvF2MIhk,1891
src/rules/windows__process_creation__proc_creation_win_hktl_localpotato.eql,sha256=L9tYqp_LJxp_fYhBa7sd_VHCmil2N5HjM9xLyS-C3YY,264
src/rules/windows__process_creation__proc_creation_win_hktl_meterpreter_getsystem.eql,sha256=mPyyIXv-jN8WGspEZ-rrh89Bky32RIF28waixFqEplY,374
src/rules/windows__process_creation__proc_creation_win_hktl_meterpreter_getsystem.lucene,sha256=HoSIJIfPay7_qVtMzLx--DPO-H_8wquYYSCPoxFcMBc,342
src/rules/windows__process_creation__proc_creation_win_hktl_meterpreter_getsystem.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_mimikatz_command_line.eql,sha256=A6oRc5Nbk73eaYw4jOg4b9vNqb3yz5ElM_ErQ1yrW0M,455
src/rules/windows__process_creation__proc_creation_win_hktl_pchunter.eql,sha256=75uxoE3L7UrxGTWrMcSHF3tI0u8RdM-L_62QCKS45Jc,668
src/rules/windows__process_creation__proc_creation_win_hktl_pchunter.lucene,sha256=YGrD3W_J0Ab5eI8lSeN91O8OOVu771HZBGYzsYcqXdM,650
src/rules/windows__process_creation__proc_creation_win_hktl_pchunter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_powersploit_empire_default_schtasks.eql,sha256=dBRF_0xSkmcSQWYzuX_m0onIegE7n50lj-ZMufrkVz8,358
src/rules/windows__process_creation__proc_creation_win_hktl_powertool.eql,sha256=58EWvBuIraRMw4o6JAY0HBGk8DsGtdnQVVv2wGqRfCg,129
src/rules/windows__process_creation__proc_creation_win_hktl_purplesharp_indicators.eql,sha256=Vr1YEzl1VJlsk5IUVKIM6deLdW2v90XYdK1Su0vi2ew,169
src/rules/windows__process_creation__proc_creation_win_hktl_pypykatz.eql,sha256=qRp4onsoUCaswjOE2-f3KTxCvf1PDjLvljXs4pgP2jM,148
src/rules/windows__process_creation__proc_creation_win_hktl_quarks_pwdump.eql,sha256=qKuK6owxwyuEbs0iof59AFtLsJXLvv7PDYe5fq27j1s,225
src/rules/windows__process_creation__proc_creation_win_hktl_quarks_pwdump.lucene,sha256=DnMrCs0IBU-rrsH5pLl-qaWL-PZQIaYoKAGbxJDufx4,236
src/rules/windows__process_creation__proc_creation_win_hktl_quarks_pwdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_redmimicry_winnti_playbook.eql,sha256=nCeAUHhsaQDLDvsHBsPsPgSmWvne4HJ20J3Zy8wdRh0,176
src/rules/windows__process_creation__proc_creation_win_hktl_redmimicry_winnti_playbook.lucene,sha256=jGQPkJGkQ_zVrcnzOE6uQH0Re_W8TXlq34yy7YHcAl8,152
src/rules/windows__process_creation__proc_creation_win_hktl_redmimicry_winnti_playbook.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_relay_attacks_tools.eql,sha256=Y3nEqWDVN8xnYbAn4itQlGSQO5cTyPfmbGimyI_nY5Q,607
src/rules/windows__process_creation__proc_creation_win_hktl_rubeus.eql,sha256=uawzuXS1CR5qM3xtZAREAwvSgKtrSSxqhKqQ8Nk61Ys,467
src/rules/windows__process_creation__proc_creation_win_hktl_safetykatz.eql,sha256=jXFdsRK9kP5a6_3UEdU8npxWUqowPkNMZ4U8eBgDOvg,138
src/rules/windows__process_creation__proc_creation_win_hktl_secutyxploded.eql,sha256=dErN_s1dMLuEtaYmZiQgboK355iltQLXPcmcnol-STA,142
src/rules/windows__process_creation__proc_creation_win_hktl_secutyxploded.lucene,sha256=6ZoL_lQ3VsYOvvxCndTQ55mCx29pGEhkpnCODI43Ckc,126
src/rules/windows__process_creation__proc_creation_win_hktl_secutyxploded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_selectmyparent.eql,sha256=xA_wS0ODZOUo4HXcfz9GEN04SbQT7FXTD9ss37gxcdo,630
src/rules/windows__process_creation__proc_creation_win_hktl_selectmyparent.lucene,sha256=eC-6NM4JJTz49z4XJQooVuR22yfkTm4d5O20ZV2s9fY,603
src/rules/windows__process_creation__proc_creation_win_hktl_selectmyparent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_chisel.eql,sha256=ML3pWNFVLKPFFwvp9EQscaVbHst3_nFuKGz6axrRFvU,86
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_dpapi_execution.eql,sha256=VMUCzRAQyHZeIJmhO_QeP-kpcgeCJqj6SK7IX1csdLM,482
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_dpapi_execution.lucene,sha256=8wAFtCN5byBVsRqc96hlFqD_5QqK3ImU7ueUkQrucJA,490
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_dpapi_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_impersonation.eql,sha256=qFCyX9RIq9PHGjKq4Iup75CbHxbg-mMrHDRzW1p_4B0,382
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_ldap_monitor.eql,sha256=xA0Dh2R-oXT5x_KPVp4KH94lwp91u5SX9miNLqONWSk,222
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_ldap_monitor.lucene,sha256=KxMPIfVJhfebJ5u1mwN46CA0BT4lxGjYI8zjoym_Mr4,208
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_ldap_monitor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharpersist.eql,sha256=d_GjlkyJGVamttmDQerlOaOCsJqXmVYFk0uJyZh40K8,414
src/rules/windows__process_creation__proc_creation_win_hktl_sharpevtmute.eql,sha256=rHdH6Zh-mf9tBih4fCGUVT_v_tDDxdbSfnSg_CVkL0w,176
src/rules/windows__process_creation__proc_creation_win_hktl_sharpldapwhoami.eql,sha256=b6eOC5Q08JaCV2AwGKlll5O_DMG4UcKk4N_3CWkHt84,275
src/rules/windows__process_creation__proc_creation_win_hktl_sharpldapwhoami.lucene,sha256=OKosbnQk5hDKl3ti5ynJ1TPQlVl-x9vXzH6_hXjeiHs,269
src/rules/windows__process_creation__proc_creation_win_hktl_sharpldapwhoami.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharpmove.eql,sha256=-s0TuPDUM5PQWleICiG8jzIkHa-Y1U_CAkNE935xAps,386
src/rules/windows__process_creation__proc_creation_win_hktl_sharpsuccessor_execution.eql,sha256=4ZIgFYYSNhXzdnYVnWbkalkJ49Tmp_yPhfRf7TKGtzI,340
src/rules/windows__process_creation__proc_creation_win_hktl_sharpsuccessor_execution.lucene,sha256=IzGHSfM_7NtrfaQUQHkX8GPfYOe8s9Cj-DYeDmcpSjo,324
src/rules/windows__process_creation__proc_creation_win_hktl_sharpsuccessor_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharpup.eql,sha256=4ua50THwHLTWQlVOmVefdvoW-hi9eO7CAeripCeFR7M,289
src/rules/windows__process_creation__proc_creation_win_hktl_sharpview.eql,sha256=dXIQ0zuYnZoAqcrgI3th24VHPLVWBWcoIeXxPj4LqA4,2057
src/rules/windows__process_creation__proc_creation_win_hktl_sharpwsus_wsuspendu_execution.eql,sha256=YUNT03nCoknLBbN4JsrDmJVVY4KNaNCZhL-njE7NSus,312
src/rules/windows__process_creation__proc_creation_win_hktl_silenttrinity_stager.eql,sha256=LtDCTABC_wIdGqadMavuvkSHSbyiRe1ZeWnyjL9YqJE,47
src/rules/windows__process_creation__proc_creation_win_hktl_silenttrinity_stager.lucene,sha256=KFtZS5Noce8F9uZj_vkv7xXr8z0Q7HHQqPhUUtjT5Qk,35
src/rules/windows__process_creation__proc_creation_win_hktl_silenttrinity_stager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sliver_c2_execution_pattern.eql,sha256=D3wnkcNe9JiyqeM_L9t1vERxWcPtYaBScexlFhdv3ig,104
src/rules/windows__process_creation__proc_creation_win_hktl_soaphound_execution.eql,sha256=2qNlfvvUg-1vmJHJZHz5kelK_AjBYfNE3WCbKOI5NJc,212
src/rules/windows__process_creation__proc_creation_win_hktl_soaphound_execution.lucene,sha256=6gSBuZQr3fP1iz2KBQC0J0QNG2t-lAwjJLirU17rUZQ,215
src/rules/windows__process_creation__proc_creation_win_hktl_soaphound_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_stracciatella_execution.eql,sha256=leN1UliiH-no1wXKq2gjR4CvOgBE98i5SJBisOKyKqM,338
src/rules/windows__process_creation__proc_creation_win_hktl_sysmoneop.eql,sha256=OSbyO02vghQa04Ed7y2zH8nIgVmLE7i0hPGlMjELiLw,177
src/rules/windows__process_creation__proc_creation_win_hktl_trufflesnout.eql,sha256=gonAMHqOPFyDsENchMiVDNb_Sce96JikKaBcOSkkSYE,103
src/rules/windows__process_creation__proc_creation_win_hktl_uacme.eql,sha256=xBY5mvze61uKcRdnqW8uT1RI9OCCaukfW8mVxzYXP3I,907
src/rules/windows__process_creation__proc_creation_win_hktl_uacme.lucene,sha256=a8HxOflR1vYVQin1dAw-ESOQDOFHt39AYMxgX4_K-xU,875
src/rules/windows__process_creation__proc_creation_win_hktl_uacme.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_wce.eql,sha256=V008onSwPizkn7f3JUI8iejWNt3Z2C1mITk5fjtBX30,519
src/rules/windows__process_creation__proc_creation_win_hktl_wce.lucene,sha256=zMd1DA3hSLbxLDA0gBLHsfpHiTbbiuwhGxxwryonb4E,502
src/rules/windows__process_creation__proc_creation_win_hktl_wce.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_winpeas.eql,sha256=r3tGd6nlzVx_mzWhnBpbxxTWjfcakwMJrtDjPhq5jdg,584
src/rules/windows__process_creation__proc_creation_win_hktl_winpwn.eql,sha256=96xm3fw3SIScALnHdGoo9wpWAbG4bJNjN8XyRjTVmOA,103
src/rules/windows__process_creation__proc_creation_win_hktl_wmiexec_default_powershell.eql,sha256=GnT9QZtd-9jTD8TiWq4Ah_i_0ms14eiqIeCTI2w0lJY,84
src/rules/windows__process_creation__proc_creation_win_hktl_wsass.eql,sha256=nzoHq-YYaBSDZANearPhEk-Q_ua5EZFV_Hude6TbeuE,216
src/rules/windows__process_creation__proc_creation_win_hktl_xordump.eql,sha256=bUK5-pX4KfYYICogQmcNMkkZd0x599JCBuKy_lhO3pA,159
src/rules/windows__process_creation__proc_creation_win_hktl_xordump.lucene,sha256=X7bk61wuUlAM5TikEsdRzEZ1dXADU_6ny0a4wSt9AU0,155
src/rules/windows__process_creation__proc_creation_win_hktl_xordump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_zipexec.eql,sha256=NZ6pkux5CF3NvCtA4m8MTO72uPGHdwLSwrRGN3OTDaU,341
src/rules/windows__process_creation__proc_creation_win_hktl_zipexec.lucene,sha256=gZ7WXKuKh5vnQtJeZy5AZSqOKGTP6E-9Zy7-RKPVI_s,328
src/rules/windows__process_creation__proc_creation_win_hktl_zipexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hostname_execution.eql,sha256=sJyAfhyl9LNWp1KFaG2ACa2g1iV8L993Eop3W27ltKE,47
src/rules/windows__process_creation__proc_creation_win_hostname_execution.lucene,sha256=RGFfbTl1EFnMuMStBE7GJ5E6svKHqWyRWsSFs03NsRU,35
src/rules/windows__process_creation__proc_creation_win_hostname_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hwp_exploits.eql,sha256=EVWFkUnMTi_XdslfSVAoBr7_bw72DpvPIgVzpfk9QqE,85
src/rules/windows__process_creation__proc_creation_win_hwp_exploits.lucene,sha256=EM7GeCSV49nMvf88RbxXbDkPcu_AA1Hi3RmOxNqnZfQ,71
src/rules/windows__process_creation__proc_creation_win_hwp_exploits.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hxtsr_masquerading.eql,sha256=up7f4yUJOUctvFVDVAfhueHujkUBHE5R6X79komGd5I,185
src/rules/windows__process_creation__proc_creation_win_icacls_deny.eql,sha256=_pKVny3b8e94dqcY4Z5tBMZUJ0LZ29_0WS7OqcDgK08,168
src/rules/windows__process_creation__proc_creation_win_ieexec_download.eql,sha256=rEa4ODsgfdLHZfndmusptdsXmr4t0vxzglv7mpvIPcw,154
src/rules/windows__process_creation__proc_creation_win_ieexec_download.lucene,sha256=JcvzBcWg1NKx7eday0sZ7shkiEFOVzFUNOu1A91ti3Q,138
src/rules/windows__process_creation__proc_creation_win_ieexec_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_iexpress_susp_execution.eql,sha256=0or_7cxv5ly1WgSro2AVhn-AvHPNgHvnun5VwsE3FSI,370
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_http_logging.eql,sha256=K0Oz2oP71p6jOoigFfqNb-jcG_Azjy5SxVRguvAfCxk,255
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_http_logging.lucene,sha256=3v2NWb7RkeiVc2vLNX8L2itSKX6uBvm41m2NmTTX8o4,235
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_http_logging.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_service_account_password_dumped.eql,sha256=967ohDySo5A3hkYpl9oY1n-ouVj_Q0_p7CEaMtpbG0k,377
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_susp_module_install.eql,sha256=LCPgDzDD2I0bmWocGvXmhndFoRzB795UncSeA3G-b1Y,353
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_susp_rewrite_rule.eql,sha256=bUVLudpQoZsFvysP1ZD7F2Rc8kMUxBa6V3jZ6AzH7vw,275
src/rules/windows__process_creation__proc_creation_win_iis_connection_strings_decryption.eql,sha256=FtDPMV0xuNcrrczXwQV44o6t9WAINH0ECRAQHDHUWM0,191
src/rules/windows__process_creation__proc_creation_win_iis_logs_deletion.eql,sha256=3P4vlt3EKENyr0smiV6FG1FUbaAZY5ERgvka_N_NvzY,362
src/rules/windows__process_creation__proc_creation_win_iis_logs_deletion.lucene,sha256=FWEWCTx5GnimSmcgnIljQBo5qujtu6SRKKbT2NmD_xw,331
src/rules/windows__process_creation__proc_creation_win_iis_logs_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_iis_susp_module_registration.eql,sha256=wICMxYzw1ztOK90K-vWrvLE5SUgyzF6hdqF5FcILQes,291
src/rules/windows__process_creation__proc_creation_win_iis_susp_module_registration.lucene,sha256=e2KrsTg9nrf8EePJ33UzW6YFoe5D8uM6kq_X5nhqWMc,274
src/rules/windows__process_creation__proc_creation_win_iis_susp_module_registration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ilasm_il_code_compilation.eql,sha256=X1VL3255c4YMGx6yq8hGoaGvl9pmkp-RkzatqYj87Qs,147
src/rules/windows__process_creation__proc_creation_win_imagingdevices_unusual_parents.eql,sha256=Q7R-NLEEgNd9rCjFo3ntZMpv0MHOyhZaahnD7vXJ3F4,202
src/rules/windows__process_creation__proc_creation_win_imewbdld_download.eql,sha256=cJ2PvZkzqUEQFQY9QVkVZftncOg2oZdoibyIPPHb6H8,158
src/rules/windows__process_creation__proc_creation_win_imewbdld_download.lucene,sha256=3-HhMaLfn2iqc1XXL5Dlk5hqf_ysWWdMze_29CPZ4_c,142
src/rules/windows__process_creation__proc_creation_win_imewbdld_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_infdefaultinstall_execute_sct_scripts.eql,sha256=FisZ_Y_GOPBqWDv-LZEuzgI46Qwp9JhIQWiInIwK7rM,92
src/rules/windows__process_creation__proc_creation_win_installutil_download.eql,sha256=izUvtpOg3Ueo0IFmGV4ZXQKmIqvQCO1zxGYhUbIbx64,176
src/rules/windows__process_creation__proc_creation_win_instalutil_no_log_execution.eql,sha256=K6RjDryyBSRvRZDTznYB9na7oAkIxZ0sAfD1WsrSYcE,193
src/rules/windows__process_creation__proc_creation_win_java_keytool_susp_child_process.eql,sha256=RY76Cqlr28Ao0qdAF4yinxRPHn_IX8UIzZTHZtjZBGc,502
src/rules/windows__process_creation__proc_creation_win_java_keytool_susp_child_process.lucene,sha256=QhYWjAjQ0FU2YJY4miOSnD7-uuv9bqZkjTocIRHpY6c,482
src/rules/windows__process_creation__proc_creation_win_java_keytool_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_java_manageengine_susp_child_process.eql,sha256=I39axlhqYK4pISrI2gOTpb0ZgvbRSw_dKcYA4eI3xrE,661
src/rules/windows__process_creation__proc_creation_win_java_remote_debugging.eql,sha256=Gsfz32CfkOioXpk0-1IOhhOrxBwiC52WuQUL4q1YNAc,208
src/rules/windows__process_creation__proc_creation_win_java_susp_child_process.eql,sha256=_RiN0XtRxWX4bylRyvHISjYJckENv6n2tTXeVJIrPPc,478
src/rules/windows__process_creation__proc_creation_win_java_susp_child_process_2.eql,sha256=jnkbDT-0uexgy2sxjAFN39eqOtPbeIo9-Fzzn-v4TxQ,232
src/rules/windows__process_creation__proc_creation_win_java_sysaidserver_susp_child_process.eql,sha256=InCJAjY-CfS6VnPNvBE-Y8BQtDkkitsyUVNpI-IW_b4,125
src/rules/windows__process_creation__proc_creation_win_java_sysaidserver_susp_child_process.lucene,sha256=3C5KJ9yXj1fj01DJa4Mz8N98VB34fPoVAzjS923v0us,105
src/rules/windows__process_creation__proc_creation_win_java_sysaidserver_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_jsc_execution.eql,sha256=4yCSkAOcePbWUtpl6jSkMXivEMgWJXJA-DejsCMgyqI,85
src/rules/windows__process_creation__proc_creation_win_kavremover_uncommon_execution.eql,sha256=FFk3T_nZwo8m0e-2qAz44M72-1hvyVJPnuCBBy040lE,134
src/rules/windows__process_creation__proc_creation_win_kavremover_uncommon_execution.lucene,sha256=WibC2lYxT4mFDQ0DOyygNH2tV2JuUyn05t6xa5bhT8o,118
src/rules/windows__process_creation__proc_creation_win_kavremover_uncommon_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_kd_execution.eql,sha256=nCjY3AXmt8JV4d8KwmHbCGv7j37nuFiQJE6m-jriRho,83
src/rules/windows__process_creation__proc_creation_win_kd_execution.lucene,sha256=7pv1yL-Zp-trEY3wHCLmTx-r9BGKKJn3vLEnC55APgU,69
src/rules/windows__process_creation__proc_creation_win_kd_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.eql,sha256=HhqPKjcbXZAj-o7UhQxOmcQfOM0UmwaLRhBtyQwrBxw,77
src/rules/windows__process_creation__proc_creation_win_keyscrambler_susp_child_process.eql,sha256=w3nZ48d26aL-Bfzb4drlc9qRdwq2VHIogI_bIyHI_4Q,390
src/rules/windows__process_creation__proc_creation_win_ksetup_password_change_computer.eql,sha256=QcbER6yXHw9SMbA19RiNL1KDfZS1RRtTYLqOekgd0R8,145
src/rules/windows__process_creation__proc_creation_win_ksetup_password_change_user.eql,sha256=nbFHVmDjDnYmaxRREjyuoqe0nsMAFcE99zs5f0z5jn0,140
src/rules/windows__process_creation__proc_creation_win_ldifde_export.eql,sha256=FFH9X-bbkoZFQTKnLP2RqzadJ3MFrP3h1VyKynafKZ0,166
src/rules/windows__process_creation__proc_creation_win_ldifde_export.lucene,sha256=RBbAIz4n4md55u-WRf5qs19zvqCzgQhS36xwJhOkzK4,151
src/rules/windows__process_creation__proc_creation_win_ldifde_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ldifde_file_load.eql,sha256=GekkHqUwqvRD9bFi4n-6LiSRjmWZ04Dq-pWbrBtYRtc,159
src/rules/windows__process_creation__proc_creation_win_ldifde_file_load.lucene,sha256=11cZNK6SX9cc73Kae2sVoejXSVSEv8u1CzBRR9nnlOk,143
src/rules/windows__process_creation__proc_creation_win_ldifde_file_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_link_uncommon_parent_process.eql,sha256=iCfGKGD5_-60AAcSDK1ViKFelxSu1zJR9ogLb6OYmb0,307
src/rules/windows__process_creation__proc_creation_win_lodctr_performance_counter_tampering.eql,sha256=czgpBMB4ofeEvvO3Eai55FpHuFc8FBBq2bOW22NBu68,177
src/rules/windows__process_creation__proc_creation_win_logman_disable_eventlog.eql,sha256=JBI5eLAM3-uQw6Z8i6ALb3tlo8yqxp3J_wtfIm34fJg,279
src/rules/windows__process_creation__proc_creation_win_logman_disable_eventlog.lucene,sha256=gGWOCySVhccuQafWY0XQo1lKMYqX2n18sRYX3Y02jjw,256
src/rules/windows__process_creation__proc_creation_win_logman_disable_eventlog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.eql,sha256=isAu-epNmFgxIscLiMvhxBxErT6IemzWqAkvEOGJGwQ,169
src/rules/windows__process_creation__proc_creation_win_lolbin_devtoolslauncher.eql,sha256=kXAMulf3TiXo-F5iC7QD7ZcleJU0WyUTgSxvPqnqBb0,100
src/rules/windows__process_creation__proc_creation_win_lolbin_devtoolslauncher.lucene,sha256=hz9R6CNIP1oEAuChD5xd8NXcDwaGjwpQmyU455IsVUY,86
src/rules/windows__process_creation__proc_creation_win_lolbin_devtoolslauncher.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_diantz_ads.eql,sha256=ko67Mnsv7mTVhRFqdKqgShrcsQ9jbLPMuczpYrA02Vo,125
src/rules/windows__process_creation__proc_creation_win_lolbin_diantz_remote_cab.eql,sha256=t27G7wRivhKk-Xy6AEsZazUA3bVjpPhkybICY0Z5wg4,113
src/rules/windows__process_creation__proc_creation_win_lolbin_extrac32.eql,sha256=2ERrvLt9_JVPxbGHP5Pv9WnWlRn9HJJLoicdShwMRZw,231
src/rules/windows__process_creation__proc_creation_win_lolbin_extrac32.lucene,sha256=tlKvek20oCsISE11IqleAz0HsOIkBnPufIrAvrqeFww,208
src/rules/windows__process_creation__proc_creation_win_lolbin_extrac32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_extrac32_ads.eql,sha256=Lqwx5XDAdcFt6uLCtoqRUML4jKXHH32q0PPdjQCzgGU,127
src/rules/windows__process_creation__proc_creation_win_lolbin_gather_network_info.eql,sha256=NgmqSYR6ODuvrTwaTxJvlsdMB7idsBv9Dx6dzX0i-xc,199
src/rules/windows__process_creation__proc_creation_win_lolbin_gather_network_info.lucene,sha256=3Yz_1onURjYDadNwB2evP2JPaJJL_1D2yFKiR44jyn0,171
src/rules/windows__process_creation__proc_creation_win_lolbin_gather_network_info.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_gpscript.eql,sha256=t2FsPqPZkblHBCSbf6Eu7OP2JWR0aJ3uKmR4q3ZJAd0,259
src/rules/windows__process_creation__proc_creation_win_lolbin_ie4uinit.eql,sha256=nayW_whrQxhFdfuB1dUcGDhzmlS2znGBW6nxJplyVhc,278
src/rules/windows__process_creation__proc_creation_win_lolbin_launch_vsdevshell.eql,sha256=9gdQNyVSIvL1FDdoQpd07q24kZPXjuiWkM34cQW7EKo,134
src/rules/windows__process_creation__proc_creation_win_lolbin_launch_vsdevshell.lucene,sha256=JfeLx5PqHeXr4XpFles2KqbttwdiHyCXj4LXavv0hRo,117
src/rules/windows__process_creation__proc_creation_win_lolbin_launch_vsdevshell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_manage_bde.eql,sha256=hWHeYfPjwE7R9quVkYM8ppCxnxgfnTglM-dtbOUu4Ws,312
src/rules/windows__process_creation__proc_creation_win_lolbin_mavinject_process_injection.eql,sha256=slqWv31CvcFlBILK08C44Vlz_pzT5wvDb_QnGVdtViQ,128
src/rules/windows__process_creation__proc_creation_win_lolbin_mpiexec.eql,sha256=0Xl97dAoyxDWgAzjxO6TRKP_iVAvq3BXOLlD-RIvoVs,179
src/rules/windows__process_creation__proc_creation_win_lolbin_mpiexec.lucene,sha256=GHe_oBzPAW5Dl_FSa010QvlmzCMUXf2quxmER8dSTI0,166
src/rules/windows__process_creation__proc_creation_win_lolbin_mpiexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_msdeploy.eql,sha256=F3Nm8FGJTVhiEtlTsHLnXWG8CyEe3WqxUXjULAa6hTw,182
src/rules/windows__process_creation__proc_creation_win_lolbin_msdeploy.lucene,sha256=xgDYW6LqRZGlciM-2LDqkkgp91B5sttwoSSuLSvPEp0,169
src/rules/windows__process_creation__proc_creation_win_lolbin_msdeploy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_openconsole.eql,sha256=8zyx7K-BOdjambdlHdStyVILb5km2c6L615xAkeLJm0,193
src/rules/windows__process_creation__proc_creation_win_lolbin_openwith.eql,sha256=Sa7b-NcGa7KP5mLQqA6V9e9OE6DJWKO_ARcRzg4Mktk,79
src/rules/windows__process_creation__proc_creation_win_lolbin_openwith.lucene,sha256=aYYI1LAvETifUwPjDIHjzacmRH3PGaH9yErpaHYn_6M,66
src/rules/windows__process_creation__proc_creation_win_lolbin_openwith.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_pcalua.eql,sha256=7X1pqH5JldL-KltWH1QKuBOnl7E3rwGnYrP-UMozJ14,78
src/rules/windows__process_creation__proc_creation_win_lolbin_pcwrun.eql,sha256=HAWzgNwkigGIrSg6HggL62vewGeemwl2i2CUnsMrm8E,52
src/rules/windows__process_creation__proc_creation_win_lolbin_pcwrun_follina.eql,sha256=NWQzhyv5j8MsJkQpgCIb-dKJlfcmPufL2kD36hy05g4,78
src/rules/windows__process_creation__proc_creation_win_lolbin_pcwutl.eql,sha256=UGubB-82GFFLtd4FMVwkdEtIKTSRVGFaIMDkrR9IPqA,182
src/rules/windows__process_creation__proc_creation_win_lolbin_pester.eql,sha256=CmcQyNxdRQsG-X9qx_IdcFjRnwnPAsaROfL2rtofB1Y,253
src/rules/windows__process_creation__proc_creation_win_lolbin_pester.lucene,sha256=D5T2gVtMtVOaEWEbmhrfoUFA-aZOuL8hUin566sy4i0,234
src/rules/windows__process_creation__proc_creation_win_lolbin_pester.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_pester_1.eql,sha256=r9_0Z1sBMxK6x0nD5RyD-abgia9eSlEO0RnpJeNBLCM,313
src/rules/windows__process_creation__proc_creation_win_lolbin_printbrm.eql,sha256=1U4JRvCk1nXbbqmHr47ljOyUNRPv-xWlrz7u1BqBbGA,116
src/rules/windows__process_creation__proc_creation_win_lolbin_pubprn.eql,sha256=VHCI5drr51dK_UaZaP-t-6_WX7MzJHhaKcLu5lwkgy4,85
src/rules/windows__process_creation__proc_creation_win_lolbin_pubprn.lucene,sha256=8E6_3GC9oTij3jZsgmKi9xrTjjjWKbDFBm7IlfLtxaY,72
src/rules/windows__process_creation__proc_creation_win_lolbin_pubprn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_rasautou_dll_execution.eql,sha256=VGp_XrjEZS0PHHH2iJjHmXasaR1A8NuQgJNmgDYCoi8,166
src/rules/windows__process_creation__proc_creation_win_lolbin_register_app.eql,sha256=MyHPxVomPSEDXsSyTAiD2wy1UrzRngkvykb-AYrOLYI,93
src/rules/windows__process_creation__proc_creation_win_lolbin_remote.eql,sha256=McRbDAsPO9Pd7TiCIwEM-Q0UAZFyri72ChqkCbAN4ww,91
src/rules/windows__process_creation__proc_creation_win_lolbin_replace.eql,sha256=97syQXZF46a7hZ4YQ8BKTT_xJaFkfE6fdjDIqPvWFRM,124
src/rules/windows__process_creation__proc_creation_win_lolbin_runexehelper.eql,sha256=KWjX5bBUhsw65BExeNchYrBIBF2TbmCQoHJR6w7DXsY,58
src/rules/windows__process_creation__proc_creation_win_lolbin_runexehelper.lucene,sha256=dDDfSxvK7zhph3Pj5wGae3c2Lj67Bxcug3LhW6qcsNA,46
src/rules/windows__process_creation__proc_creation_win_lolbin_runexehelper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_runscripthelper.eql,sha256=vlYpzshndQo-ouN6C4TdcYnXinrbVt5VnsCzhHqpi_g,96
src/rules/windows__process_creation__proc_creation_win_lolbin_runscripthelper.lucene,sha256=1JK24sCvEQRt49VPIWcUmtr53OjSqNSV3MXCmd_P-aM,82
src/rules/windows__process_creation__proc_creation_win_lolbin_runscripthelper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_scriptrunner.eql,sha256=E__alsasaaS0HkZQ_J_PKb3WxRiEw2HevZ7Jzxsl884,148
src/rules/windows__process_creation__proc_creation_win_lolbin_settingsynchost.eql,sha256=ejy2EWRLIjzLQc5iY90s9rP-6lYIkKJsRipwEoAENdo,246
src/rules/windows__process_creation__proc_creation_win_lolbin_settingsynchost.lucene,sha256=i9p1RbmdezciRmlfTBmqc2uT0F72B7Eb5XOt3NbAGg8,225
src/rules/windows__process_creation__proc_creation_win_lolbin_settingsynchost.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_sftp.eql,sha256=IpxpOWvGSCD2YS8psgnxk_AaMFqYSnT8OL_kP5YR-Z0,103
src/rules/windows__process_creation__proc_creation_win_lolbin_sftp.lucene,sha256=viqUiJ6qpjzOO30bDUDQ--hUEBx329pKJDuQwvNFGRE,89
src/rules/windows__process_creation__proc_creation_win_lolbin_sftp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_driver_installed_by_pnputil.eql,sha256=LmTq9yW0ku3PwbkH2QcKmAKFEU07ravuhk_o_P6dD0I,137
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_grpconv.eql,sha256=mI6bPQuC1lzvOV0RHjV96lbENlLQ3QrLLP1mFDGvA1w,74
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_grpconv.lucene,sha256=Z8br-3fkWpdqRluGTkkqHH-EXX68jmKvhnz4iJ5mRQU,60
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_grpconv.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_sqldumper_activity.eql,sha256=ioCu8_GiaSct6dceMzZiItEJ9uOuuNAV3ifjJjZk5eY,110
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_sqldumper_activity.lucene,sha256=N_M1iJTy2minw0bVlRyMgnhfT11RdjmfOP57uBbveFU,91
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_sqldumper_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.eql,sha256=OPDaPs5RrhiPajRtZZJ8HWHhvDig9TQDYJRvqqE897w,164
src/rules/windows__process_creation__proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.eql,sha256=u-sI5sTHPKG0DQiPdvIXA6TklVaeWjdBIc6xW7vRaN8,97
src/rules/windows__process_creation__proc_creation_win_lolbin_tracker.eql,sha256=BjRX3jC5jMSTiPZt_6KZJWzIxFwdBV_IWD9K8rrKRQc,326
src/rules/windows__process_creation__proc_creation_win_lolbin_tracker.lucene,sha256=pWefHOxgdAk_iGvxgSVJoC9yQ5P8BOsyBprWyfEHk2w,304
src/rules/windows__process_creation__proc_creation_win_lolbin_tracker.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_ttdinject.eql,sha256=_laiC-7Q514pGyxhc5OaGStiUgqtUjKXeiDmtpoU60g,95
src/rules/windows__process_creation__proc_creation_win_lolbin_tttracer_mod_load.eql,sha256=kE3Vnumhq64T6jdhFrHJIoV5hf7sx9Q4uoaQqTDutRQ,54
src/rules/windows__process_creation__proc_creation_win_lolbin_tttracer_mod_load.lucene,sha256=2BntqZ9Pf8pWveJ2eisS4mKMBwVdItpe5wG-y12k18I,42
src/rules/windows__process_creation__proc_creation_win_lolbin_tttracer_mod_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_unregmp2.eql,sha256=Cgt_kmRuXxtOGmWTdUuJ06_abLZJFvPOugLKGoPvZQ0,210
src/rules/windows__process_creation__proc_creation_win_lolbin_utilityfunctions.eql,sha256=xM5zOZXFa4vCuRsnclZEFtBQLuEMvZIZm4PQXhzZDrM,80
src/rules/windows__process_creation__proc_creation_win_lolbin_visual_basic_compiler.eql,sha256=ZssfSLVKUmqGP6m7zxxqpFw3JlRE0NNtUtTl_BrAulU,88
src/rules/windows__process_creation__proc_creation_win_lolbin_visualuiaverifynative.eql,sha256=XU6C32XqgzHM4KG_8qyaDEVu8H4gk46DxAr01Cr4x3w,121
src/rules/windows__process_creation__proc_creation_win_lolbin_vsiisexelauncher.eql,sha256=NDPbG6A-wjaKx10JSaEZbblBSnQHXDmCDWBNNLkjAE8,167
src/rules/windows__process_creation__proc_creation_win_lolbin_vsiisexelauncher.lucene,sha256=9IP-JJBtnOnXH189p2QtCmsj5JIm3kYjvQeLbIlx6xQ,151
src/rules/windows__process_creation__proc_creation_win_lolbin_vsiisexelauncher.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_wfc.eql,sha256=FFfpXWcXo4d0tAJFD1YfdccObS1CFdxvV3pcceL7Yww,85
src/rules/windows__process_creation__proc_creation_win_lolscript_register_app.eql,sha256=9vDc17pUeDS1m0p_oKcFBgp1tdDRhrhzdD0voAHmay8,193
src/rules/windows__process_creation__proc_creation_win_lolscript_register_app.lucene,sha256=kKn3FD--z70srXj06D10ob7qw39t4xPrK9k2Gq7DxEU,168
src/rules/windows__process_creation__proc_creation_win_lolscript_register_app.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lsass_process_clone.eql,sha256=88_cmYz-v-deIVAi0tk5IjBUdCZZZrgmdkrBJnquU9I,127
src/rules/windows__process_creation__proc_creation_win_mftrace_child_process.eql,sha256=vDQ9uS-x8scDygGqWMO9ef7qzSwgBrriUGAVhUnA33c,53
src/rules/windows__process_creation__proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.eql,sha256=oxwYQf5ZMEOVKvA7FSbkmKQx6WJZ3I2IxGh8jw4zy88,284
src/rules/windows__process_creation__proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.lucene,sha256=G1u65ZSbiOj5cbowW-MrH5wzjhIS8pBWpjEJTLxeVUE,267
src/rules/windows__process_creation__proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mmc_mmc20_lateral_movement.eql,sha256=gOmcSt-ol9WMjaPscl3pSKlpUi64Uqe72Ol7K3nysN4,129
src/rules/windows__process_creation__proc_creation_win_mmc_rlo_abuse_pattern.eql,sha256=uUroxSWwSaVskWoOpl2ehs4sUDgUYmt5DIZQBUr_6t0,242
src/rules/windows__process_creation__proc_creation_win_mmc_rlo_abuse_pattern.lucene,sha256=4WWPZXFJ-DmfGBDb9ASbXMMmfwEApE7qgct918asKjI,220
src/rules/windows__process_creation__proc_creation_win_mmc_rlo_abuse_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mmc_susp_child_process.eql,sha256=3XRHw1IgUmFsZsIG86YDlOUX0FSdogWbEMbal7CqNUU,268
src/rules/windows__process_creation__proc_creation_win_mode_codepage_russian.eql,sha256=ynKHpSwkrM58BgeYQQq8wn2o_32hcX0wHSriZS2BO08,253
src/rules/windows__process_creation__proc_creation_win_mofcomp_execution.eql,sha256=kbvpFKC3GVOEEO_YMuXEEj9uh88QsuI_oeU_vUYrrhk,637
src/rules/windows__process_creation__proc_creation_win_mpcmdrun_dll_sideload_defender.eql,sha256=GoijB1HgD1fribdPEjfzlJskUI27uGHJwm26FuI8wBM,340
src/rules/windows__process_creation__proc_creation_win_mpcmdrun_download_arbitrary_file.eql,sha256=b3ybXvapKLhvPKDU_TncjKFKFj9ekfzGL9qzAG5FKA4,293
src/rules/windows__process_creation__proc_creation_win_mpcmdrun_remove_windows_defender_definition.eql,sha256=3GXDuy8P59UNuL-oYHkZ13BkmDB9mYlIMjEgQN9evOQ,183
src/rules/windows__process_creation__proc_creation_win_msbuild_susp_parent_process.eql,sha256=fQYRplHJXUIFqFDzmwP94q6KwCqHyMrBrIsZOyQZqME,241
src/rules/windows__process_creation__proc_creation_win_msdt_answer_file_exec.eql,sha256=jIpK4PXV8z2mlSoNmWg1BCNuh0KiTWio74pYo0tGyqE,268
src/rules/windows__process_creation__proc_creation_win_msdt_arbitrary_command_execution.eql,sha256=MNRX3g1a6Alz06nQkFbPAD6pxr1ozkyZCdOOnO6pEIQ,276
src/rules/windows__process_creation__proc_creation_win_msdt_arbitrary_command_execution.lucene,sha256=-DBwzUsL0k-ODfTacpAdvYmVaNcHNQA2E92RyNX8ikQ,264
src/rules/windows__process_creation__proc_creation_win_msdt_arbitrary_command_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msdt_susp_cab_options.eql,sha256=9cKGgogxS206Fh0wU0drlWQzOmhahCyIXdtGoPDCDq4,187
src/rules/windows__process_creation__proc_creation_win_msdt_susp_parent.eql,sha256=WrMoCdu4xus1iY_9iuGplDYAH1xrlPq-c7rtR1Knysc,316
src/rules/windows__process_creation__proc_creation_win_msdt_susp_parent.lucene,sha256=CmEJZqg9m3osGkJyYfkkAJYfeN9ekSvA2oLWF81Uuhk,294
src/rules/windows__process_creation__proc_creation_win_msdt_susp_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msedge_proxy_download.eql,sha256=w0Vf8zOvvnfZ92KyRigRfuQMExPa1XQQoxCkQKvjCeQ,166
src/rules/windows__process_creation__proc_creation_win_msedge_proxy_download.lucene,sha256=oU4sdXTKd2rM9UKv-gq6swmXYTpQXzLlYakDUWnrx04,150
src/rules/windows__process_creation__proc_creation_win_msedge_proxy_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mshta_http.eql,sha256=tNsK50rQ1yxq8rdPbQv6I_odVJfbJzvD3y5Z54w_EtM,164
src/rules/windows__process_creation__proc_creation_win_mshta_inline_vbscript.eql,sha256=gXl6UgWAN3CnboIo2VDa1wcg-dzSZ_xYx7DXT62-bwg,114
src/rules/windows__process_creation__proc_creation_win_mshta_javascript.eql,sha256=pbZKT8I9Uc9EmMNUkqkkyvaZoOTZYx7AEOIl6cuXzWE,131
src/rules/windows__process_creation__proc_creation_win_mshta_lethalhta_technique.eql,sha256=_Ma0u5Cc-uJ1ZNs281b_pReQbHY_OeDGJ4-T5mQRN6w,91
src/rules/windows__process_creation__proc_creation_win_mshta_susp_child_processes.eql,sha256=kOPtvyC5QpHQwxqZL81xd5-FWQcx9InlabZdjQ29Cq4,421
src/rules/windows__process_creation__proc_creation_win_mshta_susp_child_processes.lucene,sha256=YojmbRhR7sEuj3w7QwzOLI2MCxem-B15WiXdMkme1ZI,393
src/rules/windows__process_creation__proc_creation_win_mshta_susp_child_processes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mshta_susp_execution.eql,sha256=Jk8K__iy5oP9C4ynx-4BCBkFLGy0NAAJW_cqMu--hjg,470
src/rules/windows__process_creation__proc_creation_win_mshta_susp_pattern.eql,sha256=fY32DVhsTekdFoNR2al6F-0TTDCgCIiZxX9jZHx_yc8,681
src/rules/windows__process_creation__proc_creation_win_mshta_susp_pattern.lucene,sha256=Pze7zAc9BhctSMk9WzYp8uyjwbl7GpPMpVY_RXOUlxo,622
src/rules/windows__process_creation__proc_creation_win_mshta_susp_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msiexec_dll.eql,sha256=MBkjAg6ljh6fZL02fx0mFuoRLziPpgf7aTibOQH5OS8,219
src/rules/windows__process_creation__proc_creation_win_msiexec_dll.lucene,sha256=Y4yJ-qAGVVNiMsSq1m0uAOcs3935WqGtmMR0-xJaUZk,207
src/rules/windows__process_creation__proc_creation_win_msiexec_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msiexec_embedding.eql,sha256=RYZbHekjYYq0Ukn4-JBmY__-xRvC1Crs6bxN2oFxJD0,500
src/rules/windows__process_creation__proc_creation_win_msiexec_execute_dll.eql,sha256=0CI1gE_bZbS7XNusvbytkM8NAgQls4TQ-3_8bVMC4xA,1017
src/rules/windows__process_creation__proc_creation_win_msiexec_install_quiet.eql,sha256=BsHCtOXFevahHpRLL6ZKkM16CjglKrpuSG6rGtG6ppk,826
src/rules/windows__process_creation__proc_creation_win_msiexec_install_remote.eql,sha256=sFIX3TUsdzy5qoWXfh4ifUlsvDMUWFH0d8fd-D6MY_k,700
src/rules/windows__process_creation__proc_creation_win_msiexec_masquerading.eql,sha256=ZzBx1tq6SO44d7_2E1hV8jUzrKbvgiC2bLndYhhIgc8,217
src/rules/windows__process_creation__proc_creation_win_msiexec_masquerading.lucene,sha256=EjoGj6AZDvrkI_MfqJ_79PXA9Ie6c99DlLJaOP_fad0,195
src/rules/windows__process_creation__proc_creation_win_msiexec_masquerading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msiexec_web_install.eql,sha256=SOKMtvMiENq_r2Vm8dkJCKFDrGXfUrLReejSMQ4UsqI,77
src/rules/windows__process_creation__proc_creation_win_msohtmed_download.eql,sha256=hLJymXWjKfPuEHxKnJF6rR7_7OYNRDdHjM80TsJ25Yc,170
src/rules/windows__process_creation__proc_creation_win_msohtmed_download.lucene,sha256=0vFjc4Mqni-TKZD0sSPHf2gnfsmZQox8usRfLuK0hgM,157
src/rules/windows__process_creation__proc_creation_win_msohtmed_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mspub_download.eql,sha256=fN6Zac4VBNPoke1umMxjIOwq05ddjGALKMaIAI8C0PM,164
src/rules/windows__process_creation__proc_creation_win_msra_process_injection.eql,sha256=-pzwUPSl7uE2z_0L4oe-sXk2ZINAo86_6fbJL6HksTc,257
src/rules/windows__process_creation__proc_creation_win_msra_process_injection.lucene,sha256=CazRq644-GYTmfetEjuzkpiD_DVNQmOibf0Y5_kuNeQ,235
src/rules/windows__process_creation__proc_creation_win_msra_process_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mssql_sqlps_susp_execution.eql,sha256=74iLzE-SeRIYMrrOyZuVAew2lx2hzDCxgXSxyzZjPpw,191
src/rules/windows__process_creation__proc_creation_win_mssql_sqltoolsps_susp_execution.eql,sha256=m90lqqUw60P8mj9mwuNHr_GwGtCWuaW9nyo0rlNJGrk,202
src/rules/windows__process_creation__proc_creation_win_mssql_susp_child_process.eql,sha256=_nRvD1egjhfhXlVivT-AHcBzlcig0slwQF4EGZCcwk0,606
src/rules/windows__process_creation__proc_creation_win_mssql_veaam_susp_child_processes.eql,sha256=ts5BtSHClkm2TCWEQANnK1u8Zf2tRdDee1law0osyws,539
src/rules/windows__process_creation__proc_creation_win_mstsc_rdp_hijack_shadowing.eql,sha256=xuzbQS_nWhRjQx2gPfJ4oGdfveHG71cA_2GkOVsfnlA,88
src/rules/windows__process_creation__proc_creation_win_mstsc_rdp_hijack_shadowing.lucene,sha256=apT44RTjxYdto9gjOAVzqH8Vr-c_R5KGwHu3T9KlLxA,75
src/rules/windows__process_creation__proc_creation_win_mstsc_rdp_hijack_shadowing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mstsc_remote_connection.eql,sha256=uX07JEFHjBZTQN6dFz0XU6OB_eRvFZjw7u8vdEMQ4JM,333
src/rules/windows__process_creation__proc_creation_win_mstsc_run_local_rdp_file.eql,sha256=HdXSt9G7skz5syQ6X1PZXWh8BMnU8CxPrL2lCNnthJM,299
src/rules/windows__process_creation__proc_creation_win_mstsc_run_local_rdp_file_susp_location.eql,sha256=9v-z44ibSimtr79qoUTr1QFBFnvzS9wOcIEPS93txD8,420
src/rules/windows__process_creation__proc_creation_win_mstsc_run_local_rpd_file_susp_parent.eql,sha256=b5Nxl3xHyyH4mmWLZCW24LDMV5TFta58K8PYrGRjwDM,354
src/rules/windows__process_creation__proc_creation_win_msxsl_execution.eql,sha256=uuBgy-oc9IiHQKHe8obbMee6gPZuHWX1h9Pel_WBflY,44
src/rules/windows__process_creation__proc_creation_win_msxsl_remote_execution.eql,sha256=8WX99-aCtLIbhzBENDqHsxOIWtQHdsb7btQSor6CJFM,78
src/rules/windows__process_creation__proc_creation_win_net_groups_and_accounts_recon.eql,sha256=k8tUSfu-NVcrWtUcCGchc0uGBXG_11upgJuFwJI8qCo,581
src/rules/windows__process_creation__proc_creation_win_net_share_unmount.eql,sha256=rIawTksBNW7jJfxEPmH8hjsm7qR9xjJdqalylLnOg1w,208
src/rules/windows__process_creation__proc_creation_win_net_share_unmount.lucene,sha256=CX9vx8gbqZaIQ3w6qbooQRPJ91LEKYszTF1aaAzy9zI,179
src/rules/windows__process_creation__proc_creation_win_net_share_unmount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_net_start_service.eql,sha256=tL0aWPeNvAHa1jHFobejoyZr_coqSnx1Ivllqxlh_tI,171
src/rules/windows__process_creation__proc_creation_win_net_stop_service.eql,sha256=zJ5Rske6103QgF_SNvy-XaRbOianaqbZK824pkFPiJ0,170
src/rules/windows__process_creation__proc_creation_win_net_use_mount_admin_share.eql,sha256=s-NvCW4OQfDoy8MpIA1_mILPwtqDhj2jDPzygwcrmUY,209
src/rules/windows__process_creation__proc_creation_win_net_use_mount_admin_share.lucene,sha256=XfvJojXnfpEXT50NitHoEru3pLA6XTZhOr2Co7WnC9Y,181
src/rules/windows__process_creation__proc_creation_win_net_use_mount_admin_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_net_use_mount_internet_share.eql,sha256=NUuawzg3x2LTfXH8yXGqM1lZtSDjqINzDMYRq6qyyMU,206
src/rules/windows__process_creation__proc_creation_win_net_use_mount_share.eql,sha256=o7aFsDeixSEMtD19cuZkIAwpIGR1Op53SCmriNvMcLk,188
src/rules/windows__process_creation__proc_creation_win_net_use_network_connections_discovery.eql,sha256=YPzE0rR-R5hmwK47H5JY1NXNF3jFaZC_s-RaX1T4mW8,253
src/rules/windows__process_creation__proc_creation_win_net_use_network_connections_discovery.lucene,sha256=rr0ecRo04ArGh645Q7ZZO0IDT_hgDWyzzHNpqnN0qR0,217
src/rules/windows__process_creation__proc_creation_win_net_use_network_connections_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_net_use_password_plaintext.eql,sha256=MLTffYfjww9WsgLpgoHbXX1ZW4aV9WpZ5seb7kvP5Tw,281
src/rules/windows__process_creation__proc_creation_win_net_user_add.eql,sha256=gdw51AfpijomF06agEjVpocjuVbYOuyUv_wwCnPmst4,203
src/rules/windows__process_creation__proc_creation_win_net_user_add_never_expire.eql,sha256=msNHzJp9i9AmcceIjmi2uRiTTm-u0hd2OkCix4A86iA,246
src/rules/windows__process_creation__proc_creation_win_net_user_default_accounts_manipulation.eql,sha256=EnV2WyyAYwnnjZTmZkehJK50anzqWA75Yfbn5s4CTls,958
src/rules/windows__process_creation__proc_creation_win_net_user_default_accounts_manipulation.lucene,sha256=82HdCu_0rKInNvP7tJl7tObXGF5J6rLvjeVc84Q2wBE,976
src/rules/windows__process_creation__proc_creation_win_net_user_default_accounts_manipulation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_net_view_share_and_sessions_enum.eql,sha256=aBxprcJaOO9dBkpKuLUoMCX3IinZJtuNPEskkrmp7Zo,208
src/rules/windows__process_creation__proc_creation_win_net_view_share_and_sessions_enum.lucene,sha256=2nVsEXloB9kx3tJEzExKyYEjnWrn_2mIOxoR1shiNFQ,178
src/rules/windows__process_creation__proc_creation_win_net_view_share_and_sessions_enum.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_fw_add_rule.eql,sha256=085eK2C594ZPfJx8_FkKLBNwXFMGjJFmg9KO6z901LM,518
src/rules/windows__process_creation__proc_creation_win_netsh_fw_allow_program_in_susp_location.eql,sha256=LcvaPXxu5vAxIutV4hzOFLSKHDUYKJLICV5j6Y6lnT8,1061
src/rules/windows__process_creation__proc_creation_win_netsh_fw_allow_program_in_susp_location.lucene,sha256=sWRxryVdUzAZrpcpWyf9f2xhxQReGuSlcvkcuznWPhM,1024
src/rules/windows__process_creation__proc_creation_win_netsh_fw_allow_program_in_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_fw_allow_rdp.eql,sha256=aciPi6k9e9hM_qssVqpXDY7WYLoKnpLBjxEoIgrPjLw,298
src/rules/windows__process_creation__proc_creation_win_netsh_fw_delete_rule.eql,sha256=kobY8GCD9MFtV5BTqhhioKxMlGPRHEBPLYIH03xck-8,416
src/rules/windows__process_creation__proc_creation_win_netsh_fw_delete_rule.lucene,sha256=NJoiK75SBofg4qyzInFFj1x8zEZsgzvrX0jiiCSkHwY,400
src/rules/windows__process_creation__proc_creation_win_netsh_fw_delete_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_fw_disable.eql,sha256=gCKowaxTa0dCIjp4uFYo82J5HpFCWukPzW8rqkhspb4,382
src/rules/windows__process_creation__proc_creation_win_netsh_fw_enable_group_rule.eql,sha256=ud1dvJcx19BdDs9pFa6FPVdfrh5fdKRLRCREslENuNA,348
src/rules/windows__process_creation__proc_creation_win_netsh_fw_enable_group_rule.lucene,sha256=Zj-TVZsXqcr6a1ZNuYDndaKjoh_pm8Y2vdvhlFuZ3U4,322
src/rules/windows__process_creation__proc_creation_win_netsh_fw_enable_group_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_fw_rules_discovery.eql,sha256=TuRibFsRqa9yJgZJjEFGRz0Jbq_-seK4A-4w-G3Paoo,288
src/rules/windows__process_creation__proc_creation_win_netsh_fw_set_rule.eql,sha256=ToWmMDbFuz75_6BRYuyLnPF_MAoBMLGk5kPHLs-k_p8,168
src/rules/windows__process_creation__proc_creation_win_netsh_fw_set_rule.lucene,sha256=5bNTX2hAtkqBpTxhrOysOliJLknjs06SeNjZnLK6xZI,154
src/rules/windows__process_creation__proc_creation_win_netsh_fw_set_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_helper_dll_persistence.eql,sha256=yRG2g5BxKJxqAAtcI4lgrR6MNHaqrW-abahA-8M7SCQ,162
src/rules/windows__process_creation__proc_creation_win_netsh_packet_capture.eql,sha256=GUVIgMVl7NHLCYycYff9laZmNihksjsTURdBR9R3Ae0,163
src/rules/windows__process_creation__proc_creation_win_netsh_packet_capture.lucene,sha256=-5OtVBQ2p3xdNWOMx7L3J3AMAVYG8nfgQNssXbS6tRM,145
src/rules/windows__process_creation__proc_creation_win_netsh_packet_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_port_forwarding.eql,sha256=RCGX0Dek7kZRXmCbrbdwQzyu_1BTjcvgwPAXUhMRQps,479
src/rules/windows__process_creation__proc_creation_win_netsh_port_forwarding.lucene,sha256=ReMJmqWgMHGjibYnbECeDpSl1XH5454DtwrrZ81_RxE,448
src/rules/windows__process_creation__proc_creation_win_netsh_port_forwarding.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_port_forwarding_3389.eql,sha256=dBKn2_DGIhF5dfk7KXrYlGpiJWM5eMzcwRBnjaDqik4,224
src/rules/windows__process_creation__proc_creation_win_netsh_wifi_credential_harvesting.eql,sha256=5C_gPNx1L-R981bJB0HY6Pe35QJHTqVVFlcL5SvxpI8,259
src/rules/windows__process_creation__proc_creation_win_nltest_execution.eql,sha256=UbftB1pUsRXl_vkHTKUJVOwt_uycKWxwg_FfdvJ3Kl0,93
src/rules/windows__process_creation__proc_creation_win_nltest_recon.eql,sha256=icr55JPPscKeAKMeJZJGD8wpWy2vDo40bvRwv3pkM3A,330
src/rules/windows__process_creation__proc_creation_win_node_abuse.eql,sha256=YXZ_c_Ly91vG_d_iUN-lcvSiyjCtsD5qgu6P1qKLWI8,262
src/rules/windows__process_creation__proc_creation_win_node_adobe_creative_cloud_abuse.eql,sha256=9h1br29W-H0P2PCa8yb11nIyPYH9zoiL1C5eOv2x5Co,153
src/rules/windows__process_creation__proc_creation_win_notepad_local_passwd_discovery.eql,sha256=oyyjaRzk3WIzAEj88O-7jIXUCZujY9Yp4tBv_LKuf8k,200
src/rules/windows__process_creation__proc_creation_win_notepad_local_passwd_discovery.lucene,sha256=-wx-Lp4Gqx0qgpRg0w6R-I_-rrfvUPUi6g7kvwkLWTI,178
src/rules/windows__process_creation__proc_creation_win_notepad_local_passwd_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_nslookup_domain_discovery.eql,sha256=q8JvSWQckMrftjUy4hQ36tk3uZCpxzRzwJmri7B0Glg,95
src/rules/windows__process_creation__proc_creation_win_nslookup_domain_discovery.lucene,sha256=yn8HvY9N6Lpa3jpef7FtuC_wFGRCOcyW6GzYpRLbP8o,81
src/rules/windows__process_creation__proc_creation_win_nslookup_domain_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_nslookup_poweshell_download.eql,sha256=bKqzWgzCBUN-XUJKfb8IVmbU-AAkRAy4zENHMGd1zLk,247
src/rules/windows__process_creation__proc_creation_win_ntdsutil_susp_usage.eql,sha256=IdaeVzufrIiIjv07KF_UPNw61BL1RHCvoiJYFdIdNRg,275
src/rules/windows__process_creation__proc_creation_win_ntdsutil_usage.eql,sha256=gAdJV1ve2HuMqMcDnD9NFYP13upUGQni47SxBaDWAmA,47
src/rules/windows__process_creation__proc_creation_win_odbcconf_driver_install.eql,sha256=Maoh83BgnYpQX1T-7E4r02p5HzqXN3_IQFmKsYXuLIw,177
src/rules/windows__process_creation__proc_creation_win_odbcconf_driver_install.lucene,sha256=ZYjU9MxMhPj4OuNQbwvfHgxVbpaurDW9gYja5BCXjn8,160
src/rules/windows__process_creation__proc_creation_win_odbcconf_driver_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_odbcconf_driver_install_susp.eql,sha256=ol7d_0W-xU1sdOH6t0WnXRiX1py31LiwvIr41WRGfDY,183
src/rules/windows__process_creation__proc_creation_win_odbcconf_exec_susp_locations.eql,sha256=vtVk4dm98kiK1ljbq6KdUvMViK0VOISuVT5lZMkByzg,980
src/rules/windows__process_creation__proc_creation_win_odbcconf_register_dll_regsvr.eql,sha256=FzLea-BDnl55NM6SCKRlkB34qtfoqzsZnfUIWYnx4nQ,170
src/rules/windows__process_creation__proc_creation_win_odbcconf_register_dll_regsvr_susp.eql,sha256=yxdkz4RTfFEEkpuki8MZa9G0klP1FuaWqBm_KG7W2rM,176
src/rules/windows__process_creation__proc_creation_win_odbcconf_response_file.eql,sha256=hJ9V3fccNnOuG--0orYo7SBuAehipLbvwpO_h1hXl_g,219
src/rules/windows__process_creation__proc_creation_win_odbcconf_response_file_susp.eql,sha256=RejIjXTTmpVWYm2mr27xzE0hAGGCkjE1xktZV_OCI0I,438
src/rules/windows__process_creation__proc_creation_win_odbcconf_uncommon_child_process.eql,sha256=hnOksELIEl2HsCSbVFr4NUb5WBKBhRiJ3f9e32rffr8,54
src/rules/windows__process_creation__proc_creation_win_odbcconf_uncommon_child_process.lucene,sha256=vo8jGGb5wEiuY00rIaihlJS5vtr7lC1_2b3OuK_FHjQ,42
src/rules/windows__process_creation__proc_creation_win_odbcconf_uncommon_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_arbitrary_cli_download.eql,sha256=oNhL1T_J4w1pTuOhClvHAXQzWHRIfFTIAsGCrw2GtI0,240
src/rules/windows__process_creation__proc_creation_win_office_excel_dcom_lateral_movement.eql,sha256=jwlVS1jDeJ8Ri21iP8aiJf4l0EG0KC_r3PcEwmfbvoM,228
src/rules/windows__process_creation__proc_creation_win_office_excel_dcom_lateral_movement.lucene,sha256=9hPmvmBKi26gu54QqKl7GV5B0JcFaw8pd9SQNJvKZUk,200
src/rules/windows__process_creation__proc_creation_win_office_excel_dcom_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_exec_from_trusted_locations.eql,sha256=uXka6m89LJipS7MFon9AaO1h3ZnsWmyLm7x-CHXzqXE,537
src/rules/windows__process_creation__proc_creation_win_office_onenote_embedded_script_execution.eql,sha256=7moGSEV5XNpH8VrIrr13vOmMEc0wgY6zf9iTWUEEERY,274
src/rules/windows__process_creation__proc_creation_win_office_onenote_susp_child_processes.eql,sha256=GXWaIqdJZti_TZLBpfEJtaUBfu_SvYHMpFteiGn_7fY,1901
src/rules/windows__process_creation__proc_creation_win_office_onenote_susp_child_processes.lucene,sha256=RMoR8Cc3CCAZck7UF5iEuXxWN9VryKqI-h7JswaO8pk,1840
src/rules/windows__process_creation__proc_creation_win_office_onenote_susp_child_processes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.eql,sha256=VyUFOHylUXvrREQNLhjVvF6KPTnj6Rwu7_ulkKF4DVs,84
src/rules/windows__process_creation__proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.lucene,sha256=HD2VEheTIe7Tjhc8jxxmk8nwj9H6Rea4m4TZDTe-rsc,72
src/rules/windows__process_creation__proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_outlook_execution_from_temp.eql,sha256=_YLMJCQk_X_4Z0mkrRvL9lTm5C0NVsOosybknIv7RBs,79
src/rules/windows__process_creation__proc_creation_win_office_outlook_execution_from_temp.lucene,sha256=88d-pnmc3NmFckd4qsfT4Efdch3G3Av_UHUJghGxeJ4,68
src/rules/windows__process_creation__proc_creation_win_office_outlook_execution_from_temp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_outlook_susp_child_processes.eql,sha256=-K_26c0KJPwAxvQUS_KWZhF5Tn2KJdBqZzzellmqi-A,445
src/rules/windows__process_creation__proc_creation_win_office_outlook_susp_child_processes_remote.eql,sha256=oZFiuuDpezW8h21lwzaS7jsqnmijFWmm5kWd_CIEc4A,82
src/rules/windows__process_creation__proc_creation_win_office_spawn_exe_from_users_directory.eql,sha256=l-yAHoWeYcj-JAnAtughlblwyldQspndbPqOJtj1iJw,283
src/rules/windows__process_creation__proc_creation_win_office_susp_child_processes.eql,sha256=gRHAf7FguqzFlSrs2jVU_U-28QJve49h6rwtqkPX2vI,1628
src/rules/windows__process_creation__proc_creation_win_office_winword_dll_load.eql,sha256=mV17ibwuE-Sw2K-E7e2vlEUFosBDHnr4WdM4GBP65kE,164
src/rules/windows__process_creation__proc_creation_win_office_winword_dll_load.lucene,sha256=laVv_JjY4xpRb02r9-5t_UfFHx9fOYZGHkgh9pjHDeg,148
src/rules/windows__process_creation__proc_creation_win_office_winword_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_offlinescannershell_mpclient_sideloading.eql,sha256=WuRjzttGv_mdFhDOVCct88pRjMyugGJSA2rbrqT6JgY,270
src/rules/windows__process_creation__proc_creation_win_pdqdeploy_execution.eql,sha256=Lzmie1Yc-fgQ5KWDF-W0Ifrdbt6fJlJkSMYPAfX7INA,177
src/rules/windows__process_creation__proc_creation_win_pdqdeploy_execution.lucene,sha256=OalF7-4iB14u6FyPn4ZSLnOmFbCqsvnCCC7t4jo3nXk,162
src/rules/windows__process_creation__proc_creation_win_pdqdeploy_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pdqdeploy_runner_susp_children.eql,sha256=0o98OXEfL5HjuJvPGkNU91NhxKfc_SSPpkwxqGfaLs0,636
src/rules/windows__process_creation__proc_creation_win_perl_inline_command_execution.eql,sha256=eDR2dF2pemre2T-UDYQSflDqNInNSEtai_n54h0Ygdw,122
src/rules/windows__process_creation__proc_creation_win_php_inline_command_execution.eql,sha256=tCVD5mM6BtsvQEyeLwNtxmQUW0bVwM52PqwmwTQEnig,120
src/rules/windows__process_creation__proc_creation_win_ping_hex_ip.eql,sha256=OzBPIfJdbFMkK5MW2r47zqoMLmXsVbKvttNhxJtrtz0,94
src/rules/windows__process_creation__proc_creation_win_pktmon_execution.eql,sha256=v0SQQYLDCbGZU5SD6enX7jzliUJ6vBUvoQPLH3KmKRY,91
src/rules/windows__process_creation__proc_creation_win_plink_port_forwarding.eql,sha256=MfyDG6DZpZTnIcVWyG-EgvGqBxXHQRLb3T0vaa2aUdQ,113
src/rules/windows__process_creation__proc_creation_win_plink_susp_tunneling.eql,sha256=xLK6fN6AJh8MCIpiLie9uzOaB64dICvu51yWtuzUM5s,226
src/rules/windows__process_creation__proc_creation_win_plink_susp_tunneling.lucene,sha256=EHXO5pGSdDWHBGYsHSyQb_GER3jR9JBnt1rVhfapO6k,209
src/rules/windows__process_creation__proc_creation_win_plink_susp_tunneling.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powercfg_execution.eql,sha256=LI3JisMF6Lde6xGycaRZTqFVUqpEgMpHQw3PsTJQZd4,359
src/rules/windows__process_creation__proc_creation_win_powershell_aadinternals_cmdlets_execution.eql,sha256=tvucKWpqcVcbBB7tYlH0CW36BBcqWr4YTjor64vMA0Q,709
src/rules/windows__process_creation__proc_creation_win_powershell_active_directory_module_dll_import.eql,sha256=t_FOzHHxYIsw_ZBggShR8WuuQ1D4AeTPku3Za6P-7DE,283
src/rules/windows__process_creation__proc_creation_win_powershell_add_windows_capability.eql,sha256=lD_eyKir0BRoSOo-ZhiNDU4zz2RxINUVh0Tp9deggm4,237
src/rules/windows__process_creation__proc_creation_win_powershell_amsi_init_failed_bypass.eql,sha256=cyKZtKrDcqn8JyDZCQDiUKEMEipbyOxBQytrde9zs4g,270
src/rules/windows__process_creation__proc_creation_win_powershell_amsi_null_bits_bypass.eql,sha256=FEztJva9UrmQKVXX43yQa19ayVzPNR67EdHPgt7Qj64,91
src/rules/windows__process_creation__proc_creation_win_powershell_audio_capture.eql,sha256=OrbBIuvehHrgRbBrTuZAdkgzBV_oj9MvTlGAq_hHdRE,172
src/rules/windows__process_creation__proc_creation_win_powershell_audio_capture.lucene,sha256=cB_fuBi-96VZMd3rNzgAFnJ9YVOi4C12Rya-VBSSwh0,163
src/rules/windows__process_creation__proc_creation_win_powershell_audio_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_base64_encoded_cmd.eql,sha256=UeFd6TY9tGpZm2j11FahPLVbqJq8I4w0pC1qwQYZfEk,455
src/rules/windows__process_creation__proc_creation_win_powershell_base64_encoded_cmd_patterns.eql,sha256=4ESFIpk2Hhgmf0eJSsUqAPRj0OiL4JmG8onhEJDN3uc,496
src/rules/windows__process_creation__proc_creation_win_powershell_base64_encoded_obfusc.eql,sha256=Hvq6N8EKz6qKc_xzhMsWDCu2IWcRnKLVL6st95_-H6U,862
src/rules/windows__process_creation__proc_creation_win_powershell_base64_frombase64string.eql,sha256=yOAIEz4nPiA8RXHF6Y2tnckoxN1-sAdm0K__lyWhDO8,319
src/rules/windows__process_creation__proc_creation_win_powershell_base64_hidden_flag.eql,sha256=Om6tBsj_KC37ZRXE0_muMzUgYYrz9kTy1I4FnwF4HZE,1732
src/rules/windows__process_creation__proc_creation_win_powershell_base64_iex.eql,sha256=FPKo5uddwF2EYIGrbcSAYh0O8g_A7HfHyqPbbSfWV0s,1056
src/rules/windows__process_creation__proc_creation_win_powershell_base64_iex.lucene,sha256=K1fYotsvUN-kJ1kxrb4vWMsqeLOIirnq6rSbAzCA85g,958
src/rules/windows__process_creation__proc_creation_win_powershell_base64_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_base64_invoke.eql,sha256=brFgDdRTY4TlBNAssXGxzVpcJgmdNhO-EPa0tkraKsA,331
src/rules/windows__process_creation__proc_creation_win_powershell_base64_invoke.lucene,sha256=LZIzMJUEqqYQNpBZw0dGzqGnUWAkt4VxLl9t3XA0n6Q,297
src/rules/windows__process_creation__proc_creation_win_powershell_base64_invoke.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_base64_mppreference.eql,sha256=NV_3JJEU3-tOSbWwB2_6--7Bo4IPEakI7kAFAIsY8h0,1110
src/rules/windows__process_creation__proc_creation_win_powershell_base64_mppreference.lucene,sha256=3gW8tAl-OiF3ZElDAmFmMxYDaOPBDvzzv2qCfoB6X5w,1060
src/rules/windows__process_creation__proc_creation_win_powershell_base64_mppreference.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_base64_reflection_assembly_load.eql,sha256=4bDi7Zt3V_JLD5QoauwztWuT0y9Jzg_11bX7idA2_Y8,1046
src/rules/windows__process_creation__proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.eql,sha256=sBIkYwOLJKFNSkOqpgM0LPYT3dlWzHMxmstmS03eiuk,758
src/rules/windows__process_creation__proc_creation_win_powershell_base64_wmi_classes.eql,sha256=tTMvsS9fOX8a20pxUTajA-ZZDGDIT19jGfAnIAXxfeI,1460
src/rules/windows__process_creation__proc_creation_win_powershell_cl_invocation.eql,sha256=8rdm8_piSl00853IwG6KeHfaiQdMaxsCfu5_J5mUx0s,47
src/rules/windows__process_creation__proc_creation_win_powershell_cl_invocation.lucene,sha256=a4qaiFYXqsAddK2bwV3FgSK4fjEgvBBi85CDbGxZRsA,36
src/rules/windows__process_creation__proc_creation_win_powershell_cl_invocation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_cl_loadassembly.eql,sha256=V1J3nXk5_kz3aYXHBlju_lG3w-VB7RPWpKV7uy7ZBVY,90
src/rules/windows__process_creation__proc_creation_win_powershell_cl_mutexverifiers.eql,sha256=Dwm-bzOjL4b_rj9tzoEEA8sbXwL8d_wIfQIpg-h82So,281
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_convertto_securestring.eql,sha256=FdV31zAebMmDBRj6oVEaGSRqAsIPqE-G2dEPabAiJrI,200
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_reversed_strings.eql,sha256=kYUkvnhgztYTHf_jMF9TWhF6hGGrUcJ62XpBn7kLj9o,573
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_reversed_strings.lucene,sha256=gPBSvPoNDKrE36AsxIxzYDJQdinACliEIg_oR1fBY1s,537
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_reversed_strings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_special_characters.eql,sha256=_Tkrhzi2YXQSP0ILN_K5-d4655SJMtHhRaJR7304188,661
src/rules/windows__process_creation__proc_creation_win_powershell_comobject_msi.eql,sha256=-dubwbaSJLun7-jQeCo7K7_YTEev3l5UU57uJJezat0,357
src/rules/windows__process_creation__proc_creation_win_powershell_comobject_msi_remote.eql,sha256=y4dXqmwOcUkPu0UsRBQ1QBlVwy-YcP68LWeXBMNU3OM,412
src/rules/windows__process_creation__proc_creation_win_powershell_comobject_msi_remote.lucene,sha256=LahRP-oNKGibPYmp6HhkvyBSgF_MPiOWlWd9fN3uikM,374
src/rules/windows__process_creation__proc_creation_win_powershell_comobject_msi_remote.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_computer_discovery_get_adcomputer.eql,sha256=FsfO-1dsbqfTta7RXOg6Ff1fWpv3h4NiRDPxtGUDAjM,346
src/rules/windows__process_creation__proc_creation_win_powershell_console_history_file_access.eql,sha256=lFV_ayrHb8yOxxq3wmcKt2vSDsdPWD5mEjThQMrX7pk,111
src/rules/windows__process_creation__proc_creation_win_powershell_create_service.eql,sha256=jatvJ-AaqlO-hfhFWnU1pXDG3cA4FvZYn9JlkozYSAg,92
src/rules/windows__process_creation__proc_creation_win_powershell_decode_gzip.eql,sha256=0Lb40ggcYX52Gkp0LTIgYzWDAHv-IKXZnTUFY-17i-0,88
src/rules/windows__process_creation__proc_creation_win_powershell_decrypt_pattern.eql,sha256=gZLZylVGZh5rRaZdYN6ND1GUpbwIQ8Og4kqrkHCYPuo,648
src/rules/windows__process_creation__proc_creation_win_powershell_defender_disable_feature.eql,sha256=0imKY-zeJmTAGt1JFiaXOEJo9t2Gj4gBunZGpVl2g3Q,4319
src/rules/windows__process_creation__proc_creation_win_powershell_defender_disable_feature.lucene,sha256=4NfoznufbypQv0EngQffB2pdqprb4fpk7nlWWRVdqL8,4178
src/rules/windows__process_creation__proc_creation_win_powershell_defender_disable_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_defender_exclusion.eql,sha256=jlcen8S21rSYHP-xXP5DSDUWnCEfD1cWt5232KhyXXE,221
src/rules/windows__process_creation__proc_creation_win_powershell_disable_defender_av_security_monitoring.eql,sha256=otz2H86myxM4XZYyCm0GJCyRr6H48NMqcwBkKkS-BlQ,612
src/rules/windows__process_creation__proc_creation_win_powershell_disable_firewall.eql,sha256=Dq75dMR9jrPFHE9gzxSdTrQ1_8qzyZ8mK3tFVM2r8Hc,387
src/rules/windows__process_creation__proc_creation_win_powershell_disable_ie_features.eql,sha256=dqGZIJpRpoupqRvvsjX8ZLPYGVtXKGodbsu7U7MUckY,282
src/rules/windows__process_creation__proc_creation_win_powershell_downgrade_attack.eql,sha256=s5vlCqzhU6DoBht_9y0mqoMe9HoWfSHGqmoY9WPSqII,188
src/rules/windows__process_creation__proc_creation_win_powershell_downgrade_attack.lucene,sha256=Pr-WQ9oSw0pIMScX0WLaRgPsprLRJdqWl8e8IbjWJD8,196
src/rules/windows__process_creation__proc_creation_win_powershell_downgrade_attack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_download_com_cradles.eql,sha256=scwtVT_NSY6oen1wONCuEq93a9yE9HIx1o-UBrCLWWI,515
src/rules/windows__process_creation__proc_creation_win_powershell_download_com_cradles.lucene,sha256=Bny-DNgXJ9NAOOOORdn30MYGfxOwpxOtWkzz2cXC2KY,540
src/rules/windows__process_creation__proc_creation_win_powershell_download_com_cradles.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_download_cradle_obfuscated.eql,sha256=BjictGalNMXLTOtnpgDA_3QcddCJrWwWFGZ_KHqLADg,174
src/rules/windows__process_creation__proc_creation_win_powershell_download_dll.eql,sha256=Ed8GgmOhJE2jCBg7Kk5fWUr35sTQToT7GMENhN9TyTM,215
src/rules/windows__process_creation__proc_creation_win_powershell_download_iex.eql,sha256=UXijhGMcCoL_JNp-Udhaphs-XNhw4tIrrZmFG6Zr2_8,303
src/rules/windows__process_creation__proc_creation_win_powershell_download_iex.lucene,sha256=NF7YGlIqJmHdgDT3az5foWgRRSq9Muacub11U1zWQLo,295
src/rules/windows__process_creation__proc_creation_win_powershell_download_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_download_patterns.eql,sha256=SdoA0ANOOBPV6D5c1E0uynVIVU18GdDzFpIIjVuBOwI,380
src/rules/windows__process_creation__proc_creation_win_powershell_download_patterns.lucene,sha256=283Ufe83NgjEwPw0V_iBpOoOkiqBLp_RLfWvU9PHrdU,344
src/rules/windows__process_creation__proc_creation_win_powershell_download_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_download_susp_file_sharing_domains.eql,sha256=SiNAq44SEDTUfaewwESYkKU9t7f6y6xEi_C0GG5j9wM,853
src/rules/windows__process_creation__proc_creation_win_powershell_dsinternals_cmdlets.eql,sha256=LmHMANk-xKXGx1vfsxtynSw61v4TYoA49MBMbzVKwl0,1669
src/rules/windows__process_creation__proc_creation_win_powershell_email_exfil.eql,sha256=yYJ5gg7nBM8qfJeJ7C-V5iIxkFjfZjfhTn06BDqOPfA,338
src/rules/windows__process_creation__proc_creation_win_powershell_enable_susp_windows_optional_feature.eql,sha256=J3MIsni2zSJFv_W4U2c7tbrp7aoXtZki7tyujMu7F1k,322
src/rules/windows__process_creation__proc_creation_win_powershell_enable_susp_windows_optional_feature.lucene,sha256=CXJ8foZtlt639Jk5JiCHyXNvwzLE-SW2iDpT7saBVy8,308
src/rules/windows__process_creation__proc_creation_win_powershell_enable_susp_windows_optional_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_encode.eql,sha256=-BYWAp_K91l4TyJJJccMwjJtRsrvKTJWuswrXwaKRD0,357
src/rules/windows__process_creation__proc_creation_win_powershell_encode.lucene,sha256=9TzEd-s6hL5W6BRxDBdePNuqUTeseW9VHLUKkqEBTQQ,338
src/rules/windows__process_creation__proc_creation_win_powershell_encode.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_encoding_patterns.eql,sha256=B_nLPTGYShtS8SvcjrOjJr6YgivzeDnZTjQ_H8NpGEM,476
src/rules/windows__process_creation__proc_creation_win_powershell_exec_data_file.eql,sha256=wqMEpOjjCNx5FM2DkV-fE8SyPi0zlCnpHeZlu8jKgEk,213
src/rules/windows__process_creation__proc_creation_win_powershell_export_certificate.eql,sha256=ve3TiMlLkx0Xs0HZeJLU-WD4ArXjaCRxPzy7tcRtnlY,91
src/rules/windows__process_creation__proc_creation_win_powershell_frombase64string.eql,sha256=rDqypG40xkHnpz7_tbtT2ZMwBT2hJ3zhPcmgN2uGEX0,55
src/rules/windows__process_creation__proc_creation_win_powershell_frombase64string_archive.eql,sha256=9GyMrq7s5cAsiD4oyVEC_CIULJfS79zmDI73XjGoRMc,128
src/rules/windows__process_creation__proc_creation_win_powershell_get_clipboard.eql,sha256=aQwYBRWYQDfG0TMloHDuNaE9f3WNj_uJ1firO6M9gdI,49
src/rules/windows__process_creation__proc_creation_win_powershell_get_clipboard.lucene,sha256=ykahYQUKX09Efb88Z6xzl1dYylj_cidlm1boQldt4MA,38
src/rules/windows__process_creation__proc_creation_win_powershell_get_clipboard.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_get_localgroup_member_recon.eql,sha256=2_Cf7mBXFVqp76qXJUFDJpPaZryxN_jxqTJCcxgLdzc,307
src/rules/windows__process_creation__proc_creation_win_powershell_getprocess_lsass.eql,sha256=EiNMICGHqsJFq7W6coMnn-6v58ndmdC0_lR2oG8ZdM0,87
src/rules/windows__process_creation__proc_creation_win_powershell_hide_services_via_set_service.eql,sha256=3zcma-GkM7mBWeuoN0W4wRndFYoGisDBAlEGwLr0gfM,247
src/rules/windows__process_creation__proc_creation_win_powershell_hide_services_via_set_service.lucene,sha256=LXgf6qk9OFYkXoNVLjYIKw1COzCGdkecp_bzgxPGoHM,227
src/rules/windows__process_creation__proc_creation_win_powershell_hide_services_via_set_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_iex_patterns.eql,sha256=jiJbRYeaZE_h58GJbHV9Zn2YGj-AS-63y04y1qXTFew,409
src/rules/windows__process_creation__proc_creation_win_powershell_iex_patterns.lucene,sha256=PpaC9MIFcziX_VjNF8W-pLeupBRlFgWEosub0S0In0c,416
src/rules/windows__process_creation__proc_creation_win_powershell_iex_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_import_cert_susp_locations.eql,sha256=MpLNL8RaIo2hLC3trrGAlUbetF257Nv6aeCJs_7XFc8,318
src/rules/windows__process_creation__proc_creation_win_powershell_import_cert_susp_locations.lucene,sha256=yTu9qgeExlyqjuWs1EScjrpDeRnkCd7Dyv6j7_a-DvA,295
src/rules/windows__process_creation__proc_creation_win_powershell_import_cert_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_import_module_susp_dirs.eql,sha256=xEzqop1s1EAxi8wHkd1JyyBpWCVGm-9oNO-FCKn9v6Q,455
src/rules/windows__process_creation__proc_creation_win_powershell_install_unsigned_appx_packages.eql,sha256=6iXIZkjuKGXldJyt0OQ2WKx6V_TCgLTXrX1cc-bgn7A,270
src/rules/windows__process_creation__proc_creation_win_powershell_invocation_specific.eql,sha256=r7M2gsRHK1WPd9gkwc49Dgqeji9DGBzddkhwpUh4OaU,1384
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_direct_ip.eql,sha256=MlJEq96vaSK53J6Y-KLlUlhrcZ31bGAk4Y8RwTX2e3g,442
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_direct_ip.lucene,sha256=EMHqj8v230DHoNfsjCBdVOkGQnqlqMAKCj2Uw14Eztc,434
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_direct_ip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_download.eql,sha256=k5Ymy18eWdUnVyMyBFgZjQwpwStHrn9jlNHhxdGrfug,512
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_download.lucene,sha256=OKRhtHgL7gMntfhnZ_RplzvcmMAZcx2SK8shv8qa_H0,466
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_kerberos_kerberos_ticket_request_via_cli.eql,sha256=oGOTlrXxycwQgLhe_QvdjkzDLizHpWnLSKnyvR8ptiA,281
src/rules/windows__process_creation__proc_creation_win_powershell_mailboxexport_share.eql,sha256=PK49M1Y2KlnLbw0Or7mwGBhueowWf3fLP-Udku44CJY,143
src/rules/windows__process_creation__proc_creation_win_powershell_malicious_cmdlets.eql,sha256=rT2P8ztb2KzfdFmkSWkcgGcfjvMBfLnnxxxBcPXdQyM,4527
src/rules/windows__process_creation__proc_creation_win_powershell_malicious_cmdlets.lucene,sha256=Q_1sU3vhGBAyaJGTJ05byFSn2qSozA6jhoX2knft45o,4701
src/rules/windows__process_creation__proc_creation_win_powershell_malicious_cmdlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_msexchange_transport_agent.eql,sha256=5fuEB19TxdwoMT0zJGSn09WsGR8O-yWu6J4rU0yIzR4,58
src/rules/windows__process_creation__proc_creation_win_powershell_msexchange_transport_agent.lucene,sha256=qziVu4z4uz83ZysI_4Utsgi6XDV8905FFHjnKSOBXSg,47
src/rules/windows__process_creation__proc_creation_win_powershell_msexchange_transport_agent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_non_interactive_execution.eql,sha256=QUNblMtXKkaw9FcvXCZs2BHBwyeMTVQJMMyUiWI8yG4,698
src/rules/windows__process_creation__proc_creation_win_powershell_obfuscation_via_utf8.eql,sha256=tW73-P-_eIZ_eE-b5U_-d2dhSfb6Rx_XAsFp2Ala6VU,67
src/rules/windows__process_creation__proc_creation_win_powershell_obfuscation_via_utf8.lucene,sha256=Jz5EkzU4YJu1ErYTlwdWV4LnZrFh3JTKeXpMLXYbAP4,53
src/rules/windows__process_creation__proc_creation_win_powershell_obfuscation_via_utf8.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_public_folder.eql,sha256=D0jBVsEnjK16GjtZTmzpYVrwAHQ3jxcY7DoefQIaa40,410
src/rules/windows__process_creation__proc_creation_win_powershell_remotefxvgpudisablement_abuse.eql,sha256=t6FG7qXTpPincOhZ9w5rX6lcvyE6ZbTSiAtEpie8ijw,121
src/rules/windows__process_creation__proc_creation_win_powershell_remove_mppreference.eql,sha256=VeahVNPB_I4aOt457HRl6wn1MZ9jYhsOEyflG8NUvZ8,260
src/rules/windows__process_creation__proc_creation_win_powershell_remove_mppreference.lucene,sha256=SrUl0Lqkx9jARlD3jItRNygUlgA3Q_G4M1QoMColbKk,249
src/rules/windows__process_creation__proc_creation_win_powershell_remove_mppreference.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_reverse_shell_connection.eql,sha256=SqXc9gYploNCvyTAJK_TbhO_iy3UToaF3_R04JIXyFw,280
src/rules/windows__process_creation__proc_creation_win_powershell_run_script_from_ads.eql,sha256=21hO-Fo8zimLZEdNQyxFhhjQMYB6ZAI8HZLOcxsholA,229
src/rules/windows__process_creation__proc_creation_win_powershell_run_script_from_ads.lucene,sha256=COkSTZbykNaCX_Hnvs1x55a6h2ZYpjAhPbDtylfvUvs,201
src/rules/windows__process_creation__proc_creation_win_powershell_run_script_from_ads.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_run_script_from_input_stream.eql,sha256=q5Lpvis77KAWMVyPH5Cz6cQUSo5PH21P-psBnvk2zW4,115
src/rules/windows__process_creation__proc_creation_win_powershell_sam_access.eql,sha256=FNsR5kJAZEwzKFWsJ7vnV7LtkzBnIyRDKjcs-LiwCtc,222
src/rules/windows__process_creation__proc_creation_win_powershell_script_engine_parent.eql,sha256=abST634O52IfUjWiBwZCybNTVzZUhJ_47LibQ0VrT1o,216
src/rules/windows__process_creation__proc_creation_win_powershell_service_dacl_modification_set_service.eql,sha256=AmNwDtmsguarwtRwegIaAOfkMpPZujGlltMGh35BJAk,331
src/rules/windows__process_creation__proc_creation_win_powershell_set_acl.eql,sha256=vMJwoGrsgxrvCS4jXuH6KpSMXsz6rMYg9zhRVVFojfE,265
src/rules/windows__process_creation__proc_creation_win_powershell_set_acl_susp_location.eql,sha256=k7_M9M7Aqye2rh7Q4_BX9UwXkZGFqjxLfhE7MoKB864,417
src/rules/windows__process_creation__proc_creation_win_powershell_set_policies_to_unsecure_level.eql,sha256=_a5OB8lcjChHD8GEO6PNOPG-xDy5IFiiR-vNk3U2WCk,1036
src/rules/windows__process_creation__proc_creation_win_powershell_set_policies_to_unsecure_level.lucene,sha256=EJhrQt-B4OTxRhwmHa7vQ-CSN4aG6p2c3WbZ3e6HqkM,1016
src/rules/windows__process_creation__proc_creation_win_powershell_set_policies_to_unsecure_level.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_set_service_disabled.eql,sha256=6fbw5YW0qDG-MsY-RFwXk0if0hrEPNR-eZKxjiBh4Yk,248
src/rules/windows__process_creation__proc_creation_win_powershell_shadowcopy_deletion.eql,sha256=9Nyzo5oOC5-X8cyaF0ZaBoNljAs5oqdI2UbzpN3vMfQ,261
src/rules/windows__process_creation__proc_creation_win_powershell_shadowcopy_deletion.lucene,sha256=QxFWwpYLPKbe5URD0kpDkMnfCt973vE_jTD3-9hNueM,239
src/rules/windows__process_creation__proc_creation_win_powershell_shadowcopy_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_snapins_hafnium.eql,sha256=9izllP-zan1Z0DB2IpsWzPwPuKOIm0hSPRC1-rk4SxE,513
src/rules/windows__process_creation__proc_creation_win_powershell_snapins_hafnium.lucene,sha256=tuEwqBC0tcH41h5hwsEvuyex-XsPdw7GdCklaE0a5JE,490
src/rules/windows__process_creation__proc_creation_win_powershell_snapins_hafnium.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_stop_service.eql,sha256=uHfaQ5kqkGSI_ELdYc1cPOaEoFm7cLJ9OhkJBRQV6Ds,191
src/rules/windows__process_creation__proc_creation_win_powershell_susp_download_patterns.eql,sha256=y3aAZhJU8Sd42-MYYpBoIqpK5oBFJCau0xOou0fP88o,362
src/rules/windows__process_creation__proc_creation_win_powershell_susp_parameter_variation.eql,sha256=CO9mQkw8THdU7yQ2ku87b7CuHEkc7TjqE9K2wQHKdT8,2008
src/rules/windows__process_creation__proc_creation_win_powershell_susp_parameter_variation.lucene,sha256=O1AnsBdRpdllw_C8jCYsqtKwjUgcQoNTmOhMzvIgBPo,2318
src/rules/windows__process_creation__proc_creation_win_powershell_susp_parameter_variation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_susp_parent_process.eql,sha256=PUWsjhwjzNcsEcyPa42GXQokkQ7JCxcAaskfO0HewoE,815
src/rules/windows__process_creation__proc_creation_win_powershell_susp_ps_appdata.eql,sha256=gnMilLBLuBY6FUv7QEGupTuwQdrKXMgdvBa_Lpia5ls,244
src/rules/windows__process_creation__proc_creation_win_powershell_susp_ps_appdata.lucene,sha256=MbkjlvRwRjR3_mUoqhwNJzcH4789qmjuzdqYG0omWdY,213
src/rules/windows__process_creation__proc_creation_win_powershell_susp_ps_appdata.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_token_obfuscation.eql,sha256=l71iCTNPBroffcUA-Z3Sl3BDkNu3eLMlKcaQLQGuHm0,188
src/rules/windows__process_creation__proc_creation_win_powershell_uninstall_defender_feature.eql,sha256=Uo9fifkL2Qj_CdMtPJwg6G6-fNCZnPWaFt41keBQ6To,332
src/rules/windows__process_creation__proc_creation_win_powershell_user_discovery_get_aduser.eql,sha256=VtWFtxRbS1GXq4azAyM3rrOrNsMc69nsWAwjiZsIT8Y,342
src/rules/windows__process_creation__proc_creation_win_powershell_webclient_casing.eql,sha256=GTb-4ozJTws5LHDedMxUwddFCbSKUaQxnIRKgCxV2p8,3662
src/rules/windows__process_creation__proc_creation_win_powershell_x509enrollment.eql,sha256=YvjKGZ4NzK8FpuqWxqowttWasiQgKp0jjPCSJLWE27Q,117
src/rules/windows__process_creation__proc_creation_win_powershell_xor_commandline.eql,sha256=zK0h7t9wSLZOpehNRbxoDL6ItDUwhkiX9HLRHedBNQo,411
src/rules/windows__process_creation__proc_creation_win_powershell_zip_compress.eql,sha256=me40DLhgC1bePrLF0-0ysjkYVx4BaUge9qZ5KfZchzs,227
src/rules/windows__process_creation__proc_creation_win_presentationhost_download.eql,sha256=2iAkGMrJd6uFnnNaUhHU22BrdBDlMo63YkoIS9TaOU0,186
src/rules/windows__process_creation__proc_creation_win_presentationhost_uncommon_location_exec.eql,sha256=Bwqg3POYJxQY2hHq1fjXhawxefxTW8eZUqehyMTSv-Q,234
src/rules/windows__process_creation__proc_creation_win_pressanykey_lolbin_execution.eql,sha256=XIOO09o22IkPxY5TQu74hPUaCjr7ZWt44I-UXtara0E,79
src/rules/windows__process_creation__proc_creation_win_print_remote_file_copy.eql,sha256=yIhi0phFEq5L-WVQ6vYhK5KdZJCkHNz7j8xhXLNGw7E,193
src/rules/windows__process_creation__proc_creation_win_protocolhandler_download.eql,sha256=C5Rb-Qu54_rDTuJJqF2i1CugXCZi9fLlHSNoPPCDxUk,184
src/rules/windows__process_creation__proc_creation_win_provlaunch_potential_abuse.eql,sha256=4BS5tCx6JjV-zXxve9dGi_2u4aFS1KWcDbpRiYV_HzA,462
src/rules/windows__process_creation__proc_creation_win_provlaunch_susp_child_process.eql,sha256=E4akw3-Xl4A83nMi2eqKI5udwuk1GSaTchL9TVA9j-0,456
src/rules/windows__process_creation__proc_creation_win_provlaunch_susp_child_process.lucene,sha256=nyBAw22opJaJecRHdNId3CNdMaTzhl6_TkjNH4dZ5dE,424
src/rules/windows__process_creation__proc_creation_win_provlaunch_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_psr_capture_screenshots.eql,sha256=Fb9NSuPAIJN8xMNpDxrH22rr_nkiVgd50R8rascWanE,100
src/rules/windows__process_creation__proc_creation_win_pua_3proxy_execution.eql,sha256=xbeTuAU5COIDXsb2ItHnNquypmuMf0q2xhnANgwicfc,148
src/rules/windows__process_creation__proc_creation_win_pua_3proxy_execution.lucene,sha256=6zwI5Atsmt3HXtvadD0_2rbnDynRFJR2QnXiQeAuIig,141
src/rules/windows__process_creation__proc_creation_win_pua_3proxy_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_adfind_enumeration.eql,sha256=B_kyqKB0T5x-pUU-6Gqva8J1PmrnBHB0lt1TNEFXiz0,294
src/rules/windows__process_creation__proc_creation_win_pua_adfind_enumeration.lucene,sha256=i8E4lCxet0rStgmNn-OGppOvsEsbOPm1BGRV6XpN94I,276
src/rules/windows__process_creation__proc_creation_win_pua_adfind_enumeration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_adfind_execution.eql,sha256=DX6W297JJhEnF5ciOk4MZyfsrBJlu6zN0jx1HZwOlPM,496
src/rules/windows__process_creation__proc_creation_win_pua_adfind_susp_usage.eql,sha256=8T5v3a5phKtAS-lFeGzZjU7TzdD6vVsiMq3W4RttQbw,359
src/rules/windows__process_creation__proc_creation_win_pua_advanced_ip_scanner.eql,sha256=RgW6PpTqmeHM5LcIYOeuBY59xXb7sgtpGbmjG2nG4w4,238
src/rules/windows__process_creation__proc_creation_win_pua_advanced_port_scanner.eql,sha256=d-U-g3TxabixWNeYURoEqAaurnRlg6_EYEbVVfSD9nY,244
src/rules/windows__process_creation__proc_creation_win_pua_advanced_port_scanner.lucene,sha256=1vWiy4J37JdS1dDQ585xuND0m-uBw6BBGqJiiPWRd4A,228
src/rules/windows__process_creation__proc_creation_win_pua_advanced_port_scanner.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_advancedrun.eql,sha256=28tdOyyNLrw12Pg17iQmiGVeeI7O8Ksi2kYkXrt7PZQ,266
src/rules/windows__process_creation__proc_creation_win_pua_advancedrun_priv_user.eql,sha256=Cy0OfWlNzNvUDfdS8uLtWyTQoQzpFhH0wLZH6I-t8rY,265
src/rules/windows__process_creation__proc_creation_win_pua_advancedrun_priv_user.lucene,sha256=VMcKRCW7fctZwjvfSF14w29i-nmuYrg2VRAZoYVFCJY,257
src/rules/windows__process_creation__proc_creation_win_pua_advancedrun_priv_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_chisel.eql,sha256=wDKgKbM-7NE-9r1BWU4xYCZ4GR4VkpcmNjKjk-nQz_c,236
src/rules/windows__process_creation__proc_creation_win_pua_cleanwipe.eql,sha256=Wcgw9HBD_6cq7UV7fIyx5wNFTyuWwv63AFdhomXZN5U,349
src/rules/windows__process_creation__proc_creation_win_pua_crassus.eql,sha256=DR4W2QiVXh4q0lpESBs__Ou95n54nXWNiYjNv92UQis,131
src/rules/windows__process_creation__proc_creation_win_pua_csexec.eql,sha256=fzk66qPCgivaP0L96AjgRn88hTb8O0g4j3-xwlkdqhc,80
src/rules/windows__process_creation__proc_creation_win_pua_defendercheck.eql,sha256=vsVEmMjRA1X5QxhQn9760_S5dihv46fSJbwKQEqCHYk,94
src/rules/windows__process_creation__proc_creation_win_pua_ditsnap.eql,sha256=cR4GEDRkLFkENt6Y2Jc-mucP76QDjhabhNSGRnbTwwk,86
src/rules/windows__process_creation__proc_creation_win_pua_frp.eql,sha256=6KNCqXd98I4i5A2YpDiC6ZJExW4xfE4d0PBd6sLF5qk,314
src/rules/windows__process_creation__proc_creation_win_pua_frp.lucene,sha256=PJoFUYtQMR23tw4B0yQmU87pZ1UnstilfDfj_3zCDWc,289
src/rules/windows__process_creation__proc_creation_win_pua_frp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_iox.eql,sha256=ztEtB4r15Vu4nbcMrU7iGiJUQP6tE-LXb4Uo4m48I2Q,358
src/rules/windows__process_creation__proc_creation_win_pua_iox.lucene,sha256=ymyWTQLtAsidooZX_N-iii-RSqYq2TBeLZS5wdM0XrQ,349
src/rules/windows__process_creation__proc_creation_win_pua_iox.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_mouselock_execution.eql,sha256=qPlNBUbHMzY8GX-PMtPTHil9F0diYIecV3G_Ha46N7M,118
src/rules/windows__process_creation__proc_creation_win_pua_netcat.eql,sha256=j0l7QPZGXeiBeVflsWBnahIJwKz-6YQeosyKbuqgsko,267
src/rules/windows__process_creation__proc_creation_win_pua_netscan.eql,sha256=UYGs0j0WQn065KZzCMZRwKSX0A3vYW-XLVJ3cxBDfMc,148
src/rules/windows__process_creation__proc_creation_win_pua_ngrok.eql,sha256=KdBV5lIqjl6RlTIvg2SA3qBWfiNpjEHF5dZ1Y1IQs1o,445
src/rules/windows__process_creation__proc_creation_win_pua_nimgrab.eql,sha256=3gA8SEPmpptjeYaQmumkg6XThCv0pk3GQmRmLlAYe4c,248
src/rules/windows__process_creation__proc_creation_win_pua_nimscan.eql,sha256=kp6-WqLlSZYgW5b9HeY_3hYtxErpgMEcOff1DXLVWs4,221
src/rules/windows__process_creation__proc_creation_win_pua_nircmd.eql,sha256=LYOGhQ6_nyBrYWnfdEhTHGt8ab0fafZ7VdegyxxfVwA,318
src/rules/windows__process_creation__proc_creation_win_pua_nircmd.lucene,sha256=EL1aXZ_bXxZNrnkdMWmyKPNP9eDjCnrYmuvQum_kgb4,296
src/rules/windows__process_creation__proc_creation_win_pua_nircmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_nircmd_as_system.eql,sha256=2p0oaRg4S_aLvUGvqw8-2dXVw8ZzDYtF2F-JyaT3trI,49
src/rules/windows__process_creation__proc_creation_win_pua_nmap_zenmap.eql,sha256=4uiXOekz218EhKrzbtfSBmFLxMYHksJF04K7dVyrNuI,140
src/rules/windows__process_creation__proc_creation_win_pua_nps.eql,sha256=NXCGkuxiJEIQJUH0J4siByQhEe4ErwEPVdMmuy0Jf_I,408
src/rules/windows__process_creation__proc_creation_win_pua_nps.lucene,sha256=bi944ifQy2K6rC98-yARZHRK7V1PlgpZQzKcQ63jIfE,395
src/rules/windows__process_creation__proc_creation_win_pua_nps.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_nsudo.eql,sha256=NqT3E5pDYnkmlFt1r6AXY-SFJz9pkllRIPMKEPGUQp8,369
src/rules/windows__process_creation__proc_creation_win_pua_pingcastle.eql,sha256=3_asHXe2BxlIq1ONAfo-KUigjbOBpM83Lmt6fmb7FG4,7975
src/rules/windows__process_creation__proc_creation_win_pua_pingcastle_script_parent.eql,sha256=28ArP5hqHdVyfU7ZdDht4ruT3UJGZshJd_6VZqpGTII,1622
src/rules/windows__process_creation__proc_creation_win_pua_pingcastle_script_parent.lucene,sha256=Tzw-qrOD65f8Nhz-weYNPGCZoB-B7b07f2ZSKvsBWKk,1613
src/rules/windows__process_creation__proc_creation_win_pua_pingcastle_script_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_process_hacker.eql,sha256=Bihe9keDiOM580OqudwnznbeWsVZDVrM2GtEJ57LQw0,727
src/rules/windows__process_creation__proc_creation_win_pua_process_hacker.lucene,sha256=q8JA3BQBg6bBgY_nTcfbJiKd1MXAS-tqVstNXaSbZNY,704
src/rules/windows__process_creation__proc_creation_win_pua_process_hacker.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_radmin.eql,sha256=4I2hgvQIVN-VPdbpQqFRYi31DpiCw35nPw92dNV5sN0,133
src/rules/windows__process_creation__proc_creation_win_pua_radmin.lucene,sha256=bKpJ2shXIkZPUAMyfEnmT_wOHNmzVl3vGi_wQY9WA1g,119
src/rules/windows__process_creation__proc_creation_win_pua_radmin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_rcedit_execution.eql,sha256=7YYOc8K56tUMxrL5AP-7fnb2sFDwt_ip44G1S0_kK9s,350
src/rules/windows__process_creation__proc_creation_win_pua_rclone_execution.eql,sha256=oeKdOW-pn580JeYpVW5ZhWgd_rH1QHqI2VP6U0qMFYY,483
src/rules/windows__process_creation__proc_creation_win_pua_restic.eql,sha256=2QNerbAjioPI5DmmPh1Ab5FDnEqK1awiqh94l2QRFZo,456
src/rules/windows__process_creation__proc_creation_win_pua_runxcmd.eql,sha256=WaBxDAkU4PR8rqeaIAblBqnfYTMcWXKlhy1O_n1sLh4,118
src/rules/windows__process_creation__proc_creation_win_pua_seatbelt.eql,sha256=LudF_BMvg35rfwIE7v6eX_jccEPhS0L12NimGMJwQBE,652
src/rules/windows__process_creation__proc_creation_win_pua_seatbelt.lucene,sha256=Jehpmbx-94CQnBrhy9gYY0HVXhqUTdLMlma-YTQp21Y,654
src/rules/windows__process_creation__proc_creation_win_pua_seatbelt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_system_informer.eql,sha256=fw85uk73j1v-MR4sZ-iarGNYukNmkFS3MIT1DMuf4Tk,444
src/rules/windows__process_creation__proc_creation_win_pua_system_informer.lucene,sha256=msSwZYe9nKnCB7mRZxasXzwBXGZaI_ElG3iHH1YblMw,424
src/rules/windows__process_creation__proc_creation_win_pua_system_informer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_trufflehog.eql,sha256=ZuPrh8wNu8Xpwri8dxDHF2Au8zhpWq_SzsTWwLQmDFU,262
src/rules/windows__process_creation__proc_creation_win_pua_trufflehog.lucene,sha256=jp0uRDcDs6CL1G6eSEleSBGXgKnGxvXdcfvcIbTjnD0,265
src/rules/windows__process_creation__proc_creation_win_pua_trufflehog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_webbrowserpassview.eql,sha256=dm_sgqm_pSXvqRNg77bBis4ajs27QtE_dgRnN4eol3g,113
src/rules/windows__process_creation__proc_creation_win_pua_wsudo_susp_execution.eql,sha256=0MLtTnDLU6sNPLYHYr3Y0d1JmNhb3vPs4vdaYDDw_2Y,314
src/rules/windows__process_creation__proc_creation_win_pua_wsudo_susp_execution.lucene,sha256=7r4SLmSs0ntrx7klET2IEh-zpC2mhMvRtnFb1bqcrtA,301
src/rules/windows__process_creation__proc_creation_win_pua_wsudo_susp_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_python_adidnsdump.eql,sha256=I98xOfTMX2gynvAEBk0328lAPdikNoPvLogLi1MIbts,85
src/rules/windows__process_creation__proc_creation_win_python_adidnsdump.lucene,sha256=247Gh-a86CSh0gKsF-pfb-8OF0520z_6OZwIxpMAFdk,71
src/rules/windows__process_creation__proc_creation_win_python_adidnsdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_python_inline_command_execution.eql,sha256=yIPZs1A5kpQ5FOX_U2czftuLFocwiVQqlSwJENPueAE,1045
src/rules/windows__process_creation__proc_creation_win_python_pty_spawn.eql,sha256=POR4uuQA7ssAnMgmP1aRSje-eoAkSKxmRFPLEBB6FgA,216
src/rules/windows__process_creation__proc_creation_win_qemu_suspicious_execution.eql,sha256=QF3LXLTtv9dLz5YpQqbUcmhvhtYO9JDbLvB-fd-opgc,323
src/rules/windows__process_creation__proc_creation_win_query_session_exfil.eql,sha256=DPOVBJlWQr3z4XcPygUyJQa8K5CTpQAgHAEAlAETYvA,128
src/rules/windows__process_creation__proc_creation_win_quickassist_execution.eql,sha256=xOn8M864rT768vGNUdUMuyOtxX8DN5LciYMENedvj4E,50
src/rules/windows__process_creation__proc_creation_win_rar_compress_data.eql,sha256=1zwoLI6wfJX7VOn20GV1YZz-7G3F-0YNG5tda8hdpaM,75
src/rules/windows__process_creation__proc_creation_win_rar_compress_data.lucene,sha256=D-ER89q4v9Mf5TC-S2jXMpzh28MShSF0VVaQid6MCUs,63
src/rules/windows__process_creation__proc_creation_win_rar_compress_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rar_compression_with_password.eql,sha256=_P3-EgaZ-F0a7_8etcGrnMcJWl8PFHRn3LXxir8C9GM,92
src/rules/windows__process_creation__proc_creation_win_rar_susp_greedy_compression.eql,sha256=RPs2S8QCgqgu30XAr4V1wBX3uK5G67XvkTFVpo7xI-I,404
src/rules/windows__process_creation__proc_creation_win_rasdial_execution.eql,sha256=ohaYWPOR_xHTlQZdEK-fwacPh8mYmRw5U5D5Hut5drw,44
src/rules/windows__process_creation__proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.eql,sha256=VcqZK6xiRZXbK6ElSSJmVaxouYC_o9QT-LOD1jJS_Xc,308
src/rules/windows__process_creation__proc_creation_win_rdrleakdiag_process_dumping.eql,sha256=2bapuhJei5Uo5faIBWcKYUEXtHjuyWjCykVUndXLA_M,432
src/rules/windows__process_creation__proc_creation_win_reagentc_disable_windows_recovery_environment.eql,sha256=sGF65qCrdzDsND9A6Hm5unTGI1jneGX2f7MI6kjb66g,205
src/rules/windows__process_creation__proc_creation_win_reg_add_run_key.eql,sha256=L97SYCJwQXw1-26fVqzCbC0R-d1frIrGshZbIX-3R4w,348
src/rules/windows__process_creation__proc_creation_win_reg_add_safeboot.eql,sha256=My80G7TBwNtcI5-mUbHrYrTPCtKaOlDatdBupbW4jSc,220
src/rules/windows__process_creation__proc_creation_win_reg_bitlocker.eql,sha256=ihoUlN0YXFEcXCKG8R0NYgsQbtcnXXAjRRXduc_msmQ,400
src/rules/windows__process_creation__proc_creation_win_reg_credential_access_via_password_filter.eql,sha256=f7W1lSUIRSKbi-GBM27J9nG325lHLLl76sKRj7fAU_g,157
src/rules/windows__process_creation__proc_creation_win_reg_credential_access_via_password_filter.lucene,sha256=aJ1nnOmOXKTLeB_jcpGdK_Kq-N5QAS9RFXtsQS_fX9A,142
src/rules/windows__process_creation__proc_creation_win_reg_credential_access_via_password_filter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_defender_exclusion.eql,sha256=t0W66HnK8-70BaPBVMCpK0E5XOcxmvLzUA7NPdE5J3E,411
src/rules/windows__process_creation__proc_creation_win_reg_delete_runmru.eql,sha256=c7icdzaRMF01pdDWFScgFCP2zK1hqi3PZ2qN13bKMO8,217
src/rules/windows__process_creation__proc_creation_win_reg_delete_runmru.lucene,sha256=DpTAmTQZbQZtIAD4Gq_Lg-QFqKlomw55YP30Ym-HNs8,200
src/rules/windows__process_creation__proc_creation_win_reg_delete_runmru.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_delete_safeboot.eql,sha256=ias4a6_HRdMa3cKHPWwCFOK6tCulDzY2yUdYKz2K_as,201
src/rules/windows__process_creation__proc_creation_win_reg_delete_services.eql,sha256=iJgUaboIHXAQ-sFOTsngYY97eUZXTt-jm6y-PkGnuMI,192
src/rules/windows__process_creation__proc_creation_win_reg_delete_services.lucene,sha256=wEX8jX4geyVRIUX9HlxTtTzDvZzHgIio7dwEqYGyXrI,175
src/rules/windows__process_creation__proc_creation_win_reg_delete_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_desktop_background_change.eql,sha256=pmQFi-sVqjoV0eO7psidrW-GVGkLXkZY-EIKuCZZ-Ag,521
src/rules/windows__process_creation__proc_creation_win_reg_direct_asep_registry_keys_modification.eql,sha256=YU8ldNvSYRClk0ue8kjuNFuHoV0_jzUgAsMF66kzMEc,719
src/rules/windows__process_creation__proc_creation_win_reg_disable_defender_wmi_autologger.eql,sha256=S-0T7QIzbMWWMGfXPmW1i8PRO_3JNuajESPq-Uu8iKQ,353
src/rules/windows__process_creation__proc_creation_win_reg_disable_sec_services.eql,sha256=9TRrcYh4JVzKXEAmVtNHzwKyrBCYYhBmwbUyXsojA6A,392
src/rules/windows__process_creation__proc_creation_win_reg_disable_sec_services.lucene,sha256=SyAvDV580ULMGl53rwk23SIvI96guSVsfT5h9zsPM68,368
src/rules/windows__process_creation__proc_creation_win_reg_disable_sec_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_dumping_sensitive_hives.eql,sha256=WZJh6F_tOjjhKL4pUUK5G0ktJr3D2696lGjXxH_TWwo,480
src/rules/windows__process_creation__proc_creation_win_reg_dumping_sensitive_hives.lucene,sha256=EhINKRTwLU3eth2SU_fAbIpfx-sIbX1Hcj5X1cyoZsA,450
src/rules/windows__process_creation__proc_creation_win_reg_dumping_sensitive_hives.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_enable_windows_recall.eql,sha256=ZI6gqK7jayrlXDdlPQIp8-M1wJCY5ZIfkRtwSA3UqXc,286
src/rules/windows__process_creation__proc_creation_win_reg_enable_windows_recall.lucene,sha256=XoTauV5tY6vKcJQ0AAq0rT9ZHMeM056Ll7ea5S9k860,258
src/rules/windows__process_creation__proc_creation_win_reg_enable_windows_recall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_enumeration_for_credentials_in_registry.eql,sha256=1NbjYDS0mUy_W9SV0NAUf8DIqiSlEBLRfVZZ0_j9D70,396
src/rules/windows__process_creation__proc_creation_win_reg_import_from_suspicious_paths.eql,sha256=QsPkO2U0ybuHaLeVngh1ZwGbYY4Fl8RcVU7jcgcm4tY,292
src/rules/windows__process_creation__proc_creation_win_reg_import_from_suspicious_paths.lucene,sha256=jKENIw9sTxKjnvGYWaGJICsLQyTcG4iKENT7X9aM-ec,269
src/rules/windows__process_creation__proc_creation_win_reg_import_from_suspicious_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_lsa_disable_restricted_admin.eql,sha256=0keDZefzWzOTGJZhfcGqg8Rrumb2U6HKPJF3-BkJx88,129
src/rules/windows__process_creation__proc_creation_win_reg_lsa_ppl_protection_disabled.eql,sha256=vyjb4-1BbB2Dm4-lnOFw0OTw8BYqRsE5jBR4i3tJnpo,273
src/rules/windows__process_creation__proc_creation_win_reg_lsa_ppl_protection_disabled.lucene,sha256=4FThRJPN5imw15iYjl-NXER1eD6GMwoXUDoVVQk_GuU,260
src/rules/windows__process_creation__proc_creation_win_reg_lsa_ppl_protection_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_machineguid.eql,sha256=DSV5S0gQHD5KxvcCFpwUbu25J02vLzOGueuznbariE0,181
src/rules/windows__process_creation__proc_creation_win_reg_modify_group_policy_settings.eql,sha256=rVqwcidOXZjP--oCaXl8EUYRZsfgWaSeh-4Prf4N0wg,377
src/rules/windows__process_creation__proc_creation_win_reg_nolmhash.eql,sha256=BpjM6Hm25oqD58gDd9qM22Cv6oRjHScJ83wi6gVINDY,147
src/rules/windows__process_creation__proc_creation_win_reg_open_command.eql,sha256=SO1XyYhIpK8WjMTH7EKgutT0oPpfTWbASVpALDaWDEg,596
src/rules/windows__process_creation__proc_creation_win_reg_query_registry.eql,sha256=AKkN79V9EBmtbYAZtNnWsbC5xUg1avbmr_GZPuvnmK8,353
src/rules/windows__process_creation__proc_creation_win_reg_rdp_keys_tamper.eql,sha256=eZILZTUaascYdLcfMye1Rau6cy28jXLGrMaLE8LjghI,753
src/rules/windows__process_creation__proc_creation_win_reg_screensaver.eql,sha256=8iWj_lGa71uBwesBdsQR-6MHTLFz6eCwwz-G2IanCdU,814
src/rules/windows__process_creation__proc_creation_win_reg_screensaver.lucene,sha256=UGmbPrSOeUL6yTKGA9hx8s4TMEPvKSDWTrrS-00Iptc,790
src/rules/windows__process_creation__proc_creation_win_reg_screensaver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_service_imagepath_change.eql,sha256=_YB81QG2lDhw9RDjqvKG6J5YSzaGfJF8lH-vVomuCFE,276
src/rules/windows__process_creation__proc_creation_win_reg_software_discovery.eql,sha256=MxKsmKzKTw5J7ro5aAAoe803brX6FCcROMK9enphg1w,193
src/rules/windows__process_creation__proc_creation_win_reg_susp_paths.eql,sha256=dAz345cnBrLKjTIvDMXa4C_bX1YM0naSPc27ttqwhg4,433
src/rules/windows__process_creation__proc_creation_win_reg_volsnap_disable.eql,sha256=fE8OLuigJOdUtZ0819ujabRoRhmTG_xSOd4Z5m395pg,98
src/rules/windows__process_creation__proc_creation_win_reg_windows_defender_tamper.eql,sha256=3PkwBwh3KmPnZz230dVs4KRtK8gbBPHnBtJm5Wm9Ihs,1370
src/rules/windows__process_creation__proc_creation_win_reg_windows_defender_tamper.lucene,sha256=ePbLiGgn1oySweoFUVYb4_kzYjJBc0Q8_4A1-F3Kquo,1333
src/rules/windows__process_creation__proc_creation_win_reg_windows_defender_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_write_protect_for_storage_disabled.eql,sha256=zGlR3nC63XBUA2g4yf7tiOerBiVHS1D5aquKQ-y1yGQ,186
src/rules/windows__process_creation__proc_creation_win_regasm_no_flag_or_dll_execution.eql,sha256=rd_ka81EKTKLdWAGBm3PpXOeVBWlEcAa7Wv0uS46iYk,186
src/rules/windows__process_creation__proc_creation_win_regasm_regsvcs_uncommon_extension_execution.eql,sha256=EUv3wlQPcLNxQrl116H1Gc97KIfNp_VJUEMyhhUjUHQ,241
src/rules/windows__process_creation__proc_creation_win_regasm_regsvcs_uncommon_extension_execution.lucene,sha256=mWGKlrMr3NrChWq3OCHG7RsnaRRlnj1iU7LYfrdg95Q,207
src/rules/windows__process_creation__proc_creation_win_regasm_regsvcs_uncommon_extension_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regasm_regsvcs_uncommon_location_execution.eql,sha256=LU1Wm2IajRXkTZkxyDcpDclbRDLCWeyE9ThswaqE7_c,333
src/rules/windows__process_creation__proc_creation_win_regedit_export_critical_keys.eql,sha256=2tWG89DbtdP0a6abjpsffQQib0g0RKZAdN_XedVMwSM,323
src/rules/windows__process_creation__proc_creation_win_regedit_export_keys.eql,sha256=iR1fIFIvoN7DQjAWKneqf-9SRzaQl8GHlMNv4bmiNX0,333
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys.eql,sha256=h2GBO7kIe-DQOVuh32_wVKmHdIBjPNnL59sNx3KBIDg,477
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys.lucene,sha256=QhFI0WUMxrY9lNGoXNasvjSsamXNGvLPlrCJi8vrgP0,541
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys_ads.eql,sha256=-oSOcU88DBtrEXHHrKbZJp_7E-N9gptemyZJqfF8jDY,467
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys_ads.lucene,sha256=wDhOFAr2KDmXKAzRaz_fvpy0QZupDIBAtB1ybku2rgU,528
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys_ads.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regedit_trustedinstaller.eql,sha256=Y8VUJmYTsz4494wyzK3sMDShzq5wGH_I-ekNo7H-sIg,136
src/rules/windows__process_creation__proc_creation_win_regini_ads.eql,sha256=_3nAcmTeAD-3pcfVovvmuhshB_qhj3qnUbrNTwkGtXA,137
src/rules/windows__process_creation__proc_creation_win_regini_execution.eql,sha256=PjO_wnhv8q4k5489D7dlBpGEXFao0gRFuLp2hEgxBnk,143
src/rules/windows__process_creation__proc_creation_win_registry_cimprovider_dll_load.eql,sha256=sjsyHtg_sS7oAZz8MJ9AZa32cooC2UEThZyj-tDSALo,129
src/rules/windows__process_creation__proc_creation_win_registry_enumeration_for_credentials_cli.eql,sha256=jAWErhlGF9nyy4Ae9zwxAdPkg-0jAbTY4Z9zkPVBOGE,902
src/rules/windows__process_creation__proc_creation_win_registry_export_of_thirdparty_creds.eql,sha256=gTPy7-uvMu7FTyDu1wWL0DpsSmmg9vjQH7rYuubEsO8,937
src/rules/windows__process_creation__proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.eql,sha256=vwAhGF7ceQaaTsh5v3k3di3Q9SKjGl4K_GmDMIMBfHk,184
src/rules/windows__process_creation__proc_creation_win_registry_install_reg_debugger_backdoor.eql,sha256=ifylmMqLwlR9maDmNLT88aVYNdd5dkpClInLuLdXneo,257
src/rules/windows__process_creation__proc_creation_win_registry_install_reg_debugger_backdoor.lucene,sha256=GrZzy2BI_y4rJ6yv3Y2ZjyhU4Oan-Zna6OHD4_lJQ5U,239
src/rules/windows__process_creation__proc_creation_win_registry_install_reg_debugger_backdoor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_registry_logon_script.eql,sha256=Va1SMX7BiHluHTQVC7LvhCZnSuSXRBD6LD4xGLDRL4Q,58
src/rules/windows__process_creation__proc_creation_win_registry_new_network_provider.eql,sha256=J97MZT2qTnmRrpJaObHq3WRTgmCe0XezNerZgwfEvRw,122
src/rules/windows__process_creation__proc_creation_win_registry_new_network_provider.lucene,sha256=TB-DCpxDv6oIXXHDiZE59IDgfppHxglMbNNK2lt2kSM,107
src/rules/windows__process_creation__proc_creation_win_registry_new_network_provider.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_registry_office_disable_python_security_warnings.eql,sha256=E-earcZ0cSt8hzdTezNkqoRxBdgO_l_QNmdV-um5WYk,190
src/rules/windows__process_creation__proc_creation_win_registry_office_disable_python_security_warnings.lucene,sha256=o2s1kBfH30-wfIzMmVmYKZ3Dfw4dAL4F6ec9uRGyGk4,172
src/rules/windows__process_creation__proc_creation_win_registry_office_disable_python_security_warnings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_registry_privilege_escalation_via_service_key.eql,sha256=X_hELK7-RuquGLxbiBBDSKQZtvDmo9JT9l37PyQ8VI0,248
src/rules/windows__process_creation__proc_creation_win_registry_provlaunch_provisioning_command.eql,sha256=KVHFlsUygRfUzA_mgF2SUqo3f5DV68-xf0WGH0uF-UI,81
src/rules/windows__process_creation__proc_creation_win_registry_set_unsecure_powershell_policy.eql,sha256=Or4--aMqjq8B9XWUNs7ib6wnwkzlGKanfZ9Q_rhfZ6I,242
src/rules/windows__process_creation__proc_creation_win_registry_special_accounts_hide_user.eql,sha256=BYE_J1I_iAZiEjMO0vYKq8OTP9P0uKk_-aBZ9T8YMVQ,259
src/rules/windows__process_creation__proc_creation_win_registry_typed_paths_persistence.eql,sha256=dy77Y_PR56utCRf4Pbt8NDtU76jRoe6CFryIzmKHgpA,104
src/rules/windows__process_creation__proc_creation_win_registry_typed_paths_persistence.lucene,sha256=LH4pVCDUKC0Uk9A0wlqanCNHstTTcICh6iwFi_TQrMA,92
src/rules/windows__process_creation__proc_creation_win_registry_typed_paths_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_flags_anomaly.eql,sha256=Md1ftpAtW2VT7mCoT9GOf0p2Fh9N7Hwz2SX7xrBya6U,231
src/rules/windows__process_creation__proc_creation_win_regsvr32_flags_anomaly.lucene,sha256=qgFIoxgpk-r7biz0U8smueubBAivrk6RLHSyhXm1XgU,227
src/rules/windows__process_creation__proc_creation_win_regsvr32_flags_anomaly.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_http_ip_pattern.eql,sha256=wWwbugOpynV_oP0nlHaDraUbeFMdSu3OU6xL7olNOtU,797
src/rules/windows__process_creation__proc_creation_win_regsvr32_http_ip_pattern.lucene,sha256=qboPX3aKRg0Pzjt5wq3CghdPXqpjafXgWPYsQpZROLQ,991
src/rules/windows__process_creation__proc_creation_win_regsvr32_http_ip_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_network_pattern.eql,sha256=7YEZWQLMWrlpbHSYYLonSNNJiaKYeGoTBZuoB9Kjhuo,202
src/rules/windows__process_creation__proc_creation_win_regsvr32_network_pattern.lucene,sha256=FrxUk4l8nxsU1u6HFh__yTapLMDhbP8T0KhSf86Nvj8,176
src/rules/windows__process_creation__proc_creation_win_regsvr32_network_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_remote_share.eql,sha256=ECPjcJVey9DWpRGUgSmZHPPWt4FaLqL5YQa-lPgttyM,132
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_child_process.eql,sha256=eWsH6QkudCkm7GbxI9QaW1z1lMVuETle73C159sZAQM,412
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_child_process.lucene,sha256=kY5HagttFoP2CELOxEkSHb2P9EPRkHULvYrGmID7_Xg,393
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_exec_path_1.eql,sha256=Q62dpswoBr6yc0wUwSlJqC7mMxAuTxjAO1KHQIORBfc,272
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_exec_path_2.eql,sha256=OgpuyXXAJeT4UQ8FZFTCLt0nUqxPbp332-x8oUah9J4,1217
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_extensions.eql,sha256=xLvzsv0VvfmBLMgxn8h9v3DdZu7FanRW5ZiPIoanQLA,323
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_parent.eql,sha256=hR-1lD1ZZqwlQuEJi4gVu5H-RYqRpQKxBaOCC3xTrKE,364
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_parent.lucene,sha256=ZYIQr98u-KAuxUFUwHfqm01VfD7FTI2o0krLhcQ7Buo,345
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_uncommon_extension.eql,sha256=D7pMIz2zjgg586zfEBziOMxxAX4j4joQQ-nYJzRu8oA,341
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk.eql,sha256=nGklbtxeDnYiuqTijVbwMxMTZjtVmtn7h7yNPxSLsJ4,191
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_piped_password_via_cli.eql,sha256=G4gB96H1BaN0f8few6NENvZfOSpofx2FnejxDyNMFjE,123
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_revoked_cert.eql,sha256=6E0Nd04qRoZFD5peR2342k7z1dlY_-lc-LXOXRCuytA,362
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_silent_install.eql,sha256=pft42lV8K9r4gYRU13IVnsRLrM9FRwKHcU7AutQiIDM,129
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_silent_install.lucene,sha256=Kd4bfvamHhIT2sQrZNlrUDR80bm9sIMQz6siudPPdY0,121
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_silent_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_susp_exec.eql,sha256=J-r1aW25Lzhbtu0V9LrLYdhln1kCCGgMvXGuJF4dRm8,310
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_gotoopener.eql,sha256=fa1um8V_7v1I-vszf6e2qIRvmKRou1YyqBWu_KeWOYs,121
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_logmein.eql,sha256=-LcUazwnP8OR-xylaYrv8V4L7vfFfpclQFmlPPANf-8,127
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_logmein.lucene,sha256=tT1bTqYfck7QrRErFmhJj-aqaTwALiq6QlqGOe25pzw,112
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_logmein.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_meshagent_arguments.eql,sha256=rOu3vFOQdLRVn7veGJBQyKtVx0URMfX9av4fTmkGHxg,53
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_meshagent_exec.eql,sha256=yNoQWzmLb45qgdM5xMAHoZzy9FfuwQCe3oipEnTh0Z8,137
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_netsupport.eql,sha256=4kqnFYN2YTB1yBLjBNBvHxHKgrpu63NG8NubeTJGvLc,203
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_netsupport_susp_exec.eql,sha256=nb66qKDHqteAcCPLopLNBzVOikkz_QELx5UImqDSe6E,316
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_renamed_meshagent_execution.eql,sha256=jN4gSzdk5BkSg-5C0dchfnbXdqATnK-HtMFuuChLjFw,150
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_rurat_non_default_location.eql,sha256=l742JCCjCL2L_ZbymVhnfn_7wx8PEjzjnkWXirhd_AE,244
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_rurat_non_default_location.lucene,sha256=NB_uW9nzJca9mdXsIsRtlywgPmPooC_LQ93MWNPm7ME,226
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_rurat_non_default_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect.eql,sha256=g1T9PZ512ZjhyJ2Bo-lHLdObQdF9cnQNlBEjtezo2GI,142
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.eql,sha256=FGfBIBGvaYuQPbSi1HdReTnSG8fl_y83nsso3ju_mHg,182
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.lucene,sha256=TJP8xj4ExTdCKuA4NALF1-PapASxH0ny5pAzIlHEqjE,172
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_remote_execution.eql,sha256=vHavE27NJyt-D-Z_k6wRMTiGhy91jjwnkUItLamwqdo,207
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.eql,sha256=-aH5Nj0gG7KExlLBUoIvGk6hrmZYgS8QQPCTx_qY1as,326
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.lucene,sha256=4qkOUPsdsYAIjR0qUn3_g6-iUgeSZyTNlvxQGmn_ojE,304
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_webshell.eql,sha256=rms1QG5FwScSPriiqfamfIo-RvJtgBFkxSetgd2p-00,127
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_simple_help.eql,sha256=VF15mCIPFB1MMzcAmUVDyVW4nf4mGEj7gBZEdVwOX8s,149
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.eql,sha256=H5LpjPHBc6qpfNGwbNaa74VgxzNPvFtOo-IZAMnYdPI,261
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.lucene,sha256=80-8cYeW2m5W1rpBk7EbB14xcWRw4FaOB7460r3_SkI,252
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_teamviewer_incoming_connection.eql,sha256=Qmrt4VjjNrLc-0Y-YpmNHnvWy25UosUSVoMKNZ5IQC0,186
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_ultraviewer.eql,sha256=55kx6EHFt21Hj9S4fxFY2Uhs-3RkxYQRIKFrnRLc2ZU,145
src/rules/windows__process_creation__proc_creation_win_remote_time_discovery.eql,sha256=iyI9xAonWH3aFQTSYK2mDNySWeyeHfdoTIklU-8NQAg,174
src/rules/windows__process_creation__proc_creation_win_remote_time_discovery.lucene,sha256=QN9zvj0FIlMV-VQXaZaW4nxGpcmI81iyejV1NgRPz9c,150
src/rules/windows__process_creation__proc_creation_win_remote_time_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_adfind.eql,sha256=o-s0ZjptC3CkSs43gu9Shs5dF8xHXfL9hngn8HUY3Ic,857
src/rules/windows__process_creation__proc_creation_win_renamed_autohotkey.eql,sha256=6U2a2Xa4fRvtDNId5UUSkDSNydEvUSxmKWbXJSCI9hk,520
src/rules/windows__process_creation__proc_creation_win_renamed_autoit.eql,sha256=FXTZ5WuqUSIwuv5nz4L89xx1Y3kUhC4N1qJun4DSNGQ,463
src/rules/windows__process_creation__proc_creation_win_renamed_binary.eql,sha256=PLf2DWwaa4lU5B6BtunIbNO0lynjCQsNn4d0mBo0yAA,381
src/rules/windows__process_creation__proc_creation_win_renamed_binary_highly_relevant.eql,sha256=jnO2NYsLEv8zlhXFXWSr1OqUDhiklO02cnPx1oxqMdQ,870
src/rules/windows__process_creation__proc_creation_win_renamed_boinc.eql,sha256=pfNJtEbI6mRJr6sozt0Bi1sQvWwV1TKVaRjdHjQzJ9w,96
src/rules/windows__process_creation__proc_creation_win_renamed_browsercore.eql,sha256=oSa0zHY3_EkEp50c9xHgONn4R5sMbG4pvK2Ee7rraQM,108
src/rules/windows__process_creation__proc_creation_win_renamed_cloudflared.eql,sha256=peBGUcV7EI46AC3ElHTJiW17yTk67wJMNeIkb-8_6yw,3509
src/rules/windows__process_creation__proc_creation_win_renamed_createdump.eql,sha256=xb4cweQdlDWuTwSI0OQOWeNnPSelzwLRgddsT4bimzc,333
src/rules/windows__process_creation__proc_creation_win_renamed_createdump.lucene,sha256=mfm0aGgtC4iRFBEZgx_kmFY2kRl8VtIq2I2byjMtQ5k,321
src/rules/windows__process_creation__proc_creation_win_renamed_createdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_curl.eql,sha256=XeJP2ZuGNMDbpuBNqcosMBGapIxk3o8OJhFSVaEMDI8,141
src/rules/windows__process_creation__proc_creation_win_renamed_dctask64.eql,sha256=54SmfsOU1ciwad7zZNx5-ObMFqvR1hj6_WfcnlM8yN0,275
src/rules/windows__process_creation__proc_creation_win_renamed_dctask64.lucene,sha256=i1ONsfxjxQ4LZlbv8WfJyp1FLgwQcNSRq81nfsjC4TA,259
src/rules/windows__process_creation__proc_creation_win_renamed_dctask64.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_ftp.eql,sha256=oDK44-eD2f0L1mr4p21R_zWTf_iPTcakhn9hwd0Kzf4,92
src/rules/windows__process_creation__proc_creation_win_renamed_ftp.lucene,sha256=MPPuU6VArTK50m7_Qy3U_8u7UDaWzKPGMZSlK4YCLIk,78
src/rules/windows__process_creation__proc_creation_win_renamed_ftp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_gpg4win.eql,sha256=IaMU4sL5anaTSls2jokUcEq8W_q0B1DXxnRQfDcR80U,117
src/rules/windows__process_creation__proc_creation_win_renamed_gpg4win.lucene,sha256=0XsPHir5JrF4tc5bOQwAB2QVjdiC3uqS7jlE-_6ejOE,97
src/rules/windows__process_creation__proc_creation_win_renamed_gpg4win.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_jusched.eql,sha256=Oftsr0cyxsXy_yPwRdVIvBnn2pZTOpureqaOeLNz7Ao,142
src/rules/windows__process_creation__proc_creation_win_renamed_mavinject.eql,sha256=8s5E9ZA_SX5TC2fYBiidyHfYKNviGyZyzfYX6vOqpU8,169
src/rules/windows__process_creation__proc_creation_win_renamed_megasync.eql,sha256=zaLsGZzdpz5UjokcNe_vPdq91DLb3DdnUYCgCEIOwqs,102
src/rules/windows__process_creation__proc_creation_win_renamed_msdt.eql,sha256=kzALlR1ASPo3XZntyt6bo17m_6t9Q3QUzwCS9WGLG6Q,94
src/rules/windows__process_creation__proc_creation_win_renamed_msteams.eql,sha256=Fyr7Vz9TEFi8QBC3R15hJd4J2QAAuaZwhfBpm2qPh5g,149
src/rules/windows__process_creation__proc_creation_win_renamed_netsupport_rat.eql,sha256=lknENytMIRAcLJFRWSLuNXI8giAPXp6N9w_ZPB1N3o4,231
src/rules/windows__process_creation__proc_creation_win_renamed_nircmd.eql,sha256=cejWCRsx4qx-DV6Vb4WB5gOpMj4-VlJ6V46wdnz8BmA,126
src/rules/windows__process_creation__proc_creation_win_renamed_nircmd.lucene,sha256=aXn_KNYn5mCPO4ycwvfm7ySJxjvaedmz3-SB8KLLiK4,106
src/rules/windows__process_creation__proc_creation_win_renamed_nircmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_office_processes.eql,sha256=AmL3O7bkW03chdhOjkrNmEj85zo8UJ5LPvgPUYxpwEA,600
src/rules/windows__process_creation__proc_creation_win_renamed_paexec.eql,sha256=e4tf22Q7pwN1EiP77lW5TPjBj0S02gkMtPPyvlR-Loo,436
src/rules/windows__process_creation__proc_creation_win_renamed_pingcastle.eql,sha256=UvLdxfA-bDOO6I7DATBVSy-5_H5IZ-fp_y3zHQlSHI4,897
src/rules/windows__process_creation__proc_creation_win_renamed_plink.eql,sha256=p0LiaduhQFml2x-zXj0g1g5KG5FiYA0vWTaAFDek3xw,204
src/rules/windows__process_creation__proc_creation_win_renamed_pressanykey.eql,sha256=1-vpghXHAU8EGwIhCAxTKRvw55OIcrV-OtP1wIzkLAs,152
src/rules/windows__process_creation__proc_creation_win_renamed_rundll32_dllregisterserver.eql,sha256=9R2LXDsIOpm_as5XTVEULHBkK1dfS_5BDKWHeIYfPcI,100
src/rules/windows__process_creation__proc_creation_win_renamed_rurat.eql,sha256=Me54OhotwLL-DR0g7H8YlYBTJ73rzLgmEo5a9nqztEg,125
src/rules/windows__process_creation__proc_creation_win_renamed_rurat.lucene,sha256=d1eFcwXpvEm5SIvPwca3PzWG5svo27erfai_TyuWtto,106
src/rules/windows__process_creation__proc_creation_win_renamed_rurat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_schtasks_execution.eql,sha256=AscLWhcJ2CZ_bZvaweuKHZO_ErasE9rlWvuLTybEJR0,1346
src/rules/windows__process_creation__proc_creation_win_renamed_schtasks_execution.lucene,sha256=K3hxV83_MqUp6hYOB8_aPuRiJXQPAYqrt6gyacSHJEQ,1378
src/rules/windows__process_creation__proc_creation_win_renamed_schtasks_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_debugview.eql,sha256=3dzKmJUQIXVH5v2VmU7ZB3JJOapD_lnP_UBJNfcDjNI,150
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_procdump.eql,sha256=8Yzaha7zTO-yhAgNVSQ_b4cNAziyOrbAtN560e3WrlY,447
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_psexec_service.eql,sha256=TzFwHf8qFjHiHjCeV7BvuSsGi_FSuXlRBtJWdDFpS6E,112
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_sdelete.eql,sha256=X0SSn_3iTEF_Hr_M5pjK1S-VjnOMfKsNRIaHDvJ1KqY,130
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_sdelete.lucene,sha256=wwt8FfPt1izeileV_NSET5LUJ15zqfcPweDhOrF1Nbs,110
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_sdelete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_vmnat.eql,sha256=fjz13kpLOAveqSZ1mRQe_vJTz_J9ouZiD9ZDIIbRqrY,94
src/rules/windows__process_creation__proc_creation_win_renamed_vmnat.lucene,sha256=4W5_aXN5SrDmMPVMG5kFbrs-JxkP8u6zNahbl1DnwHc,80
src/rules/windows__process_creation__proc_creation_win_renamed_vmnat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_whoami.eql,sha256=ascUUgcMx0JEr0csMRYzPHiohSVlfMzIQydWzDLWHf4,98
src/rules/windows__process_creation__proc_creation_win_rpcping_credential_capture.eql,sha256=zhxqHBApZJP9Hc6NJBPHF0sAh10CJHXayoS9QHTjVZI,410
src/rules/windows__process_creation__proc_creation_win_ruby_inline_command_execution.eql,sha256=p4fKvFNtJnY16sA_TuADHpwIBX6JEqPv5Re2ZutEsHk,122
src/rules/windows__process_creation__proc_creation_win_rundll32_ads_stored_dll_execution.eql,sha256=JXcRL9O-qZURbph5Iy_QU9UU1ta8Rk9vMQ8S3eNBCcs,192
src/rules/windows__process_creation__proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.eql,sha256=Y9KV3HNwswg_EYdfrXcjF9pelF4sciou3W7WtfbqErE,270
src/rules/windows__process_creation__proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.lucene,sha256=mAsxY3sjd2r2cyUyynLIWm0-RyrH_t2KPWXc0MHi8uU,248
src/rules/windows__process_creation__proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_inline_vbs.eql,sha256=jvUGIbWhwXAizsoyZF0SsV494GmnDLyOk3QQ1SEHQGc,164
src/rules/windows__process_creation__proc_creation_win_rundll32_inline_vbs.lucene,sha256=Ot2EzWIwP-GNe-XE2aP7l1jrSIIqrIn27aR3R1Mn5OY,146
src/rules/windows__process_creation__proc_creation_win_rundll32_inline_vbs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_installscreensaver.eql,sha256=GWw_-wsIIBAvgeD7Q0-ejanqMW5joQ2eVq1KbN3vvNk,145
src/rules/windows__process_creation__proc_creation_win_rundll32_keymgr.eql,sha256=zQdecvOZ8P1egrOYAPCcEBa8Md7kmh4UHPv8I2LjZ84,177
src/rules/windows__process_creation__proc_creation_win_rundll32_mshtml_runhtmlapplication.eql,sha256=tLNv_b970E7jSg7xKiUcVSa9CTt2l6EpyNlSlc9O1Ts,148
src/rules/windows__process_creation__proc_creation_win_rundll32_no_params.eql,sha256=7a4rtbqtWULsLkfbXmQghfyOGCttg8pN-QgRgPtT7-8,189
src/rules/windows__process_creation__proc_creation_win_rundll32_ntlmrelay.eql,sha256=OtSwHJjYoTkz6lJu_ZMQH_blGBos0Oo90exfGl37ALE,289
src/rules/windows__process_creation__proc_creation_win_rundll32_obfuscated_ordinal_call.eql,sha256=YJ4SU1ttVjNa54_oiv92h-otbn3ATiOGJz7xwyTKshg,212
src/rules/windows__process_creation__proc_creation_win_rundll32_obfuscated_ordinal_call.lucene,sha256=vYcsxi_sADtH5MvD2N0uZQLI8mlH-d2jVtfsq6Zm-Q4,190
src/rules/windows__process_creation__proc_creation_win_rundll32_obfuscated_ordinal_call.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_parent_explorer.eql,sha256=9Zom5aqxtlwhCNcu0Eafrw1dZbKnfMTCaagTsIolaco,272
src/rules/windows__process_creation__proc_creation_win_rundll32_process_dump_via_comsvcs.eql,sha256=a41FCTKe2v3hDGYnr3isvJAb7ikWSzhHPAXl3WGPSvs,479
src/rules/windows__process_creation__proc_creation_win_rundll32_registered_com_objects.eql,sha256=aZ4oe9EnLxtr926UihMQUQDmGbqIVJe7Xjf6Fa9Sty0,227
src/rules/windows__process_creation__proc_creation_win_rundll32_run_locations.eql,sha256=F-q4QuuaqIYbEWbwJ3UgdNWUPBidCoYhDDubM5-S0Rc,336
src/rules/windows__process_creation__proc_creation_win_rundll32_setupapi_installhinfsection.eql,sha256=Pl3wR12YCjjOx3nhBG6ov9nnDAATWNjou6cKH5tVNw4,200
src/rules/windows__process_creation__proc_creation_win_rundll32_shell32_susp_execution.eql,sha256=nPiPf7LBoD2qEiCbyiwyCGwxvf7-QKP-Y-WBwLG6gc4,332
src/rules/windows__process_creation__proc_creation_win_rundll32_shelldispatch_potential_abuse.eql,sha256=HbRO7LnVrBFxgLib984---B5bCDERFjeZIh3bZxA4E8,147
src/rules/windows__process_creation__proc_creation_win_rundll32_shelldispatch_potential_abuse.lucene,sha256=RjoX2o3L-xYmzIKsk7Z7gfa0VQPCusvfybDw4SO0lTY,131
src/rules/windows__process_creation__proc_creation_win_rundll32_shelldispatch_potential_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_spawn_explorer.eql,sha256=Pg5d9rFpfoEbiG-6e-6c381Jrg-u7lC7ybAeL0s5HvU,168
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_activity.eql,sha256=1EYVxgN1B63L1ESYvl6WXwB8WMGWvho613Lf-wsEyrg,2512
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_activity.lucene,sha256=8DHmP0YlPhOPh9w1KzFZ8swQObiLYYFltY6QCmWjQXM,2399
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_control_dll_load.eql,sha256=Pago2MqSCYRhFSvNF4YZBleCuwKOpkX9TXynOX88oDE,203
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_execution_with_image_extension.eql,sha256=VOJJ3bd1fltl8uKCSEsB_2DiRbRGiTjKgW1GSnlJlII,273
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shellexec_execution.eql,sha256=kNIlbMqdTe-5FQA5oqqLnnOgKTZflTdqPbmFMoH93Qk,216
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shellexec_execution.lucene,sha256=Bq4-uMuPIuiIdUKv7yn3Bz0c-uhPrUP9k6ECuOBq0FQ,194
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shellexec_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shellexec_ordinal_execution.eql,sha256=l4kJw_3B6e96W6K5yNOBIXnc-P2m56AT_PBTiYGXdZc,662
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shimcache_flush.eql,sha256=EyW4L1xPa6q-WISh5yHphtn_3dsijLDGbIQ-MgxIXhA,308
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shimcache_flush.lucene,sha256=ypbEWE9mCsh7zlriGMtROe8o5VX6gM7mbOaI2G2tPHY,274
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shimcache_flush.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_sys.eql,sha256=sHW6dHIiTX5jBvqD2jXAKNhK2yJKK2OuX3IvIHIF6IA,104
src/rules/windows__process_creation__proc_creation_win_rundll32_udl_exec.eql,sha256=Giw_guJ2pKtdlZ8wji4-vhezSwaLk5xAUAHe1k0YvUM,319
src/rules/windows__process_creation__proc_creation_win_rundll32_unc_path.eql,sha256=SMw7q7xPZVqwUh7WC4jFO3x-xa2yiW8fpOTg6yGkpxQ,167
src/rules/windows__process_creation__proc_creation_win_rundll32_uncommon_dll_extension.eql,sha256=rL9kB09ndXaeIMGvJWsuOgESXNW002Wh4EnDkpiJi-k,1148
src/rules/windows__process_creation__proc_creation_win_rundll32_user32_dll.eql,sha256=Za_KZjQywMsARTCPr9SseM6K_GftpG471BoP2Q9_LBk,226
src/rules/windows__process_creation__proc_creation_win_rundll32_webdav_client_execution.eql,sha256=5i7Xz-ySse_UbK2_AgFHk06LULmrIVaFhwqOQ_skITk,221
src/rules/windows__process_creation__proc_creation_win_rundll32_webdav_client_susp_execution.eql,sha256=zJm8AcuAT5yt9KttAlWSfR6hlDNbvJxX60kXDu8BXUM,656
src/rules/windows__process_creation__proc_creation_win_rundll32_without_parameters.eql,sha256=eQBZwh4RTDYOkpB-Rt0anXbhv-yc83so_LKA3J04-hA,66
src/rules/windows__process_creation__proc_creation_win_runonce_execution.eql,sha256=gTEEk44271EnrVMPDT0NAX-NrsIe0b7Bfae4i-uqEaM,162
src/rules/windows__process_creation__proc_creation_win_sc_change_sevice_image_path_by_non_admin.eql,sha256=hjxVAu8Xl0rZtgvXryS6jSrk_NmNwth3adrhdJiUQJo,266
src/rules/windows__process_creation__proc_creation_win_sc_change_sevice_image_path_by_non_admin.lucene,sha256=tyZI63mVp4sJS7sm066jv7RvjaU2i59v_mbZA0rcZAE,241
src/rules/windows__process_creation__proc_creation_win_sc_change_sevice_image_path_by_non_admin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_create_service.eql,sha256=lPBhSk5iwaRI4ykdMGD7HzN6iSQwC3qIz_HOm2pejQA,300
src/rules/windows__process_creation__proc_creation_win_sc_create_service.lucene,sha256=C09_TvbsU2-sgMoJ4AiBKtsT81g8aXUIUHhVHEuK2rs,279
src/rules/windows__process_creation__proc_creation_win_sc_create_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_disable_service.eql,sha256=Q6S2WdCQz6MLFj1ywj6PGHk71rCTn3yqxlfc5xSkhK0,222
src/rules/windows__process_creation__proc_creation_win_sc_new_kernel_driver.eql,sha256=krH7pbuJl3wO1-j47dhmR0GNbbcncOjtQ_BVmGNdDHM,726
src/rules/windows__process_creation__proc_creation_win_sc_query_interesting_services.eql,sha256=SGw3VHhIxXM0kLpPUZi2nBhxLb9_00jZdB_mniTA4F4,161
src/rules/windows__process_creation__proc_creation_win_sc_sdset_allow_service_changes.eql,sha256=AmidaeiSqWBHXyTlxPfheXwD0cs_O-Ci1fx78HsQ_3s,327
src/rules/windows__process_creation__proc_creation_win_sc_sdset_allow_service_changes.lucene,sha256=AUWH-iwPXO9ZK5v1n9RbZcTlC_iJiSTihjskZbNbhPc,301
src/rules/windows__process_creation__proc_creation_win_sc_sdset_allow_service_changes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_sdset_deny_service_access.eql,sha256=mcAaCXVbWtb_w_sCZ_aANeWCgjmuOhGngLZ2CJULmSQ,233
src/rules/windows__process_creation__proc_creation_win_sc_sdset_deny_service_access.lucene,sha256=Nvhm4Ut8w3pWuy_mSEaQey6cJXJHNXn2YoAiA-4Wv0A,207
src/rules/windows__process_creation__proc_creation_win_sc_sdset_deny_service_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_sdset_hide_sevices.eql,sha256=v6-CRkMNus3HafbjIG8e08RwSwX7G0k5czLp0C_wpZA,162
src/rules/windows__process_creation__proc_creation_win_sc_sdset_hide_sevices.lucene,sha256=L-88r8zjKlACqDTpOXH0jWuXbJMIAwlhBn605v6KyXk,144
src/rules/windows__process_creation__proc_creation_win_sc_sdset_hide_sevices.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_sdset_modification.eql,sha256=-6EYLrVruizdv--Mqh5RofVSZCyhuQIt08YUSVop7lI,120
src/rules/windows__process_creation__proc_creation_win_sc_sdset_modification.lucene,sha256=1OXd6_hUFAOjMBTnsupI2FSMQw0gH-HrSdJm8RY64_o,104
src/rules/windows__process_creation__proc_creation_win_sc_sdset_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_service_path_modification.eql,sha256=XUXn0XXgk83qde4vxTiicJgKsxtqjP0mDch3_pWD9Mk,508
src/rules/windows__process_creation__proc_creation_win_sc_service_tamper_for_persistence.eql,sha256=-QDOT84PNlyW2e8mxe1EMZELHp1FAJWF8xpBsc0Pyhk,624
src/rules/windows__process_creation__proc_creation_win_sc_stop_service.eql,sha256=jAO5VfHw0FFpiZRJqx3bLIKRjcTg9dTIUglcq9tsxQ8,121
src/rules/windows__process_creation__proc_creation_win_sc_stop_service.lucene,sha256=iBd6iYtnqld5dYJ0mMhXyA7MGjHFWIULJjE2Mbp9GbE,107
src/rules/windows__process_creation__proc_creation_win_sc_stop_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_appdata_local_system.eql,sha256=_nW_GMYL4PbWeIiVdr7LLgEO7lV07PrsZov8Xt6Dgcc,513
src/rules/windows__process_creation__proc_creation_win_schtasks_change.eql,sha256=rusBp1U1VLonHcgoMOGGKHu1fnnRMOohqjI_U6oBDzA,783
src/rules/windows__process_creation__proc_creation_win_schtasks_creation.eql,sha256=2eMdlN-fo-C0QpVdn-blta1NGvyolGU8uR1_wARYe0w,528
src/rules/windows__process_creation__proc_creation_win_schtasks_creation_temp_folder.eql,sha256=NzJd_SSo2uJxuZouNiZ8wpgFfPYx5eaYyy-wWZ0A9OE,166
src/rules/windows__process_creation__proc_creation_win_schtasks_curl_and_powershell_combo.eql,sha256=H2izZX_shinc5vh6kLa6rfOBL_8ZND7NJPh6MvZIsgo,305
src/rules/windows__process_creation__proc_creation_win_schtasks_delete.eql,sha256=GlnV_Q6ErvgLJML3ZqC6WuBdxgrkM3uCEfHYSd85e6s,378
src/rules/windows__process_creation__proc_creation_win_schtasks_delete_all.eql,sha256=CnmtV4teHJ5Zvf8GYWsW0-KKh0dBEiQ8J-EaUs37w2E,158
src/rules/windows__process_creation__proc_creation_win_schtasks_disable.eql,sha256=JDz2FXT08gAlyrhQwwqvL1lb7h62kd22KIRMeCVw__k,478
src/rules/windows__process_creation__proc_creation_win_schtasks_env_folder.eql,sha256=4oB-XWd8MNATifKqGW4-fjpYhi89Nx3Zy_MN1m-96BE,1384
src/rules/windows__process_creation__proc_creation_win_schtasks_folder_combos.eql,sha256=qOc6eb9EvnF8MmQoGoLFw44wOGEo8Hs_rWWN-IMOWYM,362
src/rules/windows__process_creation__proc_creation_win_schtasks_folder_combos.lucene,sha256=PBx2jbScM6MjcTiCOfXbDi_WM9eBZV13yxfXLI-QLs0,351
src/rules/windows__process_creation__proc_creation_win_schtasks_folder_combos.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_guid_task_name.eql,sha256=rtvir1pBBUogEME7y9zwkGq-7Mn6I9T-TjCT5dwq5Wg,216
src/rules/windows__process_creation__proc_creation_win_schtasks_one_time_only_midnight_task.eql,sha256=OBsHqySwZO6UDyF--FLInHC4yuNWE9sT2qLEQ4hBpic,319
src/rules/windows__process_creation__proc_creation_win_schtasks_openssh_tunnelling.eql,sha256=FBHjufBkIGW4ZCc3NKwjlxBsVpRtzt-n0Guufp0NPps,319
src/rules/windows__process_creation__proc_creation_win_schtasks_openssh_tunnelling.lucene,sha256=kwqmbqNq2JBFdUkBYjRvmXg8vw8q6GrKHtK41jw0tG0,301
src/rules/windows__process_creation__proc_creation_win_schtasks_openssh_tunnelling.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_persistence_windows_telemetry.eql,sha256=CZkQBSgO4dKR_aSGLZ4uyH5GT8nS4uNIBXSr85SRQJ4,222
src/rules/windows__process_creation__proc_creation_win_schtasks_powershell_persistence.eql,sha256=KujAkOmuLh5hl2ghFIrUT7Y-oLpyaEU7jRhFUKoaklE,271
src/rules/windows__process_creation__proc_creation_win_schtasks_powershell_persistence.lucene,sha256=kDUpCAm4tcl5YQEGfEppyScyyAGWs1UROROm7-vui-w,263
src/rules/windows__process_creation__proc_creation_win_schtasks_powershell_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_reg_loader.eql,sha256=OfazjSmBY_g76eCQHS38Bwpi2NdIf0KUUuSH8dwOIK8,367
src/rules/windows__process_creation__proc_creation_win_schtasks_reg_loader.lucene,sha256=ayUfjStxXcMp6uC9vwr9WlXI_wxYC-cq2aaeH8JTNv0,335
src/rules/windows__process_creation__proc_creation_win_schtasks_reg_loader.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_reg_loader_encoded.eql,sha256=Y5CoxQqKd-tRO1dIjUDSaGRgFXyWuHmOxBtwSlygDog,359
src/rules/windows__process_creation__proc_creation_win_schtasks_schedule_type.eql,sha256=UcbLv1iHqk_BGylZqqF8_OUAPa61hEZFrZnfBCwhXAE,267
src/rules/windows__process_creation__proc_creation_win_schtasks_schedule_type_system.eql,sha256=wezciYrMB1IyQc0GBS93rgKgH-P6y0V-gtlhN7GMbyI,259
src/rules/windows__process_creation__proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.eql,sha256=gt0viYCFbQebec2OF2wANVwKPMdts9aJ-dIBID6N0Mk,924
src/rules/windows__process_creation__proc_creation_win_schtasks_susp_pattern.eql,sha256=DoI3oiuNLRiJJsCumXaSU6VYUyxX7mCWCo1SrhOStiY,777
src/rules/windows__process_creation__proc_creation_win_schtasks_susp_pattern.lucene,sha256=P9Cd7-z20S5n74iFox_g8ilZ95hqH9E0CwkdlS2h0Kk,765
src/rules/windows__process_creation__proc_creation_win_schtasks_susp_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_system.eql,sha256=pwfzeFgIFPMw1RpsRSQyKZgdDPmYh7AyG-CGXpVxV5w,776
src/rules/windows__process_creation__proc_creation_win_schtasks_system_process.eql,sha256=kvYdSe6VzscvcPph2nClSiqxe19bardg0DVTxH8tHTs,480
src/rules/windows__process_creation__proc_creation_win_scrcons_susp_child_process.eql,sha256=rD7maPk6e0qqNJvMur6T1L6esu1rTek_xJtNZs9tz3Y,302
src/rules/windows__process_creation__proc_creation_win_scrcons_susp_child_process.lucene,sha256=FngU6KwKC_qlULN2wIy5bpi-nzHMuhrJLvuJ8j-6Mns,282
src/rules/windows__process_creation__proc_creation_win_scrcons_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sdbinst_shim_persistence.eql,sha256=vGs6vOuJMeAqwj4ESQ_wlJDZ-iveY-YNbSebWG_ydqw,336
src/rules/windows__process_creation__proc_creation_win_sdbinst_susp_extension.eql,sha256=SuY85gcY3wCVM9dRsi0_ze0Krd_mA8d02LLop2jX_Vc,344
src/rules/windows__process_creation__proc_creation_win_sdclt_child_process.eql,sha256=YZAYazrrPUAJbg6npGM8C32HVMScp4A-KQeyHbwzId0,51
src/rules/windows__process_creation__proc_creation_win_sdclt_child_process.lucene,sha256=OhAQQ9zr4fnO-IBffvDICVH8PukalB3C0aE00Cdg9qQ,39
src/rules/windows__process_creation__proc_creation_win_sdclt_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sdiagnhost_susp_child.eql,sha256=1bZze4hkB24OSqPFlI_dGb0NbmzWPVLax3vHxPXdm0k,454
src/rules/windows__process_creation__proc_creation_win_secedit_execution.eql,sha256=Hx2QkvoNayunq7fc35hLUbDI2DxHN_Cb85izMYDbqAs,240
src/rules/windows__process_creation__proc_creation_win_security_susp_node_js_execution.eql,sha256=waeisR4T9y81gIAHjGE9xrN_Vy5nu5SwEAGxKcgjNr0,154
src/rules/windows__process_creation__proc_creation_win_servu_susp_child_process.eql,sha256=g_TAVaUvLhBaGFGaV-cPWZrSG-4Oh-UHEfebUmkioyU,346
src/rules/windows__process_creation__proc_creation_win_setres_uncommon_child_process.eql,sha256=9JONrCX5Pj9Jz4okRJraScn0FWM7uFA7pfrsEeP_B6M,204
src/rules/windows__process_creation__proc_creation_win_setspn_spn_enumeration.eql,sha256=DBk29KSDmYtEx6KmQEVgU0m1bg3_QDpsqpqvl3u5k08,252
src/rules/windows__process_creation__proc_creation_win_setup16_custom_lst_execution.eql,sha256=1CfyPjZjrIpTkTdXTLOr1xwiKzgE8Akw96LrdzxEiYk,165
src/rules/windows__process_creation__proc_creation_win_setup16_custom_lst_execution.lucene,sha256=TARMrcZx_alsEtEFV-VzLfHLIPJ-rKErXcRGFwfZuHo,154
src/rules/windows__process_creation__proc_creation_win_setup16_custom_lst_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_shutdown_execution.eql,sha256=KBq2_8ZEf6NaOF7Cr_u5E2CkC17O3sV5WACmq59Mo_Y,99
src/rules/windows__process_creation__proc_creation_win_shutdown_logoff.eql,sha256=CDcLwbebJaMcd2bSRraAMwMkUipN51483xTRDkf3on0,79
src/rules/windows__process_creation__proc_creation_win_sigverif_uncommon_child_process.eql,sha256=kWBkTt4H9LrK22WWb22Rww4kKOFfYtHOy3KCnaFdCPs,170
src/rules/windows__process_creation__proc_creation_win_sigverif_uncommon_child_process.lucene,sha256=wT1Cg8M_H6hBuqZBqKQAmeDFmV8aEVLM_6RXGZfHEPw,152
src/rules/windows__process_creation__proc_creation_win_sigverif_uncommon_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sndvol_susp_child_processes.eql,sha256=0dQBYzDMy9dbTGnDfN7slEL1Q07fi98EM9ddbhH-ofM,159
src/rules/windows__process_creation__proc_creation_win_soundrecorder_audio_capture.eql,sha256=xiXbXVCU835S_8KO8lVGMXrCN6QsBpcPVX93IwnPsgU,87
src/rules/windows__process_creation__proc_creation_win_speechruntime_child_process.eql,sha256=-siZ3kHNNf4NQDZ5eKNji6UQefBcqzwjNAUXAleEuxc,59
src/rules/windows__process_creation__proc_creation_win_speechruntime_child_process.lucene,sha256=LQFt-6LL2ZujDZ5lReDBDaFQF3dE1X9rUvuvhsm4mzQ,47
src/rules/windows__process_creation__proc_creation_win_speechruntime_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_splwow64_cli_anomaly.eql,sha256=aQ9_JMLH57Gu8bNLlPyOon3Snw7K3UtWicbDhheDxRY,88
src/rules/windows__process_creation__proc_creation_win_splwow64_cli_anomaly.lucene,sha256=OskbDNnFlRonfrVVd6Y4rTv0q7VTko_5eRlhxA2vQlc,74
src/rules/windows__process_creation__proc_creation_win_splwow64_cli_anomaly.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_spoolsv_susp_child_processes.eql,sha256=TGXH_O_3qHeN1JJf5O9zTbYKl-l-Q-u9nRj0TC1BC3U,1142
src/rules/windows__process_creation__proc_creation_win_sqlcmd_veeam_db_recon.eql,sha256=ebbkgeKU9AD7tUvNl568pv3yF8dMz6lISXOGVLc8ouM,279
src/rules/windows__process_creation__proc_creation_win_sqlcmd_veeam_db_recon.lucene,sha256=yF4fC1OGPIfRdSlp33mWsuRxDAHwbNCuSW2CaQTDGj0,256
src/rules/windows__process_creation__proc_creation_win_sqlcmd_veeam_db_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sqlcmd_veeam_dump.eql,sha256=zFuAaowK0HmBZWNwbinrIxpDvaRRy0pljQrnq2YzWsE,179
src/rules/windows__process_creation__proc_creation_win_sqlite_chromium_profile_data.eql,sha256=y8upZT1mRsojN3urtvetk_UlAvuGnItJB0KBPursOUE,312
src/rules/windows__process_creation__proc_creation_win_sqlite_firefox_gecko_profile_data.eql,sha256=HbYW8GnLd0w8XiqX8QCZutc5olFVrBmsvIMrRPs0Sjg,179
src/rules/windows__process_creation__proc_creation_win_squirrel_download.eql,sha256=O63ssGJdlQ4_c9DskfcDvar0IBvcF-yLyku0D0k6E2g,200
src/rules/windows__process_creation__proc_creation_win_squirrel_proxy_execution.eql,sha256=AFdlRjH5a9SYYkdZ63aT7BKzQwTScEQfAgTWYeG-y9s,1127
src/rules/windows__process_creation__proc_creation_win_squirrel_proxy_execution.lucene,sha256=vZDlkBfffppG-Yd5B5OCd8zCiLdvKvO_fSjpN8wsb0M,1067
src/rules/windows__process_creation__proc_creation_win_squirrel_proxy_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ssh_port_forward.eql,sha256=YIPyFgsfHY4QNTRJ4YeeGShOSnMzUjv08NvGpve51ok,130
src/rules/windows__process_creation__proc_creation_win_ssh_proxy_execution.eql,sha256=tQYuvCpSRbsD2wgpjKngnLxCt8LBNmyOlZJPh8ETpZc,754
src/rules/windows__process_creation__proc_creation_win_ssh_proxy_execution.lucene,sha256=ne796hbaHZfl_SV0xUP_HLNLDF6p4H7E8gPTMeByc2I,739
src/rules/windows__process_creation__proc_creation_win_ssh_proxy_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ssh_rdp_tunneling.eql,sha256=jb9CbVX_f5ZBCCJv6uKSLjHVZU6CnOqOVNFnaq3XdAQ,77
src/rules/windows__process_creation__proc_creation_win_ssm_agent_abuse.eql,sha256=LCpJz60BsG5eAXz8ySwtO9kaTCUGMLydXgE6ZmuIkr4,205
src/rules/windows__process_creation__proc_creation_win_stordiag_susp_child_process.eql,sha256=nLNINx3T4vHuBxUxIfs8LxV_A8vpghG3e1K-nAWwh_8,245
src/rules/windows__process_creation__proc_creation_win_stordiag_susp_child_process.lucene,sha256=P35jpXkQ2pTlyfy29aH_uVs-059uJAAWrQZ8Y9Pp02o,217
src/rules/windows__process_creation__proc_creation_win_stordiag_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_16bit_application.eql,sha256=HyyjeHMueMT7FsJOgJsGI-T9buK5FiVMamNfMh2IneY,70
src/rules/windows__process_creation__proc_creation_win_susp_16bit_application.lucene,sha256=YohZzdkET4rp7FAUiAGXgZmXVyNYLfBp5R0IvWfKlT8,52
src/rules/windows__process_creation__proc_creation_win_susp_16bit_application.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_abusing_debug_privilege.eql,sha256=xFyKBHOMPx2fiBLVbUmN4poUAP3uWe9der3693QF06o,489
src/rules/windows__process_creation__proc_creation_win_susp_add_user_local_admin_group.eql,sha256=EpR6a_04wOrtiNaYa38qN9VyvwEqqGcyaGbIl6PDb1Y,253
src/rules/windows__process_creation__proc_creation_win_susp_add_user_privileged_group.eql,sha256=1kF9hLJVppkAQluRT8mnjXCxafek6WasejklnJxKDdk,262
src/rules/windows__process_creation__proc_creation_win_susp_add_user_remote_desktop_group.eql,sha256=4YKjt_i62OefIF-Jd6C2iU6Fo2s-L04uBjgjlGmfSGE,311
src/rules/windows__process_creation__proc_creation_win_susp_alternate_data_streams.eql,sha256=w049PfQVYLGeSP8FwcOPMN16xUikgBW1pqdRxwH5JQs,473
src/rules/windows__process_creation__proc_creation_win_susp_alternate_data_streams.lucene,sha256=HSc3wDEgLc84vq49MxIk7CvhxaW2Rl5P-IHz9Qljpnk,460
src/rules/windows__process_creation__proc_creation_win_susp_alternate_data_streams.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_always_install_elevated_windows_installer.eql,sha256=EVfUcwNEnRnw-Q0-dC0jHnmaYd7QJpuRTR4Ia6vpXtU,840
src/rules/windows__process_creation__proc_creation_win_susp_appx_execution.eql,sha256=UdWd_nlEWD77UWwfPrdDLA3PIcJYyIDJHewyFby_GZo,710
src/rules/windows__process_creation__proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.eql,sha256=Qk3Ra9nFU-7kLcAhkaQbnoxSBnwFNrEHZxEPf7Ovxfk,111
src/rules/windows__process_creation__proc_creation_win_susp_archiver_iso_phishing.eql,sha256=GLIfIh49G9Ifkjc024pTL6o3D6p5rIZG7iyaVNTOGJI,181
src/rules/windows__process_creation__proc_creation_win_susp_automated_collection.eql,sha256=5NOIGNS-FIfPp0lArz4_ewDy1OJ8UrFdNPPypu3y5wk,343
src/rules/windows__process_creation__proc_creation_win_susp_bad_opsec_sacrificial_processes.eql,sha256=_7WcVuJlALTFaBASPwgP-qL-VqW-Wem3AW0Ua761Dag,943
src/rules/windows__process_creation__proc_creation_win_susp_browser_launch_from_document_reader_process.eql,sha256=A7pC7JS1OAOAtfcDFvo733RylPlMSOYyCSbSSAGESJE,522
src/rules/windows__process_creation__proc_creation_win_susp_child_process_as_system_.eql,sha256=nuE6fUemRmchHRrLA56VTyKt_C-q8X-Lb6u9sQTtDCs,442
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_escape_char.eql,sha256=hnfHhBtnIP2SikB1qGBcGtWDMspu93Al5ED2w05dhOA,67
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_escape_char.lucene,sha256=xNMuFivySStBN3q18wgKXaCZJkRFDboMTJ5_lfpNtW4,52
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_escape_char.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_unicode_img.eql,sha256=4ekJ7B01yODTc5Ilu6F5iA6Ii1uOOtAe3mEvOtS5lxQ,422
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_unicode_img.lucene,sha256=6qHvnJAVY9triD3CM1-hIBJ-tEz6M0tdyfkEzeU_mfI,388
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_unicode_img.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_clickfix_filefix_execution.eql,sha256=spV1GFiFKWHBwG74NBd2pfN0-0pUeq9W04TDaw8I8I8,340
src/rules/windows__process_creation__proc_creation_win_susp_clickfix_filefix_execution.lucene,sha256=fKkqN-GbNOyY7gUo7ghc9Thn3FnNhvwOUYFok2MSXLo,319
src/rules/windows__process_creation__proc_creation_win_susp_clickfix_filefix_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_clickfix_filefix_whitespace_padding.eql,sha256=PdRFKu9ry5SGg5lo8e4kiYReVuYiin1U25aRZejl8Us,631
src/rules/windows__process_creation__proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.eql,sha256=4vL3RUHADhxgI1UXTitzpAonwSB7vQoukmyRvtrEOW8,317
src/rules/windows__process_creation__proc_creation_win_susp_commandline_path_traversal_evasion.eql,sha256=peiko6Ov4GmBo1YoOznmTxHzlKY6yZjZ6aQJ9dFPGgw,362
src/rules/windows__process_creation__proc_creation_win_susp_copy_browser_data.eql,sha256=Mkk2cXhYjLrwBzjPridHmv1E4Ka1joecrmm4x0JkBwM,1149
src/rules/windows__process_creation__proc_creation_win_susp_copy_browser_data.lucene,sha256=1HYcMBrQKQJm5dW1rXaT88_hyeGKXyu0srepyxS3C6o,1150
src/rules/windows__process_creation__proc_creation_win_susp_copy_browser_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_copy_lateral_movement.eql,sha256=X8Ifl097nFiGBcqGRlDpG3hGVfImVPzZGADdCI9NPSI,647
src/rules/windows__process_creation__proc_creation_win_susp_copy_system_dir.eql,sha256=CKwemqUdFpEFB4T7eljoNb3v2Vsfsg3o1CWwJAvhpwE,738
src/rules/windows__process_creation__proc_creation_win_susp_copy_system_dir_lolbin.eql,sha256=e75fboPsT7xEylRRQjoyDydrSCtzx8krMyZiCRbSRfs,656
src/rules/windows__process_creation__proc_creation_win_susp_crypto_mining_monero.eql,sha256=yJkgfrmyXvvwTc4o6vbMwZGQrYyro9EWu9XiyQY3YFE,474
src/rules/windows__process_creation__proc_creation_win_susp_data_exfiltration_via_cli.eql,sha256=y-P4ATXoykAKM9_KzRTkwYCVPvz86PXALex9zYuwB2I,994
src/rules/windows__process_creation__proc_creation_win_susp_disable_raccine.eql,sha256=Udzv1m6zExhn4ZwCcml_ccs0poiDLlRq4x9PsIP_TJk,339
src/rules/windows__process_creation__proc_creation_win_susp_disable_raccine.lucene,sha256=sQKfqIfHmBKr_u-x_VwI6S_N8Kq8dNUBqwBol9ovq5M,318
src/rules/windows__process_creation__proc_creation_win_susp_disable_raccine.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_double_extension.eql,sha256=EgeNrDGqOkexQSv5heRMxAsVwzlrWnuSDEDcs0a1RmU,914
src/rules/windows__process_creation__proc_creation_win_susp_double_extension_parent.eql,sha256=Bn7GnzAW0RCsAi4kBv89C8aQdYUJDk5JI179Eo8FGgI,565
src/rules/windows__process_creation__proc_creation_win_susp_double_extension_parent.lucene,sha256=wGwG2qmbYoKvyZs3kkwRY_ZW0k_pmGHyi-liq4fBhz4,539
src/rules/windows__process_creation__proc_creation_win_susp_double_extension_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_download_office_domain.eql,sha256=iY55rQvDGIeGaYGgIDGhQwV4HmNkjo2xKQVbc9TMmSU,366
src/rules/windows__process_creation__proc_creation_win_susp_dumpstack_log_evasion.eql,sha256=Wp4ifvPxZtH6AXmfJhQucTM6DfkqKTMRnVebm03gZWw,94
src/rules/windows__process_creation__proc_creation_win_susp_elavated_msi_spawned_shell.eql,sha256=W4Byo9Absr_u0ZGnTqG57uyoP-RtHvF6nen2M_zr8Lw,309
src/rules/windows__process_creation__proc_creation_win_susp_electron_app_children.eql,sha256=DXHJ2bAKJrivjcVLEv9YaWamRvP5rvgyos8xp6yxmLo,674
src/rules/windows__process_creation__proc_creation_win_susp_electron_app_children.lucene,sha256=4NgsEjFo4ZW2OceyyqTdz6FtuBN4EYyu5j9Xy2YZrws,632
src/rules/windows__process_creation__proc_creation_win_susp_electron_app_children.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_electron_execution_proxy.eql,sha256=cgfWoSWWmvLZWHIeAuTkhetHqYjKb-_tZ-2mikhTueI,601
src/rules/windows__process_creation__proc_creation_win_susp_electron_execution_proxy.lucene,sha256=RFUIThEt4NNKxJM-lzuVB9wlDYwfzhT6IVFgmaiivVU,582
src/rules/windows__process_creation__proc_creation_win_susp_electron_execution_proxy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_elevated_system_shell_uncommon_parent.eql,sha256=f__wvGepKjw8weYRAJ7FPADN2AMDSfJO5eW1qUJDy44,1093
src/rules/windows__process_creation__proc_creation_win_susp_embed_exe_lnk.eql,sha256=UOSxrQ9U4kfcqmlnoTfn9w8cVzqfQA356X1c789KZyI,196
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_1.eql,sha256=dSTDG88J9abumnxpiNL9UCoRmiZ4nYEr7iBOZxVbshs,15786
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_1.lucene,sha256=nzWQyIhug8B6SCNkDsJUW045-7UGyjFVdayGzcHX12I,15768
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_1.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_2.eql,sha256=8D63SMx7K2d1vx0dY2TWxObQ70YNE1zQH2kXd4hWvh4,18511
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_2.lucene,sha256=634rOBjMuHmk1Gl2R68tWo2edNIU8nUmO4wWOeAz70s,18493
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_2.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_3.eql,sha256=7PFWgy8OAGFY8-9ZMpUOw-S8xXetBhEf8nsjm63-xB0,10598
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_3.lucene,sha256=AyfS90v-P2LG0HUkVAmHRqi9eCII1-Mww1QMoC8WU04,10580
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_3.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_4.eql,sha256=S1YrO7P_dgDYlSh5sjaffwy9LuD_QaOVtORxSn4SFzE,14552
src/rules/windows__process_creation__proc_creation_win_susp_etw_modification_cmdline.eql,sha256=418Yx3ZbfYtcarzCBwn-Eu52EKcEI_eerTU60SZrsR8,84
src/rules/windows__process_creation__proc_creation_win_susp_etw_trace_evasion.eql,sha256=QX3t09nfpOWxnZsZYMeVAfJNuSlCgKNuFknrVdalBXY,611
src/rules/windows__process_creation__proc_creation_win_susp_etw_trace_evasion.lucene,sha256=Niu2hEjAIyMlFV3eFRGEUCGWY4GG8DgNoxPf2ytmVG8,582
src/rules/windows__process_creation__proc_creation_win_susp_etw_trace_evasion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_eventlog_clear.eql,sha256=SPaxsVdajEdWjLQRlR7R5D-Rwopn_ScArJomMWI-WrA,905
src/rules/windows__process_creation__proc_creation_win_susp_eventlog_content_recon.eql,sha256=kyAbWobOwYiiOVDqGqv9C2sQ-phJw6-X_PzvHvkVtU0,1603
src/rules/windows__process_creation__proc_creation_win_susp_execution_from_public_folder_as_parent.eql,sha256=GRxMGNrSkDBJPAo5YO7DC5nBV-rT8gcAmneUxrsp3go,415
src/rules/windows__process_creation__proc_creation_win_susp_execution_from_public_folder_as_parent.lucene,sha256=6eVrlZRKGYUesZ0HRpJyOGHkpOjCaLHgD6c-U5r6ODU,387
src/rules/windows__process_creation__proc_creation_win_susp_execution_from_public_folder_as_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_execution_path.eql,sha256=TaGKYlOd_Dcta-5y5y2kbkytp_U0gj8j7bbhDGsZ_MY,744
src/rules/windows__process_creation__proc_creation_win_susp_file_characteristics.eql,sha256=dejyG4mz6pkO2ckCe1Vk7vJYCU3AcNEy7kezSzSVLqA,244
src/rules/windows__process_creation__proc_creation_win_susp_filefix_execution_pattern.eql,sha256=v8VzPQXvzJ9Aya16OnsFDXifpoGWeSgGQ_ocQPtKU9E,624
src/rules/windows__process_creation__proc_creation_win_susp_gather_network_info_execution.eql,sha256=gTJhhRInwz40HTHCZlJhJ6lRo9C01UGoOyXfnaRrjn0,131
src/rules/windows__process_creation__proc_creation_win_susp_hidden_dir_index_allocation.eql,sha256=CK6WYEWddLpZDNXiuLJG5gVDIPnqEpwQ1vAU409YUlQ,55
src/rules/windows__process_creation__proc_creation_win_susp_hiding_malware_in_fonts_folder.eql,sha256=OfbzRTrs-NJA2lVMBVplX-mzuDB5oqpTLzQqIpABLlo,370
src/rules/windows__process_creation__proc_creation_win_susp_homoglyph_cyrillic_lookalikes.eql,sha256=ZjHLae3PAAGYjYR04c51BMvDFrdaEKeC8z5jQshFEdc,457
src/rules/windows__process_creation__proc_creation_win_susp_image_missing.eql,sha256=eRf6tKYht2V7ce0c5U0VFDJNstkaq2mi8lKlxYS8JlY,318
src/rules/windows__process_creation__proc_creation_win_susp_inline_base64_mz_header.eql,sha256=h9xDeBWxq_17qJmrHeHfW-xyZr8OVSJZTXmhlUDZBYs,148
src/rules/windows__process_creation__proc_creation_win_susp_inline_node_js_execution.eql,sha256=VDRc2T6SLlIOo9g1FlB074TLpbPXnL479vdnNbDGHSc,330
src/rules/windows__process_creation__proc_creation_win_susp_inline_win_api_access.eql,sha256=rBC7DfzZoMJXm6HXI6KvD9yM22ZeERQuMj_h3tl_xwI,1250
src/rules/windows__process_creation__proc_creation_win_susp_jwt_token_search.eql,sha256=bUarTOogJrg5q2CPIOwn0aYOvGnWmTzLg449jmhhiXU,267
src/rules/windows__process_creation__proc_creation_win_susp_lnk_exec_hidden_cmd.eql,sha256=whTq1EZclh377M3Npp8_nOTonI7rxNeWK18ZFWdykD8,309
src/rules/windows__process_creation__proc_creation_win_susp_lnk_exec_hidden_cmd.lucene,sha256=SrglKff-Oe18KmCelf3Y2YGh7P9mxWcoIZmTbBMbsAY,369
src/rules/windows__process_creation__proc_creation_win_susp_lnk_exec_hidden_cmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_local_system_owner_account_discovery.eql,sha256=TSi9qOEMp9CgLID5wkJm-Zc6HmQIuyK1DBISsrWrm80,821
src/rules/windows__process_creation__proc_creation_win_susp_lolbin_exec_from_non_c_drive.eql,sha256=Uo8WPu2jNhxEhg-5djoDcOh18sh2ExnUhDNnpaPwEmY,490
src/rules/windows__process_creation__proc_creation_win_susp_lsass_dmp_cli_keywords.eql,sha256=y2MaPhzkHC2yxoglxbhACwxSt_l5kZU2rjf5WP15B7c,395
src/rules/windows__process_creation__proc_creation_win_susp_ms_appinstaller_download.eql,sha256=jRaMCLQCzZu_YmIdSPSF0Z7sqcZ4kx-6q42-EaEtb2Y,96
src/rules/windows__process_creation__proc_creation_win_susp_network_command.eql,sha256=A3vJ-frn202qynepTWn0xTlGCgVdIbabZD2EpK68YUY,161
src/rules/windows__process_creation__proc_creation_win_susp_network_scan_loop.eql,sha256=dgPPEO3BdqxLQUwdE4nlXQAu7CCkJ2scWLLyw8jvxdM,122
src/rules/windows__process_creation__proc_creation_win_susp_network_sniffing.eql,sha256=cIX-9BqeA8DeUC1VYKe7hXpmynq_tvXqbyPvLtr3WZ4,118
src/rules/windows__process_creation__proc_creation_win_susp_no_image_name.eql,sha256=dCScRZ6LtwgYe6AQgAjFACKstJG4afq_A1TX7MNWXeM,39
src/rules/windows__process_creation__proc_creation_win_susp_non_exe_image.eql,sha256=ZwAqZSoWoVF_T9EkPGv9LlSmq4zgyzT96gmRyhIraPI,1408
src/rules/windows__process_creation__proc_creation_win_susp_non_priv_reg_or_ps.eql,sha256=YVVNIR-e0uNsP9DY7LUmeYIyifS-yio2HJyJCjWpsOo,418
src/rules/windows__process_creation__proc_creation_win_susp_non_priv_reg_or_ps.lucene,sha256=f9uHz8-591yoj5ruJ0-fPDIoYFtvm8JC6LNRoQ2UGUk,384
src/rules/windows__process_creation__proc_creation_win_susp_non_priv_reg_or_ps.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_ntds.eql,sha256=Zwy_ut18-4O_2RdWjLMDJ_97IQN5NlgLBeBptbymDSo,847
src/rules/windows__process_creation__proc_creation_win_susp_nteventlogfile_usage.eql,sha256=kGp_ZroH-jsSjElnO7FIc-9EyJbvqqj1CRCviUPYFug,289
src/rules/windows__process_creation__proc_creation_win_susp_ntfs_short_name_path_use_image.eql,sha256=wxMQmuDyZpyNqZqO_VuyZ_-XB3kqDaD-10HcVkXZqSU,599
src/rules/windows__process_creation__proc_creation_win_susp_ntfs_short_name_use_cli.eql,sha256=kwUIjn5pTQko8xGwo-y4M7ddLeOahXtRxEYa4bn07f4,413
src/rules/windows__process_creation__proc_creation_win_susp_ntfs_short_name_use_image.eql,sha256=y27Cu1jtk3Ufg_H-fyH3aDBg6XWcA1LPTZ_hDsWZ8yQ,554
src/rules/windows__process_creation__proc_creation_win_susp_obfuscated_ip_download.eql,sha256=dykoluGjNsMBQextxm9YnqsspFb16GyZDQHeqcQtQXE,706
src/rules/windows__process_creation__proc_creation_win_susp_obfuscated_ip_via_cli.eql,sha256=yqQykGZytaCnGya6oYwUHJu9vlCuOkNTezOP7YK5tPg,607
src/rules/windows__process_creation__proc_creation_win_susp_obfuscated_ip_via_cli.lucene,sha256=s7u2g8oTOQKq-Dht80TK9WEI7pXvfPCf1e9nhzyVhQ8,1408
src/rules/windows__process_creation__proc_creation_win_susp_obfuscated_ip_via_cli.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_parents.eql,sha256=AjoJXO4VQTEh92HSJUm5GWupaUyUkUNozSWbudI5_vE,450
src/rules/windows__process_creation__proc_creation_win_susp_powershell_execution_via_dll.eql,sha256=NZrmYO3Wr2Pla0ujV-bqMjkJa6jh-iModZK-4b7TxrA,419
src/rules/windows__process_creation__proc_creation_win_susp_priv_escalation_via_named_pipe.eql,sha256=QVt99_0-72RqkX5CdCg8gw2GIDnTwhxEn28-sf4kPXs,254
src/rules/windows__process_creation__proc_creation_win_susp_private_keys_recon.eql,sha256=ixGgH5oVQ_W6TFElRjcZAqKETMATcMi0wKZJlRUKGQw,534
src/rules/windows__process_creation__proc_creation_win_susp_privilege_escalation_cli_patterns.eql,sha256=N8pWpRidjFbcUFFs-iiGOyi-tBNIGeNgDN31oidySOQ,358
src/rules/windows__process_creation__proc_creation_win_susp_privilege_escalation_cli_patterns.lucene,sha256=WzVcjprluFGDWN3kXD3HHOHrVc149W2D6H9HUAJg69k,387
src/rules/windows__process_creation__proc_creation_win_susp_privilege_escalation_cli_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_proc_wrong_parent.eql,sha256=_AwZXkJHeWV6IQ83D4g4k24t9bwxYM7dH52I2lhfHIU,630
src/rules/windows__process_creation__proc_creation_win_susp_progname.eql,sha256=L3vfLsRo6FGvzRnKyHKTVGDvwBbC8mK_-CUoVJNXq10,798
src/rules/windows__process_creation__proc_creation_win_susp_progname.lucene,sha256=QWSjcXdv2ztr1UEkLnaHMkd-OxwL8TCdodGFywFaoLo,766
src/rules/windows__process_creation__proc_creation_win_susp_progname.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_recon.eql,sha256=SZpdo-wnxwACOIbkEwBtCeltbbt1hhtUbwYdQmgG2VQ,252
src/rules/windows__process_creation__proc_creation_win_susp_recycle_bin_fake_execution.eql,sha256=t5TY0mzzmbwNyoFKLfWjk-7tf1-5_xQwqvc58sEk-3Y,77
src/rules/windows__process_creation__proc_creation_win_susp_recycle_bin_fake_execution.lucene,sha256=lQkU8D0IrA7mZb4XXO6g1EUV1wOjSU73EqWZid0YH1c,57
src/rules/windows__process_creation__proc_creation_win_susp_recycle_bin_fake_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_redirect_local_admin_share.eql,sha256=eBioNzs-x4XjmdTukni6kEdopQawGv25C_MUrPTMPvo,125
src/rules/windows__process_creation__proc_creation_win_susp_remote_desktop_tunneling.eql,sha256=A9I-OZUSIy1G_dJ2vHK5QEROQN2R8LLAFBZifxVRYmo,128
src/rules/windows__process_creation__proc_creation_win_susp_remote_desktop_tunneling.lucene,sha256=uJIX9jRhb4ZgXF69R7pKiNs7N6IlOpOg85wZm6E0ZOs,124
src/rules/windows__process_creation__proc_creation_win_susp_remote_desktop_tunneling.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_right_to_left_override.eql,sha256=Xwqyd2hrf5RwNaJGcnzP4Y4_Gc22JGEvO0qWTNTWU04,65
src/rules/windows__process_creation__proc_creation_win_susp_right_to_left_override.lucene,sha256=NX1qhsEZGD7q6z0MB4Y66ImLr7qeWAkBkbE52ms8xvk,50
src/rules/windows__process_creation__proc_creation_win_susp_right_to_left_override.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_script_exec_from_env_folder.eql,sha256=T-YwkHM6T6bLIQgopoyRv4DaaywowRzpQ9baBBXR3wM,769
src/rules/windows__process_creation__proc_creation_win_susp_script_exec_from_temp.eql,sha256=aiCsqxIsbUS_ZFR0_paSbI2OBn86UFWFLd_t44ULTo4,528
src/rules/windows__process_creation__proc_creation_win_susp_sensitive_file_access_shadowcopy.eql,sha256=gJFziyUbHQaGwX8yxtw1IB0awqoUQd_xMo06OASOfMI,167
src/rules/windows__process_creation__proc_creation_win_susp_service_creation.eql,sha256=FbgIN-G0AqRxD40YDvcf52CPEITV2HmY3BgXJovivBE,564
src/rules/windows__process_creation__proc_creation_win_susp_service_creation.lucene,sha256=RqxjVrp6qXFlE8khxzAhgqwrCTg-PsdG-9ymC2UEdjw,545
src/rules/windows__process_creation__proc_creation_win_susp_service_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_service_dir.eql,sha256=dQ5VCnV3pml3Bc6Wfp6z9tfATEmwCMY6nCB4s5eITvM,379
src/rules/windows__process_creation__proc_creation_win_susp_service_dir.lucene,sha256=IRKKHdcEKC3MRiscEhygMR73yepIJ1MjSfhXIFoKfog,345
src/rules/windows__process_creation__proc_creation_win_susp_service_dir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_service_tamper.eql,sha256=AnEaEp12coHYYzM4BLDqynjWBiSVxyoRAnz5wDBgA6E,4547
src/rules/windows__process_creation__proc_creation_win_susp_shadow_copies_creation.eql,sha256=t5LqZgl02paoe8K864NxDhHnUo4Fex_v0L1MTlaUJys,284
src/rules/windows__process_creation__proc_creation_win_susp_shadow_copies_deletion.eql,sha256=dqWsUluPs4C9LdVGr8SrqZFgRmcyiLCDKZ0TG3VkWlE,764
src/rules/windows__process_creation__proc_creation_win_susp_shell_spawn_susp_program.eql,sha256=E48cZLAYSotI52IwnXe9e1_ulEQXvqnup_UsxwgN_Nk,1179
src/rules/windows__process_creation__proc_creation_win_susp_sysnative.eql,sha256=JHdDQgw4jffbN3IQY9MapxILGyLpLAEyzgicBlNg3oo,581
src/rules/windows__process_creation__proc_creation_win_susp_system_exe_anomaly.eql,sha256=29LqLceW2gN3v98bLVpKs4ZTgHFnMljNU_O3nwShnqk,1934
src/rules/windows__process_creation__proc_creation_win_susp_system_user_anomaly.eql,sha256=j4-pzIt9KZRLQxKWp7wTonx2qzQ10xnr0K__ec3fi_w,1633
src/rules/windows__process_creation__proc_creation_win_susp_sysvol_access.eql,sha256=G7u6wyfNCbNhGyX2Pkv0r-lQKI6WZdckufOGQh8cdqQ,88
src/rules/windows__process_creation__proc_creation_win_susp_sysvol_access.lucene,sha256=xRlTP-aFLBbOjDniXsHxmEW5o78QmoJ4fmangRu5oB8,72
src/rules/windows__process_creation__proc_creation_win_susp_sysvol_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_task_folder_evasion.eql,sha256=sbgWwJLRPzDi7H82oFIX1DT9X70YXiqiKpDhGSD3jpA,201
src/rules/windows__process_creation__proc_creation_win_susp_use_of_te_bin.eql,sha256=jViV27f371jz4fy9C6RG9c4tJ7PLLqujwBPwG7HnJgA,126
src/rules/windows__process_creation__proc_creation_win_susp_use_of_vsjitdebugger_bin.eql,sha256=fPT_PGWNSTWwzCgW3grUdqpB_TE8wbZLzjLjctSQp3w,151
src/rules/windows__process_creation__proc_creation_win_susp_use_of_vsjitdebugger_bin.lucene,sha256=TIM0pqJE3plRgV2BCqs-mYTwDSOxzCWu7oU72SxbLBY,131
src/rules/windows__process_creation__proc_creation_win_susp_use_of_vsjitdebugger_bin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_userinit_child.eql,sha256=Ug979DLxjFlzepmpgTFURFhOjS87YdgGhjvUnlN8Pho,319
src/rules/windows__process_creation__proc_creation_win_susp_velociraptor_child_process.eql,sha256=JxqRddHK_hTBvwDTMk0ArjG0sgjCq7IjhDsI4cJXf8s,501
src/rules/windows__process_creation__proc_creation_win_susp_weak_or_abused_passwords.eql,sha256=t6dfNTqBsVLJiujgEEJguMAku8DHHwo41csjBUiT0i8,160
src/rules/windows__process_creation__proc_creation_win_susp_weak_or_abused_passwords.lucene,sha256=CR74thO8WiYgYLU4szoCaKx_Xzkip76h_XTIHUG6Bf4,143
src/rules/windows__process_creation__proc_creation_win_susp_weak_or_abused_passwords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_web_request_cmd_and_cmdlets.eql,sha256=aqVDYW20uQy5JjKCtPWslUVddi8mZ2mRhwcdbH-dYQ0,241
src/rules/windows__process_creation__proc_creation_win_susp_web_request_cmd_and_cmdlets.lucene,sha256=irsqOQU1TO9JGspDEjMFBjsZHGsjoxkIZPSg6VKNBEg,236
src/rules/windows__process_creation__proc_creation_win_susp_web_request_cmd_and_cmdlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_whoami_as_param.eql,sha256=bhUIFg8IxB0zAhZdRowLDFvqYKM7T6NTtfw1VKuHAkY,47
src/rules/windows__process_creation__proc_creation_win_susp_workfolders.eql,sha256=K82oeUIjpVU4reNGCjrMjbmvWhAr89sF5ECCLtwhaWc,165
src/rules/windows__process_creation__proc_creation_win_svchost_execution_with_no_cli_flags.eql,sha256=6VZpLEZDSYoFjGWk7Vf2qaHbb4EnaqYEdNLDkXlBKw4,245
src/rules/windows__process_creation__proc_creation_win_svchost_masqueraded_execution.eql,sha256=Iv5jFbEvKWf11eG0Wi9PAowmjJYiWqeZjqr6AYtctxY,209
src/rules/windows__process_creation__proc_creation_win_svchost_termserv_proc_spawn.eql,sha256=onQbzbMENAfyAfvp-WFYQdlnLFAgpbYOsGQInp4OaaE,347
src/rules/windows__process_creation__proc_creation_win_svchost_uncommon_command_line_flags.eql,sha256=96jdnpdoUfTJa3-rnxlZBH-JPo4zzdsfOeY4jd3hAdc,300
src/rules/windows__process_creation__proc_creation_win_svchost_uncommon_parent_process.eql,sha256=x9h3R8XWWkT-pLYJc3BLNbE0OVQ5QlTs4feTG2k8fqk,322
src/rules/windows__process_creation__proc_creation_win_svchost_uncommon_parent_process.lucene,sha256=U4hxWG2ihMFxEnn-BYOxbJfFmGX651gWXCxLRIWOX44,300
src/rules/windows__process_creation__proc_creation_win_svchost_uncommon_parent_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_accesschk_check_permissions.eql,sha256=89v5l35XdFyWvL-LluODEAPbalkGEazu4Z6xv1uNSwY,306
src/rules/windows__process_creation__proc_creation_win_sysinternals_accesschk_check_permissions.lucene,sha256=GQ22nuEV3Mz8lzKVQg3jlVwPj3ZlwKu1yWhd79kk93k,280
src/rules/windows__process_creation__proc_creation_win_sysinternals_accesschk_check_permissions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_adexplorer_execution.eql,sha256=b0DCnJrUDR8bZJUAHgJjVVv5AFiB4l1KMk7clq8_vRU,303
src/rules/windows__process_creation__proc_creation_win_sysinternals_adexplorer_execution.lucene,sha256=emQjqfSnhSbI7t7p10tuv16ejyCZr2p4C30v4-Kd1m8,280
src/rules/windows__process_creation__proc_creation_win_sysinternals_adexplorer_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_adexplorer_susp_execution.eql,sha256=BABS1NZ4HoEbeV_xrbiGxUNnpC9mD31GrodGyGtKal0,419
src/rules/windows__process_creation__proc_creation_win_sysinternals_eula_accepted.eql,sha256=FVHIlxdp2UoG48jPWfrjywRuGV0ihyOWLdXeXIkQE9s,134
src/rules/windows__process_creation__proc_creation_win_sysinternals_livekd_execution.eql,sha256=NkifNb4UsH2KHTodwSWs7itOYn_zCO0sXbXNCxonmjI,120
src/rules/windows__process_creation__proc_creation_win_sysinternals_livekd_kernel_memory_dump.eql,sha256=rlDTVp-sxeeg6jHQhLAMjh_5sWUnaMhdNg8w8Fz-o8c,205
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump.eql,sha256=FqlK0GKKN5qDmOaISFfv0pppGrk5-y60_zm2JUAvOUM,76
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump_evasion.eql,sha256=cvpdZGn-4dw47qWYzCRen_T90o4NcbVe905-LoRHTpo,295
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump_lsass.eql,sha256=Pp3TQNR1UbKTTIG3nfQEHTutcSH-AdrFcrmQ-q7nSao,353
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump_lsass.lucene,sha256=ZqOK1_E9oAhu0MDNOUBqeCRCW7q4NEIM_PhcgV6l3A0,350
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_execution.eql,sha256=3un454UY6sH4Ewdu5DEX-C9rHuH7N-RiVQDsBcMkKOU,89
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_execution.lucene,sha256=JyfxTI8giIy5rdzgsSI6R4AuEPIsJoSogYX3_oCKOp8,75
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_paexec_escalate_system.eql,sha256=vN1O48_Ghaq_uNyVihgDiRHTWv_onQc1RXBI0Zh_rDQ,3775
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_paexec_escalate_system.lucene,sha256=FFcp63_cstH7U7iF7us1NKKUYg51ISDndvhOjGoLYho,4291
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_paexec_escalate_system.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_remote_execution.eql,sha256=JxD1R5BZ3qeNOBhVpZP3y549H45daslUVIMpeInehAs,218
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc.eql,sha256=4blUZjxDsJdlFJKTGZqt8x4-sYaCLO2DNolcyZpfV9U,105
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc.lucene,sha256=fLG_LHkBt6UfqR13M2CUolrjHGy6XZj-BahwkvDK06E,92
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc_as_system.eql,sha256=vUrkmxbrM6smGO3WvOR1i8RRCvQOHIbnar0mt20Ll8U,112
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc_as_system.lucene.err,sha256=0-bKl361-nFbZoYXZ_ysWNysKMsKTsDTDBpJIGW9Slg,2466
src/rules/windows__process_creation__proc_creation_win_sysinternals_psloglist.eql,sha256=txtda2w82SgIcIquPrGcAjIEgUK2AkhOQUMB-LKd9eY,624
src/rules/windows__process_creation__proc_creation_win_sysinternals_psservice.eql,sha256=YOWYz25tZDO43QZ-S5cXE17Fx_hmhrkYSKHYweA9C5k,129
src/rules/windows__process_creation__proc_creation_win_sysinternals_pssuspend_execution.eql,sha256=bO_VEJODKn4eXkl8pdbf_CKPAl-wEQgkpBSeB-ZKdDE,129
src/rules/windows__process_creation__proc_creation_win_sysinternals_pssuspend_susp_execution.eql,sha256=Ok_1XUEZ0tGGaAOHG1toaeO_XaRDVg1SIwzMs7pCMnE,172
src/rules/windows__process_creation__proc_creation_win_sysinternals_sdelete.eql,sha256=QJrU4oTCalaw316nLv1OLJouzMpFEDCqBgTF60rVgao,132
src/rules/windows__process_creation__proc_creation_win_sysinternals_sdelete.lucene,sha256=NDoTuodE6qKHOmLCodjehUXzCZ46wHxA6djwEFxMnBk,119
src/rules/windows__process_creation__proc_creation_win_sysinternals_sdelete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_susp_psexec_paexec_flags.eql,sha256=DDM6ZNezq18mNlWe30Js5eCrtbihOB_e3pvJzhvssMA,3781
src/rules/windows__process_creation__proc_creation_win_sysinternals_susp_psexec_paexec_flags.lucene,sha256=FsWg5-13rxxBu4LFIDzmsOl-bws9ZdB46nH_eN9vkIA,4297
src/rules/windows__process_creation__proc_creation_win_sysinternals_susp_psexec_paexec_flags.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_sysmon_config_update.eql,sha256=I8e_mkcIJRCatFpMIFIrqsiBjM2gWysNP1mu2ClX-X4,206
src/rules/windows__process_creation__proc_creation_win_sysinternals_sysmon_uninstall.eql,sha256=NktfULOApI1ems5q0zWZjAdKJ6qOXxk9cCrTRWxiZCs,206
src/rules/windows__process_creation__proc_creation_win_sysinternals_sysmon_uninstall.lucene,sha256=znr4_5PUosFkDNtUO97u7VwJuuZ5uBd5gpAklmxYDTE,182
src/rules/windows__process_creation__proc_creation_win_sysinternals_sysmon_uninstall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_tools_masquerading.eql,sha256=hlbz9BEL2T2Q2zqs6mB-m8_4Tp7ZQRscnyap5NpVN78,4379
src/rules/windows__process_creation__proc_creation_win_sysinternals_tools_masquerading.lucene,sha256=e5YZE8rpYuiMe36U3ae7KfLSilrXy0jYRAtzHW-RMtk,4352
src/rules/windows__process_creation__proc_creation_win_sysinternals_tools_masquerading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysprep_appdata.eql,sha256=9aKC1GlZEvDipIzMQxiL-JlgFn-Ekjel9AkvevwxZKA,87
src/rules/windows__process_creation__proc_creation_win_systeminfo_execution.eql,sha256=zHHRtCddrfsykhGn0t6JucMTHuGEnOLs5TvHB8Pq0tI,96
src/rules/windows__process_creation__proc_creation_win_systeminfo_execution.lucene,sha256=Ep9YUFJUyJ2owUuXeI2zafHDUmrz0Dctkl2ShSGI8iU,82
src/rules/windows__process_creation__proc_creation_win_systeminfo_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_systemsettingsadminflows_turn_on_dev_features.eql,sha256=jV_78y5pX2aVIJhc4cJfgWS2xfpk6RH6v58wt7k__cI,260
src/rules/windows__process_creation__proc_creation_win_systemsettingsadminflows_turn_on_dev_features.lucene,sha256=RGYK3YwUQ60o5ZvGrXfC97_GYlhLuRnD-rEEYQSxOhQ,236
src/rules/windows__process_creation__proc_creation_win_systemsettingsadminflows_turn_on_dev_features.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_takeown_recursive_own.eql,sha256=H2Yb-mLLIhy1Kd7mMA_lldARRs7_sjP6PLYu3rdjhVU,113
src/rules/windows__process_creation__proc_creation_win_tapinstall_execution.eql,sha256=Z84Zsc8vIc30f1mEOSB0oZ1ZwcpXHFdxXQufYvYxx30,380
src/rules/windows__process_creation__proc_creation_win_tapinstall_execution.lucene,sha256=csiMQAZ7HQxXgoDcFxH0D1kOV1Hpx12B_SiHDOUYX4g,372
src/rules/windows__process_creation__proc_creation_win_tapinstall_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_tar_compression.eql,sha256=ysNV31sGgLEzPt8vyChXi7Uqv0raFn-Q8z2nPQvw-ss,144
src/rules/windows__process_creation__proc_creation_win_tar_extraction.eql,sha256=aMvGNtF_uMUXlGQXn889Rq8BRB-l13xGEeJA9kVr_rg,118
src/rules/windows__process_creation__proc_creation_win_taskkill_sep.eql,sha256=cVEIjK0hpp3h1NOSnKD1HtOWakgSCwYLGc0iYYE60OE,155
src/rules/windows__process_creation__proc_creation_win_tasklist_module_enumeration.eql,sha256=-W9rl0CPyZrkxk5MQj6Ksda8m9G0KNOaYgcqqLUklRo,218
src/rules/windows__process_creation__proc_creation_win_taskmgr_localsystem.eql,sha256=rsimz7Je2CMZhZ4DbIc1jrFV7egu7sCsWFrg7BhkYiY,94
src/rules/windows__process_creation__proc_creation_win_taskmgr_localsystem.lucene,sha256=Vgd-8ZPZSATRdsKfez1_94uDe1DJpB6iGUnnT77FA-c,74
src/rules/windows__process_creation__proc_creation_win_taskmgr_localsystem.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_taskmgr_susp_child_process.eql,sha256=sQJzOsrOmXKm7OHrzBhjSXfMbKxZRVE2xzjS3Q-KYNU,200
src/rules/windows__process_creation__proc_creation_win_teams_suspicious_command_line_cred_access.eql,sha256=CDNQv6A4r3bkRFZvH_EL1zid9sOKVUPXfNG9sCNHPc4,192
src/rules/windows__process_creation__proc_creation_win_tpmvscmgr_add_virtual_smartcard.eql,sha256=2Oifu8GMkuzkCUCMQeJH74Fnij5B4M_5uRTPUu3rGho,136
src/rules/windows__process_creation__proc_creation_win_tpmvscmgr_add_virtual_smartcard.lucene,sha256=8-Os3We3WKu-2dvB9EF-jPK4pJ9mT3ruJN49qZMZlIg,120
src/rules/windows__process_creation__proc_creation_win_tpmvscmgr_add_virtual_smartcard.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_tscon_localsystem.eql,sha256=JpQyuAunEWzEYU6A833xmP2dvNhX1IktiXY3T36NRzQ,92
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_redirect.eql,sha256=Dv4NUBhbQGqNH8Q0GKUqB-KV6A-fMN2a1s-GZSAtarg,51
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_redirect.lucene,sha256=_g-kiF33RrfvCy3IK5fsWsCC3QpNYKnfnXMa0YQe33s,43
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_redirect.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_session_hijacking.eql,sha256=SJettKcI2T9_bod_j67EpTyFS_JIclkS4osE9NP0NsM,163
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_session_hijacking.lucene,sha256=ZCG1aXgFUjWbhH9rvtmaDCWUs10vJzOAPAMmLMgQeJQ,144
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_session_hijacking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_changepk_slui.eql,sha256=YG_qXk969-YRYFzSYAcr1ekIlH3g0Bg-kxdvu7tHQTs,187
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cleanmgr.eql,sha256=izBQ4vsxAo2az_HyhVZJNB1NaJXgojMiCOxMGvBVQEw,269
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cmstp.eql,sha256=OMgJE3bFPNetbWwSyWbqLObFs1SwFZKKHTK2Nz9ZO5M,177
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cmstp_com_object_access.eql,sha256=WOlPzZ2luDwO1xnPijcn-ul4KzN44clg1gH11OIKK6Y,470
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cmstp_com_object_access.lucene,sha256=FWXdUC6H7S9Ql6_BcSCohj4D32dTakw830EmG0GpvDE,493
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cmstp_com_object_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_computerdefaults.eql,sha256=2tBDX4eEuXA_8rfXLhupiWTLc-veQvlHZQnHyHjYmKo,266
src/rules/windows__process_creation__proc_creation_win_uac_bypass_consent_comctl32.eql,sha256=gXyhcevIMekFe6RF6fxToWcUAWSWBKow8WCLTg5R-hg,190
src/rules/windows__process_creation__proc_creation_win_uac_bypass_consent_comctl32.lucene,sha256=fIpLjxBO0CyrqOpRlKJ_JHVWxVDtOg6zkr92-Fe4geE,174
src/rules/windows__process_creation__proc_creation_win_uac_bypass_consent_comctl32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_dismhost.eql,sha256=olIaNoJIeTTyJALq0_glZhUhx9BZ8P17-magLtsctrU,258
src/rules/windows__process_creation__proc_creation_win_uac_bypass_dismhost.lucene,sha256=D3BqNfLYbEU3SJEBBAgqkOEFo0CXVjosMl5RYq84Tug,239
src/rules/windows__process_creation__proc_creation_win_uac_bypass_dismhost.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_eventvwr_recentviews.eql,sha256=ZHwqTLEK3-eyzsNejTVX22JcfWFXk9eTAgDSXnZwHwI,133
src/rules/windows__process_creation__proc_creation_win_uac_bypass_eventvwr_recentviews.lucene,sha256=4AOfiiDmLNMzyPZlnzdbKbL1e51d10ZqpD8mbW_T9Xs,116
src/rules/windows__process_creation__proc_creation_win_uac_bypass_eventvwr_recentviews.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_fodhelper.eql,sha256=v0YQt89sAkXhASURBaYImnsXLbPbZeZCPuMC8H90OZE,55
src/rules/windows__process_creation__proc_creation_win_uac_bypass_fodhelper.lucene,sha256=L5vMDEnb6ISQLvoBmq9cVeHt1MSKCD5ApzmNfjMaenM,43
src/rules/windows__process_creation__proc_creation_win_uac_bypass_fodhelper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_hijacking_firwall_snap_in.eql,sha256=IAW3cJwsjDYBoAWezznT65qUNZb0Q4AAJHhQYKFnXVc,141
src/rules/windows__process_creation__proc_creation_win_uac_bypass_hijacking_firwall_snap_in.lucene,sha256=v5dhaTW8_OsC3EtNfiUHxfGoU4rRavgB25hUgLr5_Cw,125
src/rules/windows__process_creation__proc_creation_win_uac_bypass_hijacking_firwall_snap_in.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_icmluautil.eql,sha256=hj8ISi5L9s4QBm9WNoTx65TS-f10DZGrxExcrypbVUg,303
src/rules/windows__process_creation__proc_creation_win_uac_bypass_idiagnostic_profile.eql,sha256=sbnYqBC02vUb_FQrieeKBOP4wPdRdfV9sncSwLDQyIA,236
src/rules/windows__process_creation__proc_creation_win_uac_bypass_idiagnostic_profile.lucene,sha256=srQTDI-jAMI3H5yed4inLiLY8LhiB-L35H4P1jlhBJE,229
src/rules/windows__process_creation__proc_creation_win_uac_bypass_idiagnostic_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_ieinstal.eql,sha256=wzolQkswgSLE36c4UfK1p8Oy_ZIJ2pCYz0Fp-IwdDKQ,240
src/rules/windows__process_creation__proc_creation_win_uac_bypass_msconfig_gui.eql,sha256=1B2rqkHJoNdw7KxzF6hdXINiLiQ5-jZk6DsU8Sgze1g,240
src/rules/windows__process_creation__proc_creation_win_uac_bypass_msconfig_gui.lucene,sha256=onHN6aL07gMwvnYQs-EQs0MstW6C8zDWk6cMZfu9iOk,227
src/rules/windows__process_creation__proc_creation_win_uac_bypass_msconfig_gui.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_ntfs_reparse_point.eql,sha256=YFvUZ50Zqlji0nPiakKW95qsM4qJAd6AnyzMqM7XhEc,668
src/rules/windows__process_creation__proc_creation_win_uac_bypass_ntfs_reparse_point.lucene,sha256=aF0Rc-CS3r_WiVnD9pxPln37MHIh75B3bSx-FzSE52M,656
src/rules/windows__process_creation__proc_creation_win_uac_bypass_ntfs_reparse_point.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_pkgmgr_dism.eql,sha256=JPS3UyKtYH5CJHKWYnn-24uKmmKRBfMtjy85hJN8EvA,185
src/rules/windows__process_creation__proc_creation_win_uac_bypass_sdclt.eql,sha256=rBRrkJ2gExVgoBfrDgDTptiQDW4GjvijOdfTqHtOeP8,112
src/rules/windows__process_creation__proc_creation_win_uac_bypass_trustedpath.eql,sha256=U0ZNjsoreYKXU8TF5aIkCDThpRwjudOUWMqPs32sQfE,96
src/rules/windows__process_creation__proc_creation_win_uac_bypass_winsat.eql,sha256=c__OiQJj_aWNfHe_PogDVKwfVgb2bjoSpH_ro2xeP3w,251
src/rules/windows__process_creation__proc_creation_win_uac_bypass_winsat.lucene,sha256=VT0r_EJBLR6I6HIVdN8V15F4mvJDkfrObc_HemYlVRg,237
src/rules/windows__process_creation__proc_creation_win_uac_bypass_winsat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wmp.eql,sha256=JQa_jiNNKCsIkIwntPMuAkzLoJvLKCdx9eJtx5lHq0c,347
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wmp.lucene,sha256=xK3Xkl2ciA_VQVgNOTETeX05b9t-mF_q8sCmp0DCijw,339
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wsreset.eql,sha256=xoh8SdWObWvZCX3Jfa-rkpiOcCaD794hG3hjkoajUDc,148
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wsreset_integrity_level.eql,sha256=vPbnf51m34Z7oXtVE3oNJKiuULVWD9roFWWHb3bDp9M,142
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wsreset_integrity_level.lucene,sha256=EKlfp2Q_IzZJpPDEnnsmJGwoCGfcAtnOWKM5-NDbV98,128
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wsreset_integrity_level.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ultravnc.eql,sha256=1xqJmEriVeQfOjoTDYBwRqPyjHqt78vAMwxf9fyNiZ4,170
src/rules/windows__process_creation__proc_creation_win_ultravnc_susp_execution.eql,sha256=Yw15SUyObWTnmMGOZQ-J8cgweQaYf2YD6Wtc99CA-Fc,124
src/rules/windows__process_creation__proc_creation_win_uninstall_crowdstrike_falcon.eql,sha256=k0bJY4cnE1cGIJ5MCE5UqTqbfSu6-0mx1FHiFNa0IrQ,133
src/rules/windows__process_creation__proc_creation_win_userinit_uncommon_child_processes.eql,sha256=B9yhpdBaCaE_MKxJcXCcZ9T7WVyTZ9YJoBXSuqYuT40,765
src/rules/windows__process_creation__proc_creation_win_vaultcmd_list_creds.eql,sha256=e_wBRZRcMN3He_xHlK6z3R_Z3AXvBK1fAzvoPuUIJRk,138
src/rules/windows__process_creation__proc_creation_win_vbscript_registry_modification.eql,sha256=ObkAEqAjMvMycfyuLfPSE63bmnMQ6J-DyRDLBepE4cI,130
src/rules/windows__process_creation__proc_creation_win_verclsid_runs_com.eql,sha256=_tlaqLjCYh0wTfGmOmYp8DYbwX-XCG7XWPYpOaqdTFU,337
src/rules/windows__process_creation__proc_creation_win_verclsid_runs_com.lucene,sha256=OZ2_5_gZsBVRDpM1oTmMHiIPcvPB2iysJMUVLrBj41U,327
src/rules/windows__process_creation__proc_creation_win_verclsid_runs_com.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_virtualbox_execution.eql,sha256=EuJ0CU0Yy2HfPxCpDENb_z3_NGaYl3Z29aCj-dTNTHQ,158
src/rules/windows__process_creation__proc_creation_win_virtualbox_vboxdrvinst_execution.eql,sha256=kNm4Dsjs3M3_qMCp0r7kloWERot4XZVgn1TRq3MiDLg,128
src/rules/windows__process_creation__proc_creation_win_vmware_toolbox_cmd_persistence.eql,sha256=VuhXgFIbJ7PKKITJNRAxuBaheITAjR3pXlQqXa79U6Y,183
src/rules/windows__process_creation__proc_creation_win_vmware_toolbox_cmd_persistence_susp.eql,sha256=pg5UNiZsL90Koj_hIS9nby_FPkJe6ApCu9vMZXJ0OT0,363
src/rules/windows__process_creation__proc_creation_win_vmware_vmtoolsd_susp_child_process.eql,sha256=ClXbCLVoqIaqVqBOu4ubkJEqJh093nRg1xlLYIB9hLs,855
src/rules/windows__process_creation__proc_creation_win_vmware_vmtoolsd_susp_child_process.lucene,sha256=cvJfCdDw-pk5Rk-yGyrEo-O362cp3jAVt3i_KphCoWo,827
src/rules/windows__process_creation__proc_creation_win_vmware_vmtoolsd_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_vscode_child_processes_anomalies.eql,sha256=uJIXRsVGN74eE4Ib5vhHB87T41anX0a0-F0TQcc4uRc,520
src/rules/windows__process_creation__proc_creation_win_vscode_tunnel_execution.eql,sha256=F5DMtm88ecl9ZpZbmNCFfRQFlm7MTaImWDAsbku70x0,445
src/rules/windows__process_creation__proc_creation_win_vscode_tunnel_remote_shell_.eql,sha256=cpDf5WO4H8K-8bWfPJbim3Scm_ueu2Op7GJrgAnZgYw,374
src/rules/windows__process_creation__proc_creation_win_vscode_tunnel_renamed_execution.eql,sha256=JVSWcew59Uod2LXUwk2KAU5blXofWVB2u1F4klL-VMA,773
src/rules/windows__process_creation__proc_creation_win_vscode_tunnel_service_install.eql,sha256=C8V9l2DFZbzkKKx_GjP38bDFFTKmDceOHchkdOGj4I8,170
src/rules/windows__process_creation__proc_creation_win_vsdiagnostics_execution_proxy.eql,sha256=johjMEF8eL9iSljKAI-tqp85coR1N5VFv1nDA-Lqpi0,206
src/rules/windows__process_creation__proc_creation_win_vshadow_exec.eql,sha256=38-ewg32n7TfkO83po6DB4vRpi4RCL1Tbhsi9dqLdVU,130
src/rules/windows__process_creation__proc_creation_win_vslsagent_agentextensionpath_load.eql,sha256=4mR1E8vs1L-SPkPG9MVV58NYSVqhruvV2Zh13DgFA5g,176
src/rules/windows__process_creation__proc_creation_win_w32tm.eql,sha256=Aq-AMgbSRia7sEuAIneOD9Ikh6Z9R-R6VoG_8fRkDMk,292
src/rules/windows__process_creation__proc_creation_win_w32tm.lucene,sha256=_eusLAjgRWgZn037LuX-VQQI0m3BddX9zwZGViRXDQA,276
src/rules/windows__process_creation__proc_creation_win_w32tm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wab_execution_from_non_default_location.eql,sha256=SVS9iPq_i7Ti24njjXqYCt5jfKGlbYei6M68_sNy4Zw,215
src/rules/windows__process_creation__proc_creation_win_wab_unusual_parents.eql,sha256=uez0AD232eBxLv3u_P1Bv_7f3yJLgimq6Ksmh2T539s,234
src/rules/windows__process_creation__proc_creation_win_wbadmin_delete_all_backups.eql,sha256=qnp8A5Wf00ulrsMX5sOrQPCLcxvN3qdt8VJw2jhw3iY,215
src/rules/windows__process_creation__proc_creation_win_wbadmin_delete_all_backups.lucene,sha256=_iLhps_ehuwSzBnvZmf9naAy4qPZj6keNlcaDZudY3s,196
src/rules/windows__process_creation__proc_creation_win_wbadmin_delete_all_backups.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wbadmin_delete_backups.eql,sha256=Eg5Q-0Y6HCDGTS8k1jj7Av58SjFX21ff-1S5qIBDqyk,222
src/rules/windows__process_creation__proc_creation_win_wbadmin_dump_sensitive_files.eql,sha256=tuFTUzowYFHGAzwNeuZ2bM2VQkTMFmLVcusSPRSkeEQ,282
src/rules/windows__process_creation__proc_creation_win_wbadmin_restore_file.eql,sha256=Ge57Ch_HW-MIy1jJpdablKuYZvbqdc2aV-9ggwy_VTU,223
src/rules/windows__process_creation__proc_creation_win_wbadmin_restore_sensitive_files.eql,sha256=jb493MV94RZEHVmnNbu7guKw_xNkDFAfFf2on3NT8eg,355
src/rules/windows__process_creation__proc_creation_win_webdav_lnk_execution.eql,sha256=8qMdOhB04ZyawGl7DNnFXrCD_r1WuaRSFXS_Q88Q3DQ,232
src/rules/windows__process_creation__proc_creation_win_webdav_lnk_execution.lucene,sha256=ib0dQQGkEzaY6BM7aKDfOwUt5iVqo5JAaTUJFD4Xv64,209
src/rules/windows__process_creation__proc_creation_win_webdav_lnk_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_webshell_chopper.eql,sha256=wK-EYMRyDhbqBPlqM3X0IWyczSUFYpwwzByuRX5qSdk,250
src/rules/windows__process_creation__proc_creation_win_webshell_hacking.eql,sha256=fBsUOsismsgjxdHyZXclkBtjioE3yRR8eu2ZI1OrADg,1293
src/rules/windows__process_creation__proc_creation_win_webshell_recon_commands_and_processes.eql,sha256=gfoi2T0cV4AL1-Ad3CuLgeT8aVphBMqynYw_4yny09U,1670
src/rules/windows__process_creation__proc_creation_win_webshell_susp_process_spawned_from_webserver.eql,sha256=8G4sEs9CADn5docGh8rnSaBEPFbijqcgRBDzcuB5ZDw,1385
src/rules/windows__process_creation__proc_creation_win_webshell_tool_recon.eql,sha256=ecOPJCQHoiaW8O5QkLw1duHXE5fDw-H7Mg0Vk9UAm3c,586
src/rules/windows__process_creation__proc_creation_win_werfault_lsass_shtinkering.eql,sha256=lNZupOXo5TmOl0vSKft1XAR4_Xx0yc088ZpUIxG_dy8,395
src/rules/windows__process_creation__proc_creation_win_werfault_reflect_debugger_exec.eql,sha256=XfjpPuIpRcte-dWt_1NTukpqxMiRRdwf5XF_C6hDxfg,132
src/rules/windows__process_creation__proc_creation_win_werfaultsecure_abuse.eql,sha256=n1-_xpg3_vfHwDlBTuojIJXbUGSBMUsuOcVFMJwN_wI,370
src/rules/windows__process_creation__proc_creation_win_wermgr_susp_child_process.eql,sha256=zF8UmZv7xwBoMqtcsiFsIIN0d-xRPrkZ1DgivkrB6wE,610
src/rules/windows__process_creation__proc_creation_win_wermgr_susp_exec_location.eql,sha256=W-_7NLgHpPkHa8xG1BBdrWAtTFjgBVAQZOZG0W_NTz8,165
src/rules/windows__process_creation__proc_creation_win_wget_download_direct_ip.eql,sha256=5nlsFIGVxcVbzSLALsB0__nlhpdEMff02PRBAvXMeuM,594
src/rules/windows__process_creation__proc_creation_win_wget_download_susp_file_sharing_domains.eql,sha256=a7nNUO5r96zk1fFvyVM20NSOVBoIXttfss1OgB02eEA,1135
src/rules/windows__process_creation__proc_creation_win_wget_download_susp_locations.eql,sha256=kvyIF7gJlMh9Pc4jOEEt5MeW8vHSvc3NJIpa6VyZCK8,760
src/rules/windows__process_creation__proc_creation_win_where_browser_data_recon.eql,sha256=-eZKIB7ue4QG1CnEUtmnyQZCqm6KK6x5SrqeOaIiRa4,314
src/rules/windows__process_creation__proc_creation_win_where_browser_data_recon.lucene,sha256=Ftk8W59gT93HuXYnuu08ITbg3-sxRjon8jvCgS_ZRow,293
src/rules/windows__process_creation__proc_creation_win_where_browser_data_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_whoami_all_execution.eql,sha256=Qe9dqnhDGOUUp8trio4fELjTeHQDvlai7Gxs4V0Czus,186
src/rules/windows__process_creation__proc_creation_win_whoami_execution_from_high_priv_process.eql,sha256=bIU-47uB104QzbyXfhK6rC7FOzUiXsOj104_iZ8nExY,163
src/rules/windows__process_creation__proc_creation_win_whoami_execution_from_high_priv_process.lucene,sha256=v8JOk1yDb5noidnczdxdhUIvb4777dJoSIp_7NYv3_g,141
src/rules/windows__process_creation__proc_creation_win_whoami_execution_from_high_priv_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_whoami_groups_discovery.eql,sha256=BR4iOW1H15OI1Da16NJcXHtx6LbtDkPZk-fpFwB3Moc,155
src/rules/windows__process_creation__proc_creation_win_whoami_output.eql,sha256=q9gARncawri8u3K6pGmn1sGhVl1tmW5TYA-xUj6DEMU,194
src/rules/windows__process_creation__proc_creation_win_whoami_parent_anomaly.eql,sha256=2jwlRZnhKQ2C802Y-j1MzJB6k3m09nhAggirtuJk0gE,453
src/rules/windows__process_creation__proc_creation_win_whoami_priv_discovery.eql,sha256=RJRJCoqMXv__P18x69LMhGMEodVhoxjzZxw89bhWtW0,151
src/rules/windows__process_creation__proc_creation_win_windows_terminal_susp_children.eql,sha256=MpFAKdyqGPW5HGTG46UmoEr5PnqJLymM1fvdISAeksM,962
src/rules/windows__process_creation__proc_creation_win_winget_add_custom_source.eql,sha256=VmZwse6gjaFDL2rG9Pv07yNJYOy0vm8elird6FT9YY0,166
src/rules/windows__process_creation__proc_creation_win_winget_add_custom_source.lucene,sha256=T-SxisRpSkDtrSDiehlDMUHxsSLEBR5O1ISs3NqvSCc,150
src/rules/windows__process_creation__proc_creation_win_winget_add_custom_source.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winget_add_insecure_custom_source.eql,sha256=FRZaQW07mHAgbi5gU3B5JPk4O5QyWScYbVu-1l3Iioo,203
src/rules/windows__process_creation__proc_creation_win_winget_add_susp_custom_source.eql,sha256=T2jZsMKFTpkY7ApxyR4698G04340ukG9boMW2QdlaPk,245
src/rules/windows__process_creation__proc_creation_win_winget_local_install_via_manifest.eql,sha256=4833hG6s6s7MNUtSu3bLUs8_cGWF1q_QQrwh89Bz8RA,210
src/rules/windows__process_creation__proc_creation_win_winget_local_install_via_manifest.lucene,sha256=OF8w8burDr019KBFO44pKnVkHoELk_AFsaUbBtDNgmQ,186
src/rules/windows__process_creation__proc_creation_win_winget_local_install_via_manifest.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winrar_exfil_dmp_files.eql,sha256=YUEnnhgm_3LirIBx29qnaYqozyPtP778gBmimNq5Ubg,182
src/rules/windows__process_creation__proc_creation_win_winrar_exfil_dmp_files.lucene,sha256=UAbwzD5u8gYafnG4FcSy3UYK4l9K-czQp_SVjq4_YvM,156
src/rules/windows__process_creation__proc_creation_win_winrar_exfil_dmp_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winrar_susp_child_process.eql,sha256=f6kSM1oouRRDmOg8ZmBXIeVj1QLKA17_gwaU6QJQuzo,384
src/rules/windows__process_creation__proc_creation_win_winrar_susp_child_process.lucene,sha256=x_YTewnPxKQUlr74CV1ZF6B3lmj_Mtv7-DNMBpStKNo,356
src/rules/windows__process_creation__proc_creation_win_winrar_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winrar_uncommon_folder_execution.eql,sha256=t86NTpc4HDZxPWWSjnTYVpaOizfz21xvjQ2HnEdncZM,335
src/rules/windows__process_creation__proc_creation_win_winrm_awl_bypass.eql,sha256=v5rzq-Rrj191MoMaHziRjkSAhdEn5Xu2eYSnppXH1VM,251
src/rules/windows__process_creation__proc_creation_win_winrm_awl_bypass.lucene,sha256=gjPLju3H9DiZZebh-Tffeog4d-toBjmiih4dwgyEyws,227
src/rules/windows__process_creation__proc_creation_win_winrm_awl_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.eql,sha256=SzqxyPHTuXwstNZumRxf-2R3VJRUP_-W9RvemQ4NjAw,228
src/rules/windows__process_creation__proc_creation_win_winrm_remote_powershell_session_process.eql,sha256=P-Z1xcvRtRJlJBRxI9ODykrR7XyUD7hbt76qSjU4xjk,100
src/rules/windows__process_creation__proc_creation_win_winrm_susp_child_process.eql,sha256=HhWZeXkrW9zlbOt-YUi4q8Dv2zusFnObi3rHN5d9dwI,256
src/rules/windows__process_creation__proc_creation_win_winrs_local_command_execution.eql,sha256=VP1MHS0YmXhGAQ9U70y20gufSAEEwPFxc24jTkwns04,1177
src/rules/windows__process_creation__proc_creation_win_winrshost_command_execution.eql,sha256=IddIuLXeOt5M70MPIvt2A87SoIOqa4OCYYJaEoPE3zM,121
src/rules/windows__process_creation__proc_creation_win_winzip_password_compression.eql,sha256=rh-Y9LyjjwBDRVliH8WhBG299kT599grNrpEus2-I58,164
src/rules/windows__process_creation__proc_creation_win_wlrmdr_uncommon_child_process.eql,sha256=htEyOphClv4ZMeOErEcv0rw3gtywJ64-23hs8tUIBio,844
src/rules/windows__process_creation__proc_creation_win_wlrmdr_uncommon_child_process.lucene,sha256=Bo1NX261QtssONXTO1C3ceetOEP6Ljwf3jl2WN_1WNc,819
src/rules/windows__process_creation__proc_creation_win_wlrmdr_uncommon_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmi_backdoor_exchange_transport_agent.eql,sha256=ZvKvpcoj5uJ4BLvZpopm4rCcNH90N8mCzHvEaV7Px7I,252
src/rules/windows__process_creation__proc_creation_win_wmi_password_never_expire.eql,sha256=4GSf5mIer4f38D5iZrAEFVFrw90LkSFAjTgK0h03CPA,247
src/rules/windows__process_creation__proc_creation_win_wmi_persistence_script_event_consumer.eql,sha256=1RxlX5uhkfuPHhJOuxYvN3GsoKdNb44zv_1He5qvd-Q,139
src/rules/windows__process_creation__proc_creation_win_wmic_eventconsumer_creation.eql,sha256=d-33SsOcxxS03STeQ5qnCsl1zlSeRa3ljjv79ZXTHS4,99
src/rules/windows__process_creation__proc_creation_win_wmic_eventconsumer_creation.lucene,sha256=LVS5JbgLv1P-5GiN6RkCFOdHAgLmydk2jcfoUe3LzTs,87
src/rules/windows__process_creation__proc_creation_win_wmic_eventconsumer_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_namespace_defender.eql,sha256=-NU_ilwwDjvcdqnumF3GsOcpigwZUUw5JKW_shnpu9k,166
src/rules/windows__process_creation__proc_creation_win_wmic_process_creation.eql,sha256=RzkdQrfw9qO17vrkfnYWlDn-N2qElZ17VpKUgrOJpLs,198
src/rules/windows__process_creation__proc_creation_win_wmic_recon_computersystem.eql,sha256=rDz7JZVtAi7eGIOq_huQZVhRHfa8dBXdM0AAbR_bJCE,133
src/rules/windows__process_creation__proc_creation_win_wmic_recon_csproduct.eql,sha256=1DzSmUiV6I0YtFVK_Zh6exmJirkcYjYXLhkDomhYWOo,128
src/rules/windows__process_creation__proc_creation_win_wmic_recon_group.eql,sha256=qx2JdWUKMU5jUXPk4DMvmxsnwo8NrUWrbSIkyiYCZ5A,125
src/rules/windows__process_creation__proc_creation_win_wmic_recon_group.lucene,sha256=FUOyCMQoZJVnJ3534fxaUagAU-EnOLunAj1cPZqBrWE,110
src/rules/windows__process_creation__proc_creation_win_wmic_recon_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_recon_hotfix.eql,sha256=kGyY5fmTLH4eNsf8jZT6dj96FLlVuAwhPbsya-AgKMU,123
src/rules/windows__process_creation__proc_creation_win_wmic_recon_hotfix.lucene,sha256=TAiOK-dgAszr00Jehu7loXyue6XJyN3cAID2Bc9fGhk,108
src/rules/windows__process_creation__proc_creation_win_wmic_recon_hotfix.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_recon_process.eql,sha256=Qc6pWtGxEdk3dN_-FKCqo9XDxs983qh0nN09KDFqkiU,206
src/rules/windows__process_creation__proc_creation_win_wmic_recon_product.eql,sha256=N-Y-Kbs-TDpMYfQno3pEdFl3wlkdxDaS4Z9Ggia7aUo,198
src/rules/windows__process_creation__proc_creation_win_wmic_recon_product_class.eql,sha256=HJj7FtSRwmCS9KkLlvPkvrGH2vuF8JXD9RT2avAEKE8,190
src/rules/windows__process_creation__proc_creation_win_wmic_recon_service.eql,sha256=73xs4BcgNCtEiJC-LETKkLsTfLvFDXuNTAgyYdh_Hog,126
src/rules/windows__process_creation__proc_creation_win_wmic_recon_service.lucene,sha256=GJ4XokCNxqEDqEbIRLHgGV9Bqha6HEqdkxpZZpoUsok,110
src/rules/windows__process_creation__proc_creation_win_wmic_recon_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_recon_system_info_uncommon.eql,sha256=QJdDYmvNZVFc0NGtv946lEJrDqKwGrwpbYQLv9CQhys,259
src/rules/windows__process_creation__proc_creation_win_wmic_recon_system_info_uncommon.lucene,sha256=RxJ-ubTTTCViiSmX3zEYKEmihYd_FGs5cjZQe2zVJ5Q,241
src/rules/windows__process_creation__proc_creation_win_wmic_recon_system_info_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_recon_unquoted_service_search.eql,sha256=mS5DfyIRFec-vZLH6201pBoBxq8D70rk_3mqYid51RM,199
src/rules/windows__process_creation__proc_creation_win_wmic_recon_volume.eql,sha256=S0iZE0MCI2z_IPpSdfZ-AIQQUms-VzvsASdrTsTlRUM,316
src/rules/windows__process_creation__proc_creation_win_wmic_remote_execution.eql,sha256=Z3pz1okzw0Ijs3KxLUqwNljf2NyQQF9dZFgCX8Nl_uE,259
src/rules/windows__process_creation__proc_creation_win_wmic_remote_execution.lucene,sha256=qDa98wisxuA7uZTd-gJ1J7InwMmzRgWDyMN37TRzazM,236
src/rules/windows__process_creation__proc_creation_win_wmic_remote_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_service_manipulation.eql,sha256=gczIGbf16qyPMG8wptFOvJXD14OOQYLNrqCtOzvlrqo,237
src/rules/windows__process_creation__proc_creation_win_wmic_service_manipulation.lucene,sha256=MUijNz_w4SA7Pxty0de9QKph4VF6BFgqRw8UDWFAWbQ,215
src/rules/windows__process_creation__proc_creation_win_wmic_service_manipulation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_squiblytwo_bypass.eql,sha256=InU97aZfWMrUl38UqVfNfAzgltGgPaPvtrlekXgprbM,337
src/rules/windows__process_creation__proc_creation_win_wmic_stdregprov_reg_modification.eql,sha256=Drrg-bWUabJaNpKEm-lA5xXtg-tyZc2WNcUl-ke0QfU,165
src/rules/windows__process_creation__proc_creation_win_wmic_susp_execution_via_office_process.eql,sha256=zEXo_idbDKL_7s4gba3LZaxA5kMe_bXPyeksr9FndtY,549
src/rules/windows__process_creation__proc_creation_win_wmic_susp_process_creation.eql,sha256=bM27Jdardi5gUQNMNhikXnbIz4gOazbZ-J-2thS-Ye4,524
src/rules/windows__process_creation__proc_creation_win_wmic_susp_process_creation.lucene,sha256=UuvB4C7XoK_W1FXModoRgR9zRfYeSTnH9l7oF8FJjTQ,518
src/rules/windows__process_creation__proc_creation_win_wmic_susp_process_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_terminate_application.eql,sha256=3dyv1GeKvyf7qRCGhawF4ifBX5I3aMXqsoVKXm23P_o,164
src/rules/windows__process_creation__proc_creation_win_wmic_terminate_application.lucene,sha256=UpJP9TMntVFv2P6EEfOwBM85h7SEtm3Q3RWMEjH6jc0,146
src/rules/windows__process_creation__proc_creation_win_wmic_terminate_application.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_uninstall_application.eql,sha256=OASN_nMM_cJ5uIJuOGhReYxvoA7UY7DbnVxSYD-J0D0,164
src/rules/windows__process_creation__proc_creation_win_wmic_uninstall_security_products.eql,sha256=QRtznDffj9U--q4T9HZIuL2J2e4e-VqJg_WTDCZMDMM,1316
src/rules/windows__process_creation__proc_creation_win_wmic_xsl_script_processing.eql,sha256=nNA1YuOK_EsK9DBtnnYU98kIDMI2VSPIHtk4obfPIds,345
src/rules/windows__process_creation__proc_creation_win_wmiprvse_spawning_process.eql,sha256=6ssQKp7ybrsTNwFTc-VUif-HlnKgtYb6K19Ukf6lXnM,325
src/rules/windows__process_creation__proc_creation_win_wmiprvse_spawns_powershell.eql,sha256=AINn51K9OlxSHO1-G6X_lB6Og-ZQGddhdzShAlT13iI,196
src/rules/windows__process_creation__proc_creation_win_wmiprvse_susp_child_processes.eql,sha256=fuZg6niN6-DiLe7L6wiYAOH9P1E8LzzHVA600vJ9e04,565
src/rules/windows__process_creation__proc_creation_win_wpbbin_potential_persistence.eql,sha256=ez2avFS7i3_D2kNar_cE8B-Rn8AytzxNUtJijqn4pEI,65
src/rules/windows__process_creation__proc_creation_win_wscript_cscript_dropper.eql,sha256=dGz34ynv1XGe3SihO8xwyQxGL3GpZk8Lnle1U3_GWdk,308
src/rules/windows__process_creation__proc_creation_win_wscript_cscript_susp_child_processes.eql,sha256=qIaJaDSYUJS5PvKgZQEdBBxuw5mPSaz1t0-K74yasjU,518
src/rules/windows__process_creation__proc_creation_win_wscript_cscript_uncommon_extension_exec.eql,sha256=eoye99U1lMAemhUJkSzmTrCNw4QpqMWrJQchuSA3EdY,293
src/rules/windows__process_creation__proc_creation_win_wsl_child_processes_anomalies.eql,sha256=1anG1ZOQk4LOsMpwGN9hCycyDvAixw8F3nQ_26loxW4,429
src/rules/windows__process_creation__proc_creation_win_wsl_kali_linux_installation.eql,sha256=Fd6_ZRoZbEPET7tgVOluqfI_y5xAPyUQe779EX8jXcg,178
src/rules/windows__process_creation__proc_creation_win_wsl_kali_linux_installation.lucene,sha256=xf3LgUX6rV-cepvpad4NvYsrGM68LIjWAVo4gflMEDs,161
src/rules/windows__process_creation__proc_creation_win_wsl_kali_linux_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wsl_kali_linux_usage.eql,sha256=N7IJiGbg8vHZAFP_RZFyi5LOpoa5A8oO0AKEI2oIe0o,645
src/rules/windows__process_creation__proc_creation_win_wsl_windows_binaries_execution.eql,sha256=7d1GtQF6s3ATp9wivtDYyICubIj6hCOYzz6MMwHmWFo,102
src/rules/windows__process_creation__proc_creation_win_wsl_windows_binaries_execution.lucene,sha256=GZzTHbVJpW15dj04EHnCr6xaQPOMvysIZqdF4tis0bE,158
src/rules/windows__process_creation__proc_creation_win_wsl_windows_binaries_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wuauclt_dll_loading.eql,sha256=2rSof-2MoGloOaJ0qsIidjEYda_Nv4erKcKRvZC7bqk,609
src/rules/windows__process_creation__proc_creation_win_wuauclt_dll_loading.lucene,sha256=pvEW9OXPbOz3-EzQyutxLOHSpBPhuXscC_54344NCJ0,590
src/rules/windows__process_creation__proc_creation_win_wuauclt_dll_loading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wuauclt_no_cli_flags_execution.eql,sha256=xDghGdhYsuGc8mPGflru7vFhw3y3j0UugcFcyEgZjo0,157
src/rules/windows__process_creation__proc_creation_win_wuauclt_no_cli_flags_execution.lucene,sha256=oOd8MtyDX-8dgGA85j78gQG685QlWYRWb9BmRfeBhws,135
src/rules/windows__process_creation__proc_creation_win_wuauclt_no_cli_flags_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wusa_cab_files_extraction_from_susp_paths.eql,sha256=yWAigPbeBOHJ-AoSRXCkgghwZNez-gHd_UHYqkjLy3U,215
src/rules/windows__process_creation__proc_creation_win_wusa_susp_parent_execution.eql,sha256=NfkuSBv0B0xqpKBXdmPAEhBgHCqIdM3cX6DvKTix2KA,624
src/rules/windows__process_creation__proc_creation_win_xwizard_execution_non_default_location.eql,sha256=8oSClfFQ_f1cdfixgjuhl3Psjq98OUHL5KHow0fQ8pw,215
src/rules/windows__process_creation__proc_creation_win_xwizard_runwizard_com_object_exec.eql,sha256=TT6b18BI_jTkpRpVpEIaXt47eVeB4_ilYCQSJ0lpAcM,159
src/rules/windows__process_creation__proc_creation_win_xwizard_runwizard_com_object_exec.lucene,sha256=xMWXgTmc0ybAPH8krGgiaZwObXxQX5ahT_nJ2VP5zcc,251
src/rules/windows__process_creation__proc_creation_win_xwizard_runwizard_com_object_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_tampering__proc_tampering_susp_process_hollowing.eql,sha256=s2TqtzwkFMigGuSlq2IZNkr3osW2Iu5IU4HIM0-h2oE,402
src/rules/windows__process_tampering__proc_tampering_susp_process_hollowing.lucene,sha256=ZGEe1ygi01AP8W0IFfp7w89Z9dNZ8lYMpcRcq8_n_z8,385
src/rules/windows__process_tampering__proc_tampering_susp_process_hollowing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__raw_access_thread__raw_access_thread_susp_disk_access_using_uncommon_tools.eql,sha256=zTdfel0fbE6fZN9xeNL3iaTDUqQ3nigOWx2KZ2Mk1PM,1485
src/rules/windows__registry__registry_add__registry_add_persistence_disk_cleanup_handler_entry.eql,sha256=1IQlMfhQntml_0CE-_3Sd0lNk3K1m5P1DFBNrmYhohM,1086
src/rules/windows__registry__registry_add__registry_add_persistence_disk_cleanup_handler_entry.lucene,sha256=a0xmnueuoneB6WuLqeGMHkiyx0MZhXLpNJhbg4h9AIQ,1128
src/rules/windows__registry__registry_add__registry_add_persistence_disk_cleanup_handler_entry.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_defender_context_menu.eql,sha256=1u_HLga7fB_L-8a854uOlthdGvr2vM0UCvN39n4D5YM,293
src/rules/windows__registry__registry_delete__registry_delete_defender_context_menu.lucene,sha256=SGxDUk-nGXBfjWiglnwugI7-kUZVsLEdqAvTs_tI128,279
src/rules/windows__registry__registry_delete__registry_delete_defender_context_menu.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_enable_windows_recall.eql,sha256=m7LieHU5T0CtgYDIHY44SpxM6I2cHpFUXLGiqBslpZA,128
src/rules/windows__registry__registry_delete__registry_delete_enable_windows_recall.lucene,sha256=bEyiEhCeuudXRQPoIbzl2ZgMyeU-YiSwHrcLI2h_DlQ,114
src/rules/windows__registry__registry_delete__registry_delete_enable_windows_recall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_exploit_guard_protected_folders.eql,sha256=1jYsCuEcBGyqifogeESPlAY0IDbq36pN8PAjG-GoHII,188
src/rules/windows__registry__registry_delete__registry_delete_exploit_guard_protected_folders.lucene,sha256=_4K8NciJjJf_0uAYWKoy28-LgXQ1wXPhjLS2MAeX18Y,180
src/rules/windows__registry__registry_delete__registry_delete_exploit_guard_protected_folders.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_mstsc_history_cleared.eql,sha256=9lanvbVsQRIlwUrT-gMFdS-rNyZYPuwZgR6rpRWUrpw,240
src/rules/windows__registry__registry_delete__registry_delete_mstsc_history_cleared.lucene,sha256=7-W3wTL2JOEDvBo1ZKegEVRdoRLhsHC-CoA9zdsIBFs,225
src/rules/windows__registry__registry_delete__registry_delete_mstsc_history_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_removal_amsi_registry_key.eql,sha256=bUwT-O1qN-mYFy2ZTC9pvNXokkQS1RoAPU1g-WY_v6k,350
src/rules/windows__registry__registry_delete__registry_delete_removal_amsi_registry_key.lucene,sha256=wNMGdAhk0hOfK7-oMHI29rC5BCn3JOJsME005jggh98,342
src/rules/windows__registry__registry_delete__registry_delete_removal_amsi_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_removal_com_hijacking_registry_key.eql,sha256=wEH7i80CAkh_UWY8M410aX-TdE8Sx0sPUz56soXcoPI,1908
src/rules/windows__registry__registry_delete__registry_delete_removal_com_hijacking_registry_key.lucene,sha256=fdbAnqO6tLLXtMu8vAh-sg2HHPdHyDSZZtAe0BLXBlE,1844
src/rules/windows__registry__registry_delete__registry_delete_removal_com_hijacking_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_runmru.eql,sha256=HSAoUzj7H3H7CnlXLXXfYdyo5MN3YTPAwcy6ZI_nR2M,92
src/rules/windows__registry__registry_delete__registry_delete_runmru.lucene,sha256=N6x0LVDE_snZKTvxEvPrmc1pevxHtRY7QN-0IB-sRoM,80
src/rules/windows__registry__registry_delete__registry_delete_runmru.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_index_value_removal.eql,sha256=W-I86k2xiDeKO5YNlXOLidNKxkJefO0wceoTkTLJLXE,135
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_index_value_removal.lucene,sha256=VeYeKgYi4FtqD_EuQrTzac84wWyvBbEtv3VI_so7IkU,121
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_index_value_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_sd_value_removal.eql,sha256=X7sCWtip_TMNDBArlX-XbITLWINdWytXba7cTzUS2dU,132
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_sd_value_removal.lucene,sha256=7mRhgT3HRoVoIZRQMd5NocUeXYThEDxzK9sADFR68Dg,118
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_sd_value_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_add_local_hidden_user.eql,sha256=CC7d3wv8IatXgKOaXFQGyDN0r5ijbr3_ho458Z8Iq_g,145
src/rules/windows__registry__registry_event__registry_event_add_local_hidden_user.lucene,sha256=Jgu0OLHPzk4jptLa7v25y2cdYJECcm31g5V7RYn0UaI,130
src/rules/windows__registry__registry_event__registry_event_add_local_hidden_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_bypass_via_wsreset.eql,sha256=NtAzKAghsStAwjLdfBeLqieqj5Lpp_EYRKJBWLSdmrY,88
src/rules/windows__registry__registry_event__registry_event_bypass_via_wsreset.lucene,sha256=Rqnh0ZE0ySkYAWHGeeuKrLGRv6SJm3hohGZrXMep7Nk,76
src/rules/windows__registry__registry_event__registry_event_bypass_via_wsreset.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_cmstp_execution_by_registry.eql,sha256=V6j7lWjzAobnFPpZP3hWjymfcA6a8WGi92oXMA7dXZM,42
src/rules/windows__registry__registry_event__registry_event_cmstp_execution_by_registry.lucene,sha256=VpnzZ6nlsn-2HmpOoyeMkuUeSpvcIQsdkwFpYth_tTE,30
src/rules/windows__registry__registry_event__registry_event_cmstp_execution_by_registry.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_defender_threat_action_modified.eql,sha256=lfDdZunWvRmjcoXWnqYlx_XZVlY6zvHK_5Bg_Tll_C8,240
src/rules/windows__registry__registry_event__registry_event_defender_threat_action_modified.lucene,sha256=5dxcq1YsdnaKPkKL6iUNEzJF5rdjOF4NvQxXCAaEu-c,218
src/rules/windows__registry__registry_event__registry_event_defender_threat_action_modified.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_disable_security_events_logging_adding_reg_key_minint.eql,sha256=c6uzYcSF1QAMeTLdhzMvXviAkxTpBdM8CkbCuIzwt80,201
src/rules/windows__registry__registry_event__registry_event_disable_security_events_logging_adding_reg_key_minint.lucene,sha256=777O0z0Bz9yzN1EnLQhJDtALRywvFZylijr1zQ8uMVs,185
src/rules/windows__registry__registry_event__registry_event_disable_security_events_logging_adding_reg_key_minint.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_disable_wdigest_credential_guard.eql,sha256=D4rl6z20SN8GckIcKKTw_njJiLPtYzkTcxca5sVew0g,48
src/rules/windows__registry__registry_event__registry_event_disable_wdigest_credential_guard.lucene,sha256=xDFi0SFo6LmuvVRRlsji9ShHEFYD7dpExPYw0DMMNPE,36
src/rules/windows__registry__registry_event__registry_event_disable_wdigest_credential_guard.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_esentutl_volume_shadow_copy_service_keys.eql,sha256=nMdIT03jzIxcdVwCbm2H6dk3Q5fqGsapBit19mMv6x4,186
src/rules/windows__registry__registry_event__registry_event_esentutl_volume_shadow_copy_service_keys.lucene,sha256=rJTgyPg2jLNnLYgsNw65k2k9x5P3B7tYZK6rIXawkHs,170
src/rules/windows__registry__registry_event__registry_event_esentutl_volume_shadow_copy_service_keys.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_hack_wce_reg.eql,sha256=JQ6qHkhsgEXcTMuixCJa_C1P29BDMhhs3bDg4VaO6d0,56
src/rules/windows__registry__registry_event__registry_event_hack_wce_reg.lucene,sha256=J_0uCgi6n6AVgHvWzXw-qlBkgP2Mv9AZt6VaM6idr90,44
src/rules/windows__registry__registry_event__registry_event_hack_wce_reg.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_hybridconnectionmgr_svc_installation.eql,sha256=Dk3VxmX0ChAFk_brraWVUfitTq7rnjKb8hXCOU2J9jU,189
src/rules/windows__registry__registry_event__registry_event_hybridconnectionmgr_svc_installation.lucene,sha256=JdQfQYtkTNrOwFJ1lw5fLC7tXQcnI870Re0wQWFVRas,173
src/rules/windows__registry__registry_event__registry_event_hybridconnectionmgr_svc_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_mal_azorult.eql,sha256=GgRSaADY_XOYLoblS_tGRsYpbyZIUuhpwHk0vx9DI7U,122
src/rules/windows__registry__registry_event__registry_event_mal_azorult.lucene,sha256=wgGGAERMtwlhIZgXcZdejRzJu_QzO-EnwgDXd4a35kI,99
src/rules/windows__registry__registry_event__registry_event_mal_azorult.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_malware_qakbot_registry.eql,sha256=csM3tav1JaX0_fTRrZB_q7V5qurkZvHYa2YkCuJNE4g,56
src/rules/windows__registry__registry_event__registry_event_malware_qakbot_registry.lucene,sha256=_hDse9Sb42nAFE3b1TFJm8vpnHKVsbzOEv-vPSUolR8,44
src/rules/windows__registry__registry_event__registry_event_malware_qakbot_registry.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_modify_screensaver_binary_path.eql,sha256=YL-GCHK37ALM0-jExkZ6qN7hgtG3Kgo0mFzrbcRV1yU,142
src/rules/windows__registry__registry_event__registry_event_modify_screensaver_binary_path.lucene,sha256=NPgZ8WLHJpFjg2S-C040pYpJEeuzq1cY3hRDnUv_Z8Y,123
src/rules/windows__registry__registry_event__registry_event_modify_screensaver_binary_path.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_narrator_feedback_persistance.eql,sha256=4A7z0UwKBBn4P_ZoYnjHbxfOWA0YjAanNcfjfYtNWSU,245
src/rules/windows__registry__registry_event__registry_event_narrator_feedback_persistance.lucene,sha256=8wlPycHw7tSYiByj0kV7whbIlziFR3GChR_fwKnpxIU,231
src/rules/windows__registry__registry_event__registry_event_narrator_feedback_persistance.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_net_ntlm_downgrade.eql,sha256=O-26jWZQWp6iPAo9GBPebqxre8QdAh_TjYhSjNwPQy0,479
src/rules/windows__registry__registry_event__registry_event_net_ntlm_downgrade.lucene,sha256=vQOQYGlxXKLffZgVaChB5S8nPh97CVDYA_cDfRt5EiY,461
src/rules/windows__registry__registry_event__registry_event_net_ntlm_downgrade.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appcertdlls_registry_key.eql,sha256=GaXPSW1vFu5u_llPcW4qET3U_HRXPjBuNqIJUf0Szsc,198
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appcertdlls_registry_key.lucene,sha256=X8Zx2Kzln3zJRtF3vVrrCSP2mo14rtaaf5ZX9lgsEkg,186
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appcertdlls_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appinit_dlls_registry_key.eql,sha256=030k4T798e9N0GOxouZ6YLus2QEhUY29OgNYMIbhXpY,453
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appinit_dlls_registry_key.lucene,sha256=_vSwgNEPvEnAwKz-ux4VZ4_uY6lnWj93r08jJ-OhSbE,431
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appinit_dlls_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_office_test_regadd.eql,sha256=8UWsDg9WbPh1FNfiU5SfYSYmh5HA_YdQufFwTrBy8fk,78
src/rules/windows__registry__registry_event__registry_event_office_test_regadd.lucene,sha256=dz8e19LerTtm9t4vedZiUqsogRrC1n_VXsELg0eGlZE,67
src/rules/windows__registry__registry_event__registry_event_office_test_regadd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_office_trust_record_modification.eql,sha256=xsK6Sv5dElleL65EtP33gQwKtEmMa3MIzIGLdrgfCOs,72
src/rules/windows__registry__registry_event__registry_event_office_trust_record_modification.lucene,sha256=xQSFvyuq0VCU8PIhZiUe9CyqkiU0ql3EceDi4eTECs0,61
src/rules/windows__registry__registry_event__registry_event_office_trust_record_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_persistence_recycle_bin.eql,sha256=tZ7uV4dqKQ1e7UqYyKQs9KNIA9SIqLAAxQXhmCntS8g,294
src/rules/windows__registry__registry_event__registry_event_persistence_recycle_bin.lucene,sha256=01rnr3qxCi0yfY5aPeE2kI5rKRlOqZ7D-4o3ftR41Y8,290
src/rules/windows__registry__registry_event__registry_event_persistence_recycle_bin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_portproxy_registry_key.eql,sha256=srazrEoGD78sXkkO8H6HacFW72o1PHiDsF8b8a5FldM,65
src/rules/windows__registry__registry_event__registry_event_portproxy_registry_key.lucene,sha256=3Gi8VgPFBi8_cQhYJ1eRDEojaqAn4X7jADs0xehNi6s,52
src/rules/windows__registry__registry_event__registry_event_portproxy_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_redmimicry_winnti_reg.eql,sha256=0acP-HeDIL4jj9TNI1qm-wLa3t1eEko3EXYY5Uv1_fs,70
src/rules/windows__registry__registry_event__registry_event_redmimicry_winnti_reg.lucene,sha256=z932umfZMvGEMgP13upgA1CvUIh8zp9aNMG7__8mCco,58
src/rules/windows__registry__registry_event__registry_event_redmimicry_winnti_reg.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_runkey_winekey.eql,sha256=fSnF1fBwPo9Osten3t1nZk5UWIejxM1WfSPVE7crvmI,89
src/rules/windows__registry__registry_event__registry_event_runkey_winekey.lucene,sha256=BY_q06ypOi4Li3UadOCfxlLDfpCGI_3VivucyvrtkTM,78
src/rules/windows__registry__registry_event__registry_event_runkey_winekey.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_runonce_persistence.eql,sha256=9SAFBzi3inNZyCUASDkHFh1qRtyRdauItHOHeJrnIEk,622
src/rules/windows__registry__registry_event__registry_event_runonce_persistence.lucene,sha256=GIad5zbUJBF4MhbRLtLCF2sU0tfQnAcyZS3NSt85Ib8,635
src/rules/windows__registry__registry_event__registry_event_runonce_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_shell_open_keys_manipulation.eql,sha256=DtzuWy4HlYY6e4q0WlviCwJ6pzy2BiIlpyN6f4hC02E,502
src/rules/windows__registry__registry_event__registry_event_shell_open_keys_manipulation.lucene,sha256=LG58bXSJbgTVF9PuU3V5s0JbFMQVcEggToQ2dw4g9ms,482
src/rules/windows__registry__registry_event__registry_event_shell_open_keys_manipulation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_silentprocessexit_lsass.eql,sha256=GcZIw8ZHQcb6l9KcttffchQfijFnLA5rBwmSbuWmkZQ,96
src/rules/windows__registry__registry_event__registry_event_silentprocessexit_lsass.lucene,sha256=1X8qhJDa8x6Fuak8AtxUfd_WY0-ftWtCkq_0a7G7UgE,85
src/rules/windows__registry__registry_event__registry_event_silentprocessexit_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_ssp_added_lsa_config.eql,sha256=5l0VwJie3y2Drp4w8yml4152ZEnhQT-7etSz2_PE6Y8,233
src/rules/windows__registry__registry_event__registry_event_ssp_added_lsa_config.lucene,sha256=BGCRWG9HQT_IKipZ5T5e0PikDMjrzkm3NHfuhTZmn-8,211
src/rules/windows__registry__registry_event__registry_event_ssp_added_lsa_config.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_stickykey_like_backdoor.eql,sha256=tWLMG0a5qrMLt_B-9K68kycrHx29b5JgMYXwosRUlTs,890
src/rules/windows__registry__registry_event__registry_event_stickykey_like_backdoor.lucene,sha256=Rd_lw1FiJzW13Zjs02954NQI_Fq3s6lfKphAaHmvYwY,904
src/rules/windows__registry__registry_event__registry_event_stickykey_like_backdoor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_atbroker_change.eql,sha256=7WJ4R2llR9nzKV8sXPg24yG7zb8vqp9FB8TIpn_OVek,537
src/rules/windows__registry__registry_event__registry_event_susp_atbroker_change.lucene,sha256=tZj0WwQ9ZHUXJ-kNYkEsLuPRUvLZcFUBLW3ZEGNZlf0,517
src/rules/windows__registry__registry_event__registry_event_susp_atbroker_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_download_run_key.eql,sha256=mZUfC3iA4_CZ9eAoiZC19PbBdr_zxTTj4R0AcIY-2QE,494
src/rules/windows__registry__registry_event__registry_event_susp_download_run_key.lucene,sha256=-GDOwF-J_A4TNCfqvVkPsF8E9QBmcCTkxHj_mf9O1HM,469
src/rules/windows__registry__registry_event__registry_event_susp_download_run_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_lsass_dll_load.eql,sha256=Ans5sULwDYu6pwCE0egDzDH-mvIpCtiS-ejuHj6byu4,333
src/rules/windows__registry__registry_event__registry_event_susp_lsass_dll_load.lucene,sha256=ZrzkpMkpHKxqJoosvEEuzt_HfX4_HNwwNX8uP4vVwdM,306
src/rules/windows__registry__registry_event__registry_event_susp_lsass_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_mic_cam_access.eql,sha256=flYmBZpq5_Dvd4e98GxkOukU4R2v7Jkt6uUdEF9UWhI,356
src/rules/windows__registry__registry_event__registry_event_susp_mic_cam_access.lucene,sha256=ECbk-8VkapUBFaPPFM7EeUvVjJp40Y625kGPI1j6FCM,331
src/rules/windows__registry__registry_event__registry_event_susp_mic_cam_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_process_registry_modification.eql,sha256=6ahARYBBoye9NefKMNKxJPJxf9TcgOQQzijZYR6-X7Q,88
src/rules/windows__registry__registry_event__registry_event_susp_process_registry_modification.lucene,sha256=4cRQcPUi__SCd2-BQkwgycR1SOqi4MqOVbmuwtYX4Fg,70
src/rules/windows__registry__registry_event__registry_event_susp_process_registry_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_set_enable_anonymous_connection.eql,sha256=4YrcoBslsg-etE7DIC5Cnkct8ZbS1WFuliJR05wPUfI,128
src/rules/windows__registry__registry_event__registry_set_enable_anonymous_connection.lucene,sha256=FRpGHQhHPEO9Ndbq3wXzJNW3qvEj86yn_iwC5bCgTcM,117
src/rules/windows__registry__registry_event__registry_set_enable_anonymous_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_add_load_service_in_safe_mode.eql,sha256=gpMmXXQtswO9pcID1QljWGlz2SRTBl69eyK6qv4KGCA,916
src/rules/windows__registry__registry_set__registry_set_add_load_service_in_safe_mode.lucene,sha256=woRcBl0m5mduIhgoCYDomRpKYdHII75y3c7pPPiJSmc,887
src/rules/windows__registry__registry_set__registry_set_add_load_service_in_safe_mode.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_add_port_monitor.eql,sha256=bf8B_653ptDEtvOuz8CGnL2xJq2I2dJeC7hyjpAM0jU,538
src/rules/windows__registry__registry_set__registry_set_add_port_monitor.lucene,sha256=MExA7d3nShAEflJO6ukofE36OntWhbpuachzOlkCYio,504
src/rules/windows__registry__registry_set__registry_set_add_port_monitor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_aedebug_persistence.eql,sha256=G-PvUziSBGi7qBZUTZSI1odC1fIEZsFZmvW75AY4Mk0,242
src/rules/windows__registry__registry_set__registry_set_aedebug_persistence.lucene,sha256=oMNY8_uthBPMbJ3IA3-Xu0I5Twhxx6YMs1UVDfd2XIA,237
src/rules/windows__registry__registry_set__registry_set_aedebug_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_allow_rdp_remote_assistance_feature.eql,sha256=vx9jgT6qwt3HOM7Jt-QYtakpWFG45s2EFzUOFJLCmks,147
src/rules/windows__registry__registry_set__registry_set_allow_rdp_remote_assistance_feature.lucene,sha256=Lp2cvY2_cAlR6BwATE9dRx9WvYvbmImBZanW38SOOb4,137
src/rules/windows__registry__registry_set__registry_set_allow_rdp_remote_assistance_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_amsi_com_hijack.eql,sha256=kkRckmQjsPlLcNCHdeQ-ABNxHFr068leGIho1KqTnn4,169
src/rules/windows__registry__registry_set__registry_set_amsi_com_hijack.lucene,sha256=NrCEIjwyCyphY3zs8k0a1lxMyXON2QocEoHbTmzyS2E,163
src/rules/windows__registry__registry_set__registry_set_amsi_com_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_classes.eql,sha256=JQmUCs1tIfl__UKbVYk0D4dhp-ACVCbLulHrtX8-iQs,1154
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_classes.lucene,sha256=C9c-orl4WaexUJUqP5m4UbreqT0e12wcO3LvNZ0bpa4,1162
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_classes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_common.eql,sha256=MAmGzJi6Y9JnwnqougbUMNyLfve3YWaoGvKQpFyGILQ,2524
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_common.lucene,sha256=pLvTmyNumqrv5BVS-sgjyz78fTvyuC_8sk0RJByo614,2559
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_common.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentcontrolset.eql,sha256=e2DxINzm8-3f8WHOm0D6HBRU7-e10ukW7WNlc0V_E7g,1191
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentcontrolset.lucene,sha256=hcuH2POjzDJ4uuboT03rz5G27OioFERonx_6rAkEisE,1149
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentcontrolset.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion.eql,sha256=7gV4ud9LReRSarqK_1sIGA_Q0dG9QLQX_hV-EY-eLB8,6996
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion.lucene,sha256=7xzPQdh-mm5M_ywrgQAh17WgmYR9XYfUQz3QAPjTfGc,7046
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion_nt.eql,sha256=18rcBkZXonxDeXqyiYvh0MR_NB8Mc82hsf3nkngeFjY,3062
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion_nt.lucene,sha256=Y62dFR_hW1P6znzdBBAVBRJp4WJT02HC3iOjcsFYXq4,3014
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion_nt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_internet_explorer.eql,sha256=Yj-2ySrlqjNwbqmPo4xKAhLYRvYsfokovKKlCKsZ_Lg,651
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_internet_explorer.lucene,sha256=8fRU5Jme-nAQQhkLDHl5f7CIxKStCJF0o2sCgMl_IHQ,636
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_internet_explorer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_office.eql,sha256=bm7hwDUbEbCxCZX2eM2O8TTHRux5JAcyYTZORZHHiJA,2200
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_office.lucene,sha256=uWgGQZUMokJ7gWIgcuDZqdtswx9DJZXHolSgkvw7fuU,2137
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_office.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_session_manager.eql,sha256=rBXKwUnkBnd3xTWBlbOh1970RPZQv5ElTiBXFcGfVk8,269
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_session_manager.lucene,sha256=1ZH2H5No-upS8biQv7s5m7UYbuXtOWgu4coEPKFDu_4,250
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_session_manager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_system_scripts.eql,sha256=kaZFy0joIsK4eJUIWGMy7IaW6m8P5gtijwF8I03_lTE,217
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_system_scripts.lucene,sha256=3IaBAaKjckJA9cWJvsF7lGPcXopN9B4Z4vWj77KEuFs,197
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_system_scripts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_winsock2.eql,sha256=AUS0U9T2TrQVduUUmrK09Ro3PgpbgePPHSW4xFAdecQ,366
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_winsock2.lucene,sha256=-hdrV_mjYtrUgsh09VH_l6Jx6Mx-pjPidqtGpFnzeU4,344
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_winsock2.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node.eql,sha256=TllLgq8KMVNUuZNpSnbWXdjItjPrsZK2npIJ8dnrwdc,3906
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node.lucene,sha256=ym2AuyMKIiGLJcqi7OPIinNTVSwcRgP6obLzuXZ-g38,3884
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_classes.eql,sha256=P--zesbKqSuMzFMpLL4ILcGvZ8OBBcpnqkxtneXTK3s,727
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_classes.lucene,sha256=D8Be9N6oKtz8WD5efilmTj5VfdaoN-06zEOoeHXRtRM,731
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_classes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_currentversion.eql,sha256=W3ycOJamipv0Zh52-Zi_Aq-GBei9mshk8H5SqP6rrK0,384
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_currentversion.lucene,sha256=Z_rtI-AH0AjRIxr6SsBhjJ8ORjrRg3-dlagx1uLhNY0,371
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_currentversion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_db.eql,sha256=z9iiMrnbqvKuxjOzfVI-2FQZDElHOeu0PiNVBaVdFd8,68
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_db.lucene,sha256=s2Wvxmg7C7vPD_A5PV3cEss5UGBJGgq-23uOTo7fYRM,56
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_db.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_vbscript.eql,sha256=w_4zA9eVdx16GRrxXApZBEOvicizPt3dGAP1JroAtTM,108
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_vbscript.lucene,sha256=JlLm0f9oNeiJKYBi7MFFNb8Efouyy8TeDZ-Uj5C2vC4,93
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_vbscript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_wmi_query.eql,sha256=PtDqXOrZNcJ7L1irkrxEWeMSxcl_CzvcsUprYr9IsWs,108
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_wmi_query.lucene,sha256=iBH2HVSCc06HAIKEmeiW9uE9qUPVG8SZevnjykyiUlI,93
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_wmi_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_delegateexecute.eql,sha256=Z6UYFC9IWeVrHbHMyOobBgux3IKrz_FPWOXhCPfQ02k,100
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_delegateexecute.lucene,sha256=CkYWQsSNj1TaG7ES8JtdaAmMvwKlbaQMln8GIvlCuLQ,88
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_delegateexecute.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_eventviewer.eql,sha256=uGPCgzjvOpA1leazH6wKIVYXO6JwfqBsR5T2j9yp2ao,158
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_eventviewer.lucene,sha256=KiO_6Pry76cL3I6QDnmuZa9phCcB8Ulr8Z0SYUBFOBs,148
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_eventviewer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_silentcleanup_task.eql,sha256=dPVtrfRpperdO9_Y3Fj53LRa8eH4BaAVZZOsTCKdm9A,100
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_silentcleanup_task.lucene,sha256=7D6ncR7mog6K7mdEYZ0JQ5pavFDB9Ri4kv095gnNqyc,86
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_silentcleanup_task.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_change_rdp_port.eql,sha256=UKh2Jg_fIBXEA-gZpK8T_CUmGOV3fP4-qkC85XVpsxg,145
src/rules/windows__registry__registry_set__registry_set_change_rdp_port.lucene,sha256=WjTtPICuINVyC6DlkiMZR6GcN28Wwdvj1IfOVwLjago,136
src/rules/windows__registry__registry_set__registry_set_change_rdp_port.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_change_security_zones.eql,sha256=eKCtpYGWo2Ny7S0hadxBPHybekmF3SwQy91iqL0BrTI,214
src/rules/windows__registry__registry_set__registry_set_change_security_zones.lucene,sha256=L2gb1nRt0dNvjef8F4NNfvIfAixVTpexwu4rCCzs_3g,202
src/rules/windows__registry__registry_set__registry_set_change_security_zones.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_change_sysmon_driver_altitude.eql,sha256=Dahr1Ao8LcoO-Nvbu7D8fxv4qqBogZxMYL889JLhsuM,101
src/rules/windows__registry__registry_set__registry_set_change_sysmon_driver_altitude.lucene,sha256=o9KuJ5PZFFIEYrlf8pfjaEVuO-g_FMS3PPFxUC_VCvQ,87
src/rules/windows__registry__registry_set__registry_set_change_sysmon_driver_altitude.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_change_winevt_channelaccess.eql,sha256=Vh2X07J8HG6ZKsNAjbfc5DKcMBSjc6gn2_tfIaobzJI,388
src/rules/windows__registry__registry_set__registry_set_change_winevt_channelaccess.lucene,sha256=yLica9aUPCdzWBup-Fj-UJ4S4E96_DswPmpikM7xxDY,366
src/rules/windows__registry__registry_set__registry_set_change_winevt_channelaccess.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_chrome_extension.eql,sha256=DJHkZFxloI8bfOJ1uy-LuD2eCDW3PrIXVm5E_iyllTA,4167
src/rules/windows__registry__registry_set__registry_set_chrome_extension.lucene,sha256=ftg6wLXpszySeLau-GXkaCVxmRropwNt3vf2J21wqY8,4145
src/rules/windows__registry__registry_set__registry_set_chrome_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_clickonce_trust_prompt.eql,sha256=rKalgx_f0P1BQgbmGd2uQIEbkM7ZvruzWudZWadlN9E,266
src/rules/windows__registry__registry_set__registry_set_clickonce_trust_prompt.lucene,sha256=fuKi_H0eTHYIQFybMaTmerQ0xKONmdlYMgmPyqmH_HY,243
src/rules/windows__registry__registry_set__registry_set_clickonce_trust_prompt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_cobaltstrike_service_installs.eql,sha256=O8VRlsuS_zZUC7MBu20gwpjdcbKpGxiTzfiDUCTxFUM,359
src/rules/windows__registry__registry_set__registry_set_cobaltstrike_service_installs.lucene,sha256=1nOGVkrtyBYRsQI5sfDPghHhpgJW57rR68G7Siqlpas,333
src/rules/windows__registry__registry_set__registry_set_cobaltstrike_service_installs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_comhijack_sdclt.eql,sha256=tCP_P8W0oEznMA5-QP-Jqww9lysMofihHG3D6zHgK0c,95
src/rules/windows__registry__registry_set__registry_set_comhijack_sdclt.lucene,sha256=fIK9r50OKVib45JMgLb9kc1DyVLS-vbxu2PqPLCOQSQ,83
src/rules/windows__registry__registry_set__registry_set_comhijack_sdclt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_crashdump_disabled.eql,sha256=ib5a_P_SY8xyDQ_UzIsFTLbHGJeQKcEaSqwy6ViYmvs,128
src/rules/windows__registry__registry_set__registry_set_crashdump_disabled.lucene,sha256=wWH6pklxGIQXFUrvrJDiSNgwmaGz4I8bOZF9QmBbnaI,117
src/rules/windows__registry__registry_set__registry_set_crashdump_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_create_minint_key.eql,sha256=hONxcqOx-ji9MGRvUQifsyL26CLwzcnQKczuoOH9bNk,86
src/rules/windows__registry__registry_set__registry_set_create_minint_key.lucene,sha256=b0on7xD5KH0MtnVmtwc2hYGGJbqTY7hMO6sg8rGRN7Y,76
src/rules/windows__registry__registry_set__registry_set_create_minint_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_creation_service_susp_folder.eql,sha256=aJPe2jaKcrlKJE4f84XeoFmhLUvYKgk68qH8Gz5FNfw,841
src/rules/windows__registry__registry_set__registry_set_creation_service_susp_folder.lucene,sha256=8Afx5O_lvLjjDN8eVCQ57IouDvxFy86r53YDCHW6oMY,788
src/rules/windows__registry__registry_set__registry_set_creation_service_susp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_custom_file_open_handler_powershell_execution.eql,sha256=0xWKyHUOyt5Af5Z6TuoKVu1tiIxoi9E85FrZbjTvS2Q,141
src/rules/windows__registry__registry_set__registry_set_custom_file_open_handler_powershell_execution.lucene,sha256=irL_B1YuhX8CbiWqRrTf5VzupG0hahQYVl5jTskILCg,125
src/rules/windows__registry__registry_set__registry_set_custom_file_open_handler_powershell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dbgmanageddebugger_persistence.eql,sha256=Es4nJLtAXhZAtMmlTPIWw1hvAHdWH2bMeWpltwkei98,198
src/rules/windows__registry__registry_set__registry_set_dbgmanageddebugger_persistence.lucene,sha256=ZZSFQCmLNsd5feN174eBwUROdjUFLtwtpn3uu1zItSU,193
src/rules/windows__registry__registry_set__registry_set_dbgmanageddebugger_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_defender_exclusions.eql,sha256=-I4NV1ObB9JIPw4bwi2FYwRzRO7B254wH8eEWgI9xjg,70
src/rules/windows__registry__registry_set__registry_set_defender_exclusions.lucene,sha256=9a3YDMO2Nlpz2w_UcUosD58w74E8IY3gXceudvfqdFU,59
src/rules/windows__registry__registry_set__registry_set_defender_exclusions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_desktop_background_change.eql,sha256=uUXUzDAS3t5FPcktrTGkxGDcRx0C6dQYyuzIcXLsC6I,755
src/rules/windows__registry__registry_set__registry_set_desktop_background_change.lucene,sha256=I6QCoBI15Qds5o86vZUk4alTQt43fZ3uvwEBte_u8rA,725
src/rules/windows__registry__registry_set__registry_set_desktop_background_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_devdrv_disallow_antivirus_filter.eql,sha256=KRANCntXS3p3cyxvnwtUJqF9taUbUdRHQ4xnjZCxCvI,130
src/rules/windows__registry__registry_set__registry_set_devdrv_disallow_antivirus_filter.lucene,sha256=0hLC3gobqvebPYWd1df15Xp02Kpx2twWntHkXibiQfw,119
src/rules/windows__registry__registry_set__registry_set_devdrv_disallow_antivirus_filter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.eql,sha256=lzjZamhs9-UgMt1KMqIFiJaVdKJPKa9KtW5C5zJo_cI,295
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.lucene,sha256=knAQUSwgnC7YnHff0fepmxmE85mGi8jvNm6gckhSGGE,278
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.eql,sha256=l_hc3QBp5G-Ngw1JgRYlBlbxlaRkB650KRH8fBbm-Ik,123
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.lucene,sha256=bxvMcyDqgp8K43Cip_4h7_DDppdbVhx_4QhFQXc9WR4,112
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dhcp_calloutdll.eql,sha256=vxzQjGGHE75MMyW8uV6isJzu73STL9tW6AlO242Gkhk,138
src/rules/windows__registry__registry_set__registry_set_dhcp_calloutdll.lucene,sha256=YFz0GGTlsz79fkIt441wxRU5citZe5KHFxsMxp7IgNA,120
src/rules/windows__registry__registry_set__registry_set_dhcp_calloutdll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_administrative_share.eql,sha256=rC9shiMKFw2rZvVjEfL8UONe6e0bVWbgYAI42FvRZhM,186
src/rules/windows__registry__registry_set__registry_set_disable_administrative_share.lucene,sha256=UOnoBXvsjbWZ9SMLN3sLrQ0e8dwrCDlIVv7AsNYrw90,166
src/rules/windows__registry__registry_set__registry_set_disable_administrative_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_autologger_sessions.eql,sha256=M96hXPkOl9lfqSDHr7FumjUUg7tZlwlS0Tzt09JaiYI,627
src/rules/windows__registry__registry_set__registry_set_disable_autologger_sessions.lucene,sha256=59DUH0vcsO6GEyDo3LVh7c6Zp3W0DJl_sghoJnz_96Q,587
src/rules/windows__registry__registry_set__registry_set_disable_autologger_sessions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_defender_firewall.eql,sha256=HHHhPGFhxBNMLos4u_SrwZUXeW5HCPDzitYDXSisRlQ,172
src/rules/windows__registry__registry_set__registry_set_disable_defender_firewall.lucene,sha256=YgBrrsG6DzK0qEBxUfZPxY0IQvAcywVRntc2z8Wh6q8,158
src/rules/windows__registry__registry_set__registry_set_disable_defender_firewall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_function_user.eql,sha256=MZh0jID2nerA0wmQwxDigtZKmj6vTsJO1jLW0V6dSIo,1654
src/rules/windows__registry__registry_set__registry_set_disable_function_user.lucene,sha256=kC0zeNcYRyWu4g7QjPqtk38Dd_Ps1ENGi1ZJ4ZwvzM0,1631
src/rules/windows__registry__registry_set__registry_set_disable_function_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_macroruntimescanscope.eql,sha256=HqDZgIR-uoM7VmyXLKJ5z9gL8a6nYBPXPclYpDvnhlI,224
src/rules/windows__registry__registry_set__registry_set_disable_macroruntimescanscope.lucene,sha256=gu_AI3CKH23SQfZLhR7_Omb31YqE5Hztz-mNXcIB0xw,205
src/rules/windows__registry__registry_set__registry_set_disable_macroruntimescanscope.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_privacy_settings_experience.eql,sha256=UYMOfVxZYCBuoUr0D3i6J6A3nuqadn5v2UI-4s0zezU,151
src/rules/windows__registry__registry_set__registry_set_disable_privacy_settings_experience.lucene,sha256=ZIFP1zPbaF_d92vDWjJQU5QGHumVQiRNCkvVdqcKbP4,140
src/rules/windows__registry__registry_set__registry_set_disable_privacy_settings_experience.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_security_center_notifications.eql,sha256=74Gg4meEYvzoLDH2izipJ0t-z4jGwr_zyWuUo361L0Q,145
src/rules/windows__registry__registry_set__registry_set_disable_security_center_notifications.lucene,sha256=nTwM0ZPkGi52Oh-x4L1Y17i3ceOHlHGBRjDf-TPNzLE,134
src/rules/windows__registry__registry_set__registry_set_disable_security_center_notifications.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_system_restore.eql,sha256=oaHeliiLcdFgpzEFoG7iscmpn_yWmy64NW94HLzc7ZY,257
src/rules/windows__registry__registry_set__registry_set_disable_system_restore.lucene,sha256=N1D477rdFCM-HO86oc2lIzUNOoSB_Zmz4U5ZkLrOByg,234
src/rules/windows__registry__registry_set__registry_set_disable_system_restore.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_windows_defender_service.eql,sha256=qRBk5gCLpTNPREurUGiz3YjdHbOuihowRZF0hmcxcX8,107
src/rules/windows__registry__registry_set__registry_set_disable_windows_defender_service.lucene,sha256=ptGAhY-fyfb705FmxCF9Nq7FeiMA_SkWMg73lS0vUrc,96
src/rules/windows__registry__registry_set__registry_set_disable_windows_defender_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_windows_event_log_access.eql,sha256=kthhJX_gbwZp_bP1y2lkhGwywwZ_8Mw9PU66WMZ-c6M,669
src/rules/windows__registry__registry_set__registry_set_disable_windows_event_log_access.lucene,sha256=9hQjIyYbvrm_QMoF_mH3cy7yLQ_9q3XVmWC-Z3Adrso,637
src/rules/windows__registry__registry_set__registry_set_disable_windows_event_log_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_windows_firewall.eql,sha256=RIXQohI1eqv58DtZKwQhWIeABdNx53e4_BGXQupIPdA,254
src/rules/windows__registry__registry_set__registry_set_disable_windows_firewall.lucene,sha256=rZrhQ5WRU4Z_3lvUsIspGQyyVrZyff7L2qVwGOro7Io,237
src/rules/windows__registry__registry_set__registry_set_disable_windows_firewall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_winevt_logging.eql,sha256=8lvMVrTAxcIbfLrjD6MwK1bpcdvcPTZZo9EEPxIRZTE,1171
src/rules/windows__registry__registry_set__registry_set_disable_winevt_logging.lucene,sha256=8_JDCXuCfyh4MGgZjha0h1EIoiSSK_absspw36rXQwQ,1150
src/rules/windows__registry__registry_set__registry_set_disable_winevt_logging.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disabled_exploit_guard_net_protection_on_ms_defender.eql,sha256=tFVRiAHuFHGZGlV1WcoeklrYvcw7_Tqq05xvv2BY_eY,204
src/rules/windows__registry__registry_set__registry_set_disabled_exploit_guard_net_protection_on_ms_defender.lucene,sha256=mvYQ9RZR0jhgsHgsbvGvz4ZS0Kaq-dNHoov-TjyvPg8,199
src/rules/windows__registry__registry_set__registry_set_disabled_exploit_guard_net_protection_on_ms_defender.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disabled_microsoft_defender_eventlog.eql,sha256=hDClo-9uIDNghmWRG7gRRSwVTtTymcJOn_jhHAPWkeI,191
src/rules/windows__registry__registry_set__registry_set_disabled_microsoft_defender_eventlog.lucene,sha256=lwEq5V2sgZKHg0A1dZTbugL0YUt2bKxkCOFXus_MpDQ,184
src/rules/windows__registry__registry_set__registry_set_disabled_microsoft_defender_eventlog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disabled_pua_protection_on_microsoft_defender.eql,sha256=ciA8qWDAGre5JapYkkAJNBZ3Tx7LAILs2bHip_inI_k,134
src/rules/windows__registry__registry_set__registry_set_disabled_pua_protection_on_microsoft_defender.lucene,sha256=qO7EQi4R2yGjSGbUxwrVMEh4pFazIl10Hk0U0j17yRs,124
src/rules/windows__registry__registry_set__registry_set_disabled_pua_protection_on_microsoft_defender.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disabled_tamper_protection_on_microsoft_defender.eql,sha256=HJp3Yh6QOp_rFEYBbs8LNVsMCvLyPAIKqHqkn85zgaY,345
src/rules/windows__registry__registry_set__registry_set_disabled_tamper_protection_on_microsoft_defender.lucene,sha256=KbAAGps1bV0Mxam28_cWwQml2satCbZWZDlE7M8yba4,333
src/rules/windows__registry__registry_set__registry_set_disabled_tamper_protection_on_microsoft_defender.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disallowrun_execution.eql,sha256=nCnAvxeh05PISkeBvoAJHkbHghiUWyC2uWdhYgRYBC0,156
src/rules/windows__registry__registry_set__registry_set_disallowrun_execution.lucene,sha256=XMWL3lmOgn5bIj1CSFO8v0rncmWfBX1FEmWKM34m2ow,145
src/rules/windows__registry__registry_set__registry_set_disallowrun_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disk_cleanup_handler_autorun_persistence.eql,sha256=oKdiN62PYadv06Cli1cOgpWuATeu1loEZX57pS8Vm-M,490
src/rules/windows__registry__registry_set__registry_set_disk_cleanup_handler_autorun_persistence.lucene,sha256=czJyxLSO1nKQogV7KojfMnN79g5TtBKCFBZjIxSeAeA,458
src/rules/windows__registry__registry_set__registry_set_disk_cleanup_handler_autorun_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dns_over_https_enabled.eql,sha256=d_sz8YRNJhePSt54sAhKKFU5nKdADkdU84xO1-gaw0U,384
src/rules/windows__registry__registry_set__registry_set_dns_over_https_enabled.lucene,sha256=bp8YvtbGcVU3BhMqgzBjj8YA_dzHcsUgaBGfroRBpIQ,368
src/rules/windows__registry__registry_set__registry_set_dns_over_https_enabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dns_server_level_plugin_dll.eql,sha256=0vfCEQC45O9QS5PG50NCqC0Il04NsfKD1XkXl8TDBxg,77
src/rules/windows__registry__registry_set__registry_set_dns_server_level_plugin_dll.lucene,sha256=TK-GSNlwfuYd78bPNmWZctv98j2g1v_CpK9eWYPfa9c,65
src/rules/windows__registry__registry_set__registry_set_dns_server_level_plugin_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dot_net_etw_tamper.eql,sha256=7I5gGR4xmDMUx5uuTeGKvIBvSqILOb7hsOdxlo6gioE,269
src/rules/windows__registry__registry_set__registry_set_dot_net_etw_tamper.lucene,sha256=cTwg3QTlcduMm2JNVZlDSpY2beAF35Dx7hDNOnw53-I,245
src/rules/windows__registry__registry_set__registry_set_dot_net_etw_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dsrm_tampering.eql,sha256=Re39aY0a1bt6FeDm9TxjvXbSyFX2LLEFQ6iMGeZ7nTc,123
src/rules/windows__registry__registry_set__registry_set_dsrm_tampering.lucene,sha256=2pDpgGgzxVbvFj5uVtU7IIARVSEQBcrfgKpSYl64VCM,112
src/rules/windows__registry__registry_set__registry_set_dsrm_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_enable_periodic_backup.eql,sha256=vfQ_BUqbI1me0zDZ9mQDvx5V3SoNsDY9qN6JwbgWtN4,150
src/rules/windows__registry__registry_set__registry_set_enable_periodic_backup.lucene,sha256=a9TMjQp6abeg1CA8GXSJM1Up3v5nHhf9INBjhs2jQpE,141
src/rules/windows__registry__registry_set__registry_set_enable_periodic_backup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_enable_windows_recall.eql,sha256=30YIW9bnbNSxBq84gii7wosfyRA7FdCAMkK5k-svsK8,153
src/rules/windows__registry__registry_set__registry_set_enable_windows_recall.lucene,sha256=0308_O-LepilTCiJ_kglLuFgPUQSmCVcd-BY3JvYS1E,142
src/rules/windows__registry__registry_set__registry_set_enable_windows_recall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_enabling_cor_profiler_env_variables.eql,sha256=eMo11bC60mhXH3n1RHGLhrGpRIq4phyfOCtsfXzrPI4,155
src/rules/windows__registry__registry_set__registry_set_enabling_cor_profiler_env_variables.lucene,sha256=pap7JUN7PoAPE6uzUIAywFUIDw6IzuNmPjk57vjV6eA,135
src/rules/windows__registry__registry_set__registry_set_enabling_cor_profiler_env_variables.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_enabling_turnoffcheck.eql,sha256=Ch7qU32CxKNwab4oh314Nc2lgqY67p3Ud_h-qdQPyts,144
src/rules/windows__registry__registry_set__registry_set_enabling_turnoffcheck.lucene,sha256=Sx46wOmZb-kjCCG01h4UUdf0QbkrUckyRhMpQwPFXR8,133
src/rules/windows__registry__registry_set__registry_set_enabling_turnoffcheck.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_evtx_file_key_tamper.eql,sha256=_TVO43SGmh1WvGK5N_l75Z2V4gogoponY2TJqatELfs,175
src/rules/windows__registry__registry_set__registry_set_evtx_file_key_tamper.lucene,sha256=bTrcD0wdQ2Jm0NxakwlTnGbpQddFu4jisCItYCpL6MU,157
src/rules/windows__registry__registry_set__registry_set_evtx_file_key_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_exploit_guard_susp_allowed_apps.eql,sha256=xfC5Aml1o3_NRViiePFviKnSGTfRTYX5SlF3BTzkoUQ,283
src/rules/windows__registry__registry_set__registry_set_exploit_guard_susp_allowed_apps.lucene,sha256=D7GT1zlk3k-TguPcJ82uS8ci02izaBdtLKY11UBjtYY,264
src/rules/windows__registry__registry_set__registry_set_exploit_guard_susp_allowed_apps.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_fax_change_service_user.eql,sha256=DmSzugrT8wArj34A1FKp6yBwHlUwVpB0BfMTvulGf2Q,140
src/rules/windows__registry__registry_set__registry_set_fax_change_service_user.lucene,sha256=1mk0Ya_YTntFUqBS_2MP59ZmgaySYZz-sxglstPBRJ4,126
src/rules/windows__registry__registry_set__registry_set_fax_change_service_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_fax_dll_persistance.eql,sha256=9ygtHwNqxDOwouktpvIXIrsEr6mXSqco7X0zxHVfmd4,184
src/rules/windows__registry__registry_set__registry_set_fax_dll_persistance.lucene,sha256=LfaMxL6jspBXE4EG-Lw-E3eVaJaQ6XL7Y5pyE4aflhs,168
src/rules/windows__registry__registry_set__registry_set_fax_dll_persistance.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_file_association_exefile.eql,sha256=hjwp5CaiueFCvvCzrAmkIa45mRfqqpdOJFypM3aKfcQ,79
src/rules/windows__registry__registry_set__registry_set_file_association_exefile.lucene,sha256=ShbnOcmSWKx3bn6cvYuIz6QMMFHqstUGKmpb1Sd8GVI,65
src/rules/windows__registry__registry_set__registry_set_file_association_exefile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_filefix_typedpath_commands.eql,sha256=N1dLP2h6DS8gcdAuBXwohSXePzystTn-HnnwowlyUJM,669
src/rules/windows__registry__registry_set__registry_set_filefix_typedpath_commands.lucene,sha256=k8Pr7TQ-LMtwtOaJl7un-OkBPa72FBVL1IW17NlSKzQ,638
src/rules/windows__registry__registry_set__registry_set_filefix_typedpath_commands.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hangs_debugger_persistence.eql,sha256=w5FFkGac15YFCbssQDyRIRoD5hot6CYfqDrIbNXqa-o,101
src/rules/windows__registry__registry_set__registry_set_hangs_debugger_persistence.lucene,sha256=Pt8rJctQkektZu3OlAo0mCmfp3R7F8NN77Vyg8aUBo4,91
src/rules/windows__registry__registry_set__registry_set_hangs_debugger_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hhctrl_persistence.eql,sha256=WZEdnC3DuJ1wDib6fib14FoRtg3QqHrK0cvz5alfy3Q,175
src/rules/windows__registry__registry_set__registry_set_hhctrl_persistence.lucene,sha256=NjfIFqVIOXk2BzOo3UnGAmDUeoospVsJFv4HgvMW_C0,170
src/rules/windows__registry__registry_set__registry_set_hhctrl_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hidden_extention.eql,sha256=EAU7GQNqkS1IBL5NFfl7OIH3Xzc8l4BFNWbvRbdGwrI,308
src/rules/windows__registry__registry_set__registry_set_hidden_extention.lucene,sha256=g2lyuQKWUlRX_f6DwrS5ZbbfP0KWNOtRt_Z-78bBYq8,296
src/rules/windows__registry__registry_set__registry_set_hidden_extention.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hide_file.eql,sha256=wdP2Xp162osJH-7bXxeRTTVaBedDSZP4NHO6GivqZ8M,231
src/rules/windows__registry__registry_set__registry_set_hide_file.lucene,sha256=BZrysns0fNzoXGI6cmNA9cOPSM68Ij9cLPaWkgJWtbU,214
src/rules/windows__registry__registry_set__registry_set_hide_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hide_function_user.eql,sha256=lesLlKD4BUt7_gjBSe9j35hLWf0w63awXNoJUr38HRY,747
src/rules/windows__registry__registry_set__registry_set_hide_function_user.lucene,sha256=aqLHlK2qa0dwRT_wLRNlE-alJXNCLbqzlJgTIwCcsbk,723
src/rules/windows__registry__registry_set__registry_set_hide_function_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hide_scheduled_task_via_index_tamper.eql,sha256=lbqbMCK8Mc9F7zLwmeEJFj-ejHcZPx1VEbYPD_nM-Lc,188
src/rules/windows__registry__registry_set__registry_set_hide_scheduled_task_via_index_tamper.lucene,sha256=BmASCeqjxbLjkODd7EoWevt80Ip74KCOmBi0HSNlhqY,175
src/rules/windows__registry__registry_set__registry_set_hide_scheduled_task_via_index_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hvci_disallowed_images.eql,sha256=zbFpw8MepODLbduwIDw7xdAke7JzVAjwLA2Td3DMy-A,89
src/rules/windows__registry__registry_set__registry_set_hvci_disallowed_images.lucene,sha256=MqhL-P8sYW6l8It0t4uCfCTcj2IlXqstSGVyfQZj1xk,74
src/rules/windows__registry__registry_set__registry_set_hvci_disallowed_images.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_ie_security_zone_protocol_defaults_downgrade.eql,sha256=6ek0Pk9mTXf2RtJxwXtQ60VZ51XDXnA9Yx1BDsL75V8,214
src/rules/windows__registry__registry_set__registry_set_ie_security_zone_protocol_defaults_downgrade.lucene,sha256=92ThdKGOGuth3xrJ5NBY8Eqe3XFTDyoIIwlmG1KiAFQ,196
src/rules/windows__registry__registry_set__registry_set_ie_security_zone_protocol_defaults_downgrade.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_ime_non_default_extension.eql,sha256=8piL6tzQe6UP_oZ2qlZSV3v70JDYExxeiCT1oCdw9gI,135
src/rules/windows__registry__registry_set__registry_set_ime_non_default_extension.lucene,sha256=sxvImOCmBopb7ZS6ATAqMNSstQ7dVhHBl0C20l2t-W4,120
src/rules/windows__registry__registry_set__registry_set_ime_non_default_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_ime_suspicious_paths.eql,sha256=dVqGIKUsVk3BJJ2V8oL1dpR5lJ0YN-EhkymDBPs1680,565
src/rules/windows__registry__registry_set__registry_set_ime_suspicious_paths.lucene,sha256=1-rjzZ1FSUP4bFDWsSIKuG__tEoNmH6EtWnjOtqIRaI,528
src/rules/windows__registry__registry_set__registry_set_ime_suspicious_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_install_root_or_ca_certificat.eql,sha256=D1XrqX3Xcs2USIYYI24Ie7uq-3dNxfS_Auquhm7mvCQ,774
src/rules/windows__registry__registry_set__registry_set_install_root_or_ca_certificat.lucene,sha256=OZR2EhRxBorZtNlIHm6VT5G0VbslzkwrMB9HNCE8Qok,744
src/rules/windows__registry__registry_set__registry_set_install_root_or_ca_certificat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_internet_explorer_disable_first_run_customize.eql,sha256=GY4mgjuuUA-STYB5x-bZckhqh1BamIaVTb3x_Awa9Q0,665
src/rules/windows__registry__registry_set__registry_set_internet_explorer_disable_first_run_customize.lucene,sha256=TJ20pTGk1ztsD8fW0BQMOhKwVQScoLpRLMXmbkg8V6I,648
src/rules/windows__registry__registry_set__registry_set_internet_explorer_disable_first_run_customize.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_legalnotice_susp_message.eql,sha256=Khk52JbJb-HljljPnQJlUfkFBDLbvGXNY5zFZYIsbwA,297
src/rules/windows__registry__registry_set__registry_set_legalnotice_susp_message.lucene,sha256=RPZho6Hr9O-weF4r8ljiODtRC39GDkiY4SPPHYQ2ZYA,272
src/rules/windows__registry__registry_set__registry_set_legalnotice_susp_message.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_lolbin_onedrivestandaloneupdater.eql,sha256=V1jtWEAFDs3AxEZHLIaoTJKnnnCY_Qm51B969kjmxZs,108
src/rules/windows__registry__registry_set__registry_set_lolbin_onedrivestandaloneupdater.lucene,sha256=dEPzwNVT4kPDAYSX88sb82Agmawmo93tVySPC51fQns,96
src/rules/windows__registry__registry_set__registry_set_lolbin_onedrivestandaloneupdater.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_lsa_disablerestrictedadmin.eql,sha256=_4AYlAlMcOt-DbHoozsxj3KADcg4dfwPUvNmuwKVr2s,91
src/rules/windows__registry__registry_set__registry_set_lsa_disablerestrictedadmin.lucene,sha256=h7nLhsXREH7_PnGLYfDYwvT0YxBpO3dCs1VT9hiDWQk,79
src/rules/windows__registry__registry_set__registry_set_lsa_disablerestrictedadmin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_lsass_usermode_dumping.eql,sha256=HECbXc2lz2JPudnvZdzeK1MVBqmKl1gZm1LJE5HaLWg,261
src/rules/windows__registry__registry_set__registry_set_lsass_usermode_dumping.lucene,sha256=MUj4bZT2A2hxtXwCfQcZRyMNzb1SC6Qh4ddEbF_PfGY,248
src/rules/windows__registry__registry_set__registry_set_lsass_usermode_dumping.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_net_cli_ngenassemblyusagelog.eql,sha256=2-GS_OhbS8Gq_oz48v3gUQsZvIMNYbuZKjCBOYMn74A,84
src/rules/windows__registry__registry_set__registry_set_net_cli_ngenassemblyusagelog.lucene,sha256=jPd7iZbvA59l401LD3OFVuFfGBdLJguFujHiZh_BYjw,72
src/rules/windows__registry__registry_set__registry_set_net_cli_ngenassemblyusagelog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_netsh_help_dll_persistence_susp_location.eql,sha256=0NKgrn0AP8KajwsJFp10WS5n7EpUcksBLRizU7im3L4,598
src/rules/windows__registry__registry_set__registry_set_netsh_help_dll_persistence_susp_location.lucene,sha256=WULxv0K9pOy9Q5RS9PvV2BHZFt4mjaY76xygq1QRLG8,558
src/rules/windows__registry__registry_set__registry_set_netsh_help_dll_persistence_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_netsh_helper_dll_potential_persistence.eql,sha256=_AS5u8gjTmZJJZE2vRxSPw1u9ylG3d7hpTeYCtPq5qU,252
src/rules/windows__registry__registry_set__registry_set_netsh_helper_dll_potential_persistence.lucene,sha256=MB1bFLc4LbumSl-r2tKT2TeGzbcWT8A8eNkaykqIJ8g,229
src/rules/windows__registry__registry_set__registry_set_netsh_helper_dll_potential_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_new_application_appcompat.eql,sha256=TAGJTte7P6W0uQkVEJX9hh1sPcM2WROx1-dSbHxmtmc,79
src/rules/windows__registry__registry_set__registry_set_new_application_appcompat.lucene,sha256=y40bndYvNX2ANREKB_GlZK1F4q0PdBqgr-1S23f1PGE,67
src/rules/windows__registry__registry_set__registry_set_new_application_appcompat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_new_network_provider.eql,sha256=nlK3c1lLwPZIqxd8yIqG5675NTDzxRvtzadhgOBUhVw,421
src/rules/windows__registry__registry_set__registry_set_new_network_provider.lucene,sha256=8CJ2Kx9838WDz32cCLjHDXJlkcFsQEAi80BS4eaZieA,397
src/rules/windows__registry__registry_set__registry_set_new_network_provider.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered.eql,sha256=OG0-FlE_mEPpc3mJ8OQFbBgDUfh_GSVRbjW5AFsbdW8,485
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered.lucene,sha256=GNayuOOH8HQAz4E26zVKOJZhxdENViRzTs5rv-UrVSs,460
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered_susp.eql,sha256=Wy68Gl-QC71bUDk-_yKYbjEybHSGjwCTjNn72wC2ycw,1001
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered_susp.lucene,sha256=przGzsM4Ln8E4VYlQ791X6Bou7LEZM-V-SGghVaNLlU,971
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered_susp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_access_vbom_tamper.eql,sha256=5HJOaTQuEcVUsCwvtCgMznoDocgbqyb7ZP34S0v6UW0,101
src/rules/windows__registry__registry_set__registry_set_office_access_vbom_tamper.lucene,sha256=Bs8CdjFCR2jRzODxFn7IRhGMft-qxPFBHXGFQLmZXU8,90
src/rules/windows__registry__registry_set__registry_set_office_access_vbom_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_disable_protected_view_features.eql,sha256=imh1AnibMRwZmLlNHebqwtbRLeuyqxgEM4oUNaFhpRo,473
src/rules/windows__registry__registry_set__registry_set_office_disable_protected_view_features.lucene,sha256=id49kx6MbwopTpbp4E-1MvIcipR74opsR4tm73u6TLQ,443
src/rules/windows__registry__registry_set__registry_set_office_disable_protected_view_features.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_disable_python_security_warnings.eql,sha256=X7LDl8KyVXOm_IKY9-9_tc8qRthpK9v605BPp2RkNUs,164
src/rules/windows__registry__registry_set__registry_set_office_disable_python_security_warnings.lucene,sha256=2OMnc21MGlCy61d7zrESTQYx1TrS5lNIJDAPeIjxjxk,150
src/rules/windows__registry__registry_set__registry_set_office_disable_python_security_warnings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_enable_dde.eql,sha256=RZbpCmMINVYMM3ycNS3LUz-2jAItqEvm_FuWt7p9ctw,310
src/rules/windows__registry__registry_set__registry_set_office_enable_dde.lucene,sha256=jPngHdwXoietu0kSiK-WlNfxX_Du_M4Su6SYz4K9t0U,289
src/rules/windows__registry__registry_set__registry_set_office_enable_dde.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_load_macro_provider_on_boot.eql,sha256=fCvZaqHPkrrThUyVlQBdRDhtDO8YWT5o3Zr-YS43xSQ,107
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_load_macro_provider_on_boot.lucene,sha256=iE6zRygXC-d0sGt7dVRJwppAClwRA65RyRRcgisw4G8,93
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_load_macro_provider_on_boot.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_macro_execution.eql,sha256=eWzFp-U7bqIay6T7lGnskRd2YTuGot-bFTX1_bU_F0M,99
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_macro_execution.lucene,sha256=d9zF-TvE6587Oz1Qj89mQqyjW5sKyontR13fRu6hAiU,85
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_macro_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_unsafe_client_mail_rules.eql,sha256=OIx91E8x0Fr_eiwq7IsOhxgqjxoF_mkIhYjZl_py5Gw,127
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_unsafe_client_mail_rules.lucene,sha256=qDmBT0daCfKRMGdNCRfhOtxfzPd4GNulXwUWkjiv8c4,116
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_unsafe_client_mail_rules.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_outlook_security_settings.eql,sha256=oxtzOJEz5EdC12i7BUMO4TZ_K_SO49Zxj7eC9a6Jxxo,104
src/rules/windows__registry__registry_set__registry_set_office_outlook_security_settings.lucene,sha256=nsMVN8lOBQUzJ7JqdAp23rABASkNsral-_NfZa8j9bA,88
src/rules/windows__registry__registry_set__registry_set_office_outlook_security_settings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_trust_record_susp_location.eql,sha256=MaLOgUBYVxY3CXGXbJlXRgc-SSZ61MoHcKe0R9x4z98,246
src/rules/windows__registry__registry_set__registry_set_office_trust_record_susp_location.lucene,sha256=pb8AqnzgyW0sifMLTB9hWsStnFUYr1pDd0ln_5CxVpU,255
src/rules/windows__registry__registry_set__registry_set_office_trust_record_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_trusted_location_uncommon.eql,sha256=oQLVqY0r-JpK7hsJsSvpBTiAaRPWAXidP6NyMA0Z92M,805
src/rules/windows__registry__registry_set__registry_set_office_trusted_location_uncommon.lucene,sha256=D7-h85K7WKZlFurj9lxxHZybx0r6fI7vQ9Ra-agTL3E,797
src/rules/windows__registry__registry_set__registry_set_office_trusted_location_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_vba_warnings_tamper.eql,sha256=rSiKWxbdcFVDDwPHLH4YjduAk3MWEqWp8phCPSQQ198,102
src/rules/windows__registry__registry_set__registry_set_office_vba_warnings_tamper.lucene,sha256=aLx3NYfSsdH3wDhraCW0Fycel7VQm9in3k9_OY713qY,91
src/rules/windows__registry__registry_set__registry_set_office_vba_warnings_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_optimize_file_sharing_network.eql,sha256=ZOCguWacptvLImmDkTG11-Gav0XCgV2wPOqhWU2fJAM,74
src/rules/windows__registry__registry_set__registry_set_optimize_file_sharing_network.lucene,sha256=19w3f0Pwo6aLhpuFIUqv8skXCvSCjhS4y8lxCjT7Gfg,62
src/rules/windows__registry__registry_set__registry_set_optimize_file_sharing_network.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_amsi_providers.eql,sha256=dgFunl95cNAcyO1Reir4acqMQvXKub6_nZ4K-NOeFmo,722
src/rules/windows__registry__registry_set__registry_set_persistence_amsi_providers.lucene,sha256=RvBkrWPICsJ2TXxNigLarO34bwGl9oMCHXJl5_m2PAo,710
src/rules/windows__registry__registry_set__registry_set_persistence_amsi_providers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_app_cpmpat_layer_registerapprestart.eql,sha256=hqqL_Zkmwh8DlADr3YTB1VMMVNs36QU43Hfq4lNj7fo,157
src/rules/windows__registry__registry_set__registry_set_persistence_app_cpmpat_layer_registerapprestart.lucene,sha256=09huSYS9gztlLGEjv6Cqt_rN0UfC9mEwxDE3hFdVtm8,143
src/rules/windows__registry__registry_set__registry_set_persistence_app_cpmpat_layer_registerapprestart.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_app_paths.eql,sha256=1m7-c3BHg7SdkAdR3AZyeCmdRczg2CVxvze0RGoy7bk,435
src/rules/windows__registry__registry_set__registry_set_persistence_app_paths.lucene,sha256=_Xmu5oe5Q9k5Pm20fI1oxseENhNuyfOgM_s4r0PrhqI,407
src/rules/windows__registry__registry_set__registry_set_persistence_app_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_appx_debugger.eql,sha256=i3h_MVlQc5pCki7csjrTyqIBk4NcFUJYqcktSHqKLDw,246
src/rules/windows__registry__registry_set__registry_set_persistence_appx_debugger.lucene,sha256=bjIGa-HlIrhYXj2MBP2FfGGzo2zH1oGcRcFx8Vuvg8o,230
src/rules/windows__registry__registry_set__registry_set_persistence_appx_debugger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_autodial_dll.eql,sha256=F8PNqtEcErcc42f5hlsRhUz1jFn3WDnWX3ChQ3jqQ90,74
src/rules/windows__registry__registry_set__registry_set_persistence_autodial_dll.lucene,sha256=tMHjSu_KSRh4BZYfldwtWHjtdo7HL-YQel1QDvIX82I,62
src/rules/windows__registry__registry_set__registry_set_persistence_autodial_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_chm.eql,sha256=OeZ2OMqcShpa8MGmVaU8rNSTqqjQqic8VZqOXNJtddI,152
src/rules/windows__registry__registry_set__registry_set_persistence_chm.lucene,sha256=S0VXFyclp4sCDt_SX7OzL35ZYs7gwKxiYxIdX2eeHYM,136
src/rules/windows__registry__registry_set__registry_set_persistence_chm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_com_hijacking_builtin.eql,sha256=AoCPPGriM_sQHq9-x3vn2ls6b7NAgZj1qP9YSGuOTpw,1586
src/rules/windows__registry__registry_set__registry_set_persistence_com_hijacking_builtin.lucene,sha256=m-6rfA0jlmH1aGtbTI3MQn9UtdWIVAp-E-EPPws0xkU,1603
src/rules/windows__registry__registry_set__registry_set_persistence_com_hijacking_builtin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_com_key_linking.eql,sha256=6tICPY0vtXPBOlpmo378y4zcxnwifZv-yXKqi_z3bcI,173
src/rules/windows__registry__registry_set__registry_set_persistence_com_key_linking.lucene,sha256=yzAnzTl4LcGwCtlJdQvxmRognLC8DVkRT4vBy-DDT9k,154
src/rules/windows__registry__registry_set__registry_set_persistence_com_key_linking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_comhijack_psfactorybuffer.eql,sha256=bpimDLbuRao9iG4yE59zf3ikQ4d00iu23_xVuGn2B94,222
src/rules/windows__registry__registry_set__registry_set_persistence_comhijack_psfactorybuffer.lucene,sha256=EP3XSqf-nClMVIgkn21mdQkaJ6arsv0N9JNzGNJ8Iig,211
src/rules/windows__registry__registry_set__registry_set_persistence_comhijack_psfactorybuffer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_custom_protocol_handler.eql,sha256=tpfNerNurSBsP-gRGskE9AvLgETFnAIDqPQy6xDzsio,262
src/rules/windows__registry__registry_set__registry_set_persistence_custom_protocol_handler.lucene,sha256=zKEFKgBCwC9h08u3gjDOWkY-4B-f_MCgv0ug_Q4v-XI,246
src/rules/windows__registry__registry_set__registry_set_persistence_custom_protocol_handler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_event_viewer_events_asp.eql,sha256=TrrBqCpCmQPDjkVq6WJVKFfuIClpNXSXTwA394_qbn0,846
src/rules/windows__registry__registry_set__registry_set_persistence_event_viewer_events_asp.lucene,sha256=P4ykjEMvxLN9GAqag_TKw8pWdGqEtvpY8DE6-8xlWcI,837
src/rules/windows__registry__registry_set__registry_set_persistence_event_viewer_events_asp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_globalflags.eql,sha256=42sDFziLbOF_NJ1kjrMAJRHZlRws6vwGNLTjPzYBafQ,343
src/rules/windows__registry__registry_set__registry_set_persistence_globalflags.lucene,sha256=_BgHU4PYgui2weaY-u1D3-dPKn4wkcZad68KAuQF7Y4,316
src/rules/windows__registry__registry_set__registry_set_persistence_globalflags.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_ie.eql,sha256=b9Vt3u_ew13XAAgsAt9ujvlGSrM42xHLFChZgvLU1iY,524
src/rules/windows__registry__registry_set__registry_set_persistence_ie.lucene,sha256=g54POIv3acFzD23wqdC2ZZxvvvOxFmebTkJ55qbNVqY,501
src/rules/windows__registry__registry_set__registry_set_persistence_ie.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_ifilter.eql,sha256=RgJXM06nWHBm-Bhjlvejs_DdWeVHGzOoEhEIeioDxj8,1924
src/rules/windows__registry__registry_set__registry_set_persistence_ifilter.lucene,sha256=wEwIlGnOEQQ8WJAfnCQFiejlOxHwUkRw_di3Xa60_-k,2042
src/rules/windows__registry__registry_set__registry_set_persistence_ifilter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_logon_scripts_userinitmprlogonscript.eql,sha256=V8syNmcv8kvXKi8NVt1c5T2ZhrgSzKB-ebO2vfF5mD8,51
src/rules/windows__registry__registry_set__registry_set_persistence_logon_scripts_userinitmprlogonscript.lucene,sha256=RSXfC5kOowkTxKhGX_okjRXFjoC54TliWtLXhgR4J1g,39
src/rules/windows__registry__registry_set__registry_set_persistence_logon_scripts_userinitmprlogonscript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_lsa_extension.eql,sha256=1_VzrznhQMXpoVo-6nP9mqnm0w7xuIbFHwe2TpE9Kvw,105
src/rules/windows__registry__registry_set__registry_set_persistence_lsa_extension.lucene,sha256=5CBSiKqu1Lg-74gL3ERznA3xn7xfeL93s0UzO0XXv3A,93
src/rules/windows__registry__registry_set__registry_set_persistence_lsa_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_mpnotify.eql,sha256=2UXtXPJv2F8OIkvd9oHSUr1-iTRrkvPhiGYP5PJYPqI,98
src/rules/windows__registry__registry_set__registry_set_persistence_mpnotify.lucene,sha256=1n1gZjqUvLdUolNZAJLg9hEFn5ybtXRKEAQkvJLQ73U,87
src/rules/windows__registry__registry_set__registry_set_persistence_mpnotify.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_mycomputer.eql,sha256=rNUHRzr3JUf-vhcpp402-DNo07HDaCeTdxapaz2C2UY,118
src/rules/windows__registry__registry_set__registry_set_persistence_mycomputer.lucene,sha256=p_jqhG9RuiuJBg9q8pfeLNhFi9ej_lO50C0c3AY4APE,106
src/rules/windows__registry__registry_set__registry_set_persistence_mycomputer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_natural_language.eql,sha256=EA7g6fsEp4XyZ4ibcQS3R0IiiveOEXWy0OoWkPw9J6o,214
src/rules/windows__registry__registry_set__registry_set_persistence_natural_language.lucene,sha256=izeChwD2y7buOeJvW8g3K0xdExk2BzuFbO4RBKvHxQ4,193
src/rules/windows__registry__registry_set__registry_set_persistence_natural_language.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_office_vsto.eql,sha256=7x4uYTT8pKPkaYMWsdKNeGSOJaKHXRswiAdLYC1xTvw,1766
src/rules/windows__registry__registry_set__registry_set_persistence_office_vsto.lucene,sha256=HzXJ3o3m_Esuy0XfGQJp1Tbz62cwJvjX1JwH4LIQv4M,1735
src/rules/windows__registry__registry_set__registry_set_persistence_office_vsto.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_homepage.eql,sha256=6ZzSw8efqjc2KC7YUOUyMFNI8P4F6HBnJJDoTxTQitk,132
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_homepage.lucene,sha256=y0pHT1-lHhkh4FFOYZNxlKEyJm1jU2Z1z4mxiQG3xPM,114
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_homepage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_todaypage.eql,sha256=pXofG0AmwGjh3sjHcEaEAt9WTEtwi-dgMhIdsppGYxU,476
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_todaypage.lucene,sha256=BJDIXDXLBqxE3nwvDRxdv55I1xMZFlwyj1rjLzDvA4g,447
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_todaypage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_reflectdebugger.eql,sha256=PwXCNuGQybe1ZA51bl8ctQ3fX6hVoZaHZ0Wb3EuDUBw,97
src/rules/windows__registry__registry_set__registry_set_persistence_reflectdebugger.lucene,sha256=qknRN7Lh1byQVHTl6bV8xecKVmDo3ezpWN6QbUDUlpQ,87
src/rules/windows__registry__registry_set__registry_set_persistence_reflectdebugger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_scrobj_dll.eql,sha256=6INlOzV62sHDElnQYUsQEv6wjT9pdD4tAFxJnRxWJMY,119
src/rules/windows__registry__registry_set__registry_set_persistence_scrobj_dll.lucene,sha256=uH2Ik1xS4lQR9Ajx_9BpNF5kqnPoP6ZR15yZbEiWtHk,108
src/rules/windows__registry__registry_set__registry_set_persistence_scrobj_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database.eql,sha256=2SWZ1zHqBCNm1zl_FG_XddKc95ovoenSnv_8HOxc_Ec,313
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database.lucene,sha256=rutGxfpCqO_5LPx5BCvF3-NVm4VsaXeF1Zhp1rBM74o,296
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_susp_application.eql,sha256=Hp3naD4PBaChddVPcxquAqQHs6LCX4Wg_ne4wAvNGVI,320
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_susp_application.lucene,sha256=xEIMAPMhSRR2BwgZbB1wqjBCzbwTna4dc4M_ihj2Tug,300
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_susp_application.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_uncommon_location.eql,sha256=DojIG4C5MPurNCl4dgBHOc3YtAVQYSL1y3_cKB63_v0,218
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_uncommon_location.lucene,sha256=ndzeb9-5r9tG1fnULnSJWqYNqT3mWJn--h5xYKne7wM,203
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_uncommon_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_typed_paths.eql,sha256=1JZc8e5UQHQlFpikeZrOu5gbwg0475bfX0z2ypR9ckc,205
src/rules/windows__registry__registry_set__registry_set_persistence_typed_paths.lucene,sha256=l4k-yJknijaH3KQI5Hg1StJ8Zjj6NYKiEfmUvEd9Fvw,186
src/rules/windows__registry__registry_set__registry_set_persistence_typed_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_xll.eql,sha256=iD0g7eqvvfFDwUslbBaMOyjZXwZOb3Q1f6S4OQot6Jo,171
src/rules/windows__registry__registry_set__registry_set_persistence_xll.lucene,sha256=alEpR9Ya89cvH76FcXeBI8B-XpBZcoCuZ-QK5tq4Md8,154
src/rules/windows__registry__registry_set__registry_set_persistence_xll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_policies_associations_tamper.eql,sha256=jJAI4qQiU6CODBHck2fpXAvZFKZk_C2PodQMfpk5tII,390
src/rules/windows__registry__registry_set__registry_set_policies_associations_tamper.lucene,sha256=FU-9TXlPtOhCdu_dC-6mlhydZs3nn0FcHxl2PW0b-vk,366
src/rules/windows__registry__registry_set__registry_set_policies_associations_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_policies_attachments_tamper.eql,sha256=6EaXUo2qlg2xxywdSqpM_x_0HvyT2sVCWKNa0FjivxU,391
src/rules/windows__registry__registry_set__registry_set_policies_attachments_tamper.lucene,sha256=pMDRpRkUBSbmLQGRPL4sgJNRVYIC08TaMTmrcIO7pao,375
src/rules/windows__registry__registry_set__registry_set_policies_attachments_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_potential_clickfix_execution.eql,sha256=0Ln88Zq3D3uvnKdaCesres1rrO6ga2t6bQm6UjCWIU4,649
src/rules/windows__registry__registry_set__registry_set_potential_clickfix_execution.lucene,sha256=jbWuCJJA9_LPxGJYQRH4ws2rsFk7DCMPAd-T6HHlLgE,619
src/rules/windows__registry__registry_set__registry_set_potential_clickfix_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_as_service.eql,sha256=-GNFeNKoetCvbmO6SZcqgAO84ccy2nFH4WyZBygRQTU,139
src/rules/windows__registry__registry_set__registry_set_powershell_as_service.lucene,sha256=tEzlCFqxfycZ831B2xbUOqep4V-CxOxX31CvQ71KnYI,116
src/rules/windows__registry__registry_set__registry_set_powershell_as_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_enablescripts_enabled.eql,sha256=lUdDzqfKKEWeSuiw1IzS7W77JhRV9g236U_oSArVH1w,136
src/rules/windows__registry__registry_set__registry_set_powershell_enablescripts_enabled.lucene,sha256=Xd_B2zUOjb7q2ZwEGd-tmfKey3lmBKUzJGOMRrB9aK4,125
src/rules/windows__registry__registry_set__registry_set_powershell_enablescripts_enabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_execution_policy.eql,sha256=ptm823RqjWbQYd3ts-Sk_mFYa1dk4ZpTnrpBpEGPZ4s,316
src/rules/windows__registry__registry_set__registry_set_powershell_execution_policy.lucene,sha256=tXWFpfZlII7KznD-mYXlOfPpxvI98aarQRAhbiZkdog,282
src/rules/windows__registry__registry_set__registry_set_powershell_execution_policy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_in_run_keys.eql,sha256=qwtcZIF5CNxfKyziPpdjtboYgoK2EzNs0q3tAN9py_A,672
src/rules/windows__registry__registry_set__registry_set_powershell_in_run_keys.lucene,sha256=vRFgpVDgAdQrIFyjjhFk96Dooorq3dnXRDR4hIfOZ2o,685
src/rules/windows__registry__registry_set__registry_set_powershell_in_run_keys.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_logging_disabled.eql,sha256=E4KXoy0gAa7vQin9Lnxu9JWg_DyRjMvysKRaS4dnJ64,444
src/rules/windows__registry__registry_set__registry_set_powershell_logging_disabled.lucene,sha256=Wh_oj8R_TAu9vI1sC_wk9E2rExtEpk8dPRa_CkUzwMM,417
src/rules/windows__registry__registry_set__registry_set_powershell_logging_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_provisioning_command_abuse.eql,sha256=26KxEpFTz9FbBNAVemwGvHAQ2GwaufyI2dhK3F3VkGY,76
src/rules/windows__registry__registry_set__registry_set_provisioning_command_abuse.lucene,sha256=_fTow8lXs4XFIlTbplAEHCTvLluIKcnULUqtPyC3hzU,63
src/rules/windows__registry__registry_set__registry_set_provisioning_command_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_execution_via_eula.eql,sha256=oW4tlA-iLHiJpaVEsyo6N0r1HH64L_6aF0ZCgTEK1K8,42
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_execution_via_eula.lucene,sha256=8S8AjkGB46RSzQz0rUiX_-6NZ7XZy5u0GLVmm3Ax7Yk,30
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_execution_via_eula.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_renamed_execution_via_eula.eql,sha256=i0BiHx8EcQxkXwi6WCr_l_VWWKmdWtHpa73FCq4-7hg,773
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_renamed_execution_via_eula.lucene,sha256=VTME-QmzNFoLPhjlP4htcUPbOHNq7sLYNxgMKOi1Qv0,748
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_renamed_execution_via_eula.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_susp_execution_via_eula.eql,sha256=0ZVpL4YXtV0PDiMkAPSgP1nGb2eObG6_rHJ1Uynx6cg,252
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_susp_execution_via_eula.lucene,sha256=gJX0DklRGJPdiCYm5pQRvcvoS0SwlMCSptQmefyb1t0,235
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_susp_execution_via_eula.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_renamed_sysinternals_eula_accepted.eql,sha256=2FIfnkUpsNjacCqwNEbGvdO7PQ0AiI-bERwgupX5Skc,649
src/rules/windows__registry__registry_set__registry_set_renamed_sysinternals_eula_accepted.lucene,sha256=MtE7Ys-MSNKuLz6As-20nkKjTlftWdIImnZiSdwgVM8,627
src/rules/windows__registry__registry_set__registry_set_renamed_sysinternals_eula_accepted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_rpcrt4_etw_tamper.eql,sha256=eXw5d_wN_dqZEltypk7deG7XrneGwx0AKeoMFwe4Crk,160
src/rules/windows__registry__registry_set__registry_set_rpcrt4_etw_tamper.lucene,sha256=TAIqEAXEU6eTRlgEJZJI7mTmU2ktuYjEUmGqecymo_k,147
src/rules/windows__registry__registry_set__registry_set_rpcrt4_etw_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_runmru_susp_command_execution.eql,sha256=4mdULI9qNkRLo49sG76wU4VqFmQ7adc_xFjFjuwlwuU,420
src/rules/windows__registry__registry_set__registry_set_runmru_susp_command_execution.lucene,sha256=6FAch846SLY_3vgvK5ji42K7HVZLxW4DVhd04EgcUUQ,399
src/rules/windows__registry__registry_set__registry_set_runmru_susp_command_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_scr_file_executed_by_rundll32.eql,sha256=5OBJabHsUHQcx6q8QxKXa7u_dsKiPMBzywXUPiWYIv8,251
src/rules/windows__registry__registry_set__registry_set_scr_file_executed_by_rundll32.lucene,sha256=oOALBwfDQ4_4LNLpP4pBltQ6rK7Lw9__C7YD-LvKswY,228
src/rules/windows__registry__registry_set__registry_set_scr_file_executed_by_rundll32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_sentinelone_shell_context_tampering.eql,sha256=mDaHibGZ42tveOvb_23XCmoamxGIvI6MwnwA-UpvDA0,400
src/rules/windows__registry__registry_set__registry_set_sentinelone_shell_context_tampering.lucene,sha256=4gRP9LNs4nN1gRoP8DilzO0_ems64R6kofNBjPzHP74,385
src/rules/windows__registry__registry_set__registry_set_sentinelone_shell_context_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_servicedll_hijack.eql,sha256=0dwwq214KMtB3N2_zY2LvEkf71MIHQIx4QhAh7qesvA,624
src/rules/windows__registry__registry_set__registry_set_servicedll_hijack.lucene,sha256=epT8wNeZn2YHPF0uw4xFxxSda9vUKK_1MgVv4Ff3_2U,594
src/rules/windows__registry__registry_set__registry_set_servicedll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_services_etw_tamper.eql,sha256=gjwIbb1B7euRzTYC420-x4_dtpNPImQK96IZMp7X6DY,166
src/rules/windows__registry__registry_set__registry_set_services_etw_tamper.lucene,sha256=q4GYfBJ4159oOd4La7rlGcfw66bLZ1zeiGe-JgeeWig,156
src/rules/windows__registry__registry_set__registry_set_services_etw_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_set_nopolicies_user.eql,sha256=rn2U3gQ7oGx0vEvjbdS9gkUkbmGwS_77Jf3ox5JhyWA,905
src/rules/windows__registry__registry_set__registry_set_set_nopolicies_user.lucene,sha256=vqQxOx69WitphUmTvVyhddWUX2i40xhD821Z1C5MB4M,888
src/rules/windows__registry__registry_set__registry_set_set_nopolicies_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_sip_persistence.eql,sha256=FJ64QHz53PeGQ09290YbTkeCQsBKT2tP82NtfsaTD2E,576
src/rules/windows__registry__registry_set__registry_set_sip_persistence.lucene,sha256=5xOOLbDTy8eJF-XLFFoQfMMqFYXoaETKkqLWtoEygeE,536
src/rules/windows__registry__registry_set__registry_set_sip_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_sophos_av_tamper.eql,sha256=hd11mdkSm9NRIQ9QiEUjx8B9nbKBlAtSCxAgFTCBJYY,275
src/rules/windows__registry__registry_set__registry_set_sophos_av_tamper.lucene,sha256=BPtu8u3r5Zvv5sIUNtwCNh7yhP0ST-ZjGewUV2U7rCM,262
src/rules/windows__registry__registry_set__registry_set_sophos_av_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_special_accounts.eql,sha256=s9G68vQDJ9KZozQlubg5yrpI_KbCpURW_zoas0LbPLY,166
src/rules/windows__registry__registry_set__registry_set_special_accounts.lucene,sha256=He6y814soBNjyU9_YJyxu_y8vnOvLxM5Xdw5V5aQ8yk,156
src/rules/windows__registry__registry_set__registry_set_special_accounts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_suppress_defender_notifications.eql,sha256=LLQlPtj088rp8vrxDN_dAyUFNw0QP5Xl1UW7ioL1RIg,167
src/rules/windows__registry__registry_set__registry_set_suppress_defender_notifications.lucene,sha256=9FjyrKP9HLjm9NOILtPhbi8I_U81f4AEPTM2Zs19JdY,158
src/rules/windows__registry__registry_set__registry_set_suppress_defender_notifications.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_keyboard_layout_load.eql,sha256=a0nEDcHsYkeClX3E0Dig3maOjzwCEU4F7Ws0f8qidVo,186
src/rules/windows__registry__registry_set__registry_set_susp_keyboard_layout_load.lucene,sha256=ZX4K86MqCZa86xWQdbz4Yk1eCfdKlghS_RGj6Ox5j54,160
src/rules/windows__registry__registry_set__registry_set_susp_keyboard_layout_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_pendingfilerenameoperations.eql,sha256=dNFmT1X8-bcsEUZUIO9Uprvyt5irkEaAS0haWw8Ogms,213
src/rules/windows__registry__registry_set__registry_set_susp_pendingfilerenameoperations.lucene,sha256=qA8gv0H6OqN0_ETrFUuYYgJExweF207Nf3qcDL2zdFk,191
src/rules/windows__registry__registry_set__registry_set_susp_pendingfilerenameoperations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_printer_driver.eql,sha256=ZKS_oj3-ZwOL41tJurh_Xhwiq0cbqTFDOMpQMdQOGu4,336
src/rules/windows__registry__registry_set__registry_set_susp_printer_driver.lucene,sha256=p4pdzOMLAEhU4eb859QzacGKz9rSJOXEfdG8HA0h6ic,318
src/rules/windows__registry__registry_set__registry_set_susp_printer_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_reg_persist_explorer_run.eql,sha256=X5YZau-0gE45zxqHayBlmRZ5_Zbe7YYhJdCf815ifs0,291
src/rules/windows__registry__registry_set__registry_set_susp_reg_persist_explorer_run.lucene,sha256=MpBVCKgDgjS1B7ErPSmErWcwltuX9mh6ZFuCsIWmSwo,270
src/rules/windows__registry__registry_set__registry_set_susp_reg_persist_explorer_run.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_run_key_img_folder.eql,sha256=WyOf_7xa1FC-vGGw1lMk-1WLPkU1UzmV-UZILy9YxW0,1424
src/rules/windows__registry__registry_set__registry_set_susp_run_key_img_folder.lucene,sha256=B1ES5l_PfAshTGl3eXvJTLO34f7OkTd8RP3bkmFYpms,1380
src/rules/windows__registry__registry_set__registry_set_susp_run_key_img_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_runmru_space_character.eql,sha256=DlvSVB9bwY1UHCFSCjjGyX6nyGt0s8Gqq7O8zN2vXOU,682
src/rules/windows__registry__registry_set__registry_set_susp_runmru_space_character.lucene,sha256=IHIwKzy5xJgWgJUMdTWfg1maWMfzHfqctQKUVrVFFsE,671
src/rules/windows__registry__registry_set__registry_set_susp_runmru_space_character.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_service_installed.eql,sha256=G2j31R5CnvDEIz8dv8AgBHHHT_hHUeUE8VjtJDANAnw,396
src/rules/windows__registry__registry_set__registry_set_susp_service_installed.lucene,sha256=0v5PnNyJtL0zyDYWhw3gyvONJVunPUsdSvhZQzIiD_s,368
src/rules/windows__registry__registry_set__registry_set_susp_service_installed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_typedpaths_space_characters.eql,sha256=XnICa2PCCRWfyaDc2juokx90z9rSrEoPHzhh0iCUAsw,689
src/rules/windows__registry__registry_set__registry_set_susp_typedpaths_space_characters.lucene,sha256=3ryzlbdT3llSmtgXjqdsmTwXFwrHGz_XQ8cvC-ovljk,679
src/rules/windows__registry__registry_set__registry_set_susp_typedpaths_space_characters.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_user_shell_folders.eql,sha256=aIDEwsodJP2IXh9o5mDxBpw-HKWLKboLrJAPUn1WUtc,132
src/rules/windows__registry__registry_set__registry_set_susp_user_shell_folders.lucene,sha256=widM-w_p-IyaAZGelnoSfiYIewEzT98tVkT-AdquQ6w,120
src/rules/windows__registry__registry_set__registry_set_susp_user_shell_folders.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_wfp_filter_added.eql,sha256=mSfMeF0FvIv9Idy4agFU6xQR_fMVaXFtwH4MfMZWUPo,190
src/rules/windows__registry__registry_set__registry_set_susp_wfp_filter_added.lucene,sha256=wPdAkBVmhcSbha-pHlwdVBx2chQOvgQWIPXgu4Nzbm0,171
src/rules/windows__registry__registry_set__registry_set_susp_wfp_filter_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_suspicious_env_variables.eql,sha256=gawLEgzyMfyTzSlz6rv6bawOiB2iwDOyqmQlxwBN9Kc,611
src/rules/windows__registry__registry_set__registry_set_suspicious_env_variables.lucene,sha256=qEfMH4d-m2qwoXTpfHyqnuSpN1384XYD1-kZVnPFuWA,573
src/rules/windows__registry__registry_set__registry_set_suspicious_env_variables.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_system_lsa_nolmhash.eql,sha256=c4XRotvPWgXEm_e6pFX0VH33LoURuXUkPsjF7Z3l2NE,128
src/rules/windows__registry__registry_set__registry_set_system_lsa_nolmhash.lucene,sha256=qTDt7tgZA83Q2nRskkkqXsJjfHgQzPDW1OJ8flp2aR8,117
src/rules/windows__registry__registry_set__registry_set_system_lsa_nolmhash.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_taskcache_entry.eql,sha256=HmBVjeZrQbGIa53VbcKkJViD8f7T-Pnv0mQNP294-FY,2290
src/rules/windows__registry__registry_set__registry_set_taskcache_entry.lucene,sha256=_JS-atAuMjDbCLGAPcipEYex3vxGBIGZV6WQgoLAK6Y,2273
src/rules/windows__registry__registry_set__registry_set_taskcache_entry.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_telemetry_persistence.eql,sha256=Vf6MqZMaIgAUbNdim__G76MHOarJ29R6_MMh4MroKlw,431
src/rules/windows__registry__registry_set__registry_set_telemetry_persistence.lucene,sha256=1Yx1d9ZKo5wI8wV5XuK_9lxHZI_K1SO0xiVVKZTOKUA,401
src/rules/windows__registry__registry_set__registry_set_telemetry_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_terminal_server_suspicious.eql,sha256=3djlWq2SH4yO8_So7Te8OVgD2GtfT83XY4m31RZcO-U,162
src/rules/windows__registry__registry_set__registry_set_terminal_server_suspicious.lucene,sha256=ShR2FY1zPGZ3poHBR9z4g_uA7b9kWc2LRrRPrpFUKiE,145
src/rules/windows__registry__registry_set__registry_set_terminal_server_suspicious.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_terminal_server_tampering.eql,sha256=lP2vr-sgLotHbqvTfOPRdJdsWKntsgx1QcjO3kABz7w,977
src/rules/windows__registry__registry_set__registry_set_terminal_server_tampering.lucene,sha256=q4HvFZ9kbp2Y_ITvXR1_VXN3ftCVWFaaExv1EhWdqok,946
src/rules/windows__registry__registry_set__registry_set_terminal_server_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_timeproviders_dllname.eql,sha256=r0_skbs9QkQubvEMuEqRaOH70UbZby_fKzTJLwkkRAA,266
src/rules/windows__registry__registry_set__registry_set_timeproviders_dllname.lucene,sha256=M5RCuB9vb2JUdQ1QOy1scnquZLVbAlJn6wJqI40B6xE,245
src/rules/windows__registry__registry_set__registry_set_timeproviders_dllname.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_tls_protocol_old_version_enabled.eql,sha256=R9eYPa4rInUCQzUjKOhw2ICe4DPIaQaNaC0FnH_TTCY,247
src/rules/windows__registry__registry_set__registry_set_tls_protocol_old_version_enabled.lucene,sha256=UmJ8_7iyET0T0K7VpaAxKJgvHwNAY5TJVz2vJjlHXSg,228
src/rules/windows__registry__registry_set__registry_set_tls_protocol_old_version_enabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_treatas_persistence.eql,sha256=jkAb-I0uNUBMt8Hbwih4dCE7JIXJs0sAZPLiMZUIhYU,546
src/rules/windows__registry__registry_set__registry_set_treatas_persistence.lucene,sha256=hRlOePx-lrd9ih8VzH21bLs4q0A2evmvEit55WBbHeg,529
src/rules/windows__registry__registry_set__registry_set_treatas_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_turn_on_dev_features.eql,sha256=9CqC8lPIUk3mgrkxZnS9EEEJAQ_PC76o1bgTg6hqeRs,279
src/rules/windows__registry__registry_set__registry_set_turn_on_dev_features.lucene,sha256=zfpeaki-HHGLJEgYv24XTFkv_jz587I5BbZ2Zmo9Nz4,253
src/rules/windows__registry__registry_set__registry_set_turn_on_dev_features.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_bypass_eventvwr.eql,sha256=Sm8La_QWcNolj2i1oAQswUF2IhHWQkshjxNnKrU5Wqs,59
src/rules/windows__registry__registry_set__registry_set_uac_bypass_eventvwr.lucene,sha256=obM48ze8oeKHTykDF4jKuMoKsv0-T24fOIk-R9r9ir8,47
src/rules/windows__registry__registry_set__registry_set_uac_bypass_eventvwr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_bypass_sdclt.eql,sha256=75qTkz652tHp1p4iVjKr2bdlHik-VMDixtSqK6RDohw,260
src/rules/windows__registry__registry_set__registry_set_uac_bypass_sdclt.lucene,sha256=Vaq2fWTJuHp7rv6zn_4-_oQ3WHBzpEYlDcDMa_4OeI4,315
src/rules/windows__registry__registry_set__registry_set_uac_bypass_sdclt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_bypass_winsat.eql,sha256=Vbc16j7S9WLAHgxbO2hqsDfcN2qmqfggebMugztcmBg,238
src/rules/windows__registry__registry_set__registry_set_uac_bypass_winsat.lucene,sha256=0VYLy4XCRUD3UZaHYdhWDq3IyRqHiLVG1Oi2QyGuwSQ,221
src/rules/windows__registry__registry_set__registry_set_uac_bypass_winsat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_bypass_wmp.eql,sha256=qbNkSCCyXo1MKqkrE-blkfsFuP-70n1zV17yJ23fF4E,219
src/rules/windows__registry__registry_set__registry_set_uac_bypass_wmp.lucene,sha256=ulOQceYsH82tdkzelD_-FUeC-agBnZN6InVS1Ukrd0Q,212
src/rules/windows__registry__registry_set__registry_set_uac_bypass_wmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_disable.eql,sha256=VaNw0G-ABCYOsQMpysCJNmO44-IxRJe8Z-CboBhY_iA,145
src/rules/windows__registry__registry_set__registry_set_uac_disable.lucene,sha256=llqeCpyXnHy2w8AhxS4LO2sWm6g0HJGIgAtbJp4EcEg,134
src/rules/windows__registry__registry_set__registry_set_uac_disable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_disable_notification.eql,sha256=8iJQrNxYK1-clwQpBKQMRxakQN4_tcjaTcP0-6WRX_o,126
src/rules/windows__registry__registry_set__registry_set_uac_disable_notification.lucene,sha256=zDOr9M5jYu6eETCMUmLAt-3LCn4_jv7JjvLqzVauQB4,116
src/rules/windows__registry__registry_set__registry_set_uac_disable_notification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_disable_secure_desktop_prompt.eql,sha256=eKAmJxBt7LnhOk2UgoQnxucJvl9X7jvHtkh4MVAPJ4o,157
src/rules/windows__registry__registry_set__registry_set_uac_disable_secure_desktop_prompt.lucene,sha256=BcCLhUTgWj0KmZCdDyANrN3DCwdtZQxjt_-vIfjIcEQ,146
src/rules/windows__registry__registry_set__registry_set_uac_disable_secure_desktop_prompt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_vbs_payload_stored.eql,sha256=eN615SmV115OVG7v9P5sRDBAeDCe3kwCmbhEgmf9z0k,643
src/rules/windows__registry__registry_set__registry_set_vbs_payload_stored.lucene,sha256=pzMvNbzmHnSW-IMcRAoIvdawRg-HwXbtyZ4hdtZ6b0Y,617
src/rules/windows__registry__registry_set__registry_set_vbs_payload_stored.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_wab_dllpath_reg_change.eql,sha256=V8xe9Mp5lgGl0n2jb-NkRvxaYSaYgXncqCNqrQpzQJ4,141
src/rules/windows__registry__registry_set__registry_set_wab_dllpath_reg_change.lucene,sha256=Uzhn6Zeqb_7xDPE1wBqVtjlnUos3SuQv4JBRqGG5VIA,127
src/rules/windows__registry__registry_set__registry_set_wab_dllpath_reg_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_wdigest_enable_uselogoncredential.eql,sha256=xu2jcvUGtFaj4rF_8C-lBg9p_a1ITqybwY74Pc1qrcg,106
src/rules/windows__registry__registry_set__registry_set_wdigest_enable_uselogoncredential.lucene,sha256=o9DKoSB_iYil04g0xGbNRsQ9s4FSKh-VzGmTy9Zp9eE,95
src/rules/windows__registry__registry_set__registry_set_wdigest_enable_uselogoncredential.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_windows_defender_tamper.eql,sha256=bD8Bw2ccvmW7QPckocNS4KdCt4iMgFk3roz_qtXb5Yk,1168
src/rules/windows__registry__registry_set__registry_set_windows_defender_tamper.lucene,sha256=7MGMlRIR8It_Xx7Tt-OlRwSx-9laIIdv3-k63VtcKbs,1143
src/rules/windows__registry__registry_set__registry_set_windows_defender_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_winget_admin_settings_tampering.eql,sha256=OlgLh64-5yjgRUcOMugzRzNuJyxqxFbntXRE7RkoTps,132
src/rules/windows__registry__registry_set__registry_set_winget_admin_settings_tampering.lucene,sha256=jZzLdG6nhbQu8pXcIcmvDM54bCYgST-BUl2mP8VT3ns,115
src/rules/windows__registry__registry_set__registry_set_winget_admin_settings_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_winget_enable_local_manifest.eql,sha256=lS_n08xsMZk8Ctdtzs6ogiErkLN7VZRVsY-oyZ8CHR4,119
src/rules/windows__registry__registry_set__registry_set_winget_enable_local_manifest.lucene,sha256=KMFRrstlIQEZ11HZ-ljxHGEkHYU3Z5Kg5pUlWN-MdL8,108
src/rules/windows__registry__registry_set__registry_set_winget_enable_local_manifest.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_winlogon_allow_multiple_tssessions.eql,sha256=e1_xGiHTJkCsVruTah8_HvbaKkrbd0IKVh-mRGZW6Y0,154
src/rules/windows__registry__registry_set__registry_set_winlogon_allow_multiple_tssessions.lucene,sha256=DMJqszpw_hEbaKNMrAITVAvRno6cvnmdEdOKgKsDhXY,144
src/rules/windows__registry__registry_set__registry_set_winlogon_allow_multiple_tssessions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_winlogon_notify_key.eql,sha256=vzhBhPxbF-7yEjkmFtCXjEZZqv5urbaallU2jtyBf1c,140
src/rules/windows__registry__registry_set__registry_set_winlogon_notify_key.lucene,sha256=HEWBaHkMDzQ4JJ0xx4zX_J7GjqZncJtt48G-SI9nvOo,127
src/rules/windows__registry__registry_set__registry_set_winlogon_notify_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_config_modification.eql,sha256=23RJnUxhW3oNx1sUPywwLd5pLxZ5UUj24zO9Rk-ifR4,84
src/rules/windows__sysmon__sysmon_config_modification.lucene,sha256=FyQCm1Y7hfjyf64rxoAsT12l1x6jYg1X69lOcyLeBko,73
src/rules/windows__sysmon__sysmon_config_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_config_modification_error.eql,sha256=JhOLKu32v37GQa522ZpQE7H1b1McDZUN6CtUqqzt0Mw,493
src/rules/windows__sysmon__sysmon_config_modification_error.lucene,sha256=Kvj2KdyWdpNftPq6UsUHcCOVn9NXTKF6F86QyTs6-2E,504
src/rules/windows__sysmon__sysmon_config_modification_error.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_config_modification_status.eql,sha256=RIeYp9zSD-T29oNA3UivVWvFhO0F_iwycDEhSvJXVXc,123
src/rules/windows__sysmon__sysmon_config_modification_status.lucene,sha256=g893PkVvTfStzt4AaOBuTlN0VszsGaSXPQTSUCCHPv0,112
src/rules/windows__sysmon__sysmon_config_modification_status.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_file_block_executable.eql,sha256=lLexBcRjjuu0ecK7syQtlxyt80t_lNi00mVcz-_HXeI,84
src/rules/windows__sysmon__sysmon_file_block_executable.lucene,sha256=fH0POscFFu2a_NygkAK6nrNQi8mJKs0ssc6EZnCBAic,73
src/rules/windows__sysmon__sysmon_file_block_executable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_file_block_shredding.eql,sha256=H01Z6Johtcwljq0u07GECURzKoU1jPl7otQe9Nrk63o,84
src/rules/windows__sysmon__sysmon_file_block_shredding.lucene,sha256=tDv7JLKctmiYgXMRpCyBoAbg0hTNXo2Nga_WH57Mlek,73
src/rules/windows__sysmon__sysmon_file_block_shredding.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_file_executable_detected.eql,sha256=O4zn-QI28JVWu8yPItP7DEkZPyds5-OM1Zt-FMeKpXk,84
src/rules/windows__sysmon__sysmon_file_executable_detected.lucene,sha256=XpeCcEKv9L8wR6c1wWhnKXS9Tl4oW9kQmnwkwGyf7B4,73
src/rules/windows__sysmon__sysmon_file_executable_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__wmi_event__sysmon_wmi_event_subscription.eql,sha256=MJIc453qvvBqE_m9lJfFxs60xjFHT7TP7sr9OgLOSSs,46
src/rules/windows__wmi_event__sysmon_wmi_susp_encoded_scripts.eql,sha256=Owfog7xMP3DZvw194Ku3zYBG3k03hwVVHkQ-A0vbMlU,510
src/rules/windows__wmi_event__sysmon_wmi_susp_scripting.eql,sha256=Aqm6fJhG0yD49eAjYm2LUCH6E_zyHbQHKPgACVJ1b9M,423
src/detection-rules/hunting/README.md,sha256=J08JuZnAVzFttqj_FxrNxziJtEaRaqjg7J-2rA68V-M,10918
src/detection-rules/hunting/__init__.py,sha256=1jOKw_YxwyKjF-TPLEx38sWW7wvWpvU0QmFeYMvlfGU,242
src/detection-rules/hunting/__main__.py,sha256=x6cDT67yspV7Mt_4Xh7C39CoKwLUf9aVJYnsFIzMeqc,10841
src/detection-rules/hunting/definitions.py,sha256=OvFTQ8-dUki8szAyuGkCtk5HqboW4I_7_dDYlHakImU,2386
src/detection-rules/hunting/index.md,sha256=h_S03CBS5e_lvWJkDMwDuQpwUQ2RDVhoF1XDRX1IxG0,17650
src/detection-rules/hunting/index.yml,sha256=1AqJS-SS39xssnnVYQo5ngFcsDCMrKHbp3rDvElcXeM,29540
src/detection-rules/hunting/markdown.py,sha256=qD4sSU6tA_YD4482rboTob7zr2WCj-bMQS3e4C6w8EA,6846
src/detection-rules/hunting/run.py,sha256=gRn9r7Xgm1k-KRrlgsX1M90nBhWQRvNdAPUgWucAigA,3216
src/detection-rules/hunting/search.py,sha256=My3MHdY7aBKsGAh9InKB5eDaO0Yi2BUgmMd18DaF28s,9588
src/detection-rules/hunting/utils.py,sha256=EB6n0bPH4VY7zEqXmX9A8mVv-zYFwqq74C7tCS2V8iM,4679
src/detection-rules/hunting/aws/docs/ec2_discovery_multi_region_describe_instance_calls.md,sha256=qbtcrSUbAFJoSvpBUcdLsPTYwiGbNVD0bf7g5XNweHg,2320
src/detection-rules/hunting/aws/docs/ec2_high_instance_deployment_count_attempts.md,sha256=uTPm5QtS9D6RxyNTh6_lcnS-QAKvJ-uVT2QLJM_M47I,2446
src/detection-rules/hunting/aws/docs/ec2_modify_instance_attribute_user_data.md,sha256=nh0CHX0O9-txl996UNXT4i45PXqy1GNIyNeZ8hZKD9s,1970
src/detection-rules/hunting/aws/docs/ec2_suspicious_get_user_password_request.md,sha256=MsA-UWJFujejKH3Qc2dDg1EjXzlT698v6xKuu3kYtLM,1997
src/detection-rules/hunting/aws/docs/iam_assume_role_creation_with_attached_policy.md,sha256=aqBrK9iGu2qeUW7aZSAp2VUELhdgKviUBOb4PYl2vSs,2082
src/detection-rules/hunting/aws/docs/iam_customer_managed_policies_attached_to_existing_roles.md,sha256=gGiHXqYnHNJtQvMlCW6ZxGL5bmuI-wyd8ah-IAX75vs,2204
src/detection-rules/hunting/aws/docs/iam_unusual_access_key_usage_for_user.md,sha256=yM7g43SoT_4Ooc3U0_ALSyA-iH-wK0Ci0Fk85OUt0XM,3271
src/detection-rules/hunting/aws/docs/iam_unusual_default_aviatrix_role_activity.md,sha256=8gMJKf6ptVsg2FU5lDkEebz9o9ulKs1z-28v3b-BX70,2057
src/detection-rules/hunting/aws/docs/iam_user_activity_with_no_mfa_session.md,sha256=g_enW8bKuM4y4XUi9ZMpNq27kpY2Gvlv4xJLTTboWDg,1771
src/detection-rules/hunting/aws/docs/iam_user_creation_with_administrator_policy_assigned.md,sha256=mEl2eGL4yiOcQo0WO97BBTgwQe5jnUV8_X9rVV4wltY,2056
src/detection-rules/hunting/aws/docs/lambda_add_permissions_for_write_actions_to_function.md,sha256=MbprzSsn1Po4VKUO3NreG9gZ2vsCpprEXYyUwLRTZoM,2276
src/detection-rules/hunting/aws/docs/multiple_service_logging_deleted_or_stopped.md,sha256=TZ6Lql0oIB00Q60AdTt6jpSvUzeXCYze19WIr7e5ovY,2379
src/detection-rules/hunting/aws/docs/s3_public_bucket_rapid_object_access_attempts.md,sha256=f-Djw26A8dt81rjmo2nSyGnbAwsr_S_gSXUqQ3-9Hwc,1807
src/detection-rules/hunting/aws/docs/secretsmanager_high_frequency_get_secret_value.md,sha256=0bEIOFMtR_R9XPNUa_F4_0QwzHlMfTP19V0NVOWh29A,2409
src/detection-rules/hunting/aws/docs/servicequotas_discovery_multi_region_get_service_quota_calls.md,sha256=wtJrtKL8Q-_9wdtrtM2rsOK_IcyqsGHjpDrzmWd6sdk,2996
src/detection-rules/hunting/aws/docs/signin_single_factor_console_login_via_federated_session.md,sha256=zNwgRWAQdcIbLdcY_rxEV-ji3957CwQR5nGHpJPqmdo,2074
src/detection-rules/hunting/aws/docs/sns_direct_to_phone_messaging_spike.md,sha256=uddfXfCuX7P5U67CXgs76aWhLcfuV1PcRlYOZ1zxJXk,2433
src/detection-rules/hunting/aws/docs/sns_email_subscription_by_rare_user.md,sha256=hqWv5lYZ1CcKXMWDQQb1c_0JpLG_pgvaCMPEshuS2fc,2156
src/detection-rules/hunting/aws/docs/sns_topic_created_by_rare_user.md,sha256=u38OgvNfhyvpRScfq-UhpIgznL-1Vl8x3fvkZ210zfw,2118
src/detection-rules/hunting/aws/docs/sns_topic_message_published_by_rare_user.md,sha256=6iCM9GAiggSiYfu3cxkN-R5pVGRAeRDJMUj_CIaKmSg,2114
src/detection-rules/hunting/aws/docs/ssm_rare_sendcommand_code_execution.md,sha256=uV3ovmGY-bRLOnnz5JjBNyq9koj3KAzEiIQukKOEIqA,2198
src/detection-rules/hunting/aws/docs/ssm_sendcommand_api_used_by_ec2_instance.md,sha256=HBmrkb5NaIS6FrT6VJL-5_lFZ0vKSKbdpYzx8-z91pA,1414
src/detection-rules/hunting/aws/docs/ssm_start_remote_session_to_ec2_instance.md,sha256=2edp8T9wsRh_cAl7pIBMDMiFSHWDA9K4trZuFV3ZbIQ,2159
src/detection-rules/hunting/aws/docs/sts_suspicious_federated_temporary_credential_request.md,sha256=dJ_afo1FFvWRQZf64S-7ICJl90fhGRsfUGOq0FLzyL0,2619
src/detection-rules/hunting/aws/queries/ec2_discovery_multi_region_describe_instance_calls.toml,sha256=RvXAHwY6XDYzJYTjMxWK461mD6VHuEAdTI8QgX5U4M8,2041
src/detection-rules/hunting/aws/queries/ec2_high_instance_deployment_count_attempts.toml,sha256=0QL6oc7qDsy8ztH1EWmjQ73fdZlBKAARqHkh6NpgpjQ,2175
src/detection-rules/hunting/aws/queries/ec2_modify_instance_attribute_user_data.toml,sha256=X6sogSJKCP5PKIWjAL8jwPHfw8MnyZYZB52zuM1dixA,1678
src/detection-rules/hunting/aws/queries/ec2_suspicious_get_user_password_request.toml,sha256=PYabJ50wvpUgvkXeXALrzu8W8JqdSu9gRMWz8rN_OW0,1734
src/detection-rules/hunting/aws/queries/iam_assume_role_creation_with_attached_policy.toml,sha256=qsE7XqdntbsiVVmvVtsHUFC10RL5S1Kk3Q5lDd7Tksw,1808
src/detection-rules/hunting/aws/queries/iam_customer_managed_policies_attached_to_existing_roles.toml,sha256=WltnHliT1ekQsPAy-YdO58NQU0DjcR30ZhPVXZExgmM,1907
src/detection-rules/hunting/aws/queries/iam_unusual_access_key_usage_for_user.toml,sha256=BJpEZaeHM3CPaYIDv6IULvhIe_nN8XBvKuW1pVQJppI,3009
src/detection-rules/hunting/aws/queries/iam_unusual_default_aviatrix_role_activity.toml,sha256=dQe_GrG3AcWBWmGqmRF32UaGmoruF5Seopm78vdDBm4,1791
src/detection-rules/hunting/aws/queries/iam_user_activity_with_no_mfa_session.toml,sha256=ObjZCTOAuLXyXbqSV_8l8SZNTHBKRlGyjAL5p6WjoTs,1510
src/detection-rules/hunting/aws/queries/iam_user_creation_with_administrator_policy_assigned.toml,sha256=eDgwcGpujX3CPQVg3QGBqtNCJFY6NXoKt7IWDxeKFSM,1724
src/detection-rules/hunting/aws/queries/lambda_add_permissions_for_write_actions_to_function.toml,sha256=KFt-pP52qnT8E1GhLx4PPFePxfcQwxE1zx6dj_DmgOc,1988
src/detection-rules/hunting/aws/queries/multiple_service_logging_deleted_or_stopped.toml,sha256=I8R3NArCICHquJXj549kVK3uplNatZ-c6Dxn-4cIKdE,2111
src/detection-rules/hunting/aws/queries/s3_public_bucket_rapid_object_access_attempts.toml,sha256=vrZ3Qw1WIRykQVQzGG5WJ1o_t37qJinAUING15ZUlpE,1535
src/detection-rules/hunting/aws/queries/secretsmanager_high_frequency_get_secret_value.toml,sha256=ufDFhLQXj4SmSqzhd3zUTtE0aJsuTv4C7dwyd3LapDI,2108
src/detection-rules/hunting/aws/queries/servicequotas_discovery_multi_region_get_service_quota_calls.toml,sha256=OZjBzR4bx7EWxfCUcMwk-I1mORdCchPoGwT57ojJPPU,2708
src/detection-rules/hunting/aws/queries/signin_single_factor_console_login_via_federated_session.toml,sha256=6AnZPFQDO8oRbZro26iti67BaUTTy3cV73_8AXD9nUE,1775
src/detection-rules/hunting/aws/queries/sns_direct_to_phone_messaging_spike.toml,sha256=vWracb71w1u9TUM6YiSiS2dW4MJy4kr6oAgE46AmCx4,2214
src/detection-rules/hunting/aws/queries/sns_email_subscription_by_rare_user.toml,sha256=m-BPeel6Ra2O16gkmrBirUGDF3BihF7Ww4Jrt0daBKg,1859
src/detection-rules/hunting/aws/queries/sns_topic_created_by_rare_user.toml,sha256=Hlw_GAamslwfiBzHrPRQT9MN3t3ah0cK8OIglbWqQOQ,1887
src/detection-rules/hunting/aws/queries/sns_topic_message_published_by_rare_user.toml,sha256=0_7wPXs3O_IG9gI_X9eVEy9vUXcAvUqfE_4lOZhCQ4I,1814
src/detection-rules/hunting/aws/queries/ssm_rare_sendcommand_code_execution.toml,sha256=g8b8aL2bedoC1OwQMHCNNbRTf2vrEixnn7nNMyZaONo,1931
src/detection-rules/hunting/aws/queries/ssm_sendcommand_api_used_by_ec2_instance.toml,sha256=EmUS-yEWE1HS0d-5sdYr-WagVaf82uwSmL55nuT-g_8,1152
src/detection-rules/hunting/aws/queries/ssm_start_remote_session_to_ec2_instance.toml,sha256=huA7mDEimsfNRiYAwXKIapqCkB1ReNSHZZ1bX4zfxDQ,1914
src/detection-rules/hunting/aws/queries/sts_suspicious_federated_temporary_credential_request.toml,sha256=G1pgJqF9ulZPu_oPqfR9fUrYI3HNP4D_nON69zSVSpI,2327
src/detection-rules/hunting/azure/docs/entra_authentication_attempts_behind_rare_user_agents.md,sha256=uzb6QbIAutcwIfpicQt5GceBPJjWfYblT7iJ-vuP1HU,5020
src/detection-rules/hunting/azure/docs/entra_authentication_attempts_from_abused_hosting_service_providers.md,sha256=Y2kDlZQtHBlNU0I6HPCMg_9HEB61E6CLiDnIYNezZr8,5924
src/detection-rules/hunting/azure/docs/entra_device_code_authentication_from_unusual_principal.md,sha256=z817XdzFHhJcNZB8uusqcFU7eLVjBYMH7ZSoCHLVDg8,8254
src/detection-rules/hunting/azure/docs/entra_excessive_non_interactive_sfa_sign_ins_across_users.md,sha256=Xx2Cja0VYM0_o6Iljia_TdBFNmxWDPzjTie1zJE9FiA,4139
src/detection-rules/hunting/azure/docs/entra_rare_actions_by_service_principal.md,sha256=0p4djDxUNwI43dkawrhI1rpbXpocGdVvd6CLTP-wUn8,4223
src/detection-rules/hunting/azure/docs/entra_service_principal_credentials_added_to_rare_app.md,sha256=DujDm0Hg26Av3lS9LYdFOEemAgvEjW3e0ZDua4LhPVE,5357
src/detection-rules/hunting/azure/docs/entra_suspicious_odata_client_requests.md,sha256=zN0Hi1zB1sgTuyK35V3bMTLhUGedOI1l1FQO-K3L76s,4754
src/detection-rules/hunting/azure/docs/entra_unusual_client_app_auth_request_on_behalf_of_user.md,sha256=ZmgEvaSF_qUbmrPqsgUxZN-I5nrYFW_PSquuEQ7HhFU,3797
src/detection-rules/hunting/azure/queries/entra_authentication_attempts_behind_rare_user_agents.toml,sha256=gAlT4M8aU2JO8S2qc5iZKZw_1zTR54pY5f32MRLax3w,4705
src/detection-rules/hunting/azure/queries/entra_authentication_attempts_from_abused_hosting_service_providers.toml,sha256=q9ci3ixhaUCnPXPT4i5LYKsAHKvZUn9dSl1Y8GliLJk,5661
src/detection-rules/hunting/azure/queries/entra_device_code_authentication_from_unusual_principal.toml,sha256=Hef4kUNAsLxlmdziLE-ojvKJ8BiBfK5Vtrs6035WX3c,7914
src/detection-rules/hunting/azure/queries/entra_excessive_non_interactive_sfa_sign_ins_across_users.toml,sha256=MEhJBXL9KlehZFxpr5qgYMRtyrjOkyoqvbwsTLvcZac,3829
src/detection-rules/hunting/azure/queries/entra_rare_actions_by_service_principal.toml,sha256=snWuywwt59QodUUpZyzhoiV19eiRgdnkIH1Mdg9t1o4,3921
src/detection-rules/hunting/azure/queries/entra_service_principal_credentials_added_to_rare_app.toml,sha256=bfGgYGpp_7HbYvS_vb1kqm5bBKRsCTY32LZHQrF3dEI,5100
src/detection-rules/hunting/azure/queries/entra_suspicious_odata_client_requests.toml,sha256=u7QBTObf7FOZeE4oHiLTK1rv6dm93Vs9IB2ByC1U0MM,4343
src/detection-rules/hunting/azure/queries/entra_unusual_client_app_auth_request_on_behalf_of_user.toml,sha256=TaIoJk9ByJqE5_Y8CIO2EHg_ziGVXEieAzSU1I13hUA,3466
src/detection-rules/hunting/cross-platform/docs/potentially_spoofed_microsoft_authentication_domain.md,sha256=1dL9dtEPL_jOyevyjTVIjqxuW04vsEHXtY0XDVa2hJ8,3830
src/detection-rules/hunting/cross-platform/queries/potentially_spoofed_microsoft_authentication_domain.toml,sha256=X4BzmTYXRijvlDP0KYKWZ2fb3kUB7Lu0p60_8IckDWQ,3296
src/detection-rules/hunting/linux/docs/command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.md,sha256=B3J0IB4oEOXE7_slzV0MFd7REUuiWd1ERdm5nRkcpRg,4487
src/detection-rules/hunting/linux/docs/command_and_control_via_unusual_file_downloads_from_source_addresses.md,sha256=1rk4RK8gXtlk92eXqsdwPCA1mZrM_5j4VLd1atvbnvE,1788
src/detection-rules/hunting/linux/docs/defense_evasion_via_capitalized_process_execution.md,sha256=RCD2YfQIGGf7g_2xkQEY6-wrsux7xb1IC30CZTc3bUA,1754
src/detection-rules/hunting/linux/docs/defense_evasion_via_hidden_process_execution.md,sha256=DcFGnx0Vgz8KXwxrZoIfo_fRsy2XJpOWf4fkekm2PTo,1548
src/detection-rules/hunting/linux/docs/defense_evasion_via_multi_dot_process_execution.md,sha256=FD1-Bzh-dsWmmZdjeWA84hDmL_k28So28xw4m9NUN4c,1512
src/detection-rules/hunting/linux/docs/excessive_ssh_network_activity_unique_destinations.md,sha256=P2LlTizWaCd7W5sdzETzE0Fa4U5sp1Sa7KNacKTb3bo,1755
src/detection-rules/hunting/linux/docs/execution_uncommon_process_execution_from_suspicious_directory.md,sha256=PzhuiPSMSkLdo1HkLCn_IdKsmddi5g2HKS6Wx1MhhGc,2649
src/detection-rules/hunting/linux/docs/login_activity_by_source_address.md,sha256=_f7Igg1ZvqP9Wz9VTBBjRjsEej3bqYgtVwyaq5lCzfY,2078
src/detection-rules/hunting/linux/docs/low_volume_external_network_connections_from_process.md,sha256=9N-GfOpE5O6cWEBNB60GDk7hzkTD0qDIPr-4X03JPfA,3244
src/detection-rules/hunting/linux/docs/low_volume_gtfobins_external_network_connections.md,sha256=31nb8PhzKxQyoVgdWUleF8qAK5PUcqjy280vUeUW_MU,2554
src/detection-rules/hunting/linux/docs/low_volume_modifications_to_critical_system_binaries.md,sha256=qSsNxrIQNHYnWzkXRMX22iHk4fIIY5kDjg0j1TkuJBQ,2408
src/detection-rules/hunting/linux/docs/low_volume_process_injection_syscalls_by_executable.md,sha256=hahKwxTcEGjJEAv3_NAkA8XaOR2sZ6ymgQ9YOBf8H-0,1575
src/detection-rules/hunting/linux/docs/persistence_general_kernel_manipulation.md,sha256=f6mMFnZQ2zzw1oeGELAGLHVjUHVgd1ixS0YBPvz__tM,3860
src/detection-rules/hunting/linux/docs/persistence_reverse_bind_shells.md,sha256=6Vk_keCLklBBgL0TtrqNYVyyywDDLQPckfFqd1hCXxM,2007
src/detection-rules/hunting/linux/docs/persistence_via_cron.md,sha256=tJ8Y4L4eKKy3zMkowN8zULmV2lUw68MqeWLVgx5TeOY,4310
src/detection-rules/hunting/linux/docs/persistence_via_desktop_bus.md,sha256=urRY5tBHGRXAbFV4M_YDmcEIHUTcfpdv6MUTJRQuTRo,4215
src/detection-rules/hunting/linux/docs/persistence_via_driver_load_with_low_occurrence_frequency.md,sha256=Lc8F5nXUDlEZ6FdtdvIULMtWoRxGJJSdEGZCbGdY4Os,1999
src/detection-rules/hunting/linux/docs/persistence_via_dynamic_linker_hijacking.md,sha256=aE7dZv-xtrAMsuUWqkr5W18sOFuXN2UYQnkkpE-icd8,4063
src/detection-rules/hunting/linux/docs/persistence_via_git_hook_pager.md,sha256=7QbJF_R9957cEztw6_px34_C9AJ8CHvRT0524lGSEUo,3642
src/detection-rules/hunting/linux/docs/persistence_via_grub_bootloader.md,sha256=kT98EdohVZKqTfbRJxjvNuuUtW4gal4MCc7BsZKO-2c,4592
src/detection-rules/hunting/linux/docs/persistence_via_initramfs.md,sha256=WqmeeZWO-f4eGcsqpch_HmjkjBeq-4QfqSrN0XIRF9k,3733
src/detection-rules/hunting/linux/docs/persistence_via_loadable_kernel_modules.md,sha256=cUF5IqNuNxg2OpiWxVSgtDijcUa3up-Ml9EsMfJDBFs,3569
src/detection-rules/hunting/linux/docs/persistence_via_malicious_docker_container.md,sha256=5n2C6FZeRoppBv_k3KvXs4pLYe4uvljbSFP_vHJMF8g,3172
src/detection-rules/hunting/linux/docs/persistence_via_message_of_the_day.md,sha256=6Js3xJ01Mamu2HRHZcQfeAGms45XT8gGk9ETgjWlZGE,3257
src/detection-rules/hunting/linux/docs/persistence_via_network_manager_dispatcher_script.md,sha256=gmJHrSnpjnDt0WrDsGqheXSmFxmlAEbhlfoUQiHp9kA,3753
src/detection-rules/hunting/linux/docs/persistence_via_package_manager.md,sha256=RKAibNEmClp9WVzSUU4fVwum6Hs7C77LFjXHUsAW7nk,3934
src/detection-rules/hunting/linux/docs/persistence_via_pluggable_authentication_module.md,sha256=Pp14ttejXVIJS1n6MS_zQ4e1tvfxEyG6zVSbZ-CX6Co,3563
src/detection-rules/hunting/linux/docs/persistence_via_policykit.md,sha256=IMWV67B_FWY9iYFBeokD9PBBTN8K83ON8ddwZctw5xc,3466
src/detection-rules/hunting/linux/docs/persistence_via_rc_local.md,sha256=h-qtjs3nNeXDq64bnH3VThtIJGxfX2F9sC5iK4Bzklg,3478
src/detection-rules/hunting/linux/docs/persistence_via_rpm_dpkg_installer_packages.md,sha256=GQwUTwU2VZh-pBmBAZx1bVMjRtA7-LyfLXyzyW2zZBQ,3694
src/detection-rules/hunting/linux/docs/persistence_via_shell_modification_persistence.md,sha256=Mqq0zgSy6d0c56eTspO-cakBYnPEtd7AhFMqQQgihdU,4542
src/detection-rules/hunting/linux/docs/persistence_via_ssh_configurations_and_keys.md,sha256=Rxd9rbUQvN7KA3ETLo4cAX7oA7nsGkfjfqw8QX285Pk,3478
src/detection-rules/hunting/linux/docs/persistence_via_systemd_timers.md,sha256=lTbq2FbFeEduwZzy17m_-nRJGrX3PPlDNNlkaMBwnBA,7196
src/detection-rules/hunting/linux/docs/persistence_via_sysv_init.md,sha256=yi7LLcVULfnpG5siIf3nYJMP4NTnwy7I0e76kAUaEg0,3400
src/detection-rules/hunting/linux/docs/persistence_via_udev.md,sha256=G-8_I-f74OxwMAseHnsWuCxkuVN6BsN_awklprVEuqM,4025
src/detection-rules/hunting/linux/docs/persistence_via_unusual_system_binary_parent.md,sha256=IHbY9wwjkIK4C19JTLwoiiRiRNzcO4ZvrGR4GeZWNbs,1930
src/detection-rules/hunting/linux/docs/persistence_via_user_group_creation_modification.md,sha256=k2LKo6EhsoDescISwuxaRn7iv4Q7CSfZJd-QIeEvmZ0,1905
src/detection-rules/hunting/linux/docs/persistence_via_web_shell.md,sha256=fF-fd0BFvRDy5ceAo4KkBYFMLNFeEAxPaz8cVu8Y07E,2721
src/detection-rules/hunting/linux/docs/persistence_via_xdg_autostart_modifications.md,sha256=tVAaTb0T_T9ETm9twnV704ppazlSd0672cDXm0nQ88I,5312
src/detection-rules/hunting/linux/docs/privilege_escalation_via_existing_sudoers.md,sha256=wS1zpnIPEGTwrcUvlKTgAnIfYyKWqbA8A7QxfsDovD4,1209
src/detection-rules/hunting/linux/docs/privilege_escalation_via_process_capabilities.md,sha256=jIAuXYpUkafwJ8PTv94n02gDz4gKro6yF7v8Szh3eSg,3039
src/detection-rules/hunting/linux/docs/privilege_escalation_via_segmentation_fault_and_buffer_overflow.md,sha256=ksoknDh4UiD18-xqesdXkft-DH_LOzoG0LvZGAod5X0,2992
src/detection-rules/hunting/linux/docs/privilege_escalation_via_suid_binaries.md,sha256=24jsOiKcfzzX4UiVJpWQv31MWZ5mZWECltWuT-bC_A0,2162
src/detection-rules/hunting/linux/queries/command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.toml,sha256=mAbfB7icGpGSW5E-jJE7JfHn_aMbQsaHYZM0vcswbBM,4113
src/detection-rules/hunting/linux/queries/command_and_control_via_unusual_file_downloads_from_source_addresses.toml,sha256=ZlFRUR2llCAgzBjLZ-qCDtwkMMduKUxl2bBv9Tnv7zI,1468
src/detection-rules/hunting/linux/queries/defense_evasion_via_capitalized_process_execution.toml,sha256=aqrM0sE9abWqAbLrZNh0uQH5LdKqIjVLlh83FeA_6l8,1447
src/detection-rules/hunting/linux/queries/defense_evasion_via_hidden_process_execution.toml,sha256=dLAcQ4lsD83r-ms91PEG9LYhr4lj-qvdlbGWqYKBHS0,1267
src/detection-rules/hunting/linux/queries/defense_evasion_via_multi_dot_process_execution.toml,sha256=8DquyDIdl60zsgqpgkv9D1l_UIXEUieNiECTNa2qkLE,1194
src/detection-rules/hunting/linux/queries/excessive_ssh_network_activity_unique_destinations.toml,sha256=G9T1zx_X8SdR2_Lgyv73zuTITVa-qbXI4OE3XDZCrwU,1439
src/detection-rules/hunting/linux/queries/execution_uncommon_process_execution_from_suspicious_directory.toml,sha256=vRR_JLIg5jjtfiDZXdeHdZEW4xYAR1PNJRlSzVNiG-g,2235
src/detection-rules/hunting/linux/queries/login_activity_by_source_address.toml,sha256=GXU928tIs9KrUOuByCxBnNGx5W5ZwXhbN7Wm1aeYB4U,1813
src/detection-rules/hunting/linux/queries/low_volume_external_network_connections_from_process.toml,sha256=3bVjM3xdMpNDqIAmK8gFgNSgWqrrj1dxmoiqa9iLVQY,2908
src/detection-rules/hunting/linux/queries/low_volume_gtfobins_external_network_connections.toml,sha256=PzLoT_ZigQDHTVDdkL2MhFom443W-VISgQyjF4qcLMo,2254
src/detection-rules/hunting/linux/queries/low_volume_modifications_to_critical_system_binaries.toml,sha256=VjjDZ46RUH_eRY8SP_BaCYMReYKignmrWQ22sCpoSLA,2081
src/detection-rules/hunting/linux/queries/low_volume_process_injection_syscalls_by_executable.toml,sha256=ZfRMKegUofjSzdgQSvLmD7q0XCdeeZhSGILSYrpAL3g,1244
src/detection-rules/hunting/linux/queries/persistence_general_kernel_manipulation.toml,sha256=xyHvUaI1M9DIKbrg8ugBdpF_kipY3UE8SfnBS2xGPBo,3620
src/detection-rules/hunting/linux/queries/persistence_reverse_bind_shells.toml,sha256=WyQCyABAr8kGx9ZJWY221yov1FjahTAZwxugkZVgTQc,1781
src/detection-rules/hunting/linux/queries/persistence_via_cron.toml,sha256=HpnED81FVzIEc36tYRhlb03DkL2GPowVaCUOHHwUVbc,4065
src/detection-rules/hunting/linux/queries/persistence_via_desktop_bus.toml,sha256=9Urdlc4VJjjMzFWL35kh30QqIVXaSpW0iDHp0ceN7DE,3989
src/detection-rules/hunting/linux/queries/persistence_via_driver_load_with_low_occurrence_frequency.toml,sha256=Vuh_zYD5pSeDEDECrnkRIf8KBitFXDr8xb079TZTaxA,1687
src/detection-rules/hunting/linux/queries/persistence_via_dynamic_linker_hijacking.toml,sha256=mTt76RtsWrBx43EbZS6DOu-u43T5gqxyYj2jv5DOkco,3823
src/detection-rules/hunting/linux/queries/persistence_via_git_hook_pager.toml,sha256=UQCUJf0qeqjSxFQksKWs6ZVy5WFCqAQcfEL64ki-HUE,3384
src/detection-rules/hunting/linux/queries/persistence_via_grub_bootloader.toml,sha256=OtTnBnUfHJSqFXzp7sXZ6dSOg9CiV2Hi2us30o7bggg,4368
src/detection-rules/hunting/linux/queries/persistence_via_initramfs.toml,sha256=36uaNDFtFpNlbYVMiLPdV1u7PZChmSr-ZHTXex0Odls,3520
src/detection-rules/hunting/linux/queries/persistence_via_loadable_kernel_modules.toml,sha256=jn3gZE5nvArK1bQFB6DyfQk6ZLL1JBbwSt7kZKB8ilc,3329
src/detection-rules/hunting/linux/queries/persistence_via_malicious_docker_container.toml,sha256=MglzSZjjK629Gn6d2Qe-VNH1hMg-lyKXajbBr4gM3v8,2931
src/detection-rules/hunting/linux/queries/persistence_via_message_of_the_day.toml,sha256=_ENLB9p8YpEEJhp7QkxauPvbODN3uQaADA_aHAYormM,2987
src/detection-rules/hunting/linux/queries/persistence_via_network_manager_dispatcher_script.toml,sha256=8S8THy-gCjY-Iqf-aWjZ-39106UlIFoEmEGRt-IDb4E,3492
src/detection-rules/hunting/linux/queries/persistence_via_package_manager.toml,sha256=9nP6-dtd9O4vyAxL1h5DOHM3f6pldRA0kT6Qu286IXc,3659
src/detection-rules/hunting/linux/queries/persistence_via_pluggable_authentication_module.toml,sha256=5nhoC6m-JRwzQP7YuPqC-vx78CntDDyLe8AhFd-mFfs,3301
src/detection-rules/hunting/linux/queries/persistence_via_policykit.toml,sha256=mazz47_4qveQ8-9YWi41sIRb08JY-t3_wqL-7PpyU-E,3256
src/detection-rules/hunting/linux/queries/persistence_via_rc_local.toml,sha256=tm5MChMGyur744qc9EI2pIqYzJNdC9lNJut12DTEntA,3167
src/detection-rules/hunting/linux/queries/persistence_via_rpm_dpkg_installer_packages.toml,sha256=NO0OWU67FGwxReMrQijnMoG36xXYLSEHg2AzBQiHlPk,3460
src/detection-rules/hunting/linux/queries/persistence_via_shell_modification_persistence.toml,sha256=Y_ZjlnOVSFXI3K1wNPZAOq5LgK2TAuyQ7fim8RnPU7A,4259
src/detection-rules/hunting/linux/queries/persistence_via_ssh_configurations_and_keys.toml,sha256=aoUAf-vPuYHV68dHn8oaejYElNjkORYhQ_I3r1obN44,3171
src/detection-rules/hunting/linux/queries/persistence_via_systemd_timers.toml,sha256=GgE2IsQlNOvGpOZmMLQtdxVTPQROwgjSo7L1lxKKHSY,6921
src/detection-rules/hunting/linux/queries/persistence_via_sysv_init.toml,sha256=raU2i8bWEVe9AKr7u9FpyF41CP_in_jc5miWzAH-k68,3193
src/detection-rules/hunting/linux/queries/persistence_via_udev.toml,sha256=zpkf_6O8SFTOSJ87mRzp_Y_m5EWUzPXUeSNrBU5XD1s,3826
src/detection-rules/hunting/linux/queries/persistence_via_unusual_system_binary_parent.toml,sha256=Kr_IjBz4CzRgQsnYlEKUyA0cLLYJM7bpXRQrSFT8zVI,1606
src/detection-rules/hunting/linux/queries/persistence_via_user_group_creation_modification.toml,sha256=U-7gpyP1cLuLHxO19X6OjYJdhN-DXKxbEo6X8md7Yfc,1509
src/detection-rules/hunting/linux/queries/persistence_via_web_shell.toml,sha256=YmTkZaZD-A-87pVGgAkhMTOcNAZ4l5LFR7rN3pkuOpw,2503
src/detection-rules/hunting/linux/queries/persistence_via_xdg_autostart_modifications.toml,sha256=LlFwWDqosgh2XSbvO7z4RCTwwkxLl3Mph9-tmHBwY1o,5044
src/detection-rules/hunting/linux/queries/privilege_escalation_via_existing_sudoers.toml,sha256=RSz9VoQVcUN9QJagbAn2wfU7zzIundkc23tuaEBJeUk,942
src/detection-rules/hunting/linux/queries/privilege_escalation_via_process_capabilities.toml,sha256=bNFaCyXUsonobipEfPsLAbhRK3XVyOTcEeYtI_0Gd0A,2762
src/detection-rules/hunting/linux/queries/privilege_escalation_via_segmentation_fault_and_buffer_overflow.toml,sha256=-Oq_PUzRJ2MqY73HXMymfqdss3tKrqdpH6yxR0ycS3g,2679
src/detection-rules/hunting/linux/queries/privilege_escalation_via_suid_binaries.toml,sha256=KTsssn9MwXNyoKj0ujkemA-ZtNXRJWL6R4McmQrF288,1893
src/detection-rules/hunting/llm/README.md,sha256=qO-qpiU_nFDreSeYai_zEs2BfdGFKGx3Lh2LUWZLT3k,2385
src/detection-rules/hunting/llm/docs/aws_bedrock_dos_resource_exhaustion_detection.md,sha256=AN3cRGz6wN5k6Qcah-HVuAH3Gy8aThO0o8_azcdCozU,2190
src/detection-rules/hunting/llm/docs/aws_bedrock_ignore_previous_prompt_detection.md,sha256=QiyO22p-bh1APcSuh5yj3RFjoTwcoaX2VTqz6gn4uKs,2017
src/detection-rules/hunting/llm/docs/aws_bedrock_latency_anomalies_detection.md,sha256=NvYQPlApPjSMzJIK6UHE1A4R3zsZh62SiqspSDFLmRM,1839
src/detection-rules/hunting/llm/docs/aws_bedrock_sensitive_content_refusal_detection.md,sha256=4u8LVCReN5SwQdEnfbw5JqDbbioaX_xAMOeC77rdEoM,1586
src/detection-rules/hunting/llm/queries/aws_bedrock_dos_resource_exhaustion_detection.toml,sha256=HkQPNP0KlsIZs21ah-8XfN2bavpjDXUCUrNUeiDvTKY,1935
src/detection-rules/hunting/llm/queries/aws_bedrock_ignore_previous_prompt_detection.toml,sha256=PubCy_RStiu7G_zaT7IzhGhChzuwzdkBRd3_ZSLfxMs,1762
src/detection-rules/hunting/llm/queries/aws_bedrock_latency_anomalies_detection.toml,sha256=Vb-g27_Ni-rWSQZ7EJlEGl7Gf7x9ZYc2dycHht4znjc,1613
src/detection-rules/hunting/llm/queries/aws_bedrock_sensitive_content_refusal_detection.toml,sha256=hsItgaj1LOxqUErMkiESvmR8yiXlnwuVmYCO2XiAprY,1338
src/detection-rules/hunting/macos/docs/command_and_control_suspicious_executable_file_creation_via_python.md,sha256=Cz4DYXSi17LYlnt111PlDfYR1_oPJkdepkHQkO0u2_0,1861
src/detection-rules/hunting/macos/docs/credential_access_potential_python_stealer.md,sha256=-cceNY9X8k0hfRyr6VZH6UzZzCajVxg4JGX7KTLZ-zM,1925
src/detection-rules/hunting/macos/docs/defense_evasion_python_library_load_and_delete.md,sha256=Pz8bhx2FfkKkirfw7UrRMrnFrc-NgIBDvUvaZ8LdMEA,1750
src/detection-rules/hunting/macos/docs/defense_evasion_self_deleted_python_script_accessing_sensitive_files.md,sha256=bCAHnwtPgN5QWORpThW9xg3aHFAD7egwqpyJWnVBI1A,1911
src/detection-rules/hunting/macos/docs/defense_evasion_self_deleted_python_script_outbound_network_connection.md,sha256=AuiixirkdDCjrcaABtXF3xVMMpiYBslA9Zrf_SHUuFw,2181
src/detection-rules/hunting/macos/docs/defense_evasion_self_deleting_python_script.md,sha256=07LFOTjMj0qJDR3leiHsawZktIr2VoAbwIS4L_47cDE,1913
src/detection-rules/hunting/macos/docs/execution_python_script_drop_and_execute.md,sha256=PD4SfY77dNDjTwrPZkGY5sL1vrAPSVLVR3eWqSayjWE,1830
src/detection-rules/hunting/macos/docs/execution_suspicious_executable_file_modification_via_docker.md,sha256=XK02K97i2iqGHGKy8FNEhbwsg4Cs-7oOFthDaH6eN3c,1940
src/detection-rules/hunting/macos/docs/execution_suspicious_file_access_via_docker.md,sha256=ZZrG5as-lFowrbUO_nxvJDHKjPxGvAiIFJsAmQUL8SI,1779
src/detection-rules/hunting/macos/docs/execution_suspicious_python_app_execution_via_streamlit.md,sha256=5NTRiP54GJ36u3T6FH-TI077ObLqFuTTFfKEo_TEVGs,2491
src/detection-rules/hunting/macos/docs/execution_unsigned_or_untrusted_binary_execution_via_python.md,sha256=W4wgO88g-hnhoIDmbUjfeCncnx8CgyaZOM1zdBNkQPg,2077
src/detection-rules/hunting/macos/docs/execution_unsigned_or_untrusted_binary_fork_via_python.md,sha256=qgoyqgAZHZDV69-BuvtPJhuW7A4PX66OaM-gJctPhj8,1909
src/detection-rules/hunting/macos/docs/execution_unusual_library_load_via_python.md,sha256=haTxEJ4UgtjsvJoDoyKnixk0Anx9uuN3P9Sk_BEta9Y,1653
src/detection-rules/hunting/macos/docs/persistence_via_suspicious_launch_agent_or_launch_daemon_with_low_occurrence.md,sha256=QnFyjB4rGxZvLJHBonoEg9dxQDqGDUNTZH9CFo5m5ag,1630
src/detection-rules/hunting/macos/docs/suspicious_network_connections_by_unsigned_macho.md,sha256=-vqRrfalZDZFym8T0zKwWmCgqO_0NHQw3CFwDS0lMjA,2641
src/detection-rules/hunting/macos/queries/command_and_control_suspicious_executable_file_creation_via_python.toml,sha256=bd45jDEFXWfhXQgewj2loFkUPxH7JXWSCK2fWykit30,1546
src/detection-rules/hunting/macos/queries/credential_access_potential_python_stealer.toml,sha256=l7qO0v0oFQfUPXrgmaSsqeP-q-tZ8gjOsssUItTkWxc,1644
src/detection-rules/hunting/macos/queries/defense_evasion_python_library_load_and_delete.toml,sha256=vc0BzsTiQ5tB3gwiK-0McslcwBrSpEcZLgZGNmLnnjI,1468
src/detection-rules/hunting/macos/queries/defense_evasion_self_deleted_python_script_accessing_sensitive_files.toml,sha256=o0lr6RDhEzBiSzu9LxUDkcXaN2lQg6x670aylzcFWXI,1537
src/detection-rules/hunting/macos/queries/defense_evasion_self_deleted_python_script_outbound_network_connection.toml,sha256=mZf7XwcLDd8s2hyEpLVHmi5cXt05voFtX1-lAAfpmtE,1804
src/detection-rules/hunting/macos/queries/defense_evasion_self_deleting_python_script.toml,sha256=Yq98HPp4d9X0TtACmT6mU9ExTwTsfg2Xlrsjb3KsItM,1637
src/detection-rules/hunting/macos/queries/execution_python_script_drop_and_execute.toml,sha256=Zhim89Mg3YnBVQzdatF3BO5JMDtPjKajkzwT4BESQcQ,1558
src/detection-rules/hunting/macos/queries/execution_suspicious_executable_file_modification_via_docker.toml,sha256=rnX80gS718Qbx5GYCSJWI5fYxnLkp6wNkxvS2f58oAI,1628
src/detection-rules/hunting/macos/queries/execution_suspicious_file_access_via_docker.toml,sha256=pn7lL0dZ2hRccbfVG1PH7KhsJidEqjpTExsykCW8ysg,1502
src/detection-rules/hunting/macos/queries/execution_suspicious_python_app_execution_via_streamlit.toml,sha256=G0xV3YTmuuAut2rBg-5H_4zo1w4QHv5o2e0B4O1_3Qc,2189
src/detection-rules/hunting/macos/queries/execution_unsigned_or_untrusted_binary_execution_via_python.toml,sha256=RgORoTvoDBdNQIKfvo7hNXBgZPDKEPRoM7WzZwBim6w,1767
src/detection-rules/hunting/macos/queries/execution_unsigned_or_untrusted_binary_fork_via_python.toml,sha256=o6qFqf3MliAYNfO6Ssmh4D0ASQ9nLN3BllsYBUqDIsg,1652
src/detection-rules/hunting/macos/queries/execution_unusual_library_load_via_python.toml,sha256=xtxmBk4y4a6w57gJnOztNeREYsQMidG_XlghwszRVEQ,1423
src/detection-rules/hunting/macos/queries/persistence_via_suspicious_launch_agent_or_launch_daemon_with_low_occurrence.toml,sha256=hP_MnEnpZB5C1DQsTcumR1bU5mmAMNkm2we2uB9LdtY,1137
src/detection-rules/hunting/macos/queries/suspicious_network_connections_by_unsigned_macho.toml,sha256=ZAks7w4WKV7Te981zh5FDOuPj3ipWH6Gx5U0-NU4Rkc,2378
src/detection-rules/hunting/network/docs/command_and_control_cisco_sdwan_mythic_c2_tls_cert.md,sha256=EJFbU8DxYJR5f4FF2tlhFtaCd8hp4Y9AejFj0ze0N_Y,3090
src/detection-rules/hunting/network/queries/command_and_control_cisco_sdwan_mythic_c2_tls_cert.toml,sha256=cmdorusPHsMKyL7-EZZDz4oB08VVHUkU0C03rOvlS4M,2783
src/detection-rules/hunting/okta/docs/credential_access_mfa_bombing_push_notifications.md,sha256=FRKaYj0KjkattSeUcl8xK62tsrlR6OBFzfplUUt0UGo,1733
src/detection-rules/hunting/okta/docs/credential_access_rapid_reset_password_requests_for_different_users.md,sha256=x0LCt5-SqZBLtM-7NOMKZy1Z4ZTRCMlRozK3gIeEKcM,2135
src/detection-rules/hunting/okta/docs/defense_evasion_failed_oauth_access_token_retrieval_via_public_client_app.md,sha256=vZixfdEKH2PW1XYaZMbsEkAvHW8TsQNfJVSDXn3Mlzs,2328
src/detection-rules/hunting/okta/docs/defense_evasion_multiple_application_sso_authentication_repeat_source.md,sha256=9mF1iPCHerESa8OG5l-M7qUVcpSteoi9Ib_Z6SbiqNQ,2700
src/detection-rules/hunting/okta/docs/defense_evasion_multiple_client_sources_reported_for_oauth_access_tokens_granted.md,sha256=J4OmRBE-deN2LTQhc4iwurY_5pO9asalRrrMZ2bKF5M,2610
src/detection-rules/hunting/okta/docs/defense_evasion_rare_oauth_access_token_granted_by_application.md,sha256=A06aD8UsBA2x1FtcUTHclqqhCi3s-TJEF0wVBpgBtlY,2407
src/detection-rules/hunting/okta/docs/initial_access_higher_than_average_failed_authentication.md,sha256=a-QLrSC_Vkz0vJbp-D0hl5Pppvlgry0mSCUfJME8jjc,2321
src/detection-rules/hunting/okta/docs/initial_access_impossible_travel_sign_on.md,sha256=v8gylVcAlqDwhV0E214bp619LC3TUOQPYkrmxHC_GfY,1845
src/detection-rules/hunting/okta/docs/initial_access_password_spraying_from_repeat_source.md,sha256=uDUqxLi9_81Oo-uikZRq7pa5ZotWtiMZftzy2ykfR7U,1982
src/detection-rules/hunting/okta/docs/persistence_multi_factor_push_notification_bombing.md,sha256=Pzng5xOpfpNj_pZwDAWsrJOhAMQukrzB64jqMcXELBw,1883
src/detection-rules/hunting/okta/docs/persistence_rare_domain_with_user_authentication.md,sha256=ydCdZQwsEgMc1hQTQyL617EJIUjhgiZ8iOzSU6MxVP0,1924
src/detection-rules/hunting/okta/queries/credential_access_mfa_bombing_push_notifications.toml,sha256=8txOPZKqKrilWXQZcivZZbgYHduWiyQlEDJ3w-E_K0M,1481
src/detection-rules/hunting/okta/queries/credential_access_rapid_reset_password_requests_for_different_users.toml,sha256=6kH7_bc8O3ZPp7zRKg3DjPFVMtip0WoKAEp7YB0MmSc,1854
src/detection-rules/hunting/okta/queries/defense_evasion_failed_oauth_access_token_retrieval_via_public_client_app.toml,sha256=10mCbvIius5ge4XJYDbZr4v-0UqHNYD7V2_b9aXQx10,2038
src/detection-rules/hunting/okta/queries/defense_evasion_multiple_application_sso_authentication_repeat_source.toml,sha256=W1eMREAMGKVVgUYtAcVUECW8ZNadDUtlMVyx4HulvZs,2412
src/detection-rules/hunting/okta/queries/defense_evasion_multiple_client_sources_reported_for_oauth_access_tokens_granted.toml,sha256=qOo3M7GuGALAhXhOD1_0GuVq21dDY8VbyEn9s3Ht-tM,2291
src/detection-rules/hunting/okta/queries/defense_evasion_rare_oauth_access_token_granted_by_application.toml,sha256=hWZNSy5hRrPbPPwSilISzu3xzQu7ck-xCgnSqEb0cAg,2120
src/detection-rules/hunting/okta/queries/initial_access_higher_than_average_failed_authentication.toml,sha256=RJ9-rCYFlHP7Fdl7AIcy4VgDhG5XbvqlgzhIOiuAVDM,2044
src/detection-rules/hunting/okta/queries/initial_access_impossible_travel_sign_on.toml,sha256=kmtrt1Ji1uUyY9VSgq8YqcPUVIo00HF5Kyd5jRKcWBA,1597
src/detection-rules/hunting/okta/queries/initial_access_password_spraying_from_repeat_source.toml,sha256=3038rF_l_oooN6To8Yn52GeMxmFuPqbJmhP7qS7yzTI,1735
src/detection-rules/hunting/okta/queries/persistence_multi_factor_push_notification_bombing.toml,sha256=Mn7uJ1nGIvxav71FbzrUnz6ouGV2b0olZMTl2RlKTME,1609
src/detection-rules/hunting/okta/queries/persistence_rare_domain_with_user_authentication.toml,sha256=DpaYwydI4q8T7TsfAPCZpxTUM6-l1bOcYTXycfdarHE,1645
src/detection-rules/hunting/windows/docs/createremotethread_by_source_process_with_low_occurrence.md,sha256=L7DADCc4EiNM98by98OW4fMz5E1c-03cuY-JGSvqWyI,1395
src/detection-rules/hunting/windows/docs/detect_dll_hijack_via_masquerading_as_microsoft_native_libraries.md,sha256=f7sW-fOrB309cv2zdhYHitJtKrAqqD3stL7CrMAGPz0,4307
src/detection-rules/hunting/windows/docs/detect_masquerading_attempts_as_native_windows_binaries.md,sha256=1XELpuds8mUkH0aRpDtd2Ky3nFPUwyrCkbbzey28ygE,2822
src/detection-rules/hunting/windows/docs/detect_rare_dll_sideload_by_occurrence.md,sha256=vHgmPZ1F4AkIo9WRapB92L2I4YdVSxzEFliVPzdbg4I,4719
src/detection-rules/hunting/windows/docs/detect_rare_lsass_process_access_attempts.md,sha256=Zf1LbKn6jDWx7N96t13oQpksGFwIfkzVDtHTpGgUjNM,2934
src/detection-rules/hunting/windows/docs/domain_names_queried_via_lolbins_and_with_low_occurrence_frequency.md,sha256=4SKmvHm3e9aFbi_qGCyeq5F2phf0Yw3HI735nyfeXGk,2043
src/detection-rules/hunting/windows/docs/drivers_load_with_low_occurrence_frequency.md,sha256=7bKxXUry8n-rsXqNU-0mpWeD06sNT0kHhugzwxTLmBA,3103
src/detection-rules/hunting/windows/docs/excessive_rdp_network_activity_by_source_host_and_user.md,sha256=k_uzFcCOWJ3E-FMtVuABs-8waUU-0gvXVC2A-Ys0B8g,2227
src/detection-rules/hunting/windows/docs/excessive_smb_network_activity_by_process_id.md,sha256=Y_YV63jZ7wbvcVNXs5rL_raUvHXO1XCh5zirfPab81Y,1747
src/detection-rules/hunting/windows/docs/executable_file_creation_by_an_unusual_microsoft_binary.md,sha256=8uGpNkPvYOe6Gve-10jU5n4m62pSUm_PooL7zvtlOmA,2360
src/detection-rules/hunting/windows/docs/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.md,sha256=35vm-WdVPD8-tGU2kpxwXjVwDW97E_P406HcO90694E,2453
src/detection-rules/hunting/windows/docs/execution_via_remote_services_by_client_address.md,sha256=BySRzdE41YP_45pOLCjxruwq-3pQK1JmdBRFcg2VVm8,1680
src/detection-rules/hunting/windows/docs/execution_via_startup_with_low_occurrence_frequency.md,sha256=-ytC1vTX5Wzf0XkPcIqdrrpnQMJeXKLfUfe2_BCbVOw,2477
src/detection-rules/hunting/windows/docs/execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.md,sha256=cvIvlZ-9rwJHdejCHrGvrE-LUEOSJTBaKwi2P2Jj0JM,2836
src/detection-rules/hunting/windows/docs/execution_via_windows_scheduled_task_with_low_occurrence_frequency.md,sha256=pan8cDbuWjO1TJvaCussWJLphuBI02a3GSGkO0cBJ8c,1787
src/detection-rules/hunting/windows/docs/execution_via_windows_services_with_low_occurrence_frequency.md,sha256=he4eIOctyeBc-i2wXdBDCwpGHXRMCFQTCrSov4b1e8M,2668
src/detection-rules/hunting/windows/docs/high_count_of_network_connection_over_extended_period_by_process.md,sha256=ykodrQENvfW792RU0CUnzuS_rGgKWKUha6IBbtRadLw,6350
src/detection-rules/hunting/windows/docs/libraries_loaded_by_svchost_with_low_occurrence_frequency.md,sha256=L9VqlHXslIG6_34ZOCQBf5haT3_LTI6u8gs8BfQcW7c,3944
src/detection-rules/hunting/windows/docs/microsoft_office_child_processes_with_low_occurrence_frequency.md,sha256=-D441NHqiORszaz7WXgYMi-7Ex-fHl-tWnbyHU41QkU,2083
src/detection-rules/hunting/windows/docs/network_discovery_via_sensitive_ports_by_unusual_process.md,sha256=awz3z9k8ktbCjpyaEo8KHeU36ZJPIezzt_ubxZ0scXg,2304
src/detection-rules/hunting/windows/docs/pe_file_transfer_via_smb_admin_shares_by_agent.md,sha256=QuMTg-G894CDLR8Q_mnSCPluxmkFwdR9uHVp86ktH7U,1852
src/detection-rules/hunting/windows/docs/persistence_via_run_key_with_low_occurrence_frequency.md,sha256=F7om74Hy9WwG89EO1AF7hpFRd0gi5-5csoLJ6D-ADgs,3551
src/detection-rules/hunting/windows/docs/persistence_via_startup_with_low_occurrence_frequency.md,sha256=Y9lLxlp7kAYGah-qVkHK96gxqP2IPm_nnb5dUJYSvX4,2368
src/detection-rules/hunting/windows/docs/potential_exfiltration_by_process_total_egress_bytes.md,sha256=4wIAVudeeT1pn3ILQHlleTcZOeqoVTIKHj9plzDatC8,2273
src/detection-rules/hunting/windows/docs/rundll32_execution_aggregated_by_cmdline.md,sha256=Y_6GLmjYBvi3VUbncAbSvfMHXrqQI_RsTZQyUR0sTFA,3022
src/detection-rules/hunting/windows/docs/scheduled_task_creation_by_action_via_registry.md,sha256=hdwXAF4Ls7TBAGCXPXgOG5neAo5f3qLdpoyNJ1HeZ74,2112
src/detection-rules/hunting/windows/docs/scheduled_tasks_creation_for_unique_hosts_by_task_command.md,sha256=VaJCAayt9Y-ZeaFLGCweoWC2lti0yPfdvqHwKtMvCGc,2394
src/detection-rules/hunting/windows/docs/suspicious_base64_encoded_powershell_commands.md,sha256=d1PO8wlRsTDmkM5GYvoK-cWmE7bKPTLdxRBNiCjDYHw,2075
src/detection-rules/hunting/windows/docs/suspicious_dns_txt_record_lookups_by_process.md,sha256=Wy8VjrRtLEavg5BD_c6TufEZ1xugwmptPZ77NtmlfB0,1671
src/detection-rules/hunting/windows/docs/unique_windows_services_creation_by_servicefilename.md,sha256=Qedw-fSNJDWA-N_NWK1yNC__7-er8Akxoo4tI-t9YuU,4946
src/detection-rules/hunting/windows/docs/windows_command_and_scripting_interpreter_from_unusual_parent.md,sha256=MxWMruCmtYYp_W97Q7V2MoGqpEzcc9sAp7cIafHjX9g,2010
src/detection-rules/hunting/windows/docs/windows_logon_activity_by_source_ip.md,sha256=2inEbllfSU4qbuzYY-xRCZdhTUe_1deF6h0llpF8tAw,1894
src/detection-rules/hunting/windows/queries/createremotethread_by_source_process_with_low_occurrence.toml,sha256=rt6tg2WVTepv6cFL6X8JA8G0mBWojzO6Bok45KVNb2c,1104
src/detection-rules/hunting/windows/queries/detect_dll_hijack_via_masquerading_as_microsoft_native_libraries.toml,sha256=xXHKoTEbuzCvaHzN5KTO8XuNkMcO2RZRHge0kNmfONY,3932
src/detection-rules/hunting/windows/queries/detect_masquerading_attempts_as_native_windows_binaries.toml,sha256=2CB77RzRgtBqhjrzJvDlVRfmFde2gGIVZDPYY6_sWWI,2552
src/detection-rules/hunting/windows/queries/detect_rare_dll_sideload_by_occurrence.toml,sha256=ClDli7HMB3ojIJAYCCU2akJPeCMyW9sbUGDtS2G4ugo,4391
src/detection-rules/hunting/windows/queries/detect_rare_lsass_process_access_attempts.toml,sha256=UKjrFYg5C_4eR3kW4YqWQvAVjeQRJZ1y8QNO4NHgx_w,2596
src/detection-rules/hunting/windows/queries/domain_names_queried_via_lolbins_and_with_low_occurrence_frequency.toml,sha256=4waBMUkqqNpgs9RkXwkLGPalFWw7Q7mu4NHSeftaLcI,1714
src/detection-rules/hunting/windows/queries/drivers_load_with_low_occurrence_frequency.toml,sha256=IFU1HAth3zTa32oR2qgFIzAAbHUxF5zMzMI2ruTbFJw,2765
src/detection-rules/hunting/windows/queries/excessive_rdp_network_activity_by_source_host_and_user.toml,sha256=6gqrUFDpHoEd5IEixj8Ex312vfqXoFHj7NG6HR8vByw,1869
src/detection-rules/hunting/windows/queries/excessive_smb_network_activity_by_process_id.toml,sha256=rgJl3cxYcCnoTVVVPTpaOmD17N7D0uB1vXNLX9LY44g,1399
src/detection-rules/hunting/windows/queries/executable_file_creation_by_an_unusual_microsoft_binary.toml,sha256=6kAX-ChOKUwrPbQ6-sk5ozwpsn6SNPL4EPbYJkdcjXU,2002
src/detection-rules/hunting/windows/queries/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.toml,sha256=tcz0oMvGIBRWhi16nXkyYehPSFbGGrUaSYE7TK-Q_BM,2162
src/detection-rules/hunting/windows/queries/execution_via_remote_services_by_client_address.toml,sha256=R6yYlsOFQTOxyvRjwWXnItsnwPjv8LtbAwheBglCT00,1276
src/detection-rules/hunting/windows/queries/execution_via_startup_with_low_occurrence_frequency.toml,sha256=2gg0jQ8dFDb1bGoUj40afsn7EwEotHm13_C7uZz_b0w,2151
src/detection-rules/hunting/windows/queries/execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.toml,sha256=XKWlLlaLfni4DGyUSJRAwLndb94cr9-0C_VwzWruom8,2420
src/detection-rules/hunting/windows/queries/execution_via_windows_scheduled_task_with_low_occurrence_frequency.toml,sha256=chcwChCObrFQnWW3lF1w1fR82QuKYGgP4vqgLA02ceo,1384
src/detection-rules/hunting/windows/queries/execution_via_windows_services_with_low_occurrence_frequency.toml,sha256=6CvxPsQpT1a6UNoaa04AIF34exc60O6MuXFxxPbiO74,2229
src/detection-rules/hunting/windows/queries/high_count_of_network_connection_over_extended_period_by_process.toml,sha256=cOZK1UQIpGxPj0A0A3TwQn2O2IQuMfK4C-Y27Rr1YjY,5999
src/detection-rules/hunting/windows/queries/libraries_loaded_by_svchost_with_low_occurrence_frequency.toml,sha256=fJ_8EauC2MForUFNxv37uoR8EbErqkPkL4W6bwXLi2w,3577
src/detection-rules/hunting/windows/queries/microsoft_office_child_processes_with_low_occurrence_frequency.toml,sha256=Vjgvg_jZYwND8_-ETXPDvltUHMcSnJs9O9KWcVEO5fI,1638
src/detection-rules/hunting/windows/queries/network_discovery_via_sensitive_ports_by_unusual_process.toml,sha256=RkZR9gRI6SXbuq70GAD1hiyq1VlCnc-JP9CPartgS0M,1889
src/detection-rules/hunting/windows/queries/pe_file_transfer_via_smb_admin_shares_by_agent.toml,sha256=cUB_ZAdkqk2dbN-u4J7mTTlIoNjENJvG30E7aSsmNTc,1530
src/detection-rules/hunting/windows/queries/persistence_via_run_key_with_low_occurrence_frequency.toml,sha256=1dzS5qw84eDZeT86swgKfm_PGQCug5O7u0bMSYtmqok,3187
src/detection-rules/hunting/windows/queries/persistence_via_startup_with_low_occurrence_frequency.toml,sha256=D7WR2IHYdTzveGEOSpxllLN59dXmG5oi9pu9tW6RRJw,1987
src/detection-rules/hunting/windows/queries/potential_exfiltration_by_process_total_egress_bytes.toml,sha256=ZsDiCshS_1n8CI8h2nksPikd7Eo8p6XVP6FWSqGD_JA,2001
src/detection-rules/hunting/windows/queries/rundll32_execution_aggregated_by_cmdline.toml,sha256=INa1TC6l9xwMyX617x67esC2BFI3fYrax7Sq_hCBY-k,2588
src/detection-rules/hunting/windows/queries/scheduled_task_creation_by_action_via_registry.toml,sha256=4F2WlryA1X4Zeu8MRJVmO4wvEbMmmIJdNbTwuynOFsY,1801
src/detection-rules/hunting/windows/queries/scheduled_tasks_creation_for_unique_hosts_by_task_command.toml,sha256=BRDTZ4PfFAg21IfyecDLVk8pJicX5mIaYChWdmqwCpM,2072
src/detection-rules/hunting/windows/queries/suspicious_base64_encoded_powershell_commands.toml,sha256=6bBYigGyyLcbK0zxVIDu_MBbILprncBn_PXblp6mEhc,1589
src/detection-rules/hunting/windows/queries/suspicious_dns_txt_record_lookups_by_process.toml,sha256=my5lvoQ52WVaX-oCCeBvuEoFrJuBYQuWgQyPhpMOY9E,1321
src/detection-rules/hunting/windows/queries/unique_windows_services_creation_by_servicefilename.toml,sha256=AvachJ3lc4Iw0x_0JTfg9QMW3rtHJ_NMs4x2KHltwIU,4529
src/detection-rules/hunting/windows/queries/windows_command_and_scripting_interpreter_from_unusual_parent.toml,sha256=ulJ0bkhl_3jghi5BtGph2VVl7CQpUc5E0H-4gU3iyaU,1527
src/detection-rules/hunting/windows/queries/windows_logon_activity_by_source_ip.toml,sha256=arboAqC2AoFiOHbJNRGJ2w1SPcl64UuHlpAr39GIpHg,1559
src/detection-rules/rules/README.md,sha256=FsDrLRbMS1GiLtJxKEeB2etL1U0JZ053xE3T28iDNIY,2862
src/detection-rules/rules/_deprecated/apm_null_user_agent.toml,sha256=P1Ob5RxPCMFTR8Z_fRaFpfLNgZmJekBbg1ihzeuHpeY,1466
src/detection-rules/rules/_deprecated/command_and_control_connection_attempt_by_non_ssh_root_session.toml,sha256=L9n522sl79myzYEWozsyKhrtM9oD9n7xlHhsOq_-D-4,3405
src/detection-rules/rules/_deprecated/command_and_control_dns_directly_to_the_internet.toml,sha256=qlYl28lEc69nJXQRHz0Z-nstI8SKLXttlll_4N_rnio,2841
src/detection-rules/rules/_deprecated/command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml,sha256=Ch4I743iqDRnHQBDzBJKPMvGxfD9cscKyWkNHkjChEc,2559
src/detection-rules/rules/_deprecated/command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml,sha256=Owf2oKiHH5RMdHs16mdW5NGlZfqacps7HCUB3NE2WJc,2506
src/detection-rules/rules/_deprecated/command_and_control_linux_chisel_server_activity.toml,sha256=BaEtM6vHm5lT-Q6LjfAGz3Ke-TH3rShJ_0OO8mmYtG8,10398
src/detection-rules/rules/_deprecated/command_and_control_linux_iodine_activity.toml,sha256=ik7mymIg2c2SRv5OG5UqT-rSRKzJmrcwxRTwLAo8tkc,1841
src/detection-rules/rules/_deprecated/command_and_control_linux_port_knocking_reverse_connection.toml,sha256=17PowWGKOMFk8t2VMfTD5IBbPKYYAtAp4RVMyVJnlQY,5148
src/detection-rules/rules/_deprecated/command_and_control_non_standard_http_port.toml,sha256=AI74O9bJme8VnypTjmfu4QQMiZIHPfre2Tk4f5z75u8,7807
src/detection-rules/rules/_deprecated/command_and_control_non_standard_ssh_port.toml,sha256=SlMBF29t6TwpyGCMKrK3WLKnj7Pny0swdvaS46ufHw8,6704
src/detection-rules/rules/_deprecated/command_and_control_port_8000_activity_to_the_internet.toml,sha256=jgENNsuzg4kMtoUEaeBlpqG5F-3eCtwUVBUU4du7cXQ,2010
src/detection-rules/rules/_deprecated/command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml,sha256=uzqvyL_JvKsDojc_TCpVZW_4qUhuJ38kwUbsJwUkn4k,1568
src/detection-rules/rules/_deprecated/command_and_control_proxy_port_activity_to_the_internet.toml,sha256=N123c9tBYL3PqNd2xMKyRTZpkWdX9gQ4p8b2G7Q3N1Y,2443
src/detection-rules/rules/_deprecated/command_and_control_smtp_to_the_internet.toml,sha256=OmyIkHqqO3OdQJLBLARCht0UsqkRlUjOkXUX7lXOHE8,2119
src/detection-rules/rules/_deprecated/command_and_control_sql_server_port_activity_to_the_internet.toml,sha256=KDNeLrIR2fb2FNdMzS4mH_Mw6Ky7EhIttMD57ccXiCI,1916
src/detection-rules/rules/_deprecated/command_and_control_ssh_secure_shell_from_the_internet.toml,sha256=dT3rK50ocmiI9aTi2AO9kK7SgczzjsAxOFswYRynrjk,2757
src/detection-rules/rules/_deprecated/command_and_control_ssh_secure_shell_to_the_internet.toml,sha256=EfQzNOi7HQFnTMZT5QrVj50Sgr6iY6GOYrhLumicXcE,2151
src/detection-rules/rules/_deprecated/command_and_control_tor_activity_to_the_internet.toml,sha256=NF4Fl59KsJLdABK6K5FwmXr1tdu7NXaedQfVnuhTaDw,2329
src/detection-rules/rules/_deprecated/credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml,sha256=0gn1XEwiyKKC2FAt2-86ONDaxDYB2Hue50-8xstoxd0,6831
src/detection-rules/rules/_deprecated/credential_access_microsoft_365_potential_password_spraying_attack.toml,sha256=ieBRSQIw3hk673O5dGw1hx8_JAklxKCYcicpjYjlTHc,1815
src/detection-rules/rules/_deprecated/credential_access_potential_linux_ssh_bruteforce_root.toml,sha256=t_1U00NJarwzYBhpUkhLxdhiV2ZoPaNUOZWbY3Wq6Dk,3966
src/detection-rules/rules/_deprecated/credential_access_potential_successful_linux_ftp_bruteforce.toml,sha256=5KZIG83OEzbv7XQlFPM2k9HvSTRuO1DK_BPxK52mGn0,9451
src/detection-rules/rules/_deprecated/credential_access_potential_successful_linux_rdp_bruteforce.toml,sha256=IIOsk4fCYS3c7XspD_Cw85mb2TnW8cgftuQYHfDV5r4,9703
src/detection-rules/rules/_deprecated/credential_access_tcpdump_activity.toml,sha256=HjMr6vfU4ptYXikdukMUug9Um8DBKHXRbBwns9RriJw,1662
src/detection-rules/rules/_deprecated/defense_evasion_agent_spoofing_mismatched_id.toml,sha256=lp9561MSJeqCyFJCbkvnqGJrOooZ6wbbnPvGwEHBRqU,5723
src/detection-rules/rules/_deprecated/defense_evasion_attempt_to_disable_iptables_or_firewall.toml,sha256=xmyL9oBeFgVTsQiHxVhe6hGmu1nYihiHP_kb8Rz3j_o,1530
src/detection-rules/rules/_deprecated/defense_evasion_base64_encoding_or_decoding_activity.toml,sha256=sZ_95szs8hOpomQmmlSUVgG96KgfH9C0YRBS5icSmMw,1477
src/detection-rules/rules/_deprecated/defense_evasion_code_injection_conhost.toml,sha256=G6Yz_j7i3ly8I_QxT64BDHoVSIi2aeeVRaZjfIotC68,5188
src/detection-rules/rules/_deprecated/defense_evasion_elasticache_security_group_creation.toml,sha256=Jbig4QsukegVaLhlQJPVk_3YiZ2mC16Z-cA6tFGP8TM,6876
src/detection-rules/rules/_deprecated/defense_evasion_elasticache_security_group_modified_or_deleted.toml,sha256=oCwORGOoEJ5FEtpeejX5ws89GGYnOiBEtBScxq0rW2U,6681
src/detection-rules/rules/_deprecated/defense_evasion_execution_via_trusted_developer_utilities.toml,sha256=0DIN1D3-hRuLx57AlgtkBAOFDQUAEZ_BNMf1TG7rX9Y,1342
src/detection-rules/rules/_deprecated/defense_evasion_hex_encoding_or_decoding_activity.toml,sha256=JtVxnHzgZ_O9fPb5DxmRoiFW-Gxqw7ihShvbv4zorMM,1431
src/detection-rules/rules/_deprecated/defense_evasion_ld_preload_env_variable_process_injection.toml,sha256=N12tqet7lSXN0_AL0_CZAc9bbJlZBSyBZ2YMcjXm_Po,6018
src/detection-rules/rules/_deprecated/defense_evasion_mshta_making_network_connections.toml,sha256=-beMtzmAlThKxAhtC1QrgL6AQt76_S0sCHtgg1NeNJY,1491
src/detection-rules/rules/_deprecated/defense_evasion_potential_processherpaderping.toml,sha256=CrMLt3Zcji5ydCGpt-_p17w8NGWvdpC4i1uQ2vh-Vs4,1842
src/detection-rules/rules/_deprecated/defense_evasion_process_termination_followed_by_deletion.toml,sha256=kjpsgmi8BzvNoQCRJJLy0oW61hhZ26cFzxYazPapoxw,8481
src/detection-rules/rules/_deprecated/defense_evasion_rename_esxi_index_file.toml,sha256=lkVvaepEX8VSY-h1Z5_VDEXeYcpWSE-oTTopcVCKjGo,7730
src/detection-rules/rules/_deprecated/defense_evasion_whitespace_padding_in_command_line.toml,sha256=y1xyhawly-MX1X7wU8r7H33s61qjifj3O7MPD_9qHdg,5213
src/detection-rules/rules/_deprecated/discovery_file_dir_discovery.toml,sha256=x3H7E_TjCpMrByzKuW5gFWFiSy46etE8-wfW2wy8tNU,4102
src/detection-rules/rules/_deprecated/discovery_process_discovery_via_tasklist_command.toml,sha256=xsfztpMiMrhlVsKSJs8jpbpIr-ifl5-kWmYHjXgniSk,1357
src/detection-rules/rules/_deprecated/discovery_pspy_process_monitoring_detected.toml,sha256=aYcip-UzP4DUeQcyKKjuy6P1Nxt5AaocUmbFDnuc9XM,7457
src/detection-rules/rules/_deprecated/discovery_query_registry_via_reg.toml,sha256=yaFFIcpM9z2Z_xFL3zvhHcLyV9RU8BFtJtE_uhVhZko,1134
src/detection-rules/rules/_deprecated/discovery_whoami_commmand.toml,sha256=NEUGhhng629IInRexo-_TVOgkNCVoLvO4uaXJ4tlsqk,1256
src/detection-rules/rules/_deprecated/execution_apt_binary.toml,sha256=FGsJSS6bii45TNR3PfSXcSXmUqRRW4g0Y01xBzzDpEw,1831
src/detection-rules/rules/_deprecated/execution_awk_binary_shell.toml,sha256=jEchJX9Jf9-VQeV1-vssqVRqdQPza-Pcanw-556MCBE,1729
src/detection-rules/rules/_deprecated/execution_busybox_binary.toml,sha256=IITvx4ReXM1up2gjvYa8Aec7QUgeDfILHFHeXC58zrM,1665
src/detection-rules/rules/_deprecated/execution_c89_c99_binary.toml,sha256=5VLXlYDqDHGC7A9hJDtKHai7WMhCzUzF1-lB1MfyY9M,1791
src/detection-rules/rules/_deprecated/execution_command_shell_started_by_powershell.toml,sha256=0SGoxLXFNej0Ffb8VvVq3PCqyvE4Jbay4eC1PifB8FY,1228
src/detection-rules/rules/_deprecated/execution_cpulimit_binary.toml,sha256=Za3MQfcjwp3en5LUJsVZEPZxkv-Em2qjubwTLF5G5as,1792
src/detection-rules/rules/_deprecated/execution_crash_binary.toml,sha256=-wz6LJVZUeuLHLm6ZPEpavzyPZWbX2IQWyhpSg609i4,1606
src/detection-rules/rules/_deprecated/execution_curl_cve_2023_38545_heap_overflow.toml,sha256=zrasn_JYmeB7KA3xDBiFzipxcRYoVJN_L-8TDqosg38,9360
src/detection-rules/rules/_deprecated/execution_env_binary.toml,sha256=2qq_ndk9zYy2_D3bli2eyWzNhSgJw7glh1Zq7r5wTJ0,1666
src/detection-rules/rules/_deprecated/execution_expect_binary.toml,sha256=BIU_NjT5DFy7XrtG7MJJ_zfkL1YkoKIN9bhbmraY7Zo,1856
src/detection-rules/rules/_deprecated/execution_find_binary.toml,sha256=PKvMdNYz4AEJ0ZfZxkwPLbCmQs1OVsBQ5QSZKLD3l8c,1719
src/detection-rules/rules/_deprecated/execution_flock_binary.toml,sha256=cePqGZZf4f9-0GobaxgxMcEByc9I7pTOju6KyakcOq0,1769
src/detection-rules/rules/_deprecated/execution_gcc_binary.toml,sha256=hqaGdpJ0pDyfe9Z3mLb9YQwRiSvAgiKyJbL1TtS6QJ8,1760
src/detection-rules/rules/_deprecated/execution_linux_process_started_in_temp_directory.toml,sha256=Of0Ynl54K-ToNotSxvqmX7ZjEOpHOA4jPJwiTYAWvNs,1495
src/detection-rules/rules/_deprecated/execution_mysql_binary.toml,sha256=DhCMP0edAa6Z22WuHQxlg31aDSFfUWOVvG38eMr85m0,1728
src/detection-rules/rules/_deprecated/execution_pdf_written_file.toml,sha256=y_Z5_xAnD0GP7W-DNFS_GRhkMxjQ8yg44F-SrLqW6WM,6119
src/detection-rules/rules/_deprecated/execution_pentest_eggshell_remote_admin_tool.toml,sha256=YjiX7lVLc9t84kG7zJJj1v3eFzSnJIrIEEACT3WciSc,5396
src/detection-rules/rules/_deprecated/execution_reverse_shell_via_named_pipe.toml,sha256=ho8lidMGBTNyv3f5AT29uMlDs5PmO_UEhW0EPNLW9QI,2876
src/detection-rules/rules/_deprecated/execution_shell_evasion_linux_binary.toml,sha256=BDWRIS4g_yhCUjj5a50kXAK1vejq0l6gAISLvMTe9hk,12652
src/detection-rules/rules/_deprecated/execution_shell_suspicious_parent_child_revshell_linux.toml,sha256=M6bJXbB1RxvG7sNJifxwfKe8rn2WqRU2LOO1apmj17s,5431
src/detection-rules/rules/_deprecated/execution_ssh_binary.toml,sha256=wRBTyH4Z06Qgf7uSefoQzWzR_yZLZRXrTAqdu00kkcg,1915
src/detection-rules/rules/_deprecated/execution_suspicious_jar_child_process.toml,sha256=g7Y6xvGgfo0MTj6EGYxdDRUtE8VHgTVLnHEU8NSW_w0,5143
src/detection-rules/rules/_deprecated/execution_vi_binary.toml,sha256=rVx9fC5neqddpDzHI3cauhBO0O8eHaW1yeO0GqmPzm8,1693
src/detection-rules/rules/_deprecated/execution_via_net_com_assemblies.toml,sha256=WoQfkdoC-v0pHjs5Z1CSF9JdwbEV-N3yiKzIfcZ05Yg,1517
src/detection-rules/rules/_deprecated/exfiltration_ec2_snapshot_change_activity.toml,sha256=1G5HDecNxC7OnjHHAmJgTABviAJu6m5l8hrd94MErLQ,5984
src/detection-rules/rules/_deprecated/exfiltration_ec2_vm_export_failure.toml,sha256=KGk9FAieIO1d6lNH3b6fBTeWvRrabD22uyL__lW5Tqk,5943
src/detection-rules/rules/_deprecated/exfiltration_rds_snapshot_export.toml,sha256=sWun5b-ABOXGlkaBRRU4D7IAhq0oxcSzRiARSbzyVrs,1587
src/detection-rules/rules/_deprecated/impact_potential_linux_ransomware_file_encryption.toml,sha256=lOEgZWwU381xlheYMvcJFy9gO17FYaWP720PAL9IlUk,4275
src/detection-rules/rules/_deprecated/impact_rds_group_deletion.toml,sha256=mD95apuRrUSCvGO7SUZ8e64qLhoOmAiKB_R_qdV9gtM,6128
src/detection-rules/rules/_deprecated/impact_rds_instance_cluster_stoppage.toml,sha256=7qRnEu_TD9VlHR6kud8vFX5BD2D8I1zOulZCX0zd2Lw,6067
src/detection-rules/rules/_deprecated/impact_virtual_network_device_modified.toml,sha256=C1-KzN13Hafw3A9-Fg-37R4Bd9STq0xPe7i-vBfo69M,6954
src/detection-rules/rules/_deprecated/initial_access_cross_site_scripting.toml,sha256=QzRJdE2DmDPRpcI1GD05Zmv8ouf4zjpWvZFFtp57Nts,1617
src/detection-rules/rules/_deprecated/initial_access_login_failures.toml,sha256=_kOXSQ4PleBgeG68TjvkHXKMUomjZlIqBcP01JwEkPM,1382
src/detection-rules/rules/_deprecated/initial_access_login_location.toml,sha256=tz_uUjcVOnqB1UK96KKBXIbDjYBNfzaWgbis3_6XeSs,1370
src/detection-rules/rules/_deprecated/initial_access_login_sessions.toml,sha256=ANcZlbHYI9rAPIpTOVoBornOTDsvfhgikW-299X-CqY,1358
src/detection-rules/rules/_deprecated/initial_access_login_time.toml,sha256=_kljdiUN-qkj6Cl_sl-1JkYo3pxrfmPDQLWq8v9ndWU,1361
src/detection-rules/rules/_deprecated/initial_access_rdp_remote_desktop_protocol_to_the_internet.toml,sha256=Qwqv0Iuf1XK8f5-qP2KftZBIVXzV7Rwha_8MtLLG3uE,2587
src/detection-rules/rules/_deprecated/initial_access_ssh_connection_established_inside_a_container.toml,sha256=8IRjm-KURyYajs2vbpg_vlAUEQRwlXN5gpA0DlzcVO0,6893
src/detection-rules/rules/_deprecated/lateral_movement_malicious_remote_file_creation.toml,sha256=9psQ-KiT-Mi4cB1RCSHQ-Iy9adDa1vbLqdmG0N3nqh4,1489
src/detection-rules/rules/_deprecated/lateral_movement_remote_file_creation_in_sensitive_directory.toml,sha256=cIF5BJVeQFXhcmk-oKcfIu5re0tjf_klOdBctLEIWXA,1956
src/detection-rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_a_container.toml,sha256=tMNkzlHomJ5txCvbGqU1ee9DtSyhLJM2Nsf3rKkEJaA,7081
src/detection-rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_container.toml,sha256=GvLLvGW_QVueYL4Ykj8OkA4_KNUhUXtzEuyF3YiK5Jc,8813
src/detection-rules/rules/_deprecated/linux_mknod_activity.toml,sha256=AtOAcnSD1gRdU8oeF1nL7vR-8st7W6Cx_FM9ZqYU5fU,1252
src/detection-rules/rules/_deprecated/linux_nmap_activity.toml,sha256=4krPC1MpI7NrhqLNP_CvUd_WpeI7V4Wb_IFbB8xH7Co,1250
src/detection-rules/rules/_deprecated/linux_socat_activity.toml,sha256=fpPixypMYwHucgfqOZtKJesiqM45VL5AJ3tm3djHPJE,1283
src/detection-rules/rules/_deprecated/persistence_cap_sys_admin_added_to_new_binary.toml,sha256=elaLLLJeNPPC2ysluHFsPWClEWUpkkDu4J84UzJ8SnM,4004
src/detection-rules/rules/_deprecated/persistence_creation_modif_launch_deamon_sequence.toml,sha256=nl0Jd4DRJzV8ZcFDsu1iaFLsQTpK_EXo5281JPx4jnI,7985
src/detection-rules/rules/_deprecated/persistence_creation_of_kernel_module.toml,sha256=28DM-mMhCvG3RwE4aBN9tFNeFebjnkHlxwpCl1fkCgU,1562
src/detection-rules/rules/_deprecated/persistence_credential_access_modify_auth_module_or_config.toml,sha256=8qPbbDdQ3xZLMDVVha2djk1F9qEVnN9jLkTvBtwSOSY,7618
src/detection-rules/rules/_deprecated/persistence_cron_jobs_creation_and_runtime.toml,sha256=9NuZqZnlMzwYsrsHmFaCufJDQ_EvyjmFm1F0pV020zA,1948
src/detection-rules/rules/_deprecated/persistence_etc_file_creation.toml,sha256=aJuHvXlPf_fsjj4kyttJnRq8-7JJgBiZvnDU182TjCI,13625
src/detection-rules/rules/_deprecated/persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml,sha256=YHdUhvXuabDtrsacccM1Js8ZjkslHGFALmVMHwNc56A,3682
src/detection-rules/rules/_deprecated/persistence_kernel_module_activity.toml,sha256=NAumTSTdPVKKxNj_eawEiJj1O7NBc1BWsK95DlnIuuo,1570
src/detection-rules/rules/_deprecated/persistence_rds_cluster_creation.toml,sha256=qSHGYAesdQea2dCWfeBRM4xHwl-b-POpjWht64aO2no,6748
src/detection-rules/rules/_deprecated/persistence_rds_group_creation.toml,sha256=c2M-d7tBZpTZHitlXsObzTNhRlp3WuG2YQ0ojGNOvy0,6138
src/detection-rules/rules/_deprecated/persistence_rds_instance_creation.toml,sha256=V3Pf2qnZ4_JVdgIowqXUhcs39hZ5OxWuIhfDagZDdJ0,5917
src/detection-rules/rules/_deprecated/persistence_redshift_instance_creation.toml,sha256=F89f3HXUsjlkYCYx56zhlCgjybt78tEe28LKeNHAcoU,6164
src/detection-rules/rules/_deprecated/persistence_shell_activity_by_web_server.toml,sha256=1XiZc6_XUztm5qrZuHU01sEh6QAS9TGJ4-SDVR1Vkmo,4985
src/detection-rules/rules/_deprecated/persistence_web_server_sus_child_spawned.toml,sha256=d3LOCNIhCW4o3SpIVJ2CfOSYMH1aUkE0_M9K10mNnL8,13193
src/detection-rules/rules/_deprecated/persistence_web_server_sus_command_execution.toml,sha256=oYIHBX7v7dh6GvGFaS0ZIrghK3L-bxC16JUl2r8JX8I,12443
src/detection-rules/rules/_deprecated/persistence_web_server_sus_destination_port.toml,sha256=MVRMIA-NasK9q6oZng3gvYyiRxq0FkiYPeq4FunggOI,10108
src/detection-rules/rules/_deprecated/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml,sha256=FPINRz6iSlfk2sHVKA30AmwBavmIuhKHmxFxms6kFh0,1903
src/detection-rules/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml,sha256=z0OxMwyBUuyP95zI2UFyJTJbPG-DgFxGjLpRP6HWKro,2361
src/detection-rules/rules/_deprecated/privilege_escalation_linux_strace_activity.toml,sha256=jFqD1L6vukg2SZmd_9Dl7BOlyvneLEp73MLrn8sPjKQ,1505
src/detection-rules/rules/_deprecated/privilege_escalation_linux_uid_int_max_bug.toml,sha256=GhGncqe62MCvlD_he-9coa5ZC7Rk_IPmXMHw9bkTsFc,8113
src/detection-rules/rules/_deprecated/privilege_escalation_netcon_via_sudo_binary.toml,sha256=S4Wp681190UbtXAZRfuSVLtZeO9hz2HsdP_rdes23vU,8775
src/detection-rules/rules/_deprecated/privilege_escalation_printspooler_malicious_driver_file_changes.toml,sha256=lpOfEQ3OwDo_dF1nPSHEf8PZOfLsszfNrnDDIRoajHs,1608
src/detection-rules/rules/_deprecated/privilege_escalation_printspooler_malicious_registry_modification.toml,sha256=AlNF4rCdfNWp4xVMpUYEYHtYq1vGiWwb5-9VqY54qKI,1709
src/detection-rules/rules/_deprecated/privilege_escalation_root_login_without_mfa.toml,sha256=6kHzxusnxxfrjOoAVzHg0ar3eiQfLdnoc35nbxqQFjc,5377
src/detection-rules/rules/_deprecated/privilege_escalation_setgid_bit_set_via_chmod.toml,sha256=ByHDIGHwpb4ynYkU_6ZBQKW4Sn5nyPB6yLdtmPcojaE,1779
src/detection-rules/rules/_deprecated/privilege_escalation_sudo_buffer_overflow.toml,sha256=pjX7W3KL3ESCm9DBJMcGV4ekW2iVrMXQbzzG6gZKwVs,6845
src/detection-rules/rules/_deprecated/threat_intel_filebeat7x.toml,sha256=PgkZ1AHtQPmjxdB3aoq29HBkSf9Z3hesx-_1S2ptQas,6963
src/detection-rules/rules/_deprecated/threat_intel_filebeat8x.toml,sha256=P2To_aycPXS9uQVquiZWjQpl-XZGY4DUggWiyuwf3qQ,7564
src/detection-rules/rules/_deprecated/threat_intel_fleet_integrations.toml,sha256=apK4wtHuBhL5vRGdIiG5rYIVKca4gYicu3yPdEA9HdU,7588
src/detection-rules/rules/apm/apm_403_response_to_a_post.toml,sha256=ZIpSHsNs0SlFDVlHmZPQIPMXnPPCeMzrN7-o-a5k5r4,5258
src/detection-rules/rules/apm/apm_405_response_method_not_allowed.toml,sha256=2g1rszIMgvs0Zaf0WBQxJbW_yoqr2putP8tDyC7ZJV4,5248
src/detection-rules/rules/apm/apm_sqlmap_user_agent.toml,sha256=jmZAnk7gHPZLC8ZxxDhtE3pRhAszY5Oy3_RvgewE5xI,4897
src/detection-rules/rules/cross-platform/command_and_control_common_llm_endpoint.toml,sha256=CCyjB5GdrWH5X2S2WypalvFTECuKCFsuK2Q3l4wQL3c,9193
src/detection-rules/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml,sha256=5gGQcKxS_Jd__KgzdrboUWuAboUpFAhJkH-nOlIzeBA,8533
src/detection-rules/rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml,sha256=BJkGwmylXCaOE_IajW-hC_V5XydIpibj2OeSjFvqsy4,6143
src/detection-rules/rules/cross-platform/command_and_control_genai_process_unusual_domain.toml,sha256=0HbJnwKiOwSrg1d03_2fw8UbAFZB_Mo635sUqbVQIR0,7166
src/detection-rules/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml,sha256=fO7ABbWRe3Kq56hmNosflTgu9lzSZkdDM_1YxzLuXas,6610
src/detection-rules/rules/cross-platform/command_and_control_kubectl_networking_modification.toml,sha256=r_FE38DjCNuwgqFSU30dOVhy1i60MlMVmrxZ20x7Nx8,8686
src/detection-rules/rules/cross-platform/command_and_control_pan_elastic_defend_c2.toml,sha256=aWOgkadcvJ8oiy19J5xTHvF_viiAq5hK_664x5fYark,3202
src/detection-rules/rules/cross-platform/command_and_control_socks_fortigate_endpoint.toml,sha256=sSQ8Zl9ExQKpxFL_ALPmWr_EaUrbL3HXin7hgvoJH-c,3518
src/detection-rules/rules/cross-platform/command_and_control_suricata_elastic_defend_c2.toml,sha256=m96DOWEJoTciQ7aPCmuwz5eoMoMKlCt9b8ZAvvkfI9s,4133
src/detection-rules/rules/cross-platform/command_and_control_tunnel_qemu.toml,sha256=Z1GHUTsUdvED2HPytSJhye2R7tzi3S8pKv23bGCur44,4829
src/detection-rules/rules/cross-platform/command_and_control_uncommon_dns_request_via_bun_or_nodejs.toml,sha256=kYNqzsbxX5b_GMyO7_kpQvYwoR09_sPxUBiqPR10WMI,6507
src/detection-rules/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml,sha256=wo0aI10tqeIBUOhqFjh0pIfjx21t41haiEXlt6BheZ0,6875
src/detection-rules/rules/cross-platform/credential_access_forced_authentication_pipes.toml,sha256=IHaB480daLcQF6SdhYVjgnUlD_j1oYeY4WhBg9htTRw,6553
src/detection-rules/rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml,sha256=C-UuKNnwQxiD4fMtow3a4FlvOeibxmLoOz1W5q098l8,7286
src/detection-rules/rules/cross-platform/credential_access_gitleaks_execution.toml,sha256=NPQ8oLQwInRoz2Uu5wM7MDZ23PCRnoCGZy6dF5yZvV0,7367
src/detection-rules/rules/cross-platform/credential_access_grep_recursive_credential_discovery.toml,sha256=YCiY0BN7YUGH5uK6-Ftj8ys2XtKSP0sncEjVPPYjM7U,5582
src/detection-rules/rules/cross-platform/credential_access_multi_cloud_cli_token_harvesting.toml,sha256=ig9fUsgpNGKQgfL0A6CHrMWQNuLe191GRUrBCpPlReU,7024
src/detection-rules/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml,sha256=-Mhgdtoct3L-fCg62SNH65HnSH0IOdexZfSnqSPx3v4,10004
src/detection-rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_cli.toml,sha256=voBeeXxmzh0ochwKie5w10Os8cRMW3gRVSXz4c8KrEI,8407
src/detection-rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_request.toml,sha256=hT8xHU0yYZ4qmsOmSqFfs5TMnbdmMHdfWsNP7RMwgCk,8863
src/detection-rules/rules/cross-platform/credential_access_trufflehog_execution.toml,sha256=tTYEuQ0-6EDv6OGkW3xdwd-d6ye8uajbzJwuIRZ4d94,7353
src/detection-rules/rules/cross-platform/credential_access_web_server_cloud_imds_ssrf_request.toml,sha256=V1TClEEzs1iBFwH8W_rQqG_LNh07Fec0O8xJhJA2_4s,6047
src/detection-rules/rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts.toml,sha256=SVOT6TSzWrzGmRksFyBM2kuJl59AoxhfLFIxCgpHyGQ,5898
src/detection-rules/rules/cross-platform/defense_evasion_data_encrypted_via_openssl.toml,sha256=AFlm1h544HMOhRS363gso7rL_oG9AmXtTTQVzmpnbHE,7004
src/detection-rules/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml,sha256=8Wi7CAR7gPQQcLwZUfPtbVg4Q4Px2DrwvQTXfgtp4s8,5866
src/detection-rules/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml,sha256=De4DUjB7zTVkWe5h4cYK07CS6aToewInfpocrv-VGMc,7277
src/detection-rules/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml,sha256=J7taEqnfwlCloFVvnQA18UW1d0XRT4_19c9cNEOeqoo,8095
src/detection-rules/rules/cross-platform/defense_evasion_encoding_rot13_python_script.toml,sha256=ZCaQIe93HwSuFJdxYzM7yzvGrCw-mq5sJYX-Lj6PcLc,6367
src/detection-rules/rules/cross-platform/defense_evasion_genai_cli_unsafe_permission_bypass.toml,sha256=YGqmYEsWsqzNQHCwn3_nZZR-pr5xTxowZa6L6io3bMU,5999
src/detection-rules/rules/cross-platform/defense_evasion_genai_config_modification.toml,sha256=svA1Zct2E90HNiPL1eWx7wU0iOwjYv4GT7n0fT8e44w,7480
src/detection-rules/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml,sha256=kFDrJp2SfDPwTg4rKDkC6K_OOjF3clRRDJN-t5HOCRM,6789
src/detection-rules/rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml,sha256=wfO0kUK8J-2Kv9Lpr3BH-2iZwXsZ24c_TcZGaNBh6kQ,8224
src/detection-rules/rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line.toml,sha256=5bdLvyJY4sJh3DSLS7VemyvoS-g7Knk-NEnCwXWVi64,5909
src/detection-rules/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml,sha256=4fqv38mtk0GER1JNqEHwxTpoV3kD7OOmQDTlSvSJGzw,6993
src/detection-rules/rules/cross-platform/defense_evasion_missing_events_after_alert.toml,sha256=59JIs2qtvKoLsjsbQIeeKqGK2Ihr2aULXAN1vRauT5A,4065
src/detection-rules/rules/cross-platform/defense_evasion_potential_http_downgrade_attack.toml,sha256=2gIFddg1wIsXwkFbjRMziwA6GpuD0mJf7upxFI-dBHQ,5785
src/detection-rules/rules/cross-platform/defense_evasion_potential_kubectl_impersonation.toml,sha256=R_6RjkUvXflYawfUD3S-L_WiVHRR7Lbf7HmsvvlxKlQ,10303
src/detection-rules/rules/cross-platform/defense_evasion_potential_kubectl_masquerading.toml,sha256=dLBh2gpIlaUaTZb7b40SKsv_E8fvEBNAXSQRnEBRuPA,10620
src/detection-rules/rules/cross-platform/defense_evasion_processes_with_trailing_spaces.toml,sha256=F9yoWyZ4WkYWK3LpUlzcPeuVurt1zkJp-Dus2S9ph2Y,5556
src/detection-rules/rules/cross-platform/defense_evasion_timestomp_touch.toml,sha256=bGrH6kwXC0lrRh-ciWAxTWgc_iu9QDnwqvGnLGFFo9U,8128
src/detection-rules/rules/cross-platform/defense_evasion_whitespace_padding_command_line.toml,sha256=GkGoUYHXsuaMC5hAe0nrRY2CSsJ9P44eQV06EHjrm00,5841
src/detection-rules/rules/cross-platform/discovery_kubectl_permission_discovery.toml,sha256=__-aAN9yUT0thn5cj20hVPhs-7xhormKaZmtN3tfd8s,8233
src/detection-rules/rules/cross-platform/discovery_kubectl_secrets_all_namespaces.toml,sha256=EuDfCgNMmyYdV_imuX_cNkH14TDTibCjNT6-1k1kHMY,8223
src/detection-rules/rules/cross-platform/discovery_security_software_grep.toml,sha256=nq6x0zUvg2hJJzuV1u9YQDc6TNvS-uWAzOjpztXOIeU,6373
src/detection-rules/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml,sha256=b0YO0wh5V2h5zeCCC1Omt329ll9L_1q9CzLXjQ0wAxQ,6643
src/detection-rules/rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml,sha256=AsVv7FnW0YZxNwH9RLwjqDnaipmmAb-o6VNOT0GwXUQ,11568
src/detection-rules/rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml,sha256=Qq_uJx9duL9fLgLpfF-wTQ-nVxQbQ1c-YhZNS2efQ1Y,8020
src/detection-rules/rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml,sha256=py6wxOU9ZC1x5XS_woHU-v24g3vgfLbieUYUBHP2was,12409
src/detection-rules/rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml,sha256=iYKEqcUgBDg9Q7Oo2wdHTj1ttSDUjy5UMYNlxXDw8ME,9834
src/detection-rules/rules/cross-platform/execution_aws_ssm_session_manager_child_process.toml,sha256=H_-T0Ill_kQvFeLGe2owXEtVd2ucZxpvHxADc2Gj-Fk,6437
src/detection-rules/rules/cross-platform/execution_azure_run_command_script_child_process.toml,sha256=-3K9vuIc76EjhZYZF0yxWiEKnshW6_hQOjhokDas93w,4147
src/detection-rules/rules/cross-platform/execution_azure_vm_run_command_powershell_unrestricted_script.toml,sha256=kmSTCMN2gW95_xuhnTicSCDgddIGO0TBRgYbJ4WUXK8,5893
src/detection-rules/rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml,sha256=3o8gstJR-L3JR20XH55kmaGKh86ThwfGtFJ4vGU5uxg,8492
src/detection-rules/rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml,sha256=SwIm9SB11N0UFFYAhbZe2jrJqas6BNSgCvA4wtgJUrw,9199
src/detection-rules/rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml,sha256=Oia7NMzfF0fc0oS9SEol5obwsutsu8S3ZOhG-ceH17E,10410
src/detection-rules/rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml,sha256=kHZgVcfL_p6iHMR0N4h_lnHWUXtvFKcUi85joNIqh0k,8395
src/detection-rules/rules/cross-platform/execution_git_exploit_cve_2025_48384.toml,sha256=q71hZzIqWKCuK0QdK5ZqXcnbDHfLOraJ_p2J2KW8Q4o,7200
src/detection-rules/rules/cross-platform/execution_kubernetes_direct_api_request_via_curl_or_wget.toml,sha256=1jgyz72XWXw3EtgaHz7LcVV2-n2yauQWhfJGp3Bfi0Q,10225
src/detection-rules/rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml,sha256=OvTso0f0O8wNbE1oFoen_oQ-I7UMGtMrvdrdphyayv0,5864
src/detection-rules/rules/cross-platform/execution_openclaw_agent_child_process.toml,sha256=k_dlfSBndEUgFU612_1jpFMxf-CGWd5_ELc6U7Z7aBg,6205
src/detection-rules/rules/cross-platform/execution_potential_widespread_malware_infection.toml,sha256=oi_7e1y0axyH7TUHobRHu4Xnfr-n4yuyM_dxx98vOqE,6100
src/detection-rules/rules/cross-platform/execution_privileged_container_creation_with_host_reference.toml,sha256=k67Kv7QJc0lAZ7I6uKGIOn0u8qTe3Y1b_Yi70wjU4ro,9264
src/detection-rules/rules/cross-platform/execution_register_github_actions_runner.toml,sha256=lHDCgd7gZa2KU8NUFR5urSz-mkLlmooqK3gavKsdjls,4950
src/detection-rules/rules/cross-platform/execution_revershell_via_shell_cmd.toml,sha256=YjXwIctk_ccFZElwYzHrzTNs9tdHbqGADJpli_G0RsI,5350
src/detection-rules/rules/cross-platform/execution_sap_netweaver_jsp_webshell.toml,sha256=QimJtaWk7lhSUzDK-EH2OxLDz8Sp4ElZvzhb_e593IQ,4329
src/detection-rules/rules/cross-platform/execution_sap_netweaver_webshell_exec.toml,sha256=DoxGudZI7-8_Fov9TBc_PGtXkqCBtnwrj_UuPZ_EHt0,5617
src/detection-rules/rules/cross-platform/execution_suspicious_java_netcon_childproc.toml,sha256=4hFTs0A7vzXhSMpp6JufvvtKJizsWVBYhWToTONpqCc,7607
src/detection-rules/rules/cross-platform/execution_suspicious_python_command_execution.toml,sha256=AWKVS2E5j2lQvhwfpb0lzUKJ9HypsECJdyk7883fEOI,8034
src/detection-rules/rules/cross-platform/execution_via_github_actions_runner.toml,sha256=2Ddrgwc-Up4gzXl1rFy1GNMjEcJH3lEiLst0fVR0HWk,10593
src/detection-rules/rules/cross-platform/execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml,sha256=qBL20aXAloUb4p3f9o1PdPyoOG_8O5oM_1ZFq94_byE,10259
src/detection-rules/rules/cross-platform/exfiltration_potential_curl_data_exfiltration.toml,sha256=feNKaOrfdc9F8D3CdSdfPeGTdUk9TQtKJsggwT0DxUY,10233
src/detection-rules/rules/cross-platform/guided_onboarding_sample_rule.toml,sha256=p1GJtIMLs7uK8ueRMlMk5OP-sjUstczOGzDeo-nXdpU,4364
src/detection-rules/rules/cross-platform/impact_alert_from_a_process_with_cpu_spike.toml,sha256=ng0oo3xzNtfl18ORZOHnbIdaksiGnm6vhDQMbO_C0DM,6738
src/detection-rules/rules/cross-platform/impact_alerts_on_host_with_cpu_spike.toml,sha256=L0WrE7ikdEPcg5T2tSxZf-FfBlEKEgCjRNSE8ZKqPPg,6511
src/detection-rules/rules/cross-platform/impact_hosts_file_modified.toml,sha256=8xy0zjoIViN181WV8r50mVgWQx61MpdUjdFPt5PCq0k,7990
src/detection-rules/rules/cross-platform/impact_newly_observed_process_with_high_cpu.toml,sha256=nbySkMW6xnEvG9Ra8NrmNyjDxI_81mBfBpShADoaEHk,6120
src/detection-rules/rules/cross-platform/initial_access_azure_o365_with_network_alert.toml,sha256=BUEvaOERar9QgrOBY4LCTJ-rYWmkxJ9MhrHe6GRZJ0Y,6790
src/detection-rules/rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml,sha256=UUENe1JrdcnKJ3SY9O0ldpJcukz-dyXiu8MJHdyB_9o,5528
src/detection-rules/rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml,sha256=si3dtP88nKqqtTus7wrr5P9ma9q-3FGbzQKMkMvwv9E,5769
src/detection-rules/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml,sha256=TwfVY-cHWzNVx6P-cpc3Dk_r0ennmITJ7DPX0lapT58,10645
src/detection-rules/rules/cross-platform/initial_access_exfiltration_new_usb_device_mounted.toml,sha256=pDpUcoB-Twuqi5PdWXuS5NU7fqPnAWnUpKIJ-qwWaH4,6395
src/detection-rules/rules/cross-platform/initial_access_file_upload_followed_by_get_request.toml,sha256=k_bcRIKWdp7-BZFR9LdG-RKaA9iFr4d6yUlbwUxQTho,9168
src/detection-rules/rules/cross-platform/initial_access_fortigate_ssl_vpn_login_followed_by_siem_alert.toml,sha256=NLfPi6QLeFPetZ12eL2KDvvRDDt7z4cwQwMi3O6LzJU,3209
src/detection-rules/rules/cross-platform/initial_access_ollama_api_external_access.toml,sha256=DVvTm4caDbMMAWVkT20gnkoOXc3i9uL5jn2PEChocx8,3656
src/detection-rules/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml,sha256=XggllsAQMMxql-j5I92rfE9HtWl4HlFTs5AKbI0U0kI,6029
src/detection-rules/rules/cross-platform/lateral_movement_multi_alerts_new_srcip.toml,sha256=zU4YTDc1gqCLJo_xJQmmPkYE9Dihdh2skt3N1g2PS14,5123
src/detection-rules/rules/cross-platform/lateral_movement_multi_alerts_new_userid.toml,sha256=TbE0C4ciAfbSRLOvFC1pIBJMbH494kwxZ8kewcWQ3Lg,4391
src/detection-rules/rules/cross-platform/multiple_alerts_by_host_ip_and_source_ip.toml,sha256=H1RCi6kSmmKAgkh4A-9_UH4Mv_ugTetTFIWajD3Iw_o,6378
src/detection-rules/rules/cross-platform/multiple_alerts_different_tactics_host.toml,sha256=_XrvZq6uZZgan28biJm9vGHB_23_MuW1V-pVIAvfAwY,5046
src/detection-rules/rules/cross-platform/multiple_alerts_edr_elastic_defend_by_host.toml,sha256=st7y6zZTVom0_tbTjVFe6RCYc8Vw9DTuUWVfwAHkzuI,6452
src/detection-rules/rules/cross-platform/multiple_alerts_edr_elastic_same_process_tree.toml,sha256=Xxc3Uib6dFHdjzDtPmTvbQ_hw70wFmCXtAxD4Hbw1AE,6086
src/detection-rules/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml,sha256=-AwCunV1kdFigGHU4HrdAwG5-sTc18QlbZ8cccSX0As,7576
src/detection-rules/rules/cross-platform/multiple_alerts_email_elastic_defend_correlation.toml,sha256=hMSCy2YaDUOaPDPJF8Jx7U56fA9dgDI3qx5hVP4oUvU,4357
src/detection-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_dstip.toml,sha256=g1ZXbL3FMYMFbEOR3FhpvdDnhpkjS7VtA7rOsm-at24,5978
src/detection-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_srcip.toml,sha256=fF5HCLsDBJnXP-VOW8YkL-ZN3ACZi_SnCY5zgLfhwmc,5893
src/detection-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_user.toml,sha256=KxWshFpT9S65iBjtEI4f8oe-Rmf3DpuxWK9lZCIshfs,6748
src/detection-rules/rules/cross-platform/multiple_alerts_involving_user.toml,sha256=B7TTQQha0y1zlehzZ8xoN9UBawb2vnFlOKkufK6BVpU,6521
src/detection-rules/rules/cross-platform/multiple_alerts_llm_attack_chain_triage_by_host.toml,sha256=Vk2BA8peNKKWo5V5xhDXMRIdrHnM9URS8tLNCzk1xW4,10142
src/detection-rules/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml,sha256=aRhs5KbD52i0Qwdb7KLv-dtZ4GnMA2EBQQcUcpC_tJ4,7034
src/detection-rules/rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml,sha256=VbMxgxgQ2jI7092qAhy5gxCP9ETovMgWPEfU3h6ysXw,9937
src/detection-rules/rules/cross-platform/multiple_alerts_risky_host_esql.toml,sha256=kImJRQhepfDXQPWucL4OmhtdZUkPPOYKnE-kFRm6-4Y,7148
src/detection-rules/rules/cross-platform/multiple_alerts_same_tactic_by_host.toml,sha256=IAxWOaGfjDCxfMWk_E_R4lEC0_XyabtI9uKzUhDE-PM,6661
src/detection-rules/rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml,sha256=liG45DXuiDCGkJeul-wjPNjvphsXDw-NIWKn6KAyhDE,4860
src/detection-rules/rules/cross-platform/multiple_external_edr_alerts_by_host.toml,sha256=B67h9RoXz5t_d4ELr_O99PoWWRYPRoo3jsC0GpMeWjA,6796
src/detection-rules/rules/cross-platform/multiple_machine_learning_jobs_by_entity.toml,sha256=Lq1XD6rHIiTp97UE2DFmPPPsZTTOQpQBm_H1m_tXFu4,5409
src/detection-rules/rules/cross-platform/multiple_vulnerabilities_wiz_by_container.toml,sha256=F2id3uMv47oBI5gQnfksT91HbagRggIDbKjs_rJhx88,5030
src/detection-rules/rules/cross-platform/newly_observed_elastic_defend_alert.toml,sha256=68sekizJQ8awiD7-dppr3u9tR4SUiQok7si0pjLvzdI,5114
src/detection-rules/rules/cross-platform/newly_observed_elastic_detection_rule.toml,sha256=WAPiu7GFcQC_IeDCzJ2SxlDuy2mvrm6sNlra5-F44tI,4688
src/detection-rules/rules/cross-platform/newly_observed_fortigate_alert.toml,sha256=Seay10XExqKDj1RadkB6vKbvAHj9VxfMaIMlPhrM7dM,4167
src/detection-rules/rules/cross-platform/newly_observed_panos_alert.toml,sha256=6VQxAHS5M4nMtcFzGRc7EsCJ3ploUUvKHtHZqZgW6vk,3711
src/detection-rules/rules/cross-platform/newly_observed_suricata_alert.toml,sha256=H1frY0PejGIxsADaSShjoE3cHKGGupZLPf8cPx1SG20,3747
src/detection-rules/rules/cross-platform/persistence_shell_profile_modification.toml,sha256=uuE36YDPmpzwIJJNK_SpWik8iyVW2uEZhpng03HqRxM,6274
src/detection-rules/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml,sha256=FJhP1g6eo2-jIGFJ0Zc-JzAAAKnUjMRe4w-2l37A6dM,6945
src/detection-rules/rules/cross-platform/persistence_web_server_potential_command_injection.toml,sha256=pKQ0LoKEqyvjvSmwGG1_rdxcebeMnX0TOOXHU34ET0c,15152
src/detection-rules/rules/cross-platform/persistence_web_server_potential_sql_injection.toml,sha256=h1uWHeCBrlJyzJQ9nD9r5ieo8IKNwdai5E0qncBF4W4,11907
src/detection-rules/rules/cross-platform/privilege_escalation_echo_nopasswd_sudoers.toml,sha256=l621B13BoUyxdsfPptRYzlt-IgF4Cc-bSkVVp784zAQ,6243
src/detection-rules/rules/cross-platform/privilege_escalation_setuid_setgid_bit_set_via_chmod.toml,sha256=oGx2rpzOQ73GE_eH3p6y-6glWHKmrwhzAyW0GENYgqE,7227
src/detection-rules/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml,sha256=XeggWnPIGsG28Wm2cF9DgMuhM75yblP4w4R6OGvRm84,6476
src/detection-rules/rules/cross-platform/privilege_escalation_trap_execution.toml,sha256=u2hccCDDPhCx35bQBQxtSGS379vi6kDd-KCLnbdAhZA,5875
src/detection-rules/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml,sha256=DcmcruQNJ1I7z-jdZ5m-TKZ5qpdnJrwjWs1QAXM4GRk,6812
src/detection-rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml,sha256=nZwRbzKU4I0C90xsfJ8CmUavo_QOMQ9Mp8vwxzngVaM,6339
src/detection-rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml,sha256=VaLX5bsp9Gn6Jt3K9Cj69z68bTxNsGfylAuGkObmR8s,6958
src/detection-rules/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml,sha256=lIrK-hi6qPS7_dxShECvVHOs3_qe7I7M-bJq9OCAGPY,9369
src/detection-rules/rules/integrations/aws/NOTICE.txt,sha256=J_TLlzy-3FynutCsreov6dyNdxzN0cayBHv4dv9HzbU,1307
src/detection-rules/rules/integrations/aws/collection_cloudtrail_logging_created.toml,sha256=j_wLY65KiHsCuxH0dZzwaRT8QV0TqYjZ4Zz7i7sWFzw,5446
src/detection-rules/rules/integrations/aws/collection_s3_unauthenticated_bucket_access_by_rare_source.toml,sha256=ivikeNaXaQF8rUH0OXZXDJ32qMULpDgqvowVid3k-zw,7865
src/detection-rules/rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml,sha256=tS2qv8pOMxDGjFgVbmlKfR4Os7YWndLjpSYeMcpmDeA,6419
src/detection-rules/rules/integrations/aws/credential_access_cognito_unauthenticated_identity_pool_credentials_issued.toml,sha256=kUkDzhHbNd2emn3eAQQWLj9-yOJG3sYF8ia2hOFstAI,8050
src/detection-rules/rules/integrations/aws/credential_access_credentials_in_s3_bucket.toml,sha256=wD3EgdmXer1C430N0RYfoEfIdzroUidf-keOvuBLcmo,6114
src/detection-rules/rules/integrations/aws/credential_access_iam_compromisedkeyquarantine_policy_attached_to_user.toml,sha256=YS0EWGdbq8QikcirJdgqN040uhB_qdrXOt5ubpjVDRU,5293
src/detection-rules/rules/integrations/aws/credential_access_iam_long_term_access_key_correlated_with_elevated_detection_alerts.toml,sha256=CmWTGrks2_Jo6rS0cHtIHU0WhrJ-7HfbyOlBgpxkJrg,7329
src/detection-rules/rules/integrations/aws/credential_access_iam_long_term_access_key_first_seen_from_source_ip.toml,sha256=EPeLx5N6Rc3ph6QQYqhcMRJ0U9673ET5YoDSqlpWqFE,5495
src/detection-rules/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml,sha256=b8lRv0QrBJFSc4cPEwoFpSNiK2VxvIQXcCRtGQW9si0,5934
src/detection-rules/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml,sha256=wfXpKJP-BqF7HxBQxeQPjnPfHwu_3hUSOcakbUq3_iM,7733
src/detection-rules/rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml,sha256=0xha3CXAvaHabsBL71h9mFnNwUBU2El740AM7Hktlys,7265
src/detection-rules/rules/integrations/aws/credential_access_retrieve_secure_string_parameters_via_ssm.toml,sha256=fuZsXN7_dImMkMfYrieVDe2es--u-OurXEecKyDZrwM,7595
src/detection-rules/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml,sha256=7HmaupMyDs4KIJLNdcLlrpwp_4-qrzKjkPD0OGhI9tQ,8130
src/detection-rules/rules/integrations/aws/defense_evasion_bedrock_automated_reasoning_safety_policy_tampering.toml,sha256=GwR-7B9oE9lbJvS812IkwYVMdf16xjUF_goiykgHe-c,6125
src/detection-rules/rules/integrations/aws/defense_evasion_bedrock_guardrail_deleted_or_weakened.toml,sha256=MilEdfeASZULJsTM92ZVBHYZ2U1BQUQCyj6EcoWWrPo,5456
src/detection-rules/rules/integrations/aws/defense_evasion_bedrock_model_invocation_logging_disabled_or_modified.toml,sha256=em1_qvIijXHZ56fCeOGAn8AU2e7crFsWbzSok7AwsGk,6173
src/detection-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml,sha256=d0cn56m_aEtkqnfxZtawpNX24FlPXYl7cCXltp5OvrE,4829
src/detection-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_evasion.toml,sha256=WLit7CU1UizxIRcIMxxkTIeDj1g1DXzf28tc5Tx5BlE,7459
src/detection-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml,sha256=GAqdBgAgyjiMdrO3E3X0QeIWRBLwU_yhp-TEeOvEYoo,4770
src/detection-rules/rules/integrations/aws/defense_evasion_cloudtrail_management_events_disabled_via_eventselectors.toml,sha256=mN-L9uTYogmB2rg6lijD1zJxJx8eS9QNsH_Q6toUqnk,5669
src/detection-rules/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml,sha256=SjxDY1nhVvBSNTEhi5hgdWcXrj7TTTleKnnN_DxSl8Q,8373
src/detection-rules/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml,sha256=tDeBPsRvfmIDKwbkZ3PFOvhHDPqvEn222n1d38xhwOo,7672
src/detection-rules/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml,sha256=rouwDL2w3iRuYUXnU9z1UIQ9rRYHNjxPivDkxZlygCY,6592
src/detection-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml,sha256=P-LLl0NdyvwLolPzfKeJDFp077vqN2m2FSYhtF3NEmE,6279
src/detection-rules/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml,sha256=geqvNgy-0-yMcihY8AAkVbReg7JZgwE1NSXKZNvVlVY,6539
src/detection-rules/rules/integrations/aws/defense_evasion_ec2_serial_console_access_enabled.toml,sha256=1BWYbGlCi8NfK9BWh5ZIC-iTFWOdNZXCqbRuVZ9ghDA,7236
src/detection-rules/rules/integrations/aws/defense_evasion_eks_control_plane_logging_disabled.toml,sha256=jtnrU7TcdydsXr-84bXE1SkRgyX_e-WlNdT7WVW2zPg,3642
src/detection-rules/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml,sha256=9_gD06UG_dSTbHyID4mY4PTIzEpOUT5AVm52CbkrB14,7011
src/detection-rules/rules/integrations/aws/defense_evasion_guardduty_finding_suppression.toml,sha256=fUfXmJOR6e7rUHsVbwC4JTWtbltewJMI45m6O10lCfY,6423
src/detection-rules/rules/integrations/aws/defense_evasion_guardduty_member_manipulation.toml,sha256=mNqMGe5_rPiSrBhFZIRj3kZJlFxQwnsXKb0ts5QZNd4,7528
src/detection-rules/rules/integrations/aws/defense_evasion_iam_account_password_policy_deleted.toml,sha256=beBoG6RQWa4SejMn_1Z0bhU9gDxeVwGkF9SQmfktCAE,5236
src/detection-rules/rules/integrations/aws/defense_evasion_organizations_leave_organization.toml,sha256=HcmFWMoCEz8GTt64izJR5JatavzCf-hJqH2dm3RvPeM,6177
src/detection-rules/rules/integrations/aws/defense_evasion_rds_instance_restored.toml,sha256=AHNgveBT4_QWXdwekRTj-2G5HjwcOzkxx4g7RyzDVTQ,9413
src/detection-rules/rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml,sha256=tdV06e18f9xMBjvWuN-5RxLLU3f8QmU2bWh0DMsGKT4,7331
src/detection-rules/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml,sha256=6DhOiPSOG6D0gDfxnkQjqRdWwPVt8x_GfMO-Q-M6y6I,9126
src/detection-rules/rules/integrations/aws/defense_evasion_s3_bucket_lifecycle_expiration_added.toml,sha256=-W_y6OJ4M1YpWRQbV9NNEJvSmbEhcPdIC5kArYuqdwI,9125
src/detection-rules/rules/integrations/aws/defense_evasion_s3_bucket_server_access_logging_disabled.toml,sha256=C1Qy1Ei-EV-tP0OWtn8ICNKkgK-lJEHZf7nWguzxVLc,7370
src/detection-rules/rules/integrations/aws/defense_evasion_sqs_purge_queue.toml,sha256=QNS4mCDvwijLIoMd71S0ZTllQL-yjbz2OW9NKVQ1YFw,6209
src/detection-rules/rules/integrations/aws/defense_evasion_sts_get_federation_token.toml,sha256=G2PCY6Sdxr1Mc9Ov-M46cb6O713T56QyRfMFMIIfVBI,7028
src/detection-rules/rules/integrations/aws/defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections.toml,sha256=gHzcjsS9O9k14iIYGy6kCvmtlnGkTviQ5dKw-kA__H0,6750
src/detection-rules/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml,sha256=3BPT8BJAlb-fPnO6gwiNdANv34iv08GLb0naY9ZMX_w,8592
src/detection-rules/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml,sha256=V2ztYdPjr-lImcjaSSCSAc7GqyIQgeB_-uG-1pvA1s0,7779
src/detection-rules/rules/integrations/aws/discovery_bedrock_model_recon_and_invocation_via_long_term_key.toml,sha256=ggZiabj5rFIAnpGYiQdxy_OtmUL8l0-5hUuyWbDtPx8,6422
src/detection-rules/rules/integrations/aws/discovery_ec2_deprecated_ami_discovery.toml,sha256=Dk2HNuspzCD_Uv2EtjAdG6JMTnGUimP2CcsoLV7L_L0,6078
src/detection-rules/rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml,sha256=qaSWa1zolFE4WO4x7fq55YVzZ9JXGS9Arj9lqiOafuo,7137
src/detection-rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy.toml,sha256=KFHKrajg8AtM7o8xauYfdBmgjrJDqA64s2hNwKgtnow,8328
src/detection-rules/rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml,sha256=6Q4dfuUyYSvGPHWtlUuLKebJe9Mne0OMvRlhIfMnwzQ,12796
src/detection-rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity.toml,sha256=b7yIHFHjTftXtJ2758SzQxksBVeEmryJixS6mgbRO8k,7286
src/detection-rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity_ec2_role_new_source_as.toml,sha256=uBy8sL76NxZJ0WlJ8wKGN9eugTj-g5YYiqVJx4eCBYU,5514
src/detection-rules/rules/integrations/aws/discovery_new_terms_vpn_asn_discovery_api_calls.toml,sha256=wD40n13RjBtDWJfoqq9571yM9PSkrJJP6x2QwtZSpOA,9564
src/detection-rules/rules/integrations/aws/discovery_organization_discovery_by_rare_user.toml,sha256=GiHxaXbppNWdLQYB1JwNsgLlgbCTWeXVZymkuV_0B6I,5639
src/detection-rules/rules/integrations/aws/discovery_s3_rapid_bucket_posture_api_calls.toml,sha256=YafQAKJvWzh5_jeSOx7-ZpByLlZ6Cm8C71KW1seXTDY,10454
src/detection-rules/rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml,sha256=sLo_OovZJGHq5y5ICOifjj5YM3tMNE0fLBaMpqodVck,9462
src/detection-rules/rules/integrations/aws/discovery_ssm_inventory_reconnaissance.toml,sha256=qAn1dKDyD2-xnMNnPDU_Ran6a7y8mRRDZ1ySstVt6TI,7107
src/detection-rules/rules/integrations/aws/execution_cloudshell_environment_created.toml,sha256=Hs-ijh-qnGbuvgCVJKdmjL71I6b_U6JfpggE8KGJeU0,6439
src/detection-rules/rules/integrations/aws/execution_ec2_stop_start_with_user_data_modification.toml,sha256=vJRu3R645_DWOgVkDa1xqgvt-RU1mgYbaEa4u65e7WU,7670
src/detection-rules/rules/integrations/aws/execution_lambda_external_layer_added_to_function.toml,sha256=efomy-ZHuOFpBJWEqqle5wQRaNbFTEUXRmEgljSg9PI,6685
src/detection-rules/rules/integrations/aws/execution_lambda_function_invoked_by_unusual_principal.toml,sha256=uyrrO8M30leFAkxx6jNMGf7lfs1rszzkq9vZ_0Kj3BA,5806
src/detection-rules/rules/integrations/aws/execution_lambda_function_invoked_cross_account.toml,sha256=uB8I0J1DmTYYIwuX7EwNuUFV1syCfaeWktjHTCZ6uT4,5946
src/detection-rules/rules/integrations/aws/execution_lambda_function_invoked_from_unusual_source_asn.toml,sha256=KFhgroyzR-XEODXJjJAlOxOB_CVXprb0j0I9sz9CX5A,5660
src/detection-rules/rules/integrations/aws/execution_lambda_layer_shared_externally.toml,sha256=dCX3AWttmruEUnaUBsBNrYxPM-0Kqp7Lbuk10CuCwy0,5809
src/detection-rules/rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml,sha256=fzJn6DKaO3BYHC1k02A0U-ST0niph_U5B5e25wcRChI,6438
src/detection-rules/rules/integrations/aws/execution_ssm_command_document_created_by_rare_user.toml,sha256=yXo0HjGGqODP0BJ0pRoxGvkXaMI3BsPAP1skMf6HiZc,6219
src/detection-rules/rules/integrations/aws/execution_ssm_sendcommand_by_rare_user.toml,sha256=jOmxL0_rhf0Ylh_mUz0izxrpnFWysyNUFNJqhs94CP8,7467
src/detection-rules/rules/integrations/aws/exfiltration_bedrock_high_frequency_inference_api_probing.toml,sha256=0Y2gCjEpClSy3PMYkPG1NVb_Sp30NN7E_s_NkNQtt8o,7551
src/detection-rules/rules/integrations/aws/exfiltration_dynamodb_scan_by_unusual_user.toml,sha256=QSwcWS02y3mmOHAbzDR8s1hpk23d0M81R_QRto2U90s,6712
src/detection-rules/rules/integrations/aws/exfiltration_dynamodb_table_exported_to_s3.toml,sha256=cLMVGlRi-iMTTuqhlf_v4WsA4lbYENAmaAwOGMalyVU,6398
src/detection-rules/rules/integrations/aws/exfiltration_ec2_ami_shared_with_separate_account.toml,sha256=IyfuFJL9O0M40Ct4gzPcQdJqR_9iAhNyH2Gphco1lgE,6552
src/detection-rules/rules/integrations/aws/exfiltration_ec2_ebs_snapshot_shared_with_another_account.toml,sha256=wlp-4vcbSWlfChoApLvY6X5-PWa4rod5eSxglyxRHvI,8877
src/detection-rules/rules/integrations/aws/exfiltration_ec2_export_task.toml,sha256=isARDP538JnkP1OzcktJdrwaOEWH-P1BGwtbcnrW3nQ,7167
src/detection-rules/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml,sha256=cbBAOti6CuUGp5f_gTF7qDJ9eideF0w3lto5Fi1asow,8330
src/detection-rules/rules/integrations/aws/exfiltration_ecr_repository_policy_granted_public_access.toml,sha256=2ZN75Qnw531pfs4kk_tM2J-zLumLVPUBsyKq7GHxB-c,5498
src/detection-rules/rules/integrations/aws/exfiltration_rds_snapshot_export.toml,sha256=hQ7hz5Gs9FH3jSjxYXWj5R_JRkxXv4pECX_Tidr6Zn0,8324
src/detection-rules/rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account.toml,sha256=PGR4uulgzOjB2OZu2S0JtHCRQUwMePAm6moHPdx9h40,7993
src/detection-rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access.toml,sha256=25k7ur2Ltrws3oA2yVRxgcawGjKmWfl5QpQGzkUiWME,9953
src/detection-rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_public_access.toml,sha256=vzKB5ezvrey4RstnmJq7Anqv3QYgyoQLl9njCtyWXB8,8667
src/detection-rules/rules/integrations/aws/exfiltration_s3_bucket_replicated_to_external_account.toml,sha256=GCgMIy40Q3dJf2LqbN49_3GC7i3XMYTz-VebirlHVZk,8430
src/detection-rules/rules/integrations/aws/exfiltration_s3_uncommon_client_user_agent.toml,sha256=AMOgUkscaRS44r14n8pDwJIEDOqCEIS5Y4MXrxyBBrE,7310
src/detection-rules/rules/integrations/aws/exfiltration_sns_rare_protocol_subscription_by_user.toml,sha256=WwO3G0f4-lUm0QtHL3E9qwmlvWOf_YBEc-_E7E4huaA,7730
src/detection-rules/rules/integrations/aws/impact_aws_account_closed.toml,sha256=Su4wGWsGdHUXGRk_LCdpMm8-vcz1nXGLe0rEGfXcMCY,5496
src/detection-rules/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml,sha256=IAWpdsA7HhfXT9_t0Hvaf2bk9sw6jTQiNaK6S89TY5Y,7977
src/detection-rules/rules/integrations/aws/impact_aws_s3_bucket_enumeration_or_brute_force.toml,sha256=sjdmI7x8K9qW1XkwkboUpGv7AkrgZOnEDUfH1PUV3e4,7959
src/detection-rules/rules/integrations/aws/impact_backup_recovery_point_deleted.toml,sha256=264rk-a3qPuS310FL1mTQ3GudWY1dGq_R2ZRhDz992I,5294
src/detection-rules/rules/integrations/aws/impact_backup_vault_deleted_or_lock_removed.toml,sha256=Gslx07WeXx_qLqZA3_zD-ZCNOlNS_2D0nYnOZ_6KrA8,5866
src/detection-rules/rules/integrations/aws/impact_bedrock_api_key_destructive_action.toml,sha256=4v60dqhQjqH_JDgGiCLbEWf_thwCcdSQWmPp9gV_Zs0,5844
src/detection-rules/rules/integrations/aws/impact_bedrock_knowledge_base_or_rag_data_source_poisoning.toml,sha256=k9UiGpdPkuySnJ80_l1Uc98wUqWdKT50VXJzVVP5AFc,7177
src/detection-rules/rules/integrations/aws/impact_bedrock_provisioned_model_throughput_tampering.toml,sha256=_tn0SzbrwQfnd6Qa-sV7eowRJKPz2hll8ygosyDJ3Wo,6662
src/detection-rules/rules/integrations/aws/impact_cloudtrail_logging_updated.toml,sha256=z70WeM4zS3BGPTW2xesmgud7ywpH2X6wP3Saguiksn0,5457
src/detection-rules/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml,sha256=ls9w3_N_oO1IsRwCi0aBmlOLOouf6ao9o0IU0yG9CuU,8177
src/detection-rules/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml,sha256=Yrkh2vaQM-p8l4jJCUGCVIxAVVnBqYgnGZ5aj-9d4VQ,7969
src/detection-rules/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml,sha256=xdiWiY69P6P68tIeqM8sLjFp4qVUdgExlSKAyy6Iexc,9516
src/detection-rules/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml,sha256=cDLsgmwvUvCtSMAhBnXBU_Eam02U1kK7Olj1mVa8SJE,9560
src/detection-rules/rules/integrations/aws/impact_ecs_cryptomining_task_definition_deployment.toml,sha256=9jxMX9zEUATlBkz_yH8c3o3t5J9i7W-b85JmINh_RGk,7375
src/detection-rules/rules/integrations/aws/impact_efs_filesystem_deleted.toml,sha256=lfL5ZUYNRP68qOJYIs8d8NtQy50XmgXjrgXZtzFyauM,7761
src/detection-rules/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml,sha256=4bfj66CxwsqJu_qZ9wDLKpDdsT6EZI4XIGx3LTQBDUk,7822
src/detection-rules/rules/integrations/aws/impact_iam_group_deletion.toml,sha256=PW2gS_lbte7bwIGvxDZSDaDWDPBXXbD0FZ4c3e-SwP0,4898
src/detection-rules/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml,sha256=ybJH9axmcIW9ZG9X5JtEip6SypjZ-6-IDhbW-J_BaKk,8043
src/detection-rules/rules/integrations/aws/impact_kms_imported_key_material_deleted.toml,sha256=z8Yw1FJx3vV3QGQSpMbsJ6woJAnssVYykK0LtBxdHXQ,6541
src/detection-rules/rules/integrations/aws/impact_lambda_function_deleted.toml,sha256=2NTToovULPF6Q6CEpQQ6qXVCBi7KkbWLiwEJJ5uqYLM,5436
src/detection-rules/rules/integrations/aws/impact_lambda_high_frequency_invocation.toml,sha256=XDE31djJu_Yv0FPtGzDAJBdqo08cSQKwSk6Xn9Z8qaM,5095
src/detection-rules/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml,sha256=9XNCPE9oiP3OU1g6djZ7oXzePlPZie2OHg1OkAxqFFI,7269
src/detection-rules/rules/integrations/aws/impact_rds_instance_cluster_deletion_protection_disabled.toml,sha256=yUKt4eNkFW0oD8RRUlMD_rieTVfOtOBQnfSvqdowPmE,6953
src/detection-rules/rules/integrations/aws/impact_rds_snapshot_deleted.toml,sha256=9vUBhPJcVWrkvlz0SBDm2sLmrmaflcJ5WM1PKXsrvsU,9212
src/detection-rules/rules/integrations/aws/impact_s3_bucket_object_uploaded_with_ransom_keyword.toml,sha256=xQ233VS1fDbYFN_RQmCXCUNLG5mxixj-diXW97ctyeY,9810
src/detection-rules/rules/integrations/aws/impact_s3_excessive_object_encryption_with_sse_c.toml,sha256=-fYoQAvgJlzxryJnj-CzIg4_UqoiDJ2yUrbIDDJP7jQ,5937
src/detection-rules/rules/integrations/aws/impact_s3_object_encryption_with_external_key.toml,sha256=Rbaex9NRUQ6yCJTZUnKJE-aWTPOqa4xNV7sKlFPyo0U,10443
src/detection-rules/rules/integrations/aws/impact_s3_object_versioning_disabled.toml,sha256=8uGb-DiCPCkhYypT_usa7Ql6IlP8s6fTo_OPtebZWPE,8194
src/detection-rules/rules/integrations/aws/impact_s3_static_site_js_file_uploaded.toml,sha256=sZcjZ-GeQuX29P6ZRdPlbJKgwnNH-_qQ55DlH_g65kc,6044
src/detection-rules/rules/integrations/aws/impact_s3_unusual_object_encryption_with_sse_c.toml,sha256=HhavJu9iBwjS2gyt69H8C2Agawc76bzNaHm7ULohj9U,6486
src/detection-rules/rules/integrations/aws/initial_access_assume_role_with_web_identity_kubernetes_sa_from_external_asn.toml,sha256=AqKooL14eRoaPXNzlMW143xsnIDsJbpD8xCuU9T5wTQ,5098
src/detection-rules/rules/integrations/aws/initial_access_aws_api_unusual_asn.toml,sha256=J_HEmDrauiut_AbcElkBzQLXZVwUi5ZyPwjfa8hwEf8,7480
src/detection-rules/rules/integrations/aws/initial_access_console_login_iam_user_multiple_geolocations.toml,sha256=QGTJJpQE2L-8Vs6OMPg5LCh9mLssjkZrnft6vHooIKk,6063
src/detection-rules/rules/integrations/aws/initial_access_console_login_root.toml,sha256=EK0OLGRV8s7sgVpc2xSynUl-3oqSSZBZ6KrK-zuzTcM,7814
src/detection-rules/rules/integrations/aws/initial_access_github_actions_oidc_credentials_used_from_suspicious_network.toml,sha256=mHOn1aKoFXn8mUkUwq5KN8FLm6p6ofARc1k2gJQh4Z0,6671
src/detection-rules/rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml,sha256=gNALV9nPwXkSf1DMv2LyUaAEHrawawkp8rhiNsDIkSU,12652
src/detection-rules/rules/integrations/aws/initial_access_iam_user_console_login_without_mfa.toml,sha256=bhT9keoVc7qxsmi7s8QS4G_XJ_nwJbcplcgyWPuybsM,5606
src/detection-rules/rules/integrations/aws/initial_access_password_recovery.toml,sha256=QnHZV79ekiUZ7K3zKdQW9E6GqM3VW8r418aCSUnR7mQ,6919
src/detection-rules/rules/integrations/aws/initial_access_signin_console_login_federated_user.toml,sha256=SWyj1x17cPIOILAawiqNi8ixveAxOZRoczGYvy_iU-c,6626
src/detection-rules/rules/integrations/aws/initial_access_suspicious_user_agent_detected_in_cloudtrail.toml,sha256=pNjKoJtEyq96wMYJCjSgA1ClS0OXZxIPavCJ8jBIhYc,8185
src/detection-rules/rules/integrations/aws/lateral_movement_aws_ssm_start_session_to_ec2_instance.toml,sha256=FVbNlKK8kY3Q5JulPnYCsb3jbZV7MQZ17XwrG5Fy0G4,5718
src/detection-rules/rules/integrations/aws/lateral_movement_ec2_instance_connect_ssh_public_key_uploaded.toml,sha256=vSM5sSvfLy5zW53LnDkM5qWmKCkzrysA4ZR_jRvwld4,8428
src/detection-rules/rules/integrations/aws/lateral_movement_ec2_instance_console_login.toml,sha256=Tr5FcQpOUeBnFLdzqmivVnEmSXLWnzx-dvo6Hfaz7kI,9864
src/detection-rules/rules/integrations/aws/lateral_movement_k8_assumed_web_identity_session_with_multi_phase_api_use.toml,sha256=5lw3LOjAAsBDH7CuQYBwtVxeFbDmmj_lgdHT66mYf8k,9322
src/detection-rules/rules/integrations/aws/lateral_movement_sns_topic_message_publish_by_rare_user.toml,sha256=o_f__AK_VpSl5ZWiVKmUVDg1MIePK0YwV_SB6yehlVo,8699
src/detection-rules/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml,sha256=fTOuAENlAYC3QS0aetQS7Ej1WsTibUrpKCZ-f_YZHe0,8304
src/detection-rules/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml,sha256=Lx_9GiGGaOA2vn4lcfpdi48EhQ5KbbGCG8v5gH9poMA,8949
src/detection-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml,sha256=4ZjfJJuQyqsKlKN36dART-qzWJtjZ1866t_QsD0WZGo,8862
src/detection-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml,sha256=-Fc88tgeUHq2qgNMJrf3-G4mRDJWF8Yshlvr5pf-dAI,8455
src/detection-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml,sha256=XtRfS2BZxpUUn4uKKSymFEnD6ekke0gNItkoxMRS990,9863
src/detection-rules/rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.toml,sha256=t44rkafRjWSTv7YmSQjcCHl1Cctjt5ql8N-dN_aOlwo,7810
src/detection-rules/rules/integrations/aws/persistence_bedrock_agent_created.toml,sha256=ewl_G-pM8pS2gmLXoWMw8wTrSscBcUA742vIH8u0qsU,5057
src/detection-rules/rules/integrations/aws/persistence_bedrock_agent_or_action_group_manipulation.toml,sha256=qVBEjIutTve0NPqEjtF7qfRqqK-XDZ82VZlSFvozW8I,7017
src/detection-rules/rules/integrations/aws/persistence_bedrock_foundation_model_access_denied_attempt.toml,sha256=MRc9_c-LeQ0vDvswYczNTJLpJCASIfVLn9t8a-QyT2I,6977
src/detection-rules/rules/integrations/aws/persistence_bedrock_foundation_model_access_enabled_or_entitlement_granted.toml,sha256=AgDLozS8I0krDC1y6qIAOMroSbT4V4t7iA598o7nEJU,7093
src/detection-rules/rules/integrations/aws/persistence_bedrock_resource_based_policy_denied_attempt.toml,sha256=dr7YPM6AuJN3Y3GKoMOA_WvHkHXJnWPLj2N86fUYaZs,6334
src/detection-rules/rules/integrations/aws/persistence_bedrock_resource_based_policy_modified_or_deleted.toml,sha256=01neOTmZP4I0QYXz9vS2yk1ni3NsSP7FCjSn6GukZ-4,5667
src/detection-rules/rules/integrations/aws/persistence_bedrock_third_party_or_external_knowledge_base_associated_to_agent.toml,sha256=ueE6OYupwvQ4rdIapreylPwPK-IPv1a8fpY19mw8Ywc,6018
src/detection-rules/rules/integrations/aws/persistence_bedrock_untrusted_model_imported_or_marketplace_endpoint_registered.toml,sha256=eEKlsclD4wvqGt9assRAfaipZj0A48bZW6M4Me_T5dQ,6411
src/detection-rules/rules/integrations/aws/persistence_ec2_network_acl_creation.toml,sha256=MuBwcYAzIOSqjLdEAB6Dut11Z0dxcBa6f-LG_d1JbN8,7370
src/detection-rules/rules/integrations/aws/persistence_ec2_route_table_modified_or_deleted.toml,sha256=g6NLkIBDC8FImkV8L7fD2wSU3wpOjkQiTqDKh7iuwzs,8699
src/detection-rules/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml,sha256=evIxghGvRR2oaMS7enWH_-V8Cl8jBzP4n3pTSHi3MDc,8153
src/detection-rules/rules/integrations/aws/persistence_eks_access_entry_modified.toml,sha256=P8-RBJa40Jm_PEvg9B3YCQsQAcl7L8YQgkoaC-oWIow,4577
src/detection-rules/rules/integrations/aws/persistence_iam_api_calls_via_user_session_token.toml,sha256=yQG-8cC7j4TBrpxQ0pY74FCzBNzv6PsQh_Nr_4_sHrc,8432
src/detection-rules/rules/integrations/aws/persistence_iam_create_login_profile_for_root.toml,sha256=BeD6IIRkQza8G2o0LTVaF8iHn3ox0K54GH7d4OMqQvE,9544
src/detection-rules/rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml,sha256=yctqne-CUUXOFRiujLGW30_VzdWes5UIHupiEGhIcMU,6982
src/detection-rules/rules/integrations/aws/persistence_iam_group_creation.toml,sha256=LTyOTky1F2occ6TmsgrOUrr5c-GnmopbQJjfzIi9pQ4,5564
src/detection-rules/rules/integrations/aws/persistence_iam_login_profile_created_or_modified.toml,sha256=DwpNkDxFV2z_Y5TDbMuMxQYQzBwyYhshNPGQIjmWQYA,6644
src/detection-rules/rules/integrations/aws/persistence_iam_oidc_provider_created.toml,sha256=jwE9bpRsGFklAC1uMGXnhgu7S9EXGTE5Nml-It0mgGo,7463
src/detection-rules/rules/integrations/aws/persistence_iam_roles_anywhere_profile_created.toml,sha256=nSySp8kC-S5DNEQddpASg5wlmrAs6OPIGzCIyF59WNs,8188
src/detection-rules/rules/integrations/aws/persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml,sha256=egfVWRkWqTVuPSd0oy0aNprZJayrHLKwaJjskwZ8EQM,7891
src/detection-rules/rules/integrations/aws/persistence_iam_saml_provider_created.toml,sha256=FoBWYC_wT6KHJ_cEpnUTKoYDLoGdH4zWyAoOir2bSGo,7032
src/detection-rules/rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user.toml,sha256=Xe4Z8rff_NXpsTokGk-WB8zyL6Dn5ecdHB2_WsWioPc,9882
src/detection-rules/rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml,sha256=gP2HyP9nVl6bvDIUpib0OsKxWSOfbMaMYJM34LXC2qE,7524
src/detection-rules/rules/integrations/aws/persistence_lambda_cross_account_invocation_backdoor.toml,sha256=PMJ0drKFgHPGmjrArxEkmE4DwJVubHa5dTw18hRFb6E,6288
src/detection-rules/rules/integrations/aws/persistence_lambda_event_source_mapping_created.toml,sha256=tDvxjbq6p-EFOl_rQgwyaBLi4e6tetEkuHyiZCDa_mI,6564
src/detection-rules/rules/integrations/aws/persistence_lambda_function_url_public_access.toml,sha256=poYfYyo89SQ0R6okKitMnJjqWhay_MRkgFi0yV2RadM,6175
src/detection-rules/rules/integrations/aws/persistence_new_terms_ec2_create_keypair_unusual_source_as.toml,sha256=7iYFVyARwk3VBvo9c7B2CCQ4D-4xLerCxMve2_XlYAs,5470
src/detection-rules/rules/integrations/aws/persistence_rds_db_instance_password_modified.toml,sha256=jjkiCNG2BjvP1v-c5TKjO9D3roEZ4mZH3NeXvNND99o,8907
src/detection-rules/rules/integrations/aws/persistence_rds_instance_made_public.toml,sha256=S5DLeGKt8z9VWonwQVVeWYLREfo7SSWBY2IEPQG-qyE,7688
src/detection-rules/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml,sha256=wCO698Cg02-MTL-CRd0XoTWrT_KBGvNv8DB0EOzw_00,7367
src/detection-rules/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml,sha256=jAAyTl38LeRVszkDBMYOncwVLLEm8VOaPbAsywFJYjA,8096
src/detection-rules/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml,sha256=KWOMAWAlrmN9bT9dE2wTKKWsthOJCbD1tQZPhRVjaKA,7512
src/detection-rules/rules/integrations/aws/persistence_route_table_created.toml,sha256=wlrzZPaxP3ykvlPzZZse8SkkxbBIN-GeAMHh6ofrTDM,6829
src/detection-rules/rules/integrations/aws/persistence_sagemaker_lifecycle_config_suspicious_script_content.toml,sha256=Hk4w8iDW98IUHUXxgU_LDboRtDBHXnh92QJscuuJwEI,6389
src/detection-rules/rules/integrations/aws/persistence_sensitive_operations_via_cloudshell.toml,sha256=ptvCIhD-Vr4Fq4m2cUV56NWX63sX87cSskgwmLfKE1I,7531
src/detection-rules/rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml,sha256=FL43IEESqUrYWhR3WqVZY2HVPVj6Y5F9S0rczqwU4pY,8231
src/detection-rules/rules/integrations/aws/privilege_escalation_bedrock_agentcore_execution_role_used_outside_runtime.toml,sha256=xjE-kASRtvAZYxqoIhFz9_slYyuXg9Al9b63xeqVe_s,7274
src/detection-rules/rules/integrations/aws/privilege_escalation_bedrock_phantom_user_activity_outside_bedrock.toml,sha256=bpi5nWYEkUxHHZ1m1Oyf-_w2o1fbbLY_4c0_3SPIm14,5295
src/detection-rules/rules/integrations/aws/privilege_escalation_bedrock_phantom_user_credentials_added.toml,sha256=GqxYvIximy8Kj7W42705DMIu6StW9xtE_12ZY--XwqQ,6261
src/detection-rules/rules/integrations/aws/privilege_escalation_ec2_instance_profile_associated_with_running_instance.toml,sha256=XlS7L25DQuCM0z84gpbrMIOpzXqgjWrOjZ-g7slXnVg,4824
src/detection-rules/rules/integrations/aws/privilege_escalation_eks_access_entry_granted_cluster_admin_policy.toml,sha256=8BoIud-IpWR1KsB_H5d-PZCBAUduD21DYIt4w3jOyhk,4814
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml,sha256=92wBS_g1TXLHGYFZnmc0QXNLDY5DQdZFRVykkG1rICM,7045
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml,sha256=mug4uvHx3PFIpEuCSwSvBZa9W36tZRi63Tj0st_-jfs,6973
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml,sha256=fiir-cOunMlHQ8bW5dxeH9jBJtceLHerSVSYCRSPoEg,7715
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.toml,sha256=6asvvT4dD7uzO7UFBFUdpBMQM-pjLhrR5c38os5pJxQ,8282
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_version_created_or_set_default.toml,sha256=NE2DyuQ1pVRBuIugv8u-f5gJgWi4X5TWfhLvbQJ728s,4971
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_inline_policy_added_to_group.toml,sha256=s6-_ukHUMyP98Uck72N8jKjq3K9m_67oZYWJZvyA0WU,6020
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_permissions_boundary_modified.toml,sha256=Xbqf6rtitXDFSHO532pyaEe9PeR4fp31VW2dqhwlfLA,5942
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_privilege_operations_via_lambda_execution_role.toml,sha256=ep3K5kEuDNGRiYXYrMpMbGbxoIYyhOLwPQZkbikUFOg,6104
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_saml_provider_updated.toml,sha256=ZltaEtYlnRuhfDR39gkP4KwzsVd-OhaZwopyRyztO28,8157
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_update_assume_role_policy.toml,sha256=52dVkB2NYzY2DD5IGPgKArQJv6enPRPdsbcx2bjSaic,8054
src/detection-rules/rules/integrations/aws/privilege_escalation_kms_key_policy_put.toml,sha256=3-d_8Wf6Fco1C2ZSlykK0MIVHXPtZ4NdKu2DrzfJohQ,4509
src/detection-rules/rules/integrations/aws/privilege_escalation_role_assumption_by_service.toml,sha256=WR6ZMsAjHOXxE88KDCzOeK01fEWSPBZy2wQipOhfaCM,7769
src/detection-rules/rules/integrations/aws/privilege_escalation_role_assumption_by_user.toml,sha256=_C49lYR2uYkWEJrcpJE5zZ2ZUvsEn3A2APEJxxpNsBs,7630
src/detection-rules/rules/integrations/aws/privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml,sha256=PzKK8OqrfK5JLOt1lc8blyegqs-joohsSMJppPDladI,12718
src/detection-rules/rules/integrations/aws/privilege_escalation_sts_get_federation_token_administrator_access.toml,sha256=jzt_62KeipseE8aQCr8RF1L2_eZAkzY-9zpAlNba_cM,5272
src/detection-rules/rules/integrations/aws/privilege_escalation_sts_role_chaining.toml,sha256=Iw0V3Bs1r-FQ3HiE1LxYdn4qcOKQiX4hrnF2ldb6Fhg,9106
src/detection-rules/rules/integrations/aws/resource_development_sns_topic_created_by_rare_user.toml,sha256=rS9E9xx_vQc3vk0qLo536KUDTkaAsjEn66oE6OapDt8,6402
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_execution_without_guardrails.toml,sha256=c0cevT1mzWoFBX3gWSkDPj8yS7-hrq20C32I5yVCM-0,4847
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_by_single_user.toml,sha256=PqwbgjDSYma97wSBCrHkLxWG-TXDQY4FxI6cX7Yks1c,4857
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_in_single_request.toml,sha256=25G1pGkA_Pm9YsvEGJWJUzPADbmoepeGrWBn16IC4vw,5269
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_high_confidence_misconduct_blocks_detected.toml,sha256=sdLX9ZiabRdEBxm1GHsEQpd3C5gQKgyL013aOEcXmOM,5314
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_high_resource_consumption_detection.toml,sha256=T4DmttjFKaD-rI7yuuB6r_ahvOoJFRbW7HY1BujplYw,5036
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_attempts_to_use_denied_models_by_user.toml,sha256=u2c1QgxZcO68JmBCn_r7Ofd20lERSpnWi-QnGbepXDw,4568
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_sensitive_information_policy_blocks_detected.toml,sha256=7AXcjkalDO0nyTjJV3Hdmab9dqpFUN6z-O9QDvillHQ,4748
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_topic_policy_blocks_detected.toml,sha256=3Quejfd2m3jCBtrnbtnf1nQp6PvuUPX1Ol7JezXROUI,4638
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_validation_exception_errors_by_single_user.toml,sha256=tfMEkbWtIQ-hePLJTUuWB_9q1D6Uirbc2JSbzFumlvE,5019
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_word_policy_blocks_detected.toml,sha256=YCDnc0Ztis4S7XDXsLcPROoVqWtBpaznHl3mLesDxM0,4652
src/detection-rules/rules/integrations/aws_bedrock/credential_access_aws_bedrock_credentials_in_model_prompt_or_completion.toml,sha256=etYjHLXmT0NLU5eEh2GhxVuJqLX_GPtksHzNWiINw-w,5137
src/detection-rules/rules/integrations/aws_bedrock_agentcore/credential_access_bedrock_agentcore_runtime_prompt_containing_credentials.toml,sha256=mTP6k-dlXH-1_DsfT2vSp0MCCkqHXmwjlebAsOr22v8,4726
src/detection-rules/rules/integrations/aws_bedrock_agentcore/credential_access_bedrock_agentcore_runtime_prompt_credential_harvesting.toml,sha256=9OfrmnoywxCUFEgaWqBY8FujYuhdJtwj0yPSMI8nv3Q,7072
src/detection-rules/rules/integrations/azure/collection_azure_storage_account_blob_public_access_enabled.toml,sha256=U81kxC6Kv8Lfr0fQ1Y-NKMipmuEtwOsz2Tx9ggkJ_Qs,6098
src/detection-rules/rules/integrations/azure/collection_entra_id_sharepoint_access_from_unusual_application.toml,sha256=daZU1qiZv0wdUOf3oAn_yKCE9fDgoZRuv5r2DkH7KOo,9565
src/detection-rules/rules/integrations/azure/collection_graph_email_access_by_unusual_public_client_via_graph.toml,sha256=-Vpk71FNLwXpkYzphLjplkdiFSDAFVE3SZPguqznYyY,7532
src/detection-rules/rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml,sha256=ZmZgVrauEoG30lEXF1lxsIoTHMwwkoW8PtPl3-53v9k,7733
src/detection-rules/rules/integrations/azure/credential_access_azure_service_principal_signin_then_arc_credential_listing.toml,sha256=wJcdoImpcNEwFSc1a5x9pGEFDyEDG9Y_0inIx2E1ci8,6475
src/detection-rules/rules/integrations/azure/credential_access_azure_storage_account_keys_accessed.toml,sha256=v63qOvAZ09KAooXNUTwR8E9aPVACsiwMuE38_kfBMWQ,7273
src/detection-rules/rules/integrations/azure/credential_access_azure_vm_boot_diagnostics_retrieved_unusual_principal.toml,sha256=NhBB13JBh1lqapgwDzBZ_RIDG7clprw3iSCICLQGVCg,5106
src/detection-rules/rules/integrations/azure/credential_access_device_code_signin_aad_graph_enum.toml,sha256=abQ297bpnhDwg-g2NqoCp8SCg3KdL1q8sLz04GGj2ew,9945
src/detection-rules/rules/integrations/azure/credential_access_entra_id_brute_force_activity.toml,sha256=5rWOasudoM0UTTzm6jQhVbXnFLoJr-vpz_e0HKaUd4E,14218
src/detection-rules/rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml,sha256=bGLKFx8RuGF9fOKG71vZUPGkLNwZSDDGNYLIvih9INA,8955
src/detection-rules/rules/integrations/azure/credential_access_entra_id_ropc_unknown_client_id.toml,sha256=0bCUjPAWeY8SCeAGw23r8QUvuAP5bKCM8ox7S29vT4w,8787
src/detection-rules/rules/integrations/azure/credential_access_entra_id_signin_brute_force_microsoft_365.toml,sha256=J-IczCAeNxOfCa0v08uLKjhcUcu9m6necXvw6id3NvQ,14630
src/detection-rules/rules/integrations/azure/credential_access_entra_id_suspicious_signin.toml,sha256=uDE99nM3IQteOOlNyjYvSG-ECwkb3YB6P_05gvXW6Iw,8415
src/detection-rules/rules/integrations/azure/credential_access_entra_id_totp_brute_force_attempts.toml,sha256=STtypDkSkFoBK-_ZQxe6S8asFYTO1u4WbEE1HIivZ2E,10319
src/detection-rules/rules/integrations/azure/credential_access_key_vault_excessive_retrieval.toml,sha256=WWNURtGIZQ1TYNOph9gZ9AvxrKNWlDpnKBUG57iyMPs,11257
src/detection-rules/rules/integrations/azure/credential_access_key_vault_retrieval_from_rare_identity.toml,sha256=lBMjRCOVv6KMjOOHbkKHe_VZzQ4KAezrKByvaRE_2x0,8469
src/detection-rules/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected.toml,sha256=AtG0mm8NMzpNKzYwJ1Ju2vbOMONBv0Sa-CauBRCIWEw,6269
src/detection-rules/rules/integrations/azure/credential_access_storage_account_key_regenerated.toml,sha256=8Vz5u-yZWkmbSreP8Htv_MkDpNR_rPv2-MdWlM-B9ec,6642
src/detection-rules/rules/integrations/azure/defense_evasion_automation_runbook_deleted.toml,sha256=ATwuL35UYxx2azp9fdDNN2rxeswggov_84mtZ8hQZ_Q,5737
src/detection-rules/rules/integrations/azure/defense_evasion_entra_id_ca_mfa_bypass_first_party_graph.toml,sha256=sh_SjGMGk2tZZLXdMxwRayMTcjjkmx0kPQyV-uUjJzg,11327
src/detection-rules/rules/integrations/azure/defense_evasion_event_hub_deletion.toml,sha256=ZbT3Wd7egfUUiqfCiLjvKBKbV3CcjtIq2hw2w-Xbe8A,6613
src/detection-rules/rules/integrations/azure/defense_evasion_insights_diagnostic_settings_deletion.toml,sha256=TGDUS7zx05VTIOjt_0D_AiGHUwovC6DulNMofLif46M,6958
src/detection-rules/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml,sha256=JvgCTYgONIn68Ere0_qrCGI5oQW6APKa-XjQBX62Law,6418
src/detection-rules/rules/integrations/azure/defense_evasion_network_firewall_policy_deletion.toml,sha256=vvTkbf4if_fwzTbXztUqi5rpTE5D2ERx8uvKGr2WS5M,6267
src/detection-rules/rules/integrations/azure/defense_evasion_network_frontdoor_firewall_policy_deletion.toml,sha256=nlC_ARs-A8X_88OndZsZl-ob15bR---mKSlmf0EgFmA,5997
src/detection-rules/rules/integrations/azure/defense_evasion_network_watcher_deletion.toml,sha256=_UN2QLItbaRJ3O0QB_chMtaZ_kwaPnHNPV6Yv_mH2ZI,6140
src/detection-rules/rules/integrations/azure/defense_evasion_security_alert_suppression_rule_created.toml,sha256=YFR_2LcsSOsaQalDSBg79zP8T-xfIg6HW36Lk4D_fvc,6679
src/detection-rules/rules/integrations/azure/defense_evasion_storage_blob_permissions_modified.toml,sha256=vH1VR93jFmt3GL6SdKK5d-vRFSF40V_ubRor5r0WRAo,6217
src/detection-rules/rules/integrations/azure/discovery_aad_graph_high_4xx_ratio_by_user.toml,sha256=BmJiZK4zAhSWq50GXp_igaQ8lRTVyXNR7H7PmjmWsmY,6063
src/detection-rules/rules/integrations/azure/discovery_aad_graph_roadrecon_aiohttp_enumeration.toml,sha256=0hL1plR_8UlXOIh9pGcJ14NWl9h8UTldNSq7238jIaw,10302
src/detection-rules/rules/integrations/azure/discovery_aad_graph_suspicious_user_agent.toml,sha256=4qTuNwsGMAhQeYhfxTLzMyMeZHnhumMX-fkBEelnDZ0,7546
src/detection-rules/rules/integrations/azure/discovery_aad_graph_unusual_client_for_user.toml,sha256=zFtYWQSFMsW4-6v3oARz5U_g2pT0VXLgqkI1syfKv1w,6929
src/detection-rules/rules/integrations/azure/discovery_bloodhound_user_agents_detected.toml,sha256=R0Z9G-2cGdwzu6Xami7-8LWjcUGkgGCgM4TI0nD_fRk,7390
src/detection-rules/rules/integrations/azure/discovery_entra_id_teamfiltration_user_agents_detected.toml,sha256=dwYd3nzbLH8bsTxCVOGioCDdyghEzkMwKVj9sNXron8,7875
src/detection-rules/rules/integrations/azure/discovery_graph_activity_delegated_user_multi_category_recon.toml,sha256=Wgggtu1BmqHFOjGUGrVdt7ZUWfEzpy5nrcKgOyQYdbw,6825
src/detection-rules/rules/integrations/azure/discovery_storage_blob_container_access_modification.toml,sha256=WbvNeNTldC43XgxQX8ywv1a8tV2HIRzh8IxznfcoqhQ,6523
src/detection-rules/rules/integrations/azure/execution_automation_runbook_created_or_modified.toml,sha256=7z25MQn30CCI495TdUW2kyawLLnpLKXt6iZ7wESsk70,6578
src/detection-rules/rules/integrations/azure/execution_azure_aks_kubelet_proxy_command_endpoint.toml,sha256=RxKqeWUB7WanCCCQEMCCfvyCHBAbW7X6cn0AqvNyeNI,6270
src/detection-rules/rules/integrations/azure/execution_azure_vm_extension_crud_unusual_source.toml,sha256=2SfL9pRVgmlFINErU87gZThpaXxlJ-45WZDvYu3IKLE,7137
src/detection-rules/rules/integrations/azure/execution_azure_vm_extension_unusual_for_host.toml,sha256=gmuzau6ALST-Bp9WVrGZRhNC2lIh0Xv0389LuSMcMQM,8514
src/detection-rules/rules/integrations/azure/execution_azure_vm_managed_run_command_unusual_identity.toml,sha256=qIgfBtAWDlcVM55Gi3H-HIzhU_zTR9CKFuM6YzKwFzM,5918
src/detection-rules/rules/integrations/azure/execution_compute_vm_command_executed.toml,sha256=JU0J7BroGsDqDHt5VVpIS6svQJ9hAP-kEiBKviyK1gw,7179
src/detection-rules/rules/integrations/azure/exfiltration_azure_storage_blob_download_azcopy_sas_token.toml,sha256=m3uM2iJD4kCKlyaME7frIkMz2_2TU8MmKo38aUGhICE,7643
src/detection-rules/rules/integrations/azure/impact_azure_compute_restore_point_collection_deleted.toml,sha256=Hwx7acpEI7YPhgJIIlYJoDvCz-2i5zdX6EdN5SiyUks,6124
src/detection-rules/rules/integrations/azure/impact_azure_compute_restore_point_collections_deleted.toml,sha256=U21yeJACV3kokSKFGGxA4ls6SUXirquyU8XlPTee8gI,7895
src/detection-rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletion.toml,sha256=rMcgohICZjL11rR7_QmMdzJtTHUoxXj_3QP5MKAMzlM,7389
src/detection-rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletions.toml,sha256=FIMf7ttB3qvbDkUTA0OziLQvMfwKBwHO7d9viVIigBA,8386
src/detection-rules/rules/integrations/azure/impact_azure_storage_account_deletion.toml,sha256=XFbwhG5A6UFUcVQ9Z4WbdFcBWJm8dghT3Ahl0i99b0g,6170
src/detection-rules/rules/integrations/azure/impact_azure_storage_account_deletion_multiple.toml,sha256=ofCfqjq89RGA9JiR4GuNw0t3XhLBk3zcq30F90qVJnQ,7016
src/detection-rules/rules/integrations/azure/impact_key_vault_modified_by_unusual_user.toml,sha256=3jckr-EiFhKDkBMdYLvyf9ofnEwAj3uOddb2OnXEToQ,6253
src/detection-rules/rules/integrations/azure/impact_kubernetes_pod_deleted.toml,sha256=TaIeh8DA5F5TYezlrNRfXflc3LpywmhiRpzGOevk0kg,5989
src/detection-rules/rules/integrations/azure/impact_resources_resource_group_deletion.toml,sha256=_aop4uIF6gKdrj-T0BPuZrjMsa7z1JRlcV6nEsPPIEo,7060
src/detection-rules/rules/integrations/azure/initial_access_aad_graph_unusual_asn.toml,sha256=NfI_iT2QrUtEBGF_FmXTBAqS3jTzgTQsWooTpqJlpsg,6024
src/detection-rules/rules/integrations/azure/initial_access_azure_arc_cluster_credential_access_unusual_source.toml,sha256=OLBZ2q_IIQNn9vW1J5zhQhOZLe1inoUGY-cfOmKHwbs,6079
src/detection-rules/rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml,sha256=JeChhk96ZVamrQEz354MDvd1DRd_21vSGYRrrJqW7LM,6526
src/detection-rules/rules/integrations/azure/initial_access_entra_id_device_code_auth_with_broker_client.toml,sha256=9f9UbhIYBtGULiUujpo5IqE-N42waB25c3uZRtrPArI,7782
src/detection-rules/rules/integrations/azure/initial_access_entra_id_external_guest_user_invite.toml,sha256=jJKRY61IrkbvbIHqx9g7Fdlqf8pIna5flwC8S97Vfug,6661
src/detection-rules/rules/integrations/azure/initial_access_entra_id_federated_login_by_unusual_client.toml,sha256=Z0gajr-tazHwZj_qvHnI8HC_BMFV85-MvdsHJ4kwGKA,8008
src/detection-rules/rules/integrations/azure/initial_access_entra_id_first_time_seen_device_code_auth.toml,sha256=8B9RarekRPsH6YqpGYJXN2l2Pdu0n0IuxfYx0xoWgkk,7665
src/detection-rules/rules/integrations/azure/initial_access_entra_id_graph_single_session_from_multiple_addresses.toml,sha256=iSD_hrHfG-WDAaVtybiURd1amtXiZWG9uXJx3nYeB4c,13000
src/detection-rules/rules/integrations/azure/initial_access_entra_id_high_risk_signin.toml,sha256=lhZNo-pD7bnGPNt8ZOEqPSM0k2t415zTFF26F5xR-5Y,5111
src/detection-rules/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml,sha256=zNESbud7lMlF1hSBTme3PNbjUycyK7ShHpuWsZkcyBc,9824
src/detection-rules/rules/integrations/azure/initial_access_entra_id_kali365_user_agent.toml,sha256=1Zi035DXFm5Vp_KaZt9ONTB_kjT4SZKaThWEECE0qCI,7604
src/detection-rules/rules/integrations/azure/initial_access_entra_id_microsoft_auth_broker_nonstandard_user_agent.toml,sha256=egEF4KZkBu9PgbvNk7jB0CTuIcbLOxAsQQYwxjFl1KY,5883
src/detection-rules/rules/integrations/azure/initial_access_entra_id_microsoft_auth_broker_unusual_resource.toml,sha256=bnvUT_cJmNXWpeXHxri7nuqETAaZB2UVZk-M4z0sqbg,5485
src/detection-rules/rules/integrations/azure/initial_access_entra_id_oauth_auth_code_grant_unusual_app_resource_user.toml,sha256=Ws2CdX0ORSjrxb736ExQ8SJbl97q1-ghIJE_cVap73w,10066
src/detection-rules/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml,sha256=_SNOXpj1vRZdFQHYydkhUvQsPktYy3XnhJegiqie4g0,5234
src/detection-rules/rules/integrations/azure/initial_access_entra_id_oauth_phishing_via_first_party_microsoft_application.toml,sha256=h3EglDJS_BRf5WWWf6qxHbJfzXY5y6FweKPt3aOXLLI,9302
src/detection-rules/rules/integrations/azure/initial_access_entra_id_oauth_user_impersonation_scope.toml,sha256=rJuMiEmOEiTnd9Nnb3lDb40ArsSDWHWxZODlOSGxBrk,10377
src/detection-rules/rules/integrations/azure/initial_access_entra_id_powershell_signin.toml,sha256=cSuHTKagL8TZO2iL4vAMk5OXMpj0hLS-DK9d9o5JfPY,6025
src/detection-rules/rules/integrations/azure/initial_access_entra_id_protection_alerts_for_user.toml,sha256=2BctxPB6ZmL0LU8Tq6TqUFScLkcrbJ9FR_0oANemH3w,6239
src/detection-rules/rules/integrations/azure/initial_access_entra_id_protection_confirmed_compromise.toml,sha256=48JvdrMY9JxKDnzOFZOFj3oEujtfNpgZ8vmXZHWP8sQ,8144
src/detection-rules/rules/integrations/azure/initial_access_entra_id_protection_sign_in_risk_detected.toml,sha256=nPXwgtFPUc_HNjr0NcSnxcaolMr81YBVFVfYIqbLJRM,8850
src/detection-rules/rules/integrations/azure/initial_access_entra_id_protection_user_risk_detected.toml,sha256=LZ9Nht8AfpDcX7GOyrefafHPjaLxOjTmpBMtPsslmrA,8607
src/detection-rules/rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth.toml,sha256=AoF7tRj5jj7dX4il6YJOw3NkDIeViAGw1fM6iNIS0l4,11073
src/detection-rules/rules/integrations/azure/initial_access_entra_id_rare_authentication_requirement_for_principal_user.toml,sha256=yesleFscU-n92kj0NJu7YEhSgh2ewznwikEMC5WpTOE,9114
src/detection-rules/rules/integrations/azure/initial_access_entra_id_risky_user_or_compromised_sign_in.toml,sha256=RpZVylwRDFfs34Je8aoI0ZSeLIDrgxYPvvHhIPR-bXs,5206
src/detection-rules/rules/integrations/azure/initial_access_entra_id_service_principal_signin_unusual_source_asn.toml,sha256=hcrcKHV5_Hk-TWCroyd3mfO1HJ0TDfSAnzxqfcJyGW8,8171
src/detection-rules/rules/integrations/azure/initial_access_entra_id_signin_impossible_travel.toml,sha256=JcvLRJQEsSPuP7aYzboaCj1a7R5g98Lv1Ff1xGwvnks,15581
src/detection-rules/rules/integrations/azure/initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs.toml,sha256=pEgTWoia91s5j730xPLLRCy88k6sK4Jk0Fgjdfu-wjI,13701
src/detection-rules/rules/integrations/azure/initial_access_entra_id_temporary_access_pass_created.toml,sha256=wQXPAi18h1M5frr_K3xyh9fenb28yblRbsVUynYMF-Q,5040
src/detection-rules/rules/integrations/azure/initial_access_entra_id_unusual_legacy_auth_client_signin.toml,sha256=NdhePKkfEjZ0sNt9vtc1GtgoDVj8_9gXVzdfN0YaxbY,7130
src/detection-rules/rules/integrations/azure/initial_access_entra_id_unusual_ropc_login_attempt.toml,sha256=IVoeRlbpz46ZcMLDEmQAdRDrJ88x_hmcoC5u92V9hXA,7143
src/detection-rules/rules/integrations/azure/initial_access_entra_id_user_reported_risk.toml,sha256=SfmxIm6LMBq9Yq_itw8qQNFROxfVefol7Ot_ZI7ZVyE,5133
src/detection-rules/rules/integrations/azure/initial_access_graph_first_occurrence_of_client_request.toml,sha256=iKTWEPKC-1bmH1bCTR_Pqq20la32WCBYD2F58JG2OFQ,7462
src/detection-rules/rules/integrations/azure/initial_access_tycoon_entra_id.toml,sha256=VRm0Tb9BkywUbFddgQLs7j7PU_KgdJ9vDwMMZ1o5R84,4591
src/detection-rules/rules/integrations/azure/lateral_movement_azure_aks_api_server_proxy_to_kubelet.toml,sha256=Smg1pwIojFHBgmowPNdl7qDC7RJeglJtRJLeHgKp1Ug,6622
src/detection-rules/rules/integrations/azure/lateral_movement_azure_vm_serial_console_connect.toml,sha256=4rC1JS_LuEZynytqz3CcntPV3iS0WmBUtroJCO5tk_8,6591
src/detection-rules/rules/integrations/azure/ml_azure_event_failures.toml,sha256=Qjrctylek8x8NHXwjdR84HvvvZ3C2OHCyu7Ajn9q0qE,7732
src/detection-rules/rules/integrations/azure/ml_azure_rare_event_failures.toml,sha256=23SZmNQLcbnuc2aW0onjMSvVIoGc66ksPd7HQx8s2SE,7960
src/detection-rules/rules/integrations/azure/ml_azure_rare_method_by_city.toml,sha256=ioD6yD56SxCeDwXi-t1m-tkZ5F1UPrzwbu54Or04_ws,7868
src/detection-rules/rules/integrations/azure/ml_azure_rare_method_by_country.toml,sha256=32aOLxMAiuDo3zVZxkoZL64gWWsiSvGjZHTdkYRPec0,7455
src/detection-rules/rules/integrations/azure/ml_azure_rare_method_by_user.toml,sha256=riNd4AqyEJrr64JJtijmYB3v_N7VLqMRMubf2C35k00,8558
src/detection-rules/rules/integrations/azure/persistence_automation_account_created.toml,sha256=-4mPbAYQZeneeEFUj_xrtcTfPNaKeuUP6HSUgz5NvaM,6078
src/detection-rules/rules/integrations/azure/persistence_automation_webhook_created.toml,sha256=hD0vAXQ0JR-Hw8Wds62Bj1dc6-s6xLyF_f_Hhj-I7EA,5920
src/detection-rules/rules/integrations/azure/persistence_azure_vm_extension_deployment_by_interactive_user.toml,sha256=3DYuDMFuJdiqzCgvta1RDi0hU21sH8DuP7OLMSl485E,5188
src/detection-rules/rules/integrations/azure/persistence_entra_id_application_credential_modification.toml,sha256=cYlU0dkCKmQuJwc52Nlr0jOffM_m5Dvd63L3IQVx_go,6858
src/detection-rules/rules/integrations/azure/persistence_entra_id_conditional_access_policy_modified.toml,sha256=MmlbNXi3meynxXxB6zqPOOndjOdpdF1c7UjFVlMKkoQ,5623
src/detection-rules/rules/integrations/azure/persistence_entra_id_device_registration_to_prt_chain.toml,sha256=-EMWQm-5V6Eh3SOvLBBjKsu7A6AT-dElip5FJjBvcos,10518
src/detection-rules/rules/integrations/azure/persistence_entra_id_global_administrator_role_assigned.toml,sha256=jJPI_MYjCPcZEbZK0f7tyq8wiv50BUZY9P1ysSm2dDk,7028
src/detection-rules/rules/integrations/azure/persistence_entra_id_guest_account_promoted_to_member.toml,sha256=0QYLg9edqVZJ4zlJ1dpSfxMbxgTlbwOHFmq65R49QbU,3690
src/detection-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user.toml,sha256=8BaSs3HtWXK4rrTyZspPbkvdlHYT4ljaGOLNdIOxL2s,6470
src/detection-rules/rules/integrations/azure/persistence_entra_id_microsoft_auth_broker_drs_signin_from_suspicious_asn.toml,sha256=Tfkzzze9QczB2-lelZPud1kq3_LkaDaqilV4_J-at88,6065
src/detection-rules/rules/integrations/azure/persistence_entra_id_multiple_device_registrations.toml,sha256=9AvbcZEgPT2uxEIYpjcfSwGBEelamuEZL8j8yGzbPD0,10624
src/detection-rules/rules/integrations/azure/persistence_entra_id_oauth_app_redirect_uri_modified.toml,sha256=D-sPwVgewpslRs0yw5iD3qX3ZRGJobBZpEVKJG9ZUpk,4512
src/detection-rules/rules/integrations/azure/persistence_entra_id_phishing_kit_default_os_build_device_registration.toml,sha256=M0hfmvUTrayN6fBphkox0-udDpq6UYa0DJKC3IL-a4w,7733
src/detection-rules/rules/integrations/azure/persistence_entra_id_pim_user_added_global_admin.toml,sha256=rN_vnWwo494KSECSXiLKQhELHwiGyUUYNk2vP2LXDt4,6839
src/detection-rules/rules/integrations/azure/persistence_entra_id_privileged_identity_management_role_modified.toml,sha256=yon5059T6Fk97UYE1Mf_LhU6Xt00KIGriM5XwSY1CQg,6145
src/detection-rules/rules/integrations/azure/persistence_entra_id_register_device_unusual_user_agent.toml,sha256=7rAUO-36AAkZ5UlFYwHiH9RQwGeXW03EfcvdJfjBaVU,4139
src/detection-rules/rules/integrations/azure/persistence_entra_id_roadtools_default_device_registration.toml,sha256=2c_M3YMCbfB9YW66DBoGHqQAVlLn9PFf4BtiuyB_9wY,6928
src/detection-rules/rules/integrations/azure/persistence_entra_id_rt_to_prt_transition_from_user_device.toml,sha256=lBzjF5d5bBoV_uZqnqlxWLDR6XLDwC2wf5E-SZO0myI,7504
src/detection-rules/rules/integrations/azure/persistence_entra_id_service_principal_created.toml,sha256=vZEB30iRA6kpqA3CLFtLc-fuVhy8W0AzEHAEfDGwfmQ,6342
src/detection-rules/rules/integrations/azure/persistence_entra_id_service_principal_credentials_added.toml,sha256=wZLi21pz3WBepZOLcTNKLzE69gZ3rBbaxp97Vr3vGy0,6432
src/detection-rules/rules/integrations/azure/persistence_entra_id_service_principal_federated_issuer_modified.toml,sha256=U_m3fb7MDymfA_Jsg1vZuybYm2lbTDGl3QiqG2prL88,6721
src/detection-rules/rules/integrations/azure/persistence_entra_id_suspicious_adrs_token_request.toml,sha256=YIbufdwscrwCMyjVV1woZKdl5Koh3RX_wpj8Ok2HPys,6433
src/detection-rules/rules/integrations/azure/persistence_entra_id_suspicious_cloud_device_registration.toml,sha256=cgkqgpmjSNy3v84Q7a1nRi327NjW2Y2-iNV5LqJ-4tA,7051
src/detection-rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_application.toml,sha256=XTJbPMOll5nh-ydn9V4brYcEb0HubpXHK5yeSrHaiGY,5889
src/detection-rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_service_principal.toml,sha256=zNilGQCSQmYXxTcIvtwT0OkNXGR7ws4VOEKprfCd8k4,6096
src/detection-rules/rules/integrations/azure/persistence_entra_id_user_signed_in_from_unusual_device.toml,sha256=rFwwm9JqzI0f2PPMCA7cPWVD45mbzRjfOELDz6LLHSA,7389
src/detection-rules/rules/integrations/azure/persistence_event_hub_created_or_updated.toml,sha256=sBHS0l1zt-YXvq4PzsNzGyWG5Mueuacgwl_dlTioyTE,6793
src/detection-rules/rules/integrations/azure/persistence_graph_eam_addition_or_modification.toml,sha256=YqI3-f3cX2bO1OkLjFhyT7cmIhgucLHJNhqMBIrd5To,5820
src/detection-rules/rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml,sha256=5yv7tb6-ssdtXooKs3C-Bh8-FGNS0pW7NMgNJT4qvK8,6079
src/detection-rules/rules/integrations/azure/privilege_escalation_azure_rbac_administrator_roles_assigned.toml,sha256=KPqCfMEouJ-W-06HAEgGJAEXxlLeGcrfXRBfXejtsjQ,6145
src/detection-rules/rules/integrations/azure/privilege_escalation_entra_id_elevate_to_user_administrator_access.toml,sha256=NAxyzMInz9jaUjVjplitxr9EmxkIVnusBZj-CFmNvpk,5859
src/detection-rules/rules/integrations/azure/privilege_escalation_entra_id_tenant_domain_federation_via_audit_logs.toml,sha256=3rwWvP-QuOoxyFwxVpDomqfrjqTWud66FPTEnO6Iex0,7774
src/detection-rules/rules/integrations/azure/privilege_escalation_kubernetes_aks_rolebinding_created.toml,sha256=NEr_nHuDT9vgpOVnsrNUhVanV2maaKUDP34lP4gLc50,7222
src/detection-rules/rules/integrations/azure/resource_development_entra_id_custom_domain_added_and_verified.toml,sha256=_4xlYVGABX5QYnLfZi5uZBZyh4Tl3CJb6WfqtHJcSkk,5786
src/detection-rules/rules/integrations/azure_openai/azure_openai_denial_of_ml_service_detection.toml,sha256=k7TmTJjP6U4hoMWtkHZpeml2xar7ddOs03uiXjsIZEQ,5996
src/detection-rules/rules/integrations/azure_openai/azure_openai_insecure_output_handling_detection.toml,sha256=VOiDNib8m07nXzBHp1CdpkkhZKPAL79HtetheJ23OZ0,5792
src/detection-rules/rules/integrations/azure_openai/azure_openai_model_theft_detection.toml,sha256=vvjnYVCilaJqtKtgE-vmX-yNqO46CEZD96uE2c8LUXM,5754
src/detection-rules/rules/integrations/beaconing/command_and_control_beaconing.toml,sha256=nXWdAZwxJsBvDpwy-ccyJvsn4f4jlxSvwhAZwy11asI,8022
src/detection-rules/rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml,sha256=SD0ejJgT395orNRkG2VvyuL42Zyphj8KkAY4HqtVLJw,7402
src/detection-rules/rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml,sha256=BSlZfN-YTYJCNW9UYfRBF1VvV2-KyM9wjktCMiQyiM0,4738
src/detection-rules/rules/integrations/cloud_defend/command_and_control_interactive_file_download_from_internet.toml,sha256=sizgmlFhuGOiWAYL231aJW-j1mixTjLnrHsqH4yNAD8,7414
src/detection-rules/rules/integrations/cloud_defend/command_and_control_tunneling_and_port_forwarding.toml,sha256=5NqIVRq3R_1uzrMgNlB8I-4tO2_JIZJorF6iaZ6HFm8,7163
src/detection-rules/rules/integrations/cloud_defend/container_workload_protection.toml,sha256=9Q1DAgjwjSYh57cnwCa12zHGybKbxEfNmzk6YfDdDbA,5003
src/detection-rules/rules/integrations/cloud_defend/credential_access_cloud_creds_search_inside_a_container.toml,sha256=rPNRPXikpQGk6XO0_lF7PZXxH48wsbg9C0qGbFzjsBI,4168
src/detection-rules/rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml,sha256=gj_Nw_xVNYMp0ILbFwboIY6cZXij_QfL4lwbacgh8ZY,8500
src/detection-rules/rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml,sha256=uktXvDhA_o4m02xLh6BKZ0u0AjZYphHfBarJSeHIxhs,8540
src/detection-rules/rules/integrations/cloud_defend/credential_access_service_account_token_or_cert_read.toml,sha256=mYYSHSqPf18ePYDbnhyadaVg81kKCNiCi9UYbQb2dIo,7501
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_decoded_payload_piped_to_interpreter.toml,sha256=kw4LVBK7MCQVViKem_YY1v0lGPONJxFyIcUITO2ZXQw,9288
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_deletion_of_shell_cmdline_history.toml,sha256=4H1u6bRINtkALN3KNqmhKPXyqne9F870ALoSVhXrwnA,6855
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_file_creation_execution_deletion_cradle.toml,sha256=ftyqQj531ojr4-KtMijMF-CVTeipQOMh1zgSmVK65QI,8773
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_interactive_process_execution_from_suspicious_directory.toml,sha256=iv8MAB7b3Su41Axa4eTm23ZDamj8BGIUuWrZozGGAGc,6336
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml,sha256=O54vU-rDBPz8K5P0juLWZeMiu9OqJBPNFRkawsRtTGw,7557
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_potential_evasion_via_encoded_payload.toml,sha256=rPwNDmfE4GfF0gmRob0b8WuE-WUnk6YyYWIpdu_6orM,7414
src/detection-rules/rules/integrations/cloud_defend/discovery_dns_enumeration.toml,sha256=qxZR7clEmxxtehReAkeX0z3JMPTBGAW40dFt4bPZXns,7613
src/detection-rules/rules/integrations/cloud_defend/discovery_environment_enumeration.toml,sha256=olnSzBpfVCnSzsCfCPWCKobpLAqCvJyElheuN8Ym5Dw,7028
src/detection-rules/rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml,sha256=TcnCQ7tFr9UA-Nhoui1uL9nGL7qOWf7q9cPeLhrlfdY,7763
src/detection-rules/rules/integrations/cloud_defend/discovery_kubelet_pod_discovery_via_builtin_utilities.toml,sha256=3kG1F1o7bamtaDiTBge_QU5RZKRWcfNYm-FNJybAk-M,7064
src/detection-rules/rules/integrations/cloud_defend/discovery_potential_cluster_enumeration_via_jq.toml,sha256=vlVXJ4-KFsKVN4BUdrx0emQfu6ij4tzdVN37Kbg5jz0,2105
src/detection-rules/rules/integrations/cloud_defend/discovery_privilege_boundary_enumeration_from_interactive_process.toml,sha256=n4L6xKOvYzfI-deIH1eEYUyOH0dj2Cno8Wdfz98R_T4,7596
src/detection-rules/rules/integrations/cloud_defend/discovery_service_account_namespace_read.toml,sha256=7jIZtgSsAP2Swe81odK59JkiTvcHiGpy6jkmPb5fD_o,7069
src/detection-rules/rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml,sha256=P-YGyzjDYvDtlOYe-XXhrgIJLHRb6SnJmjm0d4D4er4,8989
src/detection-rules/rules/integrations/cloud_defend/discovery_tool_enumeration.toml,sha256=kBKMMe_cjmtuSup8ehO4vyVZ6aQ3YIQ_gHlqS8YuSPM,7186
src/detection-rules/rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml,sha256=sBilvbvJmTMpX2pxNtS9YivUbOkaiq3XM1q3VBMUkNc,8084
src/detection-rules/rules/integrations/cloud_defend/execution_container_runtime_cli_suspicious_args.toml,sha256=-2A6ewKhEBPA067Y3pgvVd5HUhI8guCTr8XNB3e8jfw,4144
src/detection-rules/rules/integrations/cloud_defend/execution_direct_interactive_kubernetes_api_request.toml,sha256=0K9n_iISNvM6nYB1J6ebicgEAMm99fSB-NQBw9NfrLk,8995
src/detection-rules/rules/integrations/cloud_defend/execution_interactive_exec_to_container.toml,sha256=9KHzgpG89CSV66oZT6Vs-SKmJfX-YvT7BXh3M2lwzuU,7787
src/detection-rules/rules/integrations/cloud_defend/execution_interactive_file_creation_followed_by_execution.toml,sha256=MHfYiqrXaxlt8-szkbPcZA4snCSl8j2w3Bht5kS2p4k,6293
src/detection-rules/rules/integrations/cloud_defend/execution_interactive_file_creation_in_system_binary_locations.toml,sha256=2Cf0lpiCrmFmh_uSA-mf3Tj6CBxG0IqfEdMKT0-_aWw,6831
src/detection-rules/rules/integrations/cloud_defend/execution_interactive_shell_spawned_from_inside_a_container.toml,sha256=VAxxtEM167qoZ2GksqG0NpU7_CZmPPizlYPt9QYIdc0,6668
src/detection-rules/rules/integrations/cloud_defend/execution_kubeletctl_execution.toml,sha256=FbY-Gg3q9mcVN7iZPZtWIQXhqE_FYeXc6z2WNw5KkSo,7310
src/detection-rules/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml,sha256=TRPiKCF0914qXthf7UJ09__vwZ3Wd0xdNu_RzfxkoOM,8688
src/detection-rules/rules/integrations/cloud_defend/execution_payload_downloaded_and_piped_to_shell.toml,sha256=QxMjYdqPeIlgB2R3LLI4vW5cKsBj-WS01XwHjwbWW3Y,7802
src/detection-rules/rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml,sha256=jhjjrOTC6yDYopnK1sMZbNeh-tKMxoD8ccqAdPV7jMM,7156
src/detection-rules/rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml,sha256=B00MxfrJLr9dP6l5e_wbDXSA8z-KozznV4CIAme1XQM,7859
src/detection-rules/rules/integrations/cloud_defend/execution_suspicious_interactive_interpreter_command_execution.toml,sha256=nN0qc2on6v4nk-0WmaMuvXbAW0zc3myGjOrb2mfy5wc,10232
src/detection-rules/rules/integrations/cloud_defend/execution_tool_installation.toml,sha256=VV4kztfXmjAUrlQkonv_4wPRcZF75G6ApJDKmYjN4sQ,6961
src/detection-rules/rules/integrations/cloud_defend/impact_process_killing.toml,sha256=DBOVgVXsvaaty71sZj0xe-BhuQsW3Xj_QUke3XX3Bk8,6702
src/detection-rules/rules/integrations/cloud_defend/persistence_modification_of_persistence_relevant_files.toml,sha256=UdEpjY45ETHB3zAaFu3R_hTHI9OYDfBJNBU8UToDPmU,10876
src/detection-rules/rules/integrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml,sha256=nQrvZThpxUpLZsbzfq_B6prW4VBMPnsw9uZuueY7JiA,6890
src/detection-rules/rules/integrations/cloud_defend/persistence_suspicious_echo_or_printf_execution.toml,sha256=leAR56gLHzeReLORaS0xw_FYkZh3jrK8b19XZd9v4Y4,10910
src/detection-rules/rules/integrations/cloud_defend/persistence_suspicious_webserver_child_process_execution.toml,sha256=X28WpPQx4tWud-jsf2kf5QQQ6KM8gyd1-KcnZYwbxlc,14067
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_chroot_execution_detected_inside_container.toml,sha256=haBiwvEi1wzQ3EA5LlUsCafdXAacTJlNpvqaVX0RQ-M,6305
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml,sha256=40Ezp0y0AG6NTEIuoXoznr7WDzKsI4eR1-p3PXAhJZk,7236
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_mount_launched_inside_a_privileged_container.toml,sha256=Wq4ZsY5VVE8B42cFf1e_0rCriAJorEFLrgX8NmAyiis,6957
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_nsenter_execution_inside_container.toml,sha256=d8wQRH4Yqjgep-yhkD7Oll1N27fChYjea9gaUI9riMA,3837
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml,sha256=5fbR5wXspPD3RZclrNGGXu0VWFJiFFumpLPux9ZNSYk,6305
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml,sha256=UR2aMwt93RrvpRSjjq_Tpa0Fq9g4HspweU3vq837rQw,6426
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_unshare_namespace_manip.toml,sha256=Wwzq4mPdnhHzTUgvH5Je1l4BlsMxnsgpFYLSJH2QEys,6079
src/detection-rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_error_audit_event_promotion.toml,sha256=Wuo7dY9NgaJ-mrUkhkGOrPh-RtpnnyV1fJFPqFj79Os,2061
src/detection-rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.toml,sha256=ZOL4skl9YqWjNq3ShK-1cZxu5TCd_EAE5LrERc6FagM,2917
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml,sha256=vmfNPkUdYC9b2BM_C4hOPa9tmBt8dcwOa0vUbvFNTP4,7122
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml,sha256=4kqWPhPEOl0fiF-lZFToRLr9a863UQF73UNyk8dUB78,7233
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml,sha256=4BhxVxJWsdMDRtUgbjCFaClLsRgJryap_NKR6XipUL8,7346
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml,sha256=RjA7L8hoc6vv2UR-rhti3lGjjRM6-oCsczFjVMmHDxs,7160
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml,sha256=2bCBhYJ5cF2xv1q8jef9LOhN9Un645_9eFyj0lDHdpc,6987
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml,sha256=u9ZAdypPvmlFMe5cAeAv7mfZoYtKlI64_QT7XgDlvvU,7191
src/detection-rules/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml,sha256=jwZMHt3bYonL--BS-F9pd7KnwuR1TXk7COZnfk7vIH0,6857
src/detection-rules/rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml,sha256=aoxOxRz075vLp8nXiyX2xMjenl6eHxwJ395wGgWjVWc,8107
src/detection-rules/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml,sha256=mUReR3rjLR8FH1u5avQJdaC_xZGuxDtJ2EMl_FOfrRg,8666
src/detection-rules/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml,sha256=WbLlALgpz1JsytBGnVGqTG7yrObiViFvf7Izvym8Y14,7849
src/detection-rules/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml,sha256=fSKeieG4oSLtPUFqNYs5ebA3x7P8V3CrH8L_PD_AiXE,7864
src/detection-rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_detected.toml,sha256=6aYCF6vJq9jFoeHmEQlHki90_jomKfVU1xiuXmejeZc,8837
src/detection-rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented.toml,sha256=K_i3j0ZsXFiJruD8AFPfkTWSsTnrwlxGUYxFjyVrnaY,8814
src/detection-rules/rules/integrations/endpoint/elastic_endpoint_security.toml,sha256=7JuxGnkWghYWeJrQTlNC_QP-4ErFwhZUw_9TWnPhCR8,6892
src/detection-rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_detected.toml,sha256=oINVbk8RAmb4vcg7D_kzJ-eNr6ZvN4jjo38bz4UpU8E,6928
src/detection-rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_prevented.toml,sha256=HqxuwMpWU0DdAPsca_DN7_huN0C-UD4StK9ePoxSRxo,6907
src/detection-rules/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml,sha256=j0CdnaijJeAt9XYH333dOfAzwNQHyPQuGY4ylgwRoE4,8719
src/detection-rules/rules/integrations/endpoint/execution_elastic_malicious_file_prevented.toml,sha256=-ZPqaZmP2z-Su3cEmdqW4knt99pjQm2JQtU7eTBXHY0,8697
src/detection-rules/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml,sha256=i0euPpVIU9ybfJMJd_KLq6vgW0eYJAXZ5AuzkKx-RKk,8674
src/detection-rules/rules/integrations/endpoint/impact_elastic_ransomware_prevented.toml,sha256=hWJgYtCQYC05-sA4f2dzwKiHOK8nylNPT8AizyzDBLo,8659
src/detection-rules/rules/integrations/entityanalytics_entra_id/persistence_entra_id_device_phishing_kit_default_os_build.toml,sha256=M1yqcV6x06ZNz5JSYWt5hOCIr7V1MVEe_hpPqITB7GA,7689
src/detection-rules/rules/integrations/entityanalytics_entra_id/persistence_entra_id_device_roadtools_default_os_build.toml,sha256=RbNo2ptNVZGatjaq5rr6oqBPxwjuDC65rWzwLsFJz7w,6716
src/detection-rules/rules/integrations/fim/persistence_suspicious_file_modifications.toml,sha256=xHG2oOZaAl-yOXeqkFU0tLIxMijxVPZSd-pIVZ_wk7M,16172
src/detection-rules/rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml,sha256=9Lc33Kvv84JFLngqTGCvsM3Ixk9IOq-UvTukCw6xk_g,5752
src/detection-rules/rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml,sha256=bIQGZTB2-FtuGR1iXYGGLiGzT1CuNwWNP_lt_AO-OJs,6070
src/detection-rules/rules/integrations/gcp/credential_access_gcp_gke_rapid_secret_get_activity_against_multiple_objects.toml,sha256=TBEmPwX4f9kNo9VC-oOvqa3AF-KF3WoB3AnaU-YhqhA,4666
src/detection-rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_suspicious_user_agent.toml,sha256=tHT8o2SZim_2ganhX7_uvPF6aDqUWVfomAnAvzVMpWM,2544
src/detection-rules/rules/integrations/gcp/credential_access_gcp_gke_secrets_list_unusual_source_asn.toml,sha256=gwJxbbOf3SzidXb0wqYnVzRqiTA--J6n57ZEAegw8Cs,3186
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_created.toml,sha256=afxs9n5FUzIoz1dlsvMQrbKtO3AzDpoNZyk3l_rc_aQ,6596
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_deleted.toml,sha256=OVReg2SxCqmnuSaMRbUAlSVJdbUeM8PTAKZUhKQi80I,6057
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_modified.toml,sha256=uCZxb9WgwaDfrPQUrGOnKE825Yz1Yr-lyL6To25Mm8I,6207
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_logging_bucket_deletion.toml,sha256=Qm303FokKJ5hf6JMFpmMz3LbgoH804VeLKYFwxWQwT0,6312
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_logging_sink_deletion.toml,sha256=6Ymp0LfwJQIf2QjfEevPAQKVKFfxpGL8DaAjI31n-Ik,6047
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_subscription_deletion.toml,sha256=rxzprvXNAEprwypEkOXGJOyn0worcG98f2w0q1wG2AM,5995
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_topic_deletion.toml,sha256=NX5KZZ1OjQfAZLOucJxQdWXBHb9BlgoGJyZ0b7pChFU,6173
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_configuration_modified.toml,sha256=Cedwz1Lc3rVFA0B5-hP9VR-dy2ip6hYI5aJv3mdB1bA,6241
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_permissions_modified.toml,sha256=0MMkTdfPAetdYJ7ssYyFPW6QlgrTOQBNo4YQdV8U2Ds,6773
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_network_deleted.toml,sha256=73hxp0dMaatbWeQin357EkzIFGc-HibzQ7CvByVIOjI,6150
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_created.toml,sha256=gXr7zDwfOw-Gl3RChvJzWKlrqk8N1eqGxPL3SAvPBec,6567
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_deleted.toml,sha256=MWLqkrtlXPSGbnZ3D3P2D_LxdppNRMZvoj0NkouimmM,6475
src/detection-rules/rules/integrations/gcp/discovery_gcp_gke_api_request_failure_burst.toml,sha256=29qj_5RbMFTS5iKrRY27KCDGZsPN_ekJRsdAxe0Oa6k,2921
src/detection-rules/rules/integrations/gcp/discovery_gcp_gke_suspicious_self_subject_review.toml,sha256=-Oh6N6en81fnyv7QfVngW-dPF8uSLoTJBbV9Wk4NiYA,2878
src/detection-rules/rules/integrations/gcp/execution_gcp_gke_user_exec_into_pod.toml,sha256=AnDbuSVPtSwrYvo4pVBj1XZJIyTXq42bcY8NhqFsiLg,2509
src/detection-rules/rules/integrations/gcp/exfiltration_gcp_logging_sink_modification.toml,sha256=LnDqwRTPDdHGBKF9kAsXunfPH9nT8nPaFqyI8yeZmwM,6565
src/detection-rules/rules/integrations/gcp/impact_gcp_gke_coredns_or_kube_dns_configuration_modified.toml,sha256=YxtiOMlMa6EehaQlGaJpAzZ5Cde5_iM7aLZEgBdqMAw,4287
src/detection-rules/rules/integrations/gcp/impact_gcp_iam_role_deletion.toml,sha256=0fYFVaGh6Bmss32ABbXi_XZ7ZtHt9ukaEZEiJU1UcKE,5738
src/detection-rules/rules/integrations/gcp/impact_gcp_service_account_deleted.toml,sha256=0yq1M0XWPuXlv_aud_ahHFNqh9-LySj9-XG2yGWq2-8,5727
src/detection-rules/rules/integrations/gcp/impact_gcp_service_account_disabled.toml,sha256=3ZX5Wn-wUW6toQXkHNILWyIehb0JtXA7LiH_2BZ-7mE,5651
src/detection-rules/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml,sha256=zL2jYyqBwHM6S11Ffi9Bv0DTkxITSvJReusWYTslRDE,5495
src/detection-rules/rules/integrations/gcp/initial_access_gcp_iam_custom_role_creation.toml,sha256=gSh1SvXVwS-Ayp9J-8uCc-VrBduUclT65b8XXOEy67s,6700
src/detection-rules/rules/integrations/gcp/ml_gcp_error_message_spike.toml,sha256=ichY4bA5mcVRBRn16Fx3M7CqqjodEn2seFXsH6U7CKI,3522
src/detection-rules/rules/integrations/gcp/ml_gcp_rare_error_code.toml,sha256=GJN2AE-K0m0AKJCLC8KM8j_qpgBVW9bSGN87yaXGmvo,4035
src/detection-rules/rules/integrations/gcp/ml_gcp_rare_method_by_city.toml,sha256=1la3dvf5oGhZU0LFBIExXtSxHmCSQCdmSb0gedurGW4,3742
src/detection-rules/rules/integrations/gcp/ml_gcp_rare_method_by_country.toml,sha256=kunqvsQd8oS6EQvxEk6TEYlRJkJzNQZGZZr81EAjFSo,4170
src/detection-rules/rules/integrations/gcp/ml_gcp_rare_method_by_user.toml,sha256=aMg82WXN_TvSdH6ZVbcB-VvaWkrnqv79oaVIZ6_0gG8,4790
src/detection-rules/rules/integrations/gcp/persistence_gcp_gke_admission_webhook_created_or_modified.toml,sha256=DaSjWbd2XxGEqgXWIX67f39KD7nxRTO_LZoFnzkZbA8,3443
src/detection-rules/rules/integrations/gcp/persistence_gcp_gke_cluster_admin_role_binding.toml,sha256=aceWfQ-e6w0jRLxhZ1ITC3Ghr1aivn4fdaxKl9QwE70,3531
src/detection-rules/rules/integrations/gcp/persistence_gcp_gke_role_binding_referencing_service_account.toml,sha256=Vvpk6a495x1wF-MRvsT7QNV35HY96PdP9nTNzGbmU1U,4105
src/detection-rules/rules/integrations/gcp/persistence_gcp_gke_sensitive_role_created_or_modified.toml,sha256=mrDS8ZTMuf9ci4xuebo0tfueTr9cnwAq4z-s01KnHts,5530
src/detection-rules/rules/integrations/gcp/persistence_gcp_iam_service_account_key_deletion.toml,sha256=HFALypNIRmi-xihbMEgDBgsdSAksvMm9roSS4keXQ3E,5996
src/detection-rules/rules/integrations/gcp/persistence_gcp_key_created_for_service_account.toml,sha256=xWrK4FbHlV3RxP1Jh-6NJFA-OuZhIlq5_Phbd6gnTuc,6290
src/detection-rules/rules/integrations/gcp/persistence_gcp_service_account_created.toml,sha256=wlymr2GeoNtVClWHN1DudK9q59aGjl9QMtBGtOE_oNw,5750
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_excessive_linux_capabilities.toml,sha256=4LVBduWGv9n2w-deDUP70DY2y4q86-1lm6EVF_H4S3E,2971
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_ipc.toml,sha256=tSzjSMc2qdCKpPjM7mS_4NnidROLE9OYTRX4g4cZIiY,2688
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_network.toml,sha256=UMomX3rM717ikIxp_TAlpSrz3eEsW0b9Y0NG3x1vyBc,2759
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_pid.toml,sha256=0mvZ4bbkFk1VR0WxDk56XbYV0LbAgI_OwQkGJ60M07M,2696
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_privileged_pod_created.toml,sha256=cvtDbRZM25P0G-oUZgeTLX6_-2hv6KROx_Jm7t8z9n4,2966
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_rbac_wildcard_elevation_on_existing_role.toml,sha256=BB58ZvOG3-RkoND9xGkU68jI1M0_vfCA4R9GBgs45gk,3975
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_sensitive_hostpath_volume.toml,sha256=A3k6ODanSuby1f-LdMOZ0vaXt4HSi8Ex5A5p3Rx5CAU,3248
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_service_account_modified_rbac_objects.toml,sha256=BDPmXP8VnjpG40_BsHNaDvvrdzrulVnhTDeXAPcVMOI,4737
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_suspicious_assignment_of_controller_service_account.toml,sha256=cS1N1AZR4E5wJ689Y2u7vTv4RjUltxthp4VAhuIjcQQ,4539
src/detection-rules/rules/integrations/gcp/privilege_escalation_gcp_gke_unusual_sensitive_workload_modification.toml,sha256=p_XkwPFTlRq_6AsceccqNRwe4ANVmI9MF7eRH068DlE,4216
src/detection-rules/rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml,sha256=MXPwfnf0K6Om2XuwJa_212NQUsdArWu5sCjfAPKUivI,5381
src/detection-rules/rules/integrations/github/defense_evasion_secret_scanning_disabled.toml,sha256=WdSye75b9D_Fu2bpi5YeGJowbKQEukTy_j-OkilvYKE,5403
src/detection-rules/rules/integrations/github/execution_github_app_deleted.toml,sha256=pAJtHJW1B_5mLPc8QEseGASWAs1rwkM5YJZ96nuSFS8,5231
src/detection-rules/rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml,sha256=wIH2F_BdeIxTHKttxVAn9foeQjIZQ97RswRKp1Bpq6o,5525
src/detection-rules/rules/integrations/github/execution_github_ueba_multiple_behavior_alerts_from_account.toml,sha256=6q-SntMIphiYXYTB1_Th2IH790UQp_-7pI2uqtWrzi8,5139
src/detection-rules/rules/integrations/github/execution_new_github_app_installed.toml,sha256=ZyVUOYZ86GdNa_ERaTBuJlvPYT8PaUi0pfhpMipipxo,5604
src/detection-rules/rules/integrations/github/exfiltration_github_private_repository_turned_public.toml,sha256=PQeDbxY988Knete7tII0SeaTph4u_1q3iXvp5d9qvUw,5510
src/detection-rules/rules/integrations/github/exfiltration_high_number_of_cloning_by_user.toml,sha256=fAeUaE_8wV5ndHrEY1S2MURzAQWs_Od1DPpZ9vH9haw,6468
src/detection-rules/rules/integrations/github/impact_github_repository_activity_from_unusual_ip.toml,sha256=tQc_f7MttZQf3IbLKs31w2JzcZ1ufmJlbzJs8l727co,3048
src/detection-rules/rules/integrations/github/impact_github_repository_deleted.toml,sha256=SveZRqG4GBOoE4A1ih1ZUXXeGhcjgEoqKCl1guhejQg,5254
src/detection-rules/rules/integrations/github/impact_high_number_of_closed_pull_requests_by_user.toml,sha256=DqlwRprDVOR-fdR9soWZr9Vx7utFNU8h3sqWkmYIX9I,6802
src/detection-rules/rules/integrations/github/impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml,sha256=K85HbnQJPtE_1X-xmZdicEapfA14ggDno6m2QBUg32Q,6778
src/detection-rules/rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.toml,sha256=iVpnMta8rwwk0mas5kUcs6qtjnL2zqdMR3T2tCfQFxg,7334
src/detection-rules/rules/integrations/github/initial_access_github_actions_bot_first_push_to_repo.toml,sha256=0l2_n6EYwbtfcv6TXjB5vnQF9EyGD1zfgYGkY4NuxXY,5009
src/detection-rules/rules/integrations/github/initial_access_github_actions_workflow_injection_blocked.toml,sha256=ov2q5jfRXf219uiIlkzqANOC6OmBZo0qgFQ1zvF8unw,5239
src/detection-rules/rules/integrations/github/initial_access_github_register_self_hosted_runner.toml,sha256=oE094JO-jZEfyVXP04wIqUC1VRABwkTNc5Fhc_IWtsE,3642
src/detection-rules/rules/integrations/github/persistence_github_org_owner_added.toml,sha256=qvwuKeOCYSQLiqUkDYVmklzzu3rPZvueebdP8Gx-kXs,6060
src/detection-rules/rules/integrations/github/persistence_new_pat_created.toml,sha256=LK7YeOWGCQGUzLQiDvNrfJbxTwzJJfS4NrF2MZIqhk4,5732
src/detection-rules/rules/integrations/github/persistence_organization_owner_role_granted.toml,sha256=G2AR9sp20GaMEhRk96ECeocmS_BotJRB3GUHdM6TZaA,5573
src/detection-rules/rules/integrations/google_workspace/collection_google_drive_ownership_transferred_via_google_workspace.toml,sha256=LE0_q7M7PdNNEqMyS5X3yCh2is9vHX6SoWFfnY7JpyY,8189
src/detection-rules/rules/integrations/google_workspace/collection_google_workspace_custom_gmail_route_created_or_modified.toml,sha256=XH5n0lf_oKHp5FF2J6-sx7uYBDhv6sCa0a4f5tc38Tc,7504
src/detection-rules/rules/integrations/google_workspace/credential_access_google_workspace_drive_encryption_key_accessed_by_anonymous_user.toml,sha256=WgODFb1j054TZVqlLDKqe2OzeXvpUXx_NY-yIeIW_CQ,7134
src/detection-rules/rules/integrations/google_workspace/defense_evasion_application_removed_from_blocklist_in_google_workspace.toml,sha256=AoAaa_EfLvPgXKYJFMnYWUNfMxlk_DtJTkHlOldjFxM,8197
src/detection-rules/rules/integrations/google_workspace/defense_evasion_domain_added_to_google_workspace_trusted_domains.toml,sha256=t6OkWHmbmapHcwUb8NmZv7Ph6c7RJgHYsQmQ1OD4lmA,7922
src/detection-rules/rules/integrations/google_workspace/defense_evasion_google_workspace_bitlocker_setting_disabled.toml,sha256=lCQxsh7lYUx9b2czWoNjvXJfVhmEmVTahDmiWveLs4U,6863
src/detection-rules/rules/integrations/google_workspace/defense_evasion_google_workspace_new_oauth_login_from_third_party_application.toml,sha256=wA5xvxBOhGLj_3Mwfxtq1id1hw-_vMplFg-B3vSEyxE,8585
src/detection-rules/rules/integrations/google_workspace/defense_evasion_restrictions_for_marketplace_modified_to_allow_any_app.toml,sha256=FZhfoBbRN9nfcoPSOxyNuavd5gx0flymY4An6slUVao,8148
src/detection-rules/rules/integrations/google_workspace/google_workspace_alert_center_promotion.toml,sha256=7aQKKAG88hmXw-lEXwqxSfQxff8hzz0uoUMiffW_rQc,2230
src/detection-rules/rules/integrations/google_workspace/impact_google_workspace_admin_role_deletion.toml,sha256=BkznDpD44N2htZcytBQg0nXHG2FTNYnm4-EwyTXWIgU,8236
src/detection-rules/rules/integrations/google_workspace/impact_google_workspace_mfa_enforcement_disabled.toml,sha256=1wctRea19lUohk-z3SpZl4bQn0wnrv0n6cfwkef5_i4,9499
src/detection-rules/rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml,sha256=xsAMUfx2Np-xza6i25_sYZE5CABtbkAT-AC5muLW7vg,7586
src/detection-rules/rules/integrations/google_workspace/initial_access_google_workspace_login_from_atypical_asn.toml,sha256=nGR7UCxUX-hvOpjQCqeN9ZBeRbr22JGHbQDAjBoUYj8,6638
src/detection-rules/rules/integrations/google_workspace/initial_access_google_workspace_login_impossible_travel.toml,sha256=VFiXFhj4BKovsn6dvc08aa6ocYuZOUojwDDKn2NPTwY,12263
src/detection-rules/rules/integrations/google_workspace/initial_access_google_workspace_suspended_user_renewed.toml,sha256=Sun5rRcLS2oNDO4GHn2VKcSFskVbnl6aLsGFrJYmTos,7658
src/detection-rules/rules/integrations/google_workspace/initial_access_object_copied_to_external_drive_with_app_consent.toml,sha256=7bDMcBwWp8LWypTEgIzL122akc3VaI4XABB-MAk2axA,10997
src/detection-rules/rules/integrations/google_workspace/persistence_application_added_to_google_workspace_domain.toml,sha256=rzIE7adV0TpR796rl7d45Y25cYUIKZCEvgd_qboh54s,7617
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_2sv_policy_disabled.toml,sha256=qGZKwEZTKmT2PGFJ8i-DPq6Ebx--bAeOlmkcrLWOssU,8054
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_admin_role_assigned_to_user.toml,sha256=CM4_nBHZTk8K12Q1rU-xLNxLwhBzJAnr6Ytf2K1reec,8286
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_api_access_granted_via_dwd.toml,sha256=zW1BPke0VEP1jKXieLMyCD43VvFZXspGGoRKYqx49RA,8887
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_custom_admin_role_created.toml,sha256=xcxzzavQ-gcSPxKiS5xMBcCluFhjWmqFPe3V_YLYpw4,8422
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn.toml,sha256=4CtKvx9S2DDESouhj5CqF55z_vB8JkyMQekbjhw3l_I,4449
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_device_registration_atypical_device.toml,sha256=lR8LeKMqstnmQXi9BbonDf18WOYH6Y5VtMA9cLUG97E,8620
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_device_registration_burst.toml,sha256=VGHCDe2VYPWES8ja3ph-BaOcG41X2Rx_2shovddewUQ,9963
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_password_policy_modified.toml,sha256=E52hn_Ok4DzBm3kcX8AXFPJmqkB8zxcL09RdvJqCSLo,9345
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_role_modified.toml,sha256=P8cSdfh2ByD8b1CVaul0jtwIoDP8tc_sZU1_cxiB2HM,9259
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_user_organizational_unit_changed.toml,sha256=DEXC7DeFodqr-KrvbipANbzgskK-KYGrpECLWjm9Clc,8052
src/detection-rules/rules/integrations/google_workspace/persistence_mfa_disabled_for_google_workspace_organization.toml,sha256=cHvYIxKOyAaAQ2J3VtBkNQaSQMOa-uUfB6Wm6i3fLPY,6597
src/detection-rules/rules/integrations/kubernetes/credential_access_azure_arc_proxy_secret_configmap_access.toml,sha256=_O52AflHQqhv4vu0ifM-W3UcPYAos-Dy3sMSZ6TaeJI,6878
src/detection-rules/rules/integrations/kubernetes/credential_access_get_secrets_access.toml,sha256=gy_fqs0K5PTE5d3TRtkH2UHHvRx6gArHO2So6iDbFhA,6048
src/detection-rules/rules/integrations/kubernetes/credential_access_kubernetes_multiple_secret_retrieval_burst.toml,sha256=LwQOYXzm7TFemMACJE56t9anEL0Fi244oZkHwFZj3rc,4316
src/detection-rules/rules/integrations/kubernetes/credential_access_kubernetes_pod_exec_cloud_instance_metadata.toml,sha256=y3G5uGuVUCp7YBLxOTGhapYgPiebWjtMLaad0wndtyY,5329
src/detection-rules/rules/integrations/kubernetes/credential_access_kubernetes_pod_exec_sensitive_file_access.toml,sha256=FW0pRQkTFbN6TtgKaaIZlbMgbMLF96TDArBPBkRtN2A,6407
src/detection-rules/rules/integrations/kubernetes/credential_access_kubernetes_secret_access_scripting_http_clients.toml,sha256=7XPl1myYVKLuvpfX_l2uGD91K5G_k2C45-5Hnh_K6zs,4301
src/detection-rules/rules/integrations/kubernetes/credential_access_kubernetes_secret_read_by_node_or_pod_service_account.toml,sha256=mUz_F35kVnHZ5wJMpi2gaE_K1xd55tip4aGC76HJghE,5691
src/detection-rules/rules/integrations/kubernetes/credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces.toml,sha256=E79eTF5cAo0nKeY6tXpHPB3KQmA3TyUpcgcK-Lcb25Y,3177
src/detection-rules/rules/integrations/kubernetes/credential_access_kubernetes_service_account_token_created_via_tokenrequest.toml,sha256=V1_mexmwOgKpyEdZtb95Vkv_Urf80y13WGFLNgAVFlM,5017
src/detection-rules/rules/integrations/kubernetes/defense_evasion_events_deleted.toml,sha256=RsIQoj20y8a2AbMyLpfaW65fo72OnL0CJ62CYFX417U,5673
src/detection-rules/rules/integrations/kubernetes/discovery_denied_service_account_request.toml,sha256=YiXnBMtCJHKaxokcP7SKvyfrUqjyQdC8mAun2ge729g,6798
src/detection-rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_anonymous_user.toml,sha256=U_iSnu41PVXZUUk0qYcpjLX7RF6ua357OGOZ8QshR54,9556
src/detection-rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_user_and_srcip.toml,sha256=t5fgtZ67zsnEzcLjmGmYK1vDLb2hSXU5arIQrWwdwAU,7410
src/detection-rules/rules/integrations/kubernetes/discovery_kubernetes_multi_resource_setup_recon.toml,sha256=3d_t-fEZ4CISQie4YH_AdGEStxiM_lVKJP9E9UX7038,5286
src/detection-rules/rules/integrations/kubernetes/discovery_suspicious_self_subject_review.toml,sha256=Wjd7d2yNJ4NMJNl7Y8uXC-0lvOmCkNhdpeI0TcO3MA8,7338
src/detection-rules/rules/integrations/kubernetes/execution_anonymous_create_update_patch_pod_request.toml,sha256=kQlSKA_fqlecF0FBLr8RIacw-8fFu0OKpN8c5AacDvQ,1670
src/detection-rules/rules/integrations/kubernetes/execution_forbidden_creation_request.toml,sha256=3e2A3HPL9KUClWjzMuukWYuZIqXK9iJdI9dfOFR89zg,6450
src/detection-rules/rules/integrations/kubernetes/execution_forbidden_request_from_unsual_user_agent.toml,sha256=UaoFrnwiwYZlk9wLa2CUbqICl3g-0c67V2KD5_IYSxU,5995
src/detection-rules/rules/integrations/kubernetes/execution_kubernetes_pod_exec_curl_wget_https.toml,sha256=dRu172MhUk9RYHAFdOFdVI9ePP-xMCSnVzKW9Trl9Y0,4520
src/detection-rules/rules/integrations/kubernetes/execution_kubernetes_pod_exec_potential_reverse_shell.toml,sha256=zfjEhbCqN2RYfBFLTPH_li2ynO8SwdOP7v-1mpgdLjE,4047
src/detection-rules/rules/integrations/kubernetes/execution_unusual_request_response_by_user_agent.toml,sha256=WruhGORAvxfDwoSeWxhPSoqlurGaLIidp6rEjSyjuJQ,6358
src/detection-rules/rules/integrations/kubernetes/execution_user_exec_to_pod.toml,sha256=CJcyQyC1gfzC46fX0oMilNN4OmjZyBmbQHCwxoN6DWc,9280
src/detection-rules/rules/integrations/kubernetes/impact_kubernetes_coredns_or_kube_dns_configuration_modified.toml,sha256=84gRyc2k62gmcbtzm1ezI22l_tgxgdDd1_rLY_CKDPA,4181
src/detection-rules/rules/integrations/kubernetes/initial_access_anonymous_request_authorized.toml,sha256=S3Orh5H9FJT9IRlsNhgB4JopSxqbrlVmqmz6THLkZdg,6311
src/detection-rules/rules/integrations/kubernetes/persistence_cluster_admin_rolebinding_created.toml,sha256=_n-g0tKqu7DmY0m0LkUFVBaBcRjtS_ZOb64i4heH2bM,6472
src/detection-rules/rules/integrations/kubernetes/persistence_exposed_service_created_with_type_nodeport.toml,sha256=5PFFO0nSBPevlGoabrfwg4XDqTmS8xQ-q1pt89LEKf8,7686
src/detection-rules/rules/integrations/kubernetes/persistence_kubernetes_admission_webhook_created_or_modified.toml,sha256=Ll4ikRauWd2dUutSbn_nFc1yhizWdb6_31MQa7Hkl7k,5999
src/detection-rules/rules/integrations/kubernetes/persistence_kubernetes_client_certificate_signing_request_created_or_approved.toml,sha256=FF1hVuHCfOiV-u-nyY6cF6u0dWGmpsQbzorlEI0hrkw,5624
src/detection-rules/rules/integrations/kubernetes/persistence_kubernetes_eks_aws_auth_configmap_modified.toml,sha256=eW9JjF8KLpPKO0fGk11dosRyUppFhwv8GoEuQ__x6gA,4454
src/detection-rules/rules/integrations/kubernetes/persistence_sensitive_role_creation_or_modification.toml,sha256=uAX5ebxUJG-sRpiEYOPRu4XXkVjTw62G1Ak58MjesOs,8742
src/detection-rules/rules/integrations/kubernetes/persistence_service_account_bound_to_clusterrole.toml,sha256=1ffmSGIpvH5HYwuv4FlMz-KLEdDBGzoP3UTrXicwEpM,6719
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_api_proxy_to_node.toml,sha256=nmTZ-j-qBUrVNOxmn-pzwbzrBQJ4OvJ5I330RWgQtGk,5685
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_container_created_with_excessive_linux_capabilities.toml,sha256=DwUynBOGuzJepsCIHpK0V6qkcVv5eMw51bKXbtgEHvM,5750
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_kubernetes_api_request_impersonating_privileged_identity.toml,sha256=rbyaKSq6avZoXVdXBwtkqvc9f5A9G3CCjeF6mxkYyqY,4808
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_kubernetes_ephemeral_container_added_to_pod.toml,sha256=_CoYr8UoiKzNoM9l7k1-pTYlYJAO9gR2i_hk4qVCV04,3841
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostipc.toml,sha256=7r7kNrMtfzoP14yWnVGfWbTTKAlyd49CySJj_QXvKFU,7313
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostnetwork.toml,sha256=2kTogM0-lI2uLZcVWQAj4O988RUuaOZ_FUwXGfy92OQ,7412
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostpid.toml,sha256=KTQxS8P4Yf_6wh8RbHXAvt7jW4xudtIELNpUAlhcDnQ,8086
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_sensitive_hostpath_volume.toml,sha256=FwNAYI8X8OEU0TpnWNBvyMEpC6uKrz3ng1B2dh5hPNc,8854
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_privileged_pod_created.toml,sha256=SDjlvwH6u3VbRzEhqhTD973RXCT09TzyleKKVGCfIEg,8376
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_role_patch_wildcard_verbs_resources_response.toml,sha256=oOUf67If6gmxZRL4Wi7AhtKvfIYrj-eW0FLJpPwPl8Q,3844
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_sensitive_rbac_change_followed_by_workload_modification.toml,sha256=v_MUPTJ5-ZVeCosdQXjREyvCDloduiYvG7-7C42xRSo,6772
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_sensitive_workload_modification_by_user_agent.toml,sha256=IOtHQihZTmF_TCuCSdL4wIz18IemvgaaKCCm4Ejjoww,6910
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_service_account_rbac_write_operation.toml,sha256=fbiMJtm3qlBSQeDWsqBUcEdumEMgqHREWkoeqw9A-f4,6411
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_suspicious_assignment_of_controller_service_account.toml,sha256=3lfW7UGX2L3_5KXmR-k7rU6txdERENOWSgrYBn9XIkQ,7284
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml,sha256=EF_XiTdaYKxGJUbw7tC7zORdGTM8A-QLyUXtPnb6d_0,7613
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml,sha256=EFZ3P3Fy0jQ1hjfiRLMVkG4cN7quXLpxdsRGL5P4AvE,7466
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml,sha256=mwOsjscR21t7Niyadu15dM04tnb5Ys2YiLIw1wXg3Wk,7787
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml,sha256=SA3__JCagR6KVJqjrpylFEQUW8hYhAv5-jfcMoyWN0M,7550
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml,sha256=SJirZ965EfnfbtCln_B8j_OenzNXtVFqvIsWaS44zFg,7627
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml,sha256=J0JUqDd2gP3CeTlvmdPCoXIxs7CfMksB1wiYZoOT5BU,7131
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml,sha256=k7BpevQ9cYiqbZ2FSgmhr4onnU_WreVv6hUHPKEiDi4,7581
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml,sha256=CFlcOfGDTY1OTWxUAxsjZXi6fAmyTXG29hzejnt-AxY,7386
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml,sha256=Ek9BlGGzbTjxXcyWYyi-qYMY7KKdRDJMb3kfKPuxSig,7468
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml,sha256=lWkbm6v5tBX5knEFlO7VymtMsD1ogQYIOb0YwJBEni0,7543
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml,sha256=YhOO9CzWX6peFkpmRZupAm4F9I2nxYzziYRcFXQb1_A,7537
src/detection-rules/rules/integrations/microsoft_exchange_online_message_trace/initial_access_azure_monitor_callback_phishing_email.toml,sha256=nqBK2w2tRRz4j2AjrgfwarNQPsyHHItqvCNXUqKC0Vw,6370
src/detection-rules/rules/integrations/o365/collection_exchange_excessive_mail_items_accessed.toml,sha256=oul5m4II_sf2sYZcEMvEHduj0bgWEvXQNDPrKcWb9sM,7497
src/detection-rules/rules/integrations/o365/collection_exchange_mailbox_access_by_unusual_client_app_id.toml,sha256=KBxdDHf1srLfnVCI7bQD5ExBQtn5mW3qWubNqTMiGZw,13130
src/detection-rules/rules/integrations/o365/collection_exchange_new_inbox_rule.toml,sha256=dLFJYb2T-M1OPAhxQDF7_4MZrBpyyIVsjocAJfe3hj0,8134
src/detection-rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads.toml,sha256=-QjSBX6uM2bLcsEyM_oytaJgPjqDEhqQbStVmw1OGeQ,8505
src/detection-rules/rules/integrations/o365/collection_sharepoint_file_download_via_powershell.toml,sha256=jNErCBcorL0p86bCrf6mHV36mRsmGoz02VS2_S5ZAZQ,6012
src/detection-rules/rules/integrations/o365/credential_access_entra_id_device_reg_via_oauth_redirection.toml,sha256=pb4Ck4fn4Q3ioO1J0KpLjliJ0rFNQlwI5raKtF72330,5758
src/detection-rules/rules/integrations/o365/credential_access_entra_id_potential_user_account_brute_force.toml,sha256=eA7fN3Uan9O8xcY_G--97YY8zxBZPAmkPOPLM_7K5Hw,8759
src/detection-rules/rules/integrations/o365/credential_access_identity_user_account_lockouts.toml,sha256=Cf8xtU8cy22uoZwK3eAWbGu_4CCplTIsDMk5pfLhiPY,6985
src/detection-rules/rules/integrations/o365/defense_evasion_entra_id_susp_oauth2_authorization.toml,sha256=sdfULSVHMIb4Mc2uhJFgJ1KXqfXp7M-VnMWoCpMwiyk,10866
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_policy_deletion.toml,sha256=ketn8MxuVqiPDBF-pckonFaX3MQACzrEuq_zrrk7-5o,6072
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_rule_modification.toml,sha256=dPBqjYn6cm7uNw1aaxIQKGiGJwQfxrwtfvbhnfOzV-s,6070
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_dkim_signing_config_disabled.toml,sha256=b_ATbEeTHS5hHUpil08_2W5frMYTIyxjgqd0ZvEyWh8,6718
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_dlp_policy_removed.toml,sha256=2c_wcUqHnhLptoH4wJnCLrkLpE6Hn0CJW4LS807WwU8,5375
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_exchange_safelinks_disabled.toml,sha256=lzEPmQUy-daHBR3DEr-SzU2GmTVIcw3gwTeQZFDzdNE,6141
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_inbox_rule_obfuscated_name.toml,sha256=hcLHkKBaEVYhTcRVvoVaudEdIchzJfpij-I1zW2ql4Q,5492
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_mailbox_audit_bypass_association.toml,sha256=p31lKw9O5DttgPdAnSJ7yd3JQy0Mp9wDITv1yRrIIkY,6438
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_policy_deletion.toml,sha256=5IghON0BKlzmgUZKOoqksN3nPR_bi33iqmzvu_YzQxY,6023
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_rule_mod.toml,sha256=jQJ0kuXMOhYxU8lPoEJEQxWksCV9TYjqJim-NcQmuFw,6162
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_new_inbox_rule_delete_or_move.toml,sha256=piv20sp6N5UzczQNK-GMwsBxAXjZSz2h1j56UydOzhg,6422
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_safe_attach_rule_disabled.toml,sha256=ACwtvrRO36wMDmlbFkokAkub1XnOBhdNhfAK5HrPFbo,6071
src/detection-rules/rules/integrations/o365/defense_evasion_mfa_notification_email_deleted.toml,sha256=3HgJqBUbRpf3HepEZW4UaAqO16AThuYMLMJ_64055to,6308
src/detection-rules/rules/integrations/o365/defense_evasion_sharepoint_sharing_policy_weakened.toml,sha256=t2RK1U_qeFCzJi_rpkaDZ1CEDwOzx1hLTZvTaviuVCw,7565
src/detection-rules/rules/integrations/o365/defense_evasion_teams_custom_app_interaction_allowed.toml,sha256=lvy9t7GrIGRahe0aX1qIOgonRCdPLC-zeQuovHiECe0,6702
src/detection-rules/rules/integrations/o365/defense_evasion_teams_external_access_enabled.toml,sha256=hU-F6bHMeDsPXLA9I1IJy3dh0-D-Wa_TjQ_IZ801mVw,5751
src/detection-rules/rules/integrations/o365/discovery_sharepoint_sensitive_term_search.toml,sha256=01jW_gDIZvJrJtgAfLhE4oYpDMuPX4RKwYC_uSibTIQ,6088
src/detection-rules/rules/integrations/o365/exfiltration_exchange_transport_rule_creation.toml,sha256=SmG_G_DRMWcmSm0UAkHKCvoTrukkk30nRKH8eHomVVQ,5980
src/detection-rules/rules/integrations/o365/exfiltration_exchange_transport_rule_modification.toml,sha256=hcvrY6jTRN5TJ-9GymqwTaJ8r99FcpDzAJSVqCGM6pY,6593
src/detection-rules/rules/integrations/o365/impact_security_compliance_potential_ransomware_activity.toml,sha256=huGBN6Vz_m6qyjToUpIBvIjtEk7xzzimSs2RTVisM2c,5907
src/detection-rules/rules/integrations/o365/impact_security_compliance_unusual_volume_of_file_deletion.toml,sha256=JD0YUceNznPhmqqP8ZoKT7tri_0Zk3H2XaQKgSS7bEs,5900
src/detection-rules/rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel.toml,sha256=7c2jLpYhjwYO5E7FVLPvERSVPZqsGotUid_zr0TCKdA,6133
src/detection-rules/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml,sha256=h4qeNOFLIDnOZP3PSCRsE-5kf63DkdP8NiyhbuG6G-c,5593
src/detection-rules/rules/integrations/o365/initial_access_identity_illicit_consent_grant_via_registered_application.toml,sha256=ffNHVETBKAclaraWRcIyBSmmPAM6hSgICcFJY0YiSv0,8006
src/detection-rules/rules/integrations/o365/initial_access_identity_oauth_device_code_grant_unusual_source_asn.toml,sha256=920p6mQxpaNQMHlLVazJ50xme1JXaIQnWeSdL_wCZmI,7945
src/detection-rules/rules/integrations/o365/initial_access_identity_oauth_device_code_grant_unusual_user_noncompliant_device.toml,sha256=dCZ7Rez2rUg8KS4Ou0jpqXB7u-d8ZODMshBDKg9nxRg,7973
src/detection-rules/rules/integrations/o365/initial_access_identity_oauth_phishing_via_first_party_microsoft_application.toml,sha256=5xi-UjLGomd0NCBA79Ya0Ix6LZn9O5LEcsYsuvMOkzA,9061
src/detection-rules/rules/integrations/o365/initial_access_identity_ropc_grant_via_legacy_authenticated_client.toml,sha256=4KB25lmQW3jaxrhHTmIUai8YuNk_S9ifsUpFFoVe53U,6450
src/detection-rules/rules/integrations/o365/initial_access_identity_unusual_sso_errors_for_user.toml,sha256=mX2dJB5yShZHEuYcgRkTD3aQ0sP7SOOK-kVQnKTEXgA,7183
src/detection-rules/rules/integrations/o365/initial_access_security_compliance_user_reported_phish_malware.toml,sha256=yuUs6E8_tF7_Jg9I4St54zHr6FCFVigswRzBOkx9xH4,6400
src/detection-rules/rules/integrations/o365/initial_access_security_compliance_user_restricted_from_sending_email.toml,sha256=VkBjAq4PMIOqXDdWdVLzbrdMZdlp2ef-V4zp6O81784,5667
src/detection-rules/rules/integrations/o365/initial_access_teams_rogue_helpdesk_chat.toml,sha256=_XNxquh4p675f475PBusdo91ncCPMBsKSkj2CMFKqEA,5970
src/detection-rules/rules/integrations/o365/initial_access_tycoon_o365.toml,sha256=qgWKsYRquMCdW_6QiarEtjVdQaEx08kkwfrZmqxS-pE,4345
src/detection-rules/rules/integrations/o365/lateral_movement_onedrive_malware_uploaded.toml,sha256=dm5TIr2c2oGG8yD55UjhpJ1Hh5v9Zl03g02mmj_KGDg,6617
src/detection-rules/rules/integrations/o365/lateral_movement_sharepoint_malware_uploaded.toml,sha256=nayHq0wfCDFR-GwQicPz6x1CBfEARQ5RM3ev3Ln3k-E,6622
src/detection-rules/rules/integrations/o365/persistence_entra_id_global_administrator_role_assign.toml,sha256=4V31GUYAej7n-MBvsaiL6r80atKGNZQnaZ0KYorC0t8,5981
src/detection-rules/rules/integrations/o365/persistence_exchange_management_role_assignment.toml,sha256=PZScQtyvACzBT8Io_1IkfNhpM8tlOGvoD8thSlGmGVg,6149
src/detection-rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation.toml,sha256=Id6sKAfO7ADSqhT8-rdb_xPQjSf-aUtVhen8k-92i3Q,6445
src/detection-rules/rules/integrations/o365/persistence_teams_guest_access_enabled.toml,sha256=CFTDWaVEdTaSlACKmHKTLH70R03garWHjOR7HPPMW1o,6000
src/detection-rules/rules/integrations/o365/privilege_escalation_exchange_new_or_modified_federation_domain.toml,sha256=TT_foxi4J_0qNvxvA4ZOTqh_9QrpPoF8OTn9fUIfnD4,6952
src/detection-rules/rules/integrations/o365/privilege_escalation_sharepoint_site_collection_admin_added.toml,sha256=lNCweMMK9FVmLcnIfHN6rJU213YYZmHVMVgipYLO4u8,5772
src/detection-rules/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml,sha256=jioGrrUFnIT0_jb-EdcNm3b3sv1OJ8HFnk9M6KkSlvs,4608
src/detection-rules/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml,sha256=zNWU-cJ3vXQC2yjXyPqlc4XyRDPVzPO1lUfg8gh7JF8,4762
src/detection-rules/rules/integrations/okta/credential_access_multiple_auth_events_from_single_device_behind_proxy.toml,sha256=9ZN81NdY5F7ZpsYWdnPNYBi6kQOpRxfB0bmAf5IxT1g,6960
src/detection-rules/rules/integrations/okta/credential_access_multiple_device_token_hashes_for_single_okta_session.toml,sha256=Sqxyn7-NUo7MxOQM9PDC9dNbv7NoKUFhr7ELeZsh2Es,8656
src/detection-rules/rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml,sha256=E-lsrZWowOD-ss6GsI6g88y6zaJTQyB0iHcCvUaczh0,4746
src/detection-rules/rules/integrations/okta/credential_access_okta_aitm_session_cookie_replay.toml,sha256=wQTIFnDyGdBpKfvjJZlqOZobpO9o3gYzZ4Bf-y0OuDY,9499
src/detection-rules/rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_with_the_same_device_token_hash.toml,sha256=KPBGRkqiU3Hj6byqkRI623md9EnUlpbS_7KZrMfSIVE,7707
src/detection-rules/rules/integrations/okta/credential_access_okta_brute_force_device_token_rotation.toml,sha256=MnqBjtspEQq-Oitn7VViyP-2lIBpei3quF0wFr-qsg8,6747
src/detection-rules/rules/integrations/okta/credential_access_okta_brute_force_multi_source.toml,sha256=9uk5Z7bVsnyGzzCq3bBLc8DrlWniDWrrCmjviEVKWcw,6328
src/detection-rules/rules/integrations/okta/credential_access_okta_credential_stuffing_single_source.toml,sha256=fwHfTaTlwhcItMo_H5YH4bntW1YxyU9qwSxI3Ubkqt8,7773
src/detection-rules/rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications.toml,sha256=8Q_4YUOGi0-1KxvgWSdzF5-W36_nOV71kPX3RDe1wc4,5367
src/detection-rules/rules/integrations/okta/credential_access_okta_password_spray_multi_source.toml,sha256=f68GM4elxdbzvp2hOoewiMjVch-1q8ioZVD6FyloGx0,6652
src/detection-rules/rules/integrations/okta/credential_access_okta_password_spray_single_source.toml,sha256=dC8zxYkQ6WIB9JkhZmjES-2jLt_M2g9NmPonygBmPiU,7991
src/detection-rules/rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml,sha256=TLdD_whzn9VkNdNTk8BuGcFfjAEqgx3yLmY8kjHtYxg,5514
src/detection-rules/rules/integrations/okta/credential_access_okta_successful_login_after_credential_attack.toml,sha256=wAey0k3nz3ihAgZMgvWMjOR49JmxEaILBcStr4HIZmE,10001
src/detection-rules/rules/integrations/okta/credential_access_user_impersonation_access.toml,sha256=M7PZrOD9yHJ_PSCnbqaLeus4gFCxqnhuAYC6ZkxD6Yo,4336
src/detection-rules/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml,sha256=spo6a-soj7CuMuWNiDZ5NaDOXKb2VAbCP40_xHXXnR0,4659
src/detection-rules/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml,sha256=wbfHSZJy__hL8PmQgpOr__YMHbFfkAFpZ1bmERyYl20,4393
src/detection-rules/rules/integrations/okta/defense_evasion_first_occurence_public_app_client_credential_token_exchange.toml,sha256=9ifwRqsHUZSy98VTCshJAG6nHDu7YV55RL-QcFnAhu8,7088
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml,sha256=x8CIx2Lsbag6E7bBg79Ot-eOLXGxei7TOsTtj9SSCYg,5553
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml,sha256=_4G9e-Axq72uvqf7-mfXMv9lZfUpl3DGg2iugXSbADU,5375
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml,sha256=xK7eNrXTM9TFX2b4aYx2v6mTOqo0YqY-OsWOTumPxdc,5881
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml,sha256=cfBf-k9v5s7qw1pUEYiMraaFC7XOxO2lsLwF-WPpmhI,5201
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml,sha256=Gda579zM-SdymD74zD8fQgfhtZtglQswaJvl61mzinY,5218
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml,sha256=Xsc_1wQ_t-FufdTBLQhx06UGYt3Gzdww5hlYjP6vxZ0,4492
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml,sha256=E0WHqIAPkrQ2QkQoUCM9Gd75FuPwmPHuOcT2qsx2dGs,4778
src/detection-rules/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml,sha256=-DlPaFj6Zzq4vEkRK7x1iE8m6tEFQ4IjNgSU8nthhRA,5798
src/detection-rules/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml,sha256=TmQZJto6uqCx6jzxuAl6wH-AJW7YWpDGqnAwGZuFU9Y,3637
src/detection-rules/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml,sha256=8x_qSLOcF2lZhmWOGpWyjG_g5Z3UauYVQTcTY-T9mEw,4377
src/detection-rules/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml,sha256=9qfEYjrSfvf-lOhoUjZdK4TyLXmZuCwKWgwuz_wIQm4,5768
src/detection-rules/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml,sha256=ppd3mIncq17UZKrC9WkJU53PzLpVkNtrrvH71iPcJ4Q,5676
src/detection-rules/rules/integrations/okta/impact_possible_okta_dos_attack.toml,sha256=VuB2k6y4g1dU4e67_-uk5go3pRHo4bh82VrHO8poSN0,6358
src/detection-rules/rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml,sha256=ADfGe4cY56HUSLp0YlhdNLhHVlZyqMhP210K1yRM4Ks,4665
src/detection-rules/rules/integrations/okta/initial_access_okta_fastpass_phishing.toml,sha256=kgfa23YB-z47ZWHfFoB-XVL5WMKhecN8DORrxI9VHMA,6188
src/detection-rules/rules/integrations/okta/initial_access_okta_suspicious_activity_after_proxy_authentication.toml,sha256=j8TY9jWqJBxsc9IPaX_B19jibNncB8yPomw7rpzcci4,4840
src/detection-rules/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml,sha256=d38fo_5JMXDEam9P1Qf6zkAYFHRrFTKABwQYC2iWGG0,5798
src/detection-rules/rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml,sha256=F-W4nv-OjL7hEBGkt0W4wbFhCtihWikhIHHlM0nhDfc,6373
src/detection-rules/rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp.toml,sha256=QUxnK0Nq4sDMSpVVzJoH5uGyigr1zTozXekLClr7qZ0,6531
src/detection-rules/rules/integrations/okta/initial_access_successful_application_sso_from_unknown_client_device.toml,sha256=P0-xc5piOBlItmv6daMmOmsLpHimBnCO7IyKzeiq6XI,5936
src/detection-rules/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml,sha256=UkeYIH1f0lY-7J1HJ4GweiY8kHUKnaZP7hWyERm8srM,6619
src/detection-rules/rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml,sha256=T-Hro2DhyaNExp5x5lThLWNNMkiTuYQ8FHoT7oeXMRI,6411
src/detection-rules/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml,sha256=-KsOHxmz6Cx0-dRYcywlX5T4fOLXy6k4C8Hp2bQDksA,2402
src/detection-rules/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml,sha256=Sh2tFDlSPAZBUqro2Td2MnfEEYtd3RUObNiSAtlMm0s,6478
src/detection-rules/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml,sha256=Gi5keUTLCkK7fQWL_TgeXZTmMOPycYKeH0OHam6PJTc,6633
src/detection-rules/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml,sha256=rwvtv1K8vUXHJ8zXQDAQb9sMZrMZxKp1H7JMr2rquzM,5908
src/detection-rules/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml,sha256=qlZcmhDUXRmISzzMQl0Ah9Y7y-Q5paso-v1j6ObXKfU,6137
src/detection-rules/rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation.toml,sha256=vdL33y6j-K2BZcdSHlAANN6J40PYbL3K44rnPDyont8,5348
src/detection-rules/rules/integrations/okta/persistence_new_idp_successfully_added_by_admin.toml,sha256=fL4gSOvxh1WfsnOQj9YgEaSZ_-YBRkLkVwFnl0fzZMI,5099
src/detection-rules/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml,sha256=LDE_cX7mCAgTYkre_g3wEsVoqJsYtL2ktR3OKO8Zj5Q,6588
src/detection-rules/rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml,sha256=YrO4Ua4WIc4-5cjGnospelkq_iJ7z33H1zE6TogCpi4,5866
src/detection-rules/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml,sha256=6hZm96tYj0DGZY2jVzBhg6pRWSFPa4BzS6IuJGQb6dw,7428
src/detection-rules/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml,sha256=KPO_VMyYhHm_hmk3Iyn2MDEXU0-7HxFtDM5ol2ARtrs,7083
src/detection-rules/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml,sha256=QKF88s7tpixyyAVB5ztkX7NZrs3eBlZDoad3U9Lxnec,6903
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml,sha256=zDZIwnvcUdjvcr1QMU5ROBAG1D6wZcP8aI4FXr4hlX4,7557
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml,sha256=B1jWWOGLRRGmw7kGdQkaTh4znWWGw2EwBIjZqek6vgY,7512
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml,sha256=Uh79L15z3aLZ9FsbaxTwt3U_b1JPRYpc8zOaoEgCxak,7419
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml,sha256=BTOwTqwxvNSo9BF-ph2_dNOh1Jeo4oCqZJulA-MNT94,7064
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml,sha256=Y_aH9SbQYOnwPu6jsrz6P1XtKyIV-D4AVxS4MWYVEqY,7124
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml,sha256=SmMwJEAU-f_38taifcShSAfuaCQzxRh7741PXQQnDUg,7755
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml,sha256=TRU44-rzBuRVjh4BauHJefZwAlGCN_5vCr9iwceomOE,7241
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml,sha256=BWy-4x7jcL9mqNBCZf4yH7ttkScMU6kbRnjwoheahG8,7104
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml,sha256=htZ70IqvbsjSjk4hBBrhGTSTJAFbHbALFeGQLenCXHQ,7323
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml,sha256=NAZs9M_W7iMBtdy9Ruwoy83f62W0B7kIxv1V6qrbCuE,7560
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml,sha256=8p8xSM_1x1sXoR0LXnr7Rwqd7HtZxdQttnUTzB5qocE,7122
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml,sha256=EXpuOWKY95Qk7wziyF1GA6UBxn3Rxnh4kdWRrsGPr8o,7526
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml,sha256=0Xueh4ZRYV5sDXElOrCnP2PJDTj2DFyQsZPy9siLxHE,7983
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml,sha256=6fnLnAbfjk6ScUtzlJRoO5KKbKTRnCD3ymLnmp-ewso,7113
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml,sha256=1JI1TGRdggcaNwSx8YUfZkhoSVUvZeOxvDJ91nyIt3I,8546
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml,sha256=dPTUIjpZky_6XPqlPZKAZzPQd2uzAKq_wvZfUYiPEcc,7630
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml,sha256=oiUWTLtjKqC6-KK3hJ3kGAvyUOuWxZDi9pkU9Q7NjRw,7087
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml,sha256=A9GhabGkJ2Aol5769EiZIorelfy7DLezJvRBBV2GYN0,7365
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml,sha256=sjA1pq7Yie7ToQAnYQHchfsam0WHwcHSJjcvqriC2MI,7192
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml,sha256=WC7z0D_en1CcOnsFpidKATBC0raZY7lKXoA6qI2b1T0,7295
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml,sha256=KxCCA1gtWaTSgXPrchvjcQQoM2ithUMgcPeeSV5EOzI,7462
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml,sha256=rOdtOoLCvQ8TUwvKtPE48QQ8Bj4H4CYqBcD6kEA2X6c,9115
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_low_probability.toml,sha256=rHhQJBcQcNUJY51FPOG9eBb7FiPbde1ZqyjkeYcppKY,8993
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml,sha256=p8iYuArVNYoBfD1JAhDq0Gsg5pvFwNPkbLiDE2mHV20,7634
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml,sha256=iP2EvZ93uWkJNr-SekiqZZ2o7RUwknx7M1mupv5u4kM,7868
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml,sha256=T-vYW7wy3z7ZgfEZcOqmfa4uJ3TGmQx4YqLij9wzGP0,7612
src/detection-rules/rules/linux/collection_linux_clipboard_activity.toml,sha256=_OkgdYKcU3vE87fXOAF2AADGr0wUpZ6zNOGh69izDaE,5801
src/detection-rules/rules/linux/collection_potential_audio_recording_activity.toml,sha256=2H7x-URs5inD9pvEe8fdtqlNJAeStLBpgC-d3hdk-W8,6120
src/detection-rules/rules/linux/collection_potential_video_recording_or_screenshot_activity.toml,sha256=_B9UD4KmLfBXC6Z5EgmwSHW9QeFdmFe4Me90lxTMaA4,6079
src/detection-rules/rules/linux/command_and_control_auditd_curl_wget_from_container.toml,sha256=XNdCCc-k6WNCyOyYC3lUiH6UQKOlVzCXSD-lVSLUzhs,5348
src/detection-rules/rules/linux/command_and_control_aws_cli_endpoint_url_used.toml,sha256=HbcwQ88zqre2AtA88DsOfcSzaO_SIbTyBUMVGhwfpVQ,6237
src/detection-rules/rules/linux/command_and_control_cat_network_activity.toml,sha256=8fJdmSK2M1nQemSP-8hPeuah9Fj_sg9_-vp1xyFYurw,10351
src/detection-rules/rules/linux/command_and_control_cupsd_foomatic_rip_netcon.toml,sha256=O-SdrxvtzaBogES41K4ADVH4DKHNkvK0B47NN-aQlTQ,8419
src/detection-rules/rules/linux/command_and_control_curl_socks_proxy_detected.toml,sha256=m58TXhlddbBpR_vV37GrInymqtjL8bjMRTX137kIWpo,9582
src/detection-rules/rules/linux/command_and_control_dns_query_to_sus_top_level_domain.toml,sha256=lEGBUFU33jgL0VRLjA78xNmTIdJd6UsKpfR7Q3BNpc4,3769
src/detection-rules/rules/linux/command_and_control_elastic_endpoint_shell_execution.toml,sha256=OwNPAdu27yy6aa8gfBiOOiaS6bmvhTHuhVGBuZIVuqY,4455
src/detection-rules/rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml,sha256=LgN345o16roaWGbqAxIjrzrrfJawOOD1-Rk5xtqNwCg,10133
src/detection-rules/rules/linux/command_and_control_git_repo_or_file_download_to_sus_dir.toml,sha256=w6KlG2h-mzVsgBrn1sfZx7gFKGc53qfCi5phwhHUl3M,9202
src/detection-rules/rules/linux/command_and_control_ip_forwarding_activity.toml,sha256=JkpmHnbROYZdNHsMCKr9aG6amsVVyOYr9NS7thL02iQ,6822
src/detection-rules/rules/linux/command_and_control_linux_chisel_client_activity.toml,sha256=c4frGPIRa09Fg9hsO2Cv2DwS6ieLVhIKnHV7Sqh8hCk,10492
src/detection-rules/rules/linux/command_and_control_linux_kworker_netcon.toml,sha256=52hjQsC271unTwnlMxsGo59BWMJzVcuI9a2pbxjzSgE,8640
src/detection-rules/rules/linux/command_and_control_linux_proxychains_activity.toml,sha256=DKQ2_eMLFrx_iruQqAECLcJw220LuQpe5tILDE3rr4c,8086
src/detection-rules/rules/linux/command_and_control_linux_ssh_x11_forwarding.toml,sha256=jHpc2UY18ioj2LJbCKrQRKMviWiR6Pvy7cruF8YOMmg,7962
src/detection-rules/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml,sha256=sousGkMY8yDufa3Fez1IuMo4te1z65ZHTzTtedH0Bd4,10576
src/detection-rules/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml,sha256=n9cwH9K1UGEnKWoFTCN1wM8AbB2gxLi6MTZalB5JCVY,11684
src/detection-rules/rules/linux/command_and_control_linux_tunneling_via_ssh_option.toml,sha256=vre38rbY3ECf1L7RGs7doW28Ktz6UW1fXjZi6wdgpy8,8418
src/detection-rules/rules/linux/command_and_control_netcon_file_creation.toml,sha256=HMWj-mD6SyGasPymusLMXBqIhfhHk_GxGiWIwJv2nug,10347
src/detection-rules/rules/linux/command_and_control_potential_tunneling_command_line.toml,sha256=GTmAy-0STaG3ES69PPm0Qmm5Cu-QL7g6_E3jUpvwdHs,10589
src/detection-rules/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml,sha256=bmYg0m0BU7wtyAXpu0ia464AAOzmEV9WZJ28EODdezo,15668
src/detection-rules/rules/linux/command_and_control_telegram_api_request.toml,sha256=JRgK7mgoUy4djUO1h2D2r4B5rg4C4fhEZeSbFwGqWLE,8919
src/detection-rules/rules/linux/command_and_control_tunneling_via_earthworm.toml,sha256=xSIEKMCtmthBDvoq2KKkPQwj9K_HGoCP9cvbfaqOjAo,11537
src/detection-rules/rules/linux/credential_access_auditd_sensitive_cloud_and_host_identity_file_open.toml,sha256=PDI7wEu9IL1fORmgZOqfLZoRc0wLzlAl5-tPAMh9-_4,9749
src/detection-rules/rules/linux/credential_access_aws_creds_search_inside_container.toml,sha256=Fa8NusczicYjW6jVjh1EgwhSJgJ9E8qEtQiisLg4ur4,8916
src/detection-rules/rules/linux/credential_access_collection_sensitive_files.toml,sha256=e45OKmF0yZizW1DD7wyOSiwx3Y46BnPV6S5RC9QbX4M,11138
src/detection-rules/rules/linux/credential_access_collection_sensitive_files_compression_inside_container.toml,sha256=cfgk7fGdm8E5Dsu3UNrOW8eefgSSxfy9OTNjsm3t6Mw,8561
src/detection-rules/rules/linux/credential_access_credential_dumping.toml,sha256=3ePtCX_AaWM_iF7EospCh2dHRp_MFpvqd2JmxiKcftw,8459
src/detection-rules/rules/linux/credential_access_gdb_init_process_hooking.toml,sha256=yerHkvxknFHKV6Ge6839BRyly09qxdbCmYnWL_gVzLA,8279
src/detection-rules/rules/linux/credential_access_gdb_process_hooking.toml,sha256=zeBWFcOuYsSdZQPfmZRIF6RJKYrFCzV0Kq0hPz33uXs,6403
src/detection-rules/rules/linux/credential_access_gh_auth_via_nodejs.toml,sha256=OpwBgglMIWLwnzBQRO-IkbyjEDuTARyM0XfXT70sNcU,5032
src/detection-rules/rules/linux/credential_access_kubernetes_and_cloud_credential_paths_via_process_args.toml,sha256=9Oahn64XYwmV0pMfuwMNvTokGXwZ9gRSyf_ENUjS9q4,5349
src/detection-rules/rules/linux/credential_access_kubernetes_service_account_secret_access.toml,sha256=ixpfMSiQGtBjfX5nXsjUtEu8q2PIW5ZGo319aQzEGPw,9971
src/detection-rules/rules/linux/credential_access_manual_memory_dumping.toml,sha256=u_ltI-7f_UbCkzkO98Qc9Ie-N62hNXdObwbw9QapO_w,9010
src/detection-rules/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml,sha256=XI9BQlkXR4xrwaMokgaaQ1_GJtEHNKI0I0rOeTkscH4,8888
src/detection-rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml,sha256=8ipFIiZE7dCgBXpJVPSkbc66PgwHXZAtA_gdSkIaBXE,6300
src/detection-rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml,sha256=sZnGNC3OIKVVIAj1pL1jB2KiP0V7tJGG-_clv1w7N1M,6276
src/detection-rules/rules/linux/credential_access_potential_password_spraying_attack.toml,sha256=fxqjBX5I2nL-S-eXuXppOuwGdfD_Gcx77AqaISOj1YQ,6443
src/detection-rules/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml,sha256=o0gT1jL_3dI1DTrg7bvg0wehp1peKhqXlBxmpEAUPH8,7144
src/detection-rules/rules/linux/credential_access_proc_credential_dumping.toml,sha256=Q250-AmHoDDDI-7-mJH-Lw6On-3MHFds93WVAokuyjM,9124
src/detection-rules/rules/linux/credential_access_segfault_from_sensitive_process.toml,sha256=3D8T2HZ47exsIRnCNrhIch28LdAVnd3qLl4dhAb0nc8,7011
src/detection-rules/rules/linux/credential_access_sensitive_keys_or_passwords_search_inside_container.toml,sha256=uTO9c62N79xZtIDlzmdekMt9fSdbvXtMKBxORydU-vY,8537
src/detection-rules/rules/linux/credential_access_ssh_backdoor_log.toml,sha256=BiZfbtgXb4h7kXrcapOPbyreIUTjuSxjQg46K_vuA3s,11504
src/detection-rules/rules/linux/credential_access_ssh_password_grabbing_via_strace.toml,sha256=bF-PdFOORfeu1UWu8hUmcYO2siA87bhwHo1MXejKRLA,5728
src/detection-rules/rules/linux/defense_evasion_acl_modification_via_setfacl.toml,sha256=WhGAdJaa58E0HAySHkOoXgRd9N9A_Y0nyVMKeFW0Nvc,6139
src/detection-rules/rules/linux/defense_evasion_apparmor_exploitation_via_sys_fs.toml,sha256=m2DVAFXJci7hHvwuzQHyKOVrQxk7JcZbYS_BpYxPBXQ,9274
src/detection-rules/rules/linux/defense_evasion_apparmor_policy_access.toml,sha256=-4uhgId39nTCzJyoH9GDYnyngQt7zcSJXny610ud7pU,8371
src/detection-rules/rules/linux/defense_evasion_apparmor_policy_violation.toml,sha256=urYIugMMdENIE_ACsftQs_yJfg_paMHVYK4Y8HtS-EQ,7739
src/detection-rules/rules/linux/defense_evasion_apparmor_profile_compilation.toml,sha256=MVw1-5D3nSuf3JcOJoJuasK_ffCr5_s_GMH2GCtHgt4,8947
src/detection-rules/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml,sha256=wlxsv_daWwLwOdge99xuqQarSoWuAA1l5Z0PNGQ1d8c,8166
src/detection-rules/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml,sha256=ewjSE9KwByNpN3eIObUTipqvzUmxgI_WFXW8wWyqYeY,9163
src/detection-rules/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml,sha256=rbvQP2aGptIIHkSc7tBSxLArlQvjm3C4qxN2AfH1kCE,10241
src/detection-rules/rules/linux/defense_evasion_authorized_keys_file_deletion.toml,sha256=hWnPbBRXGbQNaR5wLQ5KodXFd6L_n9HXqg0cR3PzBq4,8133
src/detection-rules/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml,sha256=UUsR_2bO2-pWQX2w_LnygcYrzdFVCEGpfCEhrFvtTt0,10191
src/detection-rules/rules/linux/defense_evasion_base64_decoding_activity.toml,sha256=MI4thrBxvVTr7HDb7JBJq6VSiDEFpTTGrsga4-jgodc,11156
src/detection-rules/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml,sha256=PJwrfjeTFrIDPU4Z05CwxCAWFHZ1OwM5GS--mIWNg5s,8423
src/detection-rules/rules/linux/defense_evasion_bpf_program_tampering.toml,sha256=P0hNULY4rWRasED_KbQzRwNqlRBHFXkMPjI1Se_TCHY,6701
src/detection-rules/rules/linux/defense_evasion_busybox_indirect_shell_spawn.toml,sha256=jfzhhJJOkWjPvGILtaEwcqJeydqi5QM8Eio8tnWh7Rs,8851
src/detection-rules/rules/linux/defense_evasion_chattr_immutable_file.toml,sha256=KMfaOCSonrVniQOfgVNQrTe1oz42paQkB9bleA0iqsY,10425
src/detection-rules/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml,sha256=jlKYPKbs_lBF6mgYI1ClSiIgg0sFXjr-rRsIz4NURBI,8054
src/detection-rules/rules/linux/defense_evasion_creation_of_hidden_files_directories.toml,sha256=MJP2WYfkRMThDmSrxCTN-KSGy78gPTC8j6uLuHD1Hr8,5554
src/detection-rules/rules/linux/defense_evasion_curl_or_wget_executed_via_lolbin.toml,sha256=RZZdAcatLYTX_OkYfJJn6IjpZZ8ws7C37XiZgIkoO60,12587
src/detection-rules/rules/linux/defense_evasion_directory_creation_in_bin.toml,sha256=6o51n9bAq3yeZruwADXsT8n14j86j0-EFpRLnpD3eyw,8663
src/detection-rules/rules/linux/defense_evasion_disable_apparmor_attempt.toml,sha256=5Mqq4JhNl3KWypBNlZ3PRap9e7juVTO1sx7h3mtUl4U,8699
src/detection-rules/rules/linux/defense_evasion_disable_selinux_attempt.toml,sha256=cXzdqBucVnJylkAsTEBdB4dWVg40j8ID0i5Gd6hVEyU,9270
src/detection-rules/rules/linux/defense_evasion_doas_configuration_creation_or_rename.toml,sha256=PYFMiHiku-0MLa2pyiVX0T7765xTWznd14Nu41Ei5kw,8033
src/detection-rules/rules/linux/defense_evasion_dynamic_linker_file_creation.toml,sha256=cyhAyNMvcNyBth1LxSe1L6Lr0SJeoqsG5sqzdQi0Jpk,10715
src/detection-rules/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml,sha256=LR7nv5kcnab8M6Zy11Nj1eCYG9cTJjlbwCE1S4iGGZI,8400
src/detection-rules/rules/linux/defense_evasion_file_creation_world_writeable_dir_by_unusual_process.toml,sha256=jF7NrYvb-gRWGLnWQRAMxPuExKSlK-9TyC8mDs2cH6g,9279
src/detection-rules/rules/linux/defense_evasion_file_deletion_via_shred.toml,sha256=DAWj-zYr-SaElMec6yyx6PMenBN55ctOmpyTBopbHMM,8084
src/detection-rules/rules/linux/defense_evasion_file_mod_writable_dir.toml,sha256=IfsHMIjP0FWn5yYXhJm4Qg3tb-QOoRJJ_N67LCKL5yA,9847
src/detection-rules/rules/linux/defense_evasion_hex_payload_execution_via_commandline.toml,sha256=1rc3sUp5VsmXgSpVUG0x0bI3b3n_7O4mx6hLvvE22ao,8692
src/detection-rules/rules/linux/defense_evasion_hex_payload_execution_via_utility.toml,sha256=PBj7Bq0gI9_EGIk8D3wLGK0JWn7SD74n8iY0_NQQylM,9660
src/detection-rules/rules/linux/defense_evasion_hidden_directory_creation.toml,sha256=KDo5Yziw7zmWcYLF-kbQB2iQi1Gb19ZHs5TueyaB5G8,8734
src/detection-rules/rules/linux/defense_evasion_hidden_file_dir_tmp.toml,sha256=jDBiezk8YZmghhUupwgx4Y2oLjALq3B1JpyrM-cVQgw,10236
src/detection-rules/rules/linux/defense_evasion_hidden_shared_object.toml,sha256=Xer440a3Vsv4I0i7TZOUWtUPxSzs-3233RzMGABFOH0,9437
src/detection-rules/rules/linux/defense_evasion_interactive_shell_from_system_user.toml,sha256=AP4w2luCS6S8sz94_SrR75HDcN3kdAOXL-SM80Ye9Wg,10198
src/detection-rules/rules/linux/defense_evasion_interpreter_launched_from_decoded_payload.toml,sha256=mrg78DlF_8Oms6yDBnSrh0XcoIeVOS_hoRJ3ymqEdeY,10948
src/detection-rules/rules/linux/defense_evasion_journalctl_clear_logs.toml,sha256=49ezxY359A0LAkqgZ6glhU1gxFGc_npbfZ8EeLMqNfc,8526
src/detection-rules/rules/linux/defense_evasion_kernel_module_removal.toml,sha256=2VsHHvaN6B10OOEA3OSfSpr7PXVhybpYsbFwUOLUSqc,9074
src/detection-rules/rules/linux/defense_evasion_kill_command_executed.toml,sha256=-8ll3-I3PfOGybBtk16JTHc5Xf-47fu8eDiFIlO7PIA,9582
src/detection-rules/rules/linux/defense_evasion_kthreadd_masquerading.toml,sha256=Xj91yLuFc6UVaiWtJ3mFYWChDSNKHhJW6ld0Jk1HKl8,8454
src/detection-rules/rules/linux/defense_evasion_ld_preload_cmdline.toml,sha256=k2e2qrgshCquC5N3XlEIjvTanp7Xtn_ui5c3CltOT20,9861
src/detection-rules/rules/linux/defense_evasion_ld_so_creation.toml,sha256=pPAScDUW8L-jqKNyMvQjfTDalheUQb52dnOHf2qmTJY,10334
src/detection-rules/rules/linux/defense_evasion_log_files_deleted.toml,sha256=VpYYnLkBuVx_w-Tc4hnvSyeqOUAvCHS5R1elYQardYc,10161
src/detection-rules/rules/linux/defense_evasion_lolbin_so_load.toml,sha256=UHYU_q6QppBPV27WqKHC2IFkao_yonQuErgN0szwngk,10300
src/detection-rules/rules/linux/defense_evasion_mount_execution.toml,sha256=5MmcP5rFEem4_czeUbxF-8UtFU3L5KkYlIVHtiGrs0o,8466
src/detection-rules/rules/linux/defense_evasion_multi_base64_decoding_attempt.toml,sha256=avSVqCXVmfBUe5ScSPVfZkAk_H--gSHM_UUGYkoefzE,10002
src/detection-rules/rules/linux/defense_evasion_potential_proot_exploits.toml,sha256=h4-5_XOaXut6geW6YtR5vQcxmM8hOtDxa_LNXvh3zaU,8411
src/detection-rules/rules/linux/defense_evasion_prctl_process_name_tampering.toml,sha256=E4ZxSxDwf318o7KXE79b57zIzAnzAWFKX8D07gR2wk4,7888
src/detection-rules/rules/linux/defense_evasion_proxy_execution_via_systemd_run.toml,sha256=gCO4clthuEy9Boar7nRdu2_pJ-0jwaWqI1SzZUAP0Qo,12119
src/detection-rules/rules/linux/defense_evasion_rename_esxi_files.toml,sha256=jbFm_hpN15VqGdV2UTaIh0QmWJSXygX_Gz72ECnJC_A,8569
src/detection-rules/rules/linux/defense_evasion_root_certificate_installation.toml,sha256=2xLu4cgO4BWYiMB-Yl6q7JlYBYH9QXRoxu4QJnmALjo,9184
src/detection-rules/rules/linux/defense_evasion_selinux_configuration_creation_or_renaming.toml,sha256=fyt155f04_AnYrrfpTABXkJZA3m2LLxTky89uf1V9wk,8406
src/detection-rules/rules/linux/defense_evasion_shell_history_clearing_via_environment_variables.toml,sha256=8buP87XulTCAjSOqBUk6x-30kljCfdBAIV0jQcKtNKI,9279
src/detection-rules/rules/linux/defense_evasion_ssl_certificate_deletion.toml,sha256=QRakqzMhU1oEPcIWpuXBJjLavNsFiMZvu2Q_IU05RgM,8122
src/detection-rules/rules/linux/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml,sha256=cvhmwTxyYVUcwQNbb800Aol5-rGhXtHauwZgHQGt4zo,6856
src/detection-rules/rules/linux/defense_evasion_suspicious_path_mounted.toml,sha256=mw1Nf7Kid4nc7dV7-39WkyR8G-kZ_lPxsTf_a__kas0,7822
src/detection-rules/rules/linux/defense_evasion_symlink_binary_to_writable_dir.toml,sha256=PqUcp-iugI-qb6adZpaE3th2lb91ii5Ah-62xrdNG68,6767
src/detection-rules/rules/linux/defense_evasion_sysctl_kernel_feature_activity.toml,sha256=pl1ZLehQadskSIaoxiBcaHR6NZIea1ja3xk2HYCG9wE,8550
src/detection-rules/rules/linux/defense_evasion_unsual_kill_signal.toml,sha256=vn04YcJAec8CQWl1hEkYjfMfB7VyIon7UHlGgu6B3KQ,7077
src/detection-rules/rules/linux/defense_evasion_unusual_preload_env_vars.toml,sha256=ChTAlO3YtS0tU5FEB-eQaMh5YqzdP2y6HlXk1N8QIX4,9648
src/detection-rules/rules/linux/defense_evasion_user_or_group_deletion.toml,sha256=ZJbaq8XUpCvuieITyNYkyeOMTpMJXWipkXr0ASD4EuA,7253
src/detection-rules/rules/linux/defense_evasion_var_log_file_creation_by_unsual_process.toml,sha256=zP8R97Ueaa_AlKr241i-fm8qugi1C25px0f0-0CObMA,9171
src/detection-rules/rules/linux/discovery_curl_external_ip_discovery.toml,sha256=C28mphU5X-nV5yVnpsT1rD0oGa_I1-SkKJhUdp6GVWM,10156
src/detection-rules/rules/linux/discovery_dmidecode_system_discovery.toml,sha256=O9YzLPPrBIX4dEYVccNZHTmUpIAbaH5VR6jFvAb2sNs,9579
src/detection-rules/rules/linux/discovery_docker_socket_discovery.toml,sha256=feemXXdp9OrwRNPIgHbv2o9Upwjpa5aVy8dv8RxoxdE,9000
src/detection-rules/rules/linux/discovery_dynamic_linker_via_od.toml,sha256=tBZHwhYUQw__7h8JGlR05Q6VmRXi5jgH0alO3rvEA1Y,8626
src/detection-rules/rules/linux/discovery_esxi_software_via_find.toml,sha256=YDiTH7dXZ0_J12kw3K5V7pKLfTVtJDtVAyOrNhArZIA,8104
src/detection-rules/rules/linux/discovery_esxi_software_via_grep.toml,sha256=yiSUkLyMYWZZjIHiIj2ezEQ9pSkUJhSEgMBUDCdb36U,8201
src/detection-rules/rules/linux/discovery_kernel_instrumentation_discovery_via_kprobes_and_tracefs.toml,sha256=A9pgCm053Nx5y0oayNH0zidi8w7_w6mZwq64gLZR6vU,6654
src/detection-rules/rules/linux/discovery_kernel_module_enumeration.toml,sha256=9-qvjA660MLjMXfh5TfvjQxZl8i2rRqrLHzMVIBUREY,8918
src/detection-rules/rules/linux/discovery_kernel_seeking.toml,sha256=ulAuayyFit5Do3USSGCxZZX7tidxqTzkIHCnCEP92hQ,8685
src/detection-rules/rules/linux/discovery_kernel_unpacking.toml,sha256=3jWcCdby8cNOWJssOuQCvGgRdNZfjbTa0kIIFfYwYyE,8354
src/detection-rules/rules/linux/discovery_kubeconfig_file_discovery.toml,sha256=oHTjOupYSYZiS_iWzqclq11nk0HMPQ3yPM5Nq2sYIN0,9898
src/detection-rules/rules/linux/discovery_linux_hping_activity.toml,sha256=9QfUMLfl0UU57vhTkG27vc470WEwSygQqbcC3BSnhQM,9625
src/detection-rules/rules/linux/discovery_linux_nping_activity.toml,sha256=gdp4TMjnNlyAxQ9icHP7WQ4pDvjHLTSHL3l9vHM-hbA,9641
src/detection-rules/rules/linux/discovery_manual_mount_discovery_via_exports_or_fstab.toml,sha256=iLjkvTvrtOKzTmMfB5Cif0WYK1NuYDS8Yq79krcmcm4,8159
src/detection-rules/rules/linux/discovery_pam_version_discovery.toml,sha256=DBSo7Wf1pUAvri-zx0PT2tVOx5-nnBFj13nLK0RRqPI,9436
src/detection-rules/rules/linux/discovery_passwordless_sudo_probing.toml,sha256=wMWMOEtDk1X0y_OJbdvsvu6zY-U-VLOJ9K6tFoiQPt4,7891
src/detection-rules/rules/linux/discovery_ping_sweep_detected.toml,sha256=YBXayOZ-_1WsgWivvcU2CD-HwiSRkTOMC6ZdUxTRGuw,8363
src/detection-rules/rules/linux/discovery_polkit_version_discovery.toml,sha256=huXezHDz5rrhVA8xTphlzDkQXvrfmHdlgybbKx8tGiU,8276
src/detection-rules/rules/linux/discovery_port_scanning_activity_from_compromised_host.toml,sha256=R_p9ATJoHppADflNjSCsRwqoMiaBcj6e7aRAgEEfHZo,10041
src/detection-rules/rules/linux/discovery_potential_kubeletctl_execution.toml,sha256=z7B5x033754nmIAKulsyUJlkpCj4Ox_FwziAk4Aj2B0,4437
src/detection-rules/rules/linux/discovery_private_key_password_searching_activity.toml,sha256=k7auwzoEL9Ezwuo-hXD4wJyWdjZjaOE3l7w5UlCQC9c,8571
src/detection-rules/rules/linux/discovery_proc_maps_read.toml,sha256=59-HGnakH6C7SiSRh67I8fNRVuflOVluXC7lgCQpv18,9008
src/detection-rules/rules/linux/discovery_process_capabilities.toml,sha256=bMAS9eYp8GaXcp5wUf8rsT6_QqFXKnL1hDuf1k-3WJE,7371
src/detection-rules/rules/linux/discovery_security_file_access_via_common_utility.toml,sha256=41WbBKBjknRapN5RRV22V-YcYfDMTvx3_ZzfpyCowGQ,9667
src/detection-rules/rules/linux/discovery_subnet_scanning_activity_from_compromised_host.toml,sha256=d2ufTeaA4s3kOoDoeHOvPJKavJR-oYMnAnxmuc5lVYE,9450
src/detection-rules/rules/linux/discovery_sudo_allowed_command_enumeration.toml,sha256=7rWyaNvoIWt9RV2WAXm-Ror0weF5-T2KQ0k54ekP4gs,8151
src/detection-rules/rules/linux/discovery_suid_sguid_enumeration.toml,sha256=qoZnKDQyXtdW_t4b5GireMB5hDTrWR5gr2pVkA0eY94,8694
src/detection-rules/rules/linux/discovery_suspicious_memory_grep_activity.toml,sha256=ePh9nzY-wFkNqfDYjizqB7tJy_-j2znz2VLWVufDvNA,6026
src/detection-rules/rules/linux/discovery_suspicious_network_tool_launched_inside_container.toml,sha256=RXPRX6wra6wJBTHuPhRPrA2VzmXHVaFWfyQxNBLu4VA,9112
src/detection-rules/rules/linux/discovery_suspicious_which_command_execution.toml,sha256=mGMaYHBopBIn4tROHzZoIr3VS5lZBsicaN1hnmoIH3o,6074
src/detection-rules/rules/linux/discovery_unusual_process_connection_to_container_runtime_socket.toml,sha256=bilnl-kURJWJVCnfyeHkgecu5MF7jN9GIDG4YhNmRuE,5284
src/detection-rules/rules/linux/discovery_unusual_user_enumeration_via_id.toml,sha256=e0q9aZvbYbO8X6BnDkUf4vHFwzA6_HYlXUKW4zlp1So,8295
src/detection-rules/rules/linux/discovery_virtual_machine_fingerprinting.toml,sha256=s9mOwbqwS7J1tl2RURXGoziBJVEoFKoSlmzCKSVJdwk,10620
src/detection-rules/rules/linux/discovery_yum_dnf_plugin_detection.toml,sha256=ohzIvspZ82Umj_bY1qoRClqBfr6yvVIkfnmsZoV16Ik,8529
src/detection-rules/rules/linux/execution_abnormal_process_id_file_created.toml,sha256=2aPd5XsE_iyjuZUA2NIwpmEFExA2H2_iMGNrCsndQfs,9646
src/detection-rules/rules/linux/execution_busybox_unusual_execution.toml,sha256=MMeP-m7I3lhCeHLYR3tgHfrpAJ7pF9Yr0fkNnGbKDWA,9962
src/detection-rules/rules/linux/execution_container_management_binary_launched_inside_container.toml,sha256=Ve0_SUKX3XCkAac-VR5E6tuiv5pZGX2IYKVjjcpNu2w,8627
src/detection-rules/rules/linux/execution_container_runtime_cli_suspicious_arguments.toml,sha256=2u8D2tiH232U0gXxgp9dCykpnS2u3n08q5v8834T9ZE,4545
src/detection-rules/rules/linux/execution_cupsd_foomatic_rip_file_creation.toml,sha256=Ko7Qb4G2IorHWlYS4WOq5nhW1r_HnKM4YtvlDbkBIzs,8165
src/detection-rules/rules/linux/execution_cupsd_foomatic_rip_lp_user_execution.toml,sha256=r8pemkjH0x-0N78yRNTlsjBfjMyqwmSSiHcAa_C4fWg,8372
src/detection-rules/rules/linux/execution_cupsd_foomatic_rip_shell_execution.toml,sha256=f8lxpFyrZfqkeWi5MC2zGxgyvJQIu2z7DddLFnLShF8,8198
src/detection-rules/rules/linux/execution_cupsd_foomatic_rip_suspicious_child_execution.toml,sha256=lIRnj85-5g4652snm3Ql7zlHGaDrZLex-KO2HuyotnY,10199
src/detection-rules/rules/linux/execution_egress_connection_from_entrypoint_in_container.toml,sha256=qWR7hPDazlhMUYoNu8xg7etoQCCvzrdM6a8NBA-IaWA,7503
src/detection-rules/rules/linux/execution_executable_stack_execution.toml,sha256=i94Eswz_YX9Q-Qgn-Imyj3S4RAXSTAiUnoSN7C-nvsQ,7237
src/detection-rules/rules/linux/execution_file_execution_followed_by_deletion.toml,sha256=u7ACb1lIVXliFfEKqIjGJ6MM8Mfj03oHHs2QLbClynE,9318
src/detection-rules/rules/linux/execution_file_made_executable_via_chmod_inside_container.toml,sha256=mz0AipwLo21YdjKjZW1Xbpk7SVZ_QczPGvNpLdIVx6I,9340
src/detection-rules/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml,sha256=2ZLx4AthlbpKNkBXjDIktj8sS1zX-0dQ1iejoFcVMjo,10269
src/detection-rules/rules/linux/execution_interpreter_tty_upgrade.toml,sha256=du3SJvHQ-y5rNfWUPH80h2QlRIsyde69ejqkvF-eiNo,8025
src/detection-rules/rules/linux/execution_kubectl_apply_pod_from_url.toml,sha256=V0JvsJrQJweRYQJW8mI7Mn52dt4rKyF0mdLt7hyS2HA,8521
src/detection-rules/rules/linux/execution_nc_listener_via_rlwrap.toml,sha256=fVyOkiFFqhgIPWM3JSzo_-OU7hTMdyolfV-FXoQqLeg,8318
src/detection-rules/rules/linux/execution_netcon_from_rwx_mem_region_binary.toml,sha256=C1Usux26ytuhH7KVe9Ocj5UDuSI3EFMstFtcoXBpf-o,8701
src/detection-rules/rules/linux/execution_network_event_post_compilation.toml,sha256=VM_y1s1k6AftLMebA6vhpCnIqBIuSw7fEdfXH3b3gQI,9076
src/detection-rules/rules/linux/execution_payload_downloaded_by_interpreter_and_piped_to_interpreter.toml,sha256=QnYxHzDlwM8z2mffdCSggVleGBoO2uqiX0KCQ1BMjs0,5989
src/detection-rules/rules/linux/execution_perl_tty_shell.toml,sha256=6bTXdPdLA-rsutMHpSixjyIAxLA5JNiOkamHcsioOjw,9466
src/detection-rules/rules/linux/execution_potential_hack_tool_executed.toml,sha256=Wu60yR7ZVxk3yMiWev_uDoQCEBcmckOPfjehpaqZDIk,10301
src/detection-rules/rules/linux/execution_potentially_overly_permissive_container_creation.toml,sha256=DEAvjL1hQrW8M7wfna8EDKCBwET2qNZ3jC61x7AUQ4I,8700
src/detection-rules/rules/linux/execution_process_backgrounded_by_unusual_parent.toml,sha256=xL6H48M-LLA4gYzT0CNPaAQKdrjva47Xx7_ZJzV90E8,9946
src/detection-rules/rules/linux/execution_process_started_from_process_id_file.toml,sha256=a9rU1eJuYPuPPpAK5Ww0tOOmdz9RDELca2CKNsToGo4,5805
src/detection-rules/rules/linux/execution_process_started_in_shared_memory_directory.toml,sha256=T2eNjzSQ_jsWoVeSBa0vErXL7bhe0UoSfdkBRM4ctDc,8783
src/detection-rules/rules/linux/execution_python_tty_shell.toml,sha256=Cgvt2_082fbBiR6gdXuxIU-6kYJ4XmUj0ED-URgCdEM,8485
src/detection-rules/rules/linux/execution_python_webserver_spawned.toml,sha256=pQuhuJdrMc87uuflERFCEKlmRxhfqPemAxl2o4jCmT0,8319
src/detection-rules/rules/linux/execution_remote_code_execution_via_postgresql.toml,sha256=N5hejaQG5V4to9eD7_zINgHSeReWI96Np2SBEkffkNI,8653
src/detection-rules/rules/linux/execution_shell_openssl_client_or_server.toml,sha256=czRJGK6zdaUN9CbrR-dPVa3BufE0eZutsMpSwDSEq60,9123
src/detection-rules/rules/linux/execution_shell_via_background_process.toml,sha256=7VsIE4cPn6pMFU7dm5d09XwJ3RuYzcmTokN57e8qMk8,8391
src/detection-rules/rules/linux/execution_shell_via_child_tcp_utility_linux.toml,sha256=BYJBcoZvAPvtlHNUUXrGhtqlIpgBAYJML4s-y9Gg_Rc,9235
src/detection-rules/rules/linux/execution_shell_via_java_revshell_linux.toml,sha256=F6HOp6yIny4lUiyVjM2lhoUz4VVAQFxG_wAfIwFvU8k,9587
src/detection-rules/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml,sha256=jpgyC2X9oP6RMnBHsZGzY45Rb-G5Cohc5jB4b_AWVbM,10164
src/detection-rules/rules/linux/execution_shell_via_meterpreter_linux.toml,sha256=QbOALCsJ2C-qaujLfVk3G0rCgyoxVwKMaKsoCRAZ6lM,10674
src/detection-rules/rules/linux/execution_shell_via_suspicious_binary.toml,sha256=vf5QBlvv_sg9bqKdJh1ZNcmbJyEx09zDMs9s7-7Nx48,9485
src/detection-rules/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml,sha256=AIMRjhIq0G-ZitAMHPrmUA2LqLA6wboKxr-oZn0V1Rw,8882
src/detection-rules/rules/linux/execution_shell_via_udp_cli_utility_linux.toml,sha256=3u0yvOGx1hmSLmowceuO6RhoMmlQHcNicgBh8y-siKY,11180
src/detection-rules/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml,sha256=pojGR1tvT2bUzhRijK_BX_rxyzPaOsf1qfFzv-zoQdo,8974
src/detection-rules/rules/linux/execution_suspicious_executable_running_system_commands.toml,sha256=yRfPACZGy8OTFUMUqd9hunvcwapTb6QXL9CgX_STnBM,10994
src/detection-rules/rules/linux/execution_suspicious_mining_process_creation_events.toml,sha256=OQYIAcPmICIcazQzQ58DSuwc5YXYJ3Apw8xs0f7dEyE,8557
src/detection-rules/rules/linux/execution_suspicious_mkfifo_execution.toml,sha256=lzg5gJTjZQOdfJn8j5y3rd20fUCZpQJF_iAR-Rry7Dg,8601
src/detection-rules/rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml,sha256=GWO_bd_e2rXtyWQBZgy2PWY5jlJNFpJ2hZDE9y-GvPY,10187
src/detection-rules/rules/linux/execution_suspicious_xdg_open_command_execution.toml,sha256=ZyfA4qRmD062OhxTXPHllE2Mh78znFxbux9ukMKLqoo,4367
src/detection-rules/rules/linux/execution_system_binary_file_permission_change.toml,sha256=dAkfOjm2cfLTYpr_UO12jale_d3Y_f3IGrdN5QqdpDU,9732
src/detection-rules/rules/linux/execution_tc_bpf_filter.toml,sha256=NazedvEPUvM60ymzCfX60iI88dioqPbvCfHCIdG_tXc,8755
src/detection-rules/rules/linux/execution_unix_socket_communication.toml,sha256=ZFRsY5lv70ZXLuuBUj_ed_hVpMvYZpD1n0Ncu-yBEDs,6487
src/detection-rules/rules/linux/execution_unknown_rwx_mem_region_binary_executed.toml,sha256=Wcui6hinJlGJtnmlfaFpbuxvynDRDoP6FqR70JAAJwQ,7909
src/detection-rules/rules/linux/execution_unusual_interactive_process_inside_container.toml,sha256=6jVZ24rin2FGoAMfo-_h6iTJqKEjaeFcNoZMNJ5Dcos,4213
src/detection-rules/rules/linux/execution_unusual_kthreadd_execution.toml,sha256=8OKfGztdubVIXgbt_NfJLOg_RVaslNJyG2RWvpnDpEI,9880
src/detection-rules/rules/linux/execution_unusual_path_invocation_from_command_line.toml,sha256=p7wG4Rc9S20cdjGZmypvXBHfn_D3eu2rwIBSu9i2FRc,9431
src/detection-rules/rules/linux/execution_unusual_pkexec_execution.toml,sha256=yl_QKW5Jo61Ol5Az-s7YLhqAKvEh4iTL5eMEzoOEXWE,10795
src/detection-rules/rules/linux/exfiltration_potential_data_splitting_for_exfiltration.toml,sha256=ovoH4yhYTPMtnTyXpL6GFjhQM3T4a9ALkU0-wwZ297Q,8420
src/detection-rules/rules/linux/exfiltration_potential_database_dumping.toml,sha256=2AUYCXnoFRa-tZtJkDSRbcknca9EjDMqdmTCV3D0f-Y,8479
src/detection-rules/rules/linux/exfiltration_potential_wget_data_exfiltration.toml,sha256=gNvD_4upLGGzPCCDJ-YuDms_1Fp6SNREhsVR3EZamq4,8626
src/detection-rules/rules/linux/exfiltration_unusual_file_transfer_utility_launched.toml,sha256=Nhtw2jPNenSnoYx1vmn799wMkOJr7qc5IGxH9vmcm1U,10477
src/detection-rules/rules/linux/impact_data_encrypted_via_openssl.toml,sha256=w-BKJwnGvu5piXKScg_W5daWpa6R9VJDGM2I4_eENoQ,8509
src/detection-rules/rules/linux/impact_esxi_process_kill.toml,sha256=KA0IvGN2_bKOD6WfLOAcmSS7raOGjYp46xXnlrbmua0,7725
src/detection-rules/rules/linux/impact_memory_swap_modification.toml,sha256=o9WnU8id6bF7EtHiYeA7CoCTxKLxf2wzSJhrdNpKrqs,8764
src/detection-rules/rules/linux/impact_potential_bruteforce_malware_infection.toml,sha256=CTjCvK_R0fK9X5_v_6yElaYZqijnkgTXHTJyJs0Wxx8,11078
src/detection-rules/rules/linux/impact_potential_linux_ransomware_note_detected.toml,sha256=VQcAxOTYwOgi9N3NfXVNGYbAQGjRNQJre9H9MhaK-5E,9038
src/detection-rules/rules/linux/impact_process_kill_threshold.toml,sha256=SSoMpOLOZ-az3pHBSVUli-aI9_Hsbf0gdj-5RwRNQgs,6387
src/detection-rules/rules/linux/initial_access_apache_struts_cve_2023_50164_exploitation_to_webshell.toml,sha256=Tam6WK8Qiy9sw055lwx6eFVVuJ9nodrx8rdJ5XFZ3PI,9856
src/detection-rules/rules/linux/initial_access_first_time_public_key_authentication.toml,sha256=NuOcCkSGfYXZVG3XDsmiajV_K7nT6WCDxLxfQsvo0_c,8194
src/detection-rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_ip.toml,sha256=EtySlRcJGw7olNpLgXCwpfikfIFSj290qks3XegM0iI,7450
src/detection-rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml,sha256=9Ub7g8AqGv6AAbOVtn47t6mVStN6EwJ4ghPKRDvZadQ,5730
src/detection-rules/rules/linux/initial_access_telnet_auth_bypass_envar_auditd.toml,sha256=NDRLYvFakSRqC9c_jeEP--kWAe9mill1EYZGk6QsPRg,5604
src/detection-rules/rules/linux/initial_access_telnet_auth_bypass_via_user_envar.toml,sha256=sX2g-hduHdQ_fglty8GdY2jcXH-yA_wEcgB-hiHuLew,5664
src/detection-rules/rules/linux/lateral_movement_direct_kubelet_access_via_process_args.toml,sha256=nu5qwGCvwIeC0EXPMNMdrDIOtiXJN_nWSwdc4IHiUzU,5494
src/detection-rules/rules/linux/lateral_movement_kubeconfig_file_activity.toml,sha256=ypVsw7gMGYBzUiEjeNTv1-_Vk6dutN4B6HxmpmeioP4,9755
src/detection-rules/rules/linux/lateral_movement_kubelet_api_connection_attempt_internal_ip.toml,sha256=F9kznxTgQ-LZiI8vn9gdSii25_ieXhTkZPJ5ykeOYqU,5873
src/detection-rules/rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml,sha256=f3-36_t1vaeQukdncsWSLs9hXTP2KMAXfh0rOweyvDU,9854
src/detection-rules/rules/linux/lateral_movement_ssh_it_worm_download.toml,sha256=GyfeXKHKqEftHY-c_MC9-8agsuLOZZHEuGTH52LyXS0,9114
src/detection-rules/rules/linux/lateral_movement_telnet_network_activity_external.toml,sha256=m8tXy9Fv_1_It9wzC2X58S9blKOqfEGIE6MQbM_3ENE,10086
src/detection-rules/rules/linux/lateral_movement_telnet_network_activity_internal.toml,sha256=f4wE7rZ0EpspUIiKRLqUWsthmtAPAq4FYk9hw5EINbE,9772
src/detection-rules/rules/linux/lateral_movement_unusual_remote_file_creation.toml,sha256=TRS0V6ufmLSUU-W_rUWMlw6tF8_cS0yBWkbJlw_uXAQ,10262
src/detection-rules/rules/linux/persistence_apt_package_manager_execution.toml,sha256=vdZNsuxdEDw_NN4nUj62E-VBhOVxRrIKMSv4-hKExqk,11760
src/detection-rules/rules/linux/persistence_apt_package_manager_file_creation.toml,sha256=KrqgDY_lGZ1sXfFFZi2bUR4Zgwu0AiVCjxLzUhzJ5lE,11379
src/detection-rules/rules/linux/persistence_apt_package_manager_netcon.toml,sha256=Wz83NVcRLvdBBpV9rD9TMgBeGyx0ABImMkw7vwFyfzk,10275
src/detection-rules/rules/linux/persistence_at_job_creation.toml,sha256=xeMNrk6WBcacX_HBaRnQDZ98o9DPupM2KqlWJLtRoUg,10030
src/detection-rules/rules/linux/persistence_boot_file_copy.toml,sha256=syTz59FJrPPC1RpO3TwEDbrPw4FSnQdYuWikNC_ywL4,10632
src/detection-rules/rules/linux/persistence_bpf_probe_write_user.toml,sha256=raScZTNYCeuZHG28YOXViLwKAkslL8gItPqLDeoHQOQ,7511
src/detection-rules/rules/linux/persistence_bpf_program_or_map_load.toml,sha256=GxpamolqwiwlVwTLStgq9KzGi_lEAe7JU2Uxy6iKBHk,7469
src/detection-rules/rules/linux/persistence_chkconfig_service_add.toml,sha256=y7pxp7Zrg3dhLT49gGTFWktpigJNSDNc2L8f3lOiAQo,12457
src/detection-rules/rules/linux/persistence_credential_access_modify_ssh_binaries.toml,sha256=deIdF4Hvz5mnlllBqjGUqM_b6JJX4irXmxBGl6bOy1Q,12929
src/detection-rules/rules/linux/persistence_cron_job_creation.toml,sha256=KibhbKhtUfzVXWpAOnmCEGRRHL2qwXJwmh-B18RrZSY,14648
src/detection-rules/rules/linux/persistence_dbus_service_creation.toml,sha256=njNJ-9pPZCOpDjdtcMEAg4jP8fTSrdt6y_Cpi6lOIIU,10700
src/detection-rules/rules/linux/persistence_dbus_unsual_daemon_parent_execution.toml,sha256=c1wrHWSptxBJAZ4f7lR-mn5CJ6XBTKtL7OAHQT9Ry1w,9734
src/detection-rules/rules/linux/persistence_dnf_package_manager_plugin_file_creation.toml,sha256=8g75xfHKCvUw4uE_LBdOtDLgdVSZaeb-GUwU2qMw-Oc,10946
src/detection-rules/rules/linux/persistence_dpkg_package_installation_from_unusual_parent.toml,sha256=EvDoqf3ffWEne7nrB8lx7h0-6GWCVMurj1pWB01StOA,9010
src/detection-rules/rules/linux/persistence_dpkg_unusual_execution.toml,sha256=Skr2DDgqDBI9NGNUtXhtyzaHOhdw-TBLPKt7ICzXeTI,9293
src/detection-rules/rules/linux/persistence_dracut_module_creation.toml,sha256=sC4uKaZRvHxrCfzzv6T-tqpeZts9RmxxpAjfImYyjOU,10798
src/detection-rules/rules/linux/persistence_dynamic_linker_backup.toml,sha256=Mkv-PyjVZGIZS5a1aPOzuoscOug10pTXTHTkso_fVks,12369
src/detection-rules/rules/linux/persistence_extract_initramfs_via_cpio.toml,sha256=ccaQT5jKSI2NFtngD6sShgaBbCldybwogJfn_3jc7gk,8619
src/detection-rules/rules/linux/persistence_git_hook_execution.toml,sha256=h9-FSFUS41cH1P1A35VmYCuBfh-bE6OogxjOYe6tXuA,8893
src/detection-rules/rules/linux/persistence_git_hook_file_creation.toml,sha256=pdojuQjZKh8TfmZI18ssed4biT5ippDqwJ5In3cNOZ0,10043
src/detection-rules/rules/linux/persistence_git_hook_netcon.toml,sha256=nsYwOTUugW6Pot7IblkMlfND5kMI7_CxsBqnJxyyzwQ,10118
src/detection-rules/rules/linux/persistence_git_hook_process_execution.toml,sha256=vuY7jED58TIGn-Pix6Bnh4p5qlH93KmNrMrSnXWjw2U,9633
src/detection-rules/rules/linux/persistence_grub_configuration_creation.toml,sha256=AUmngRk7_KoQHQLehAaKywxgTugLjhJEf93dSZMcRiM,10365
src/detection-rules/rules/linux/persistence_grub_makeconfig.toml,sha256=66QMolXsNP5zKTY-73uG3xOgItPEpfp941mh2-2lZ6Q,9137
src/detection-rules/rules/linux/persistence_init_d_file_creation.toml,sha256=dVBJOh9LPGAISz2iouzH7ek-bBNhww6zdLda_9z5WaE,13302
src/detection-rules/rules/linux/persistence_insmod_kernel_module_load.toml,sha256=OHVRexglj77ihetRsQKgSL5OMViSmBDlRx8VToEh4sk,12927
src/detection-rules/rules/linux/persistence_kde_autostart_modification.toml,sha256=nByu5PqWCYYM_zKuHcXFsJJZ1usDJEQd0qEG4-WE_Ts,16929
src/detection-rules/rules/linux/persistence_kernel_driver_load.toml,sha256=-lE6wiX62ax-g0rDh162WHYc91Mtln196HLt64kDQfQ,8187
src/detection-rules/rules/linux/persistence_kernel_driver_load_by_non_root.toml,sha256=3i4eeUbo303YW_KB7Fbx7iC2A3WOJOCFQrox8GoQYGQ,8434
src/detection-rules/rules/linux/persistence_kernel_module_load_from_unusual_location.toml,sha256=5OQU8P_xRrPttZ5aIA924LAujDH1anaveTOiUcIRd9I,9665
src/detection-rules/rules/linux/persistence_kernel_object_file_creation.toml,sha256=H2icdWWzax7q_uxr4w5b-4Rvk2Eye9_r1oPEk8Uwa_0,9102
src/detection-rules/rules/linux/persistence_kubernetes_sensitive_file_activity.toml,sha256=FVna2_PesECgo34oo25kBMaHjYBTZl-b-pzg082wO7s,9502
src/detection-rules/rules/linux/persistence_kubernetes_static_pod_manifest_path_process_execution.toml,sha256=6pPq4THrtFLTHa5I964jb6hdJXZKTn2hontrbaEOD48,4921
src/detection-rules/rules/linux/persistence_kworker_file_creation.toml,sha256=lZ8SKMWZYrpkcHeWDzeIwCxhKMeTs-3Y-2vuHwg0nA0,11549
src/detection-rules/rules/linux/persistence_linux_backdoor_user_creation.toml,sha256=VEb1CrNzy8b1i92mgr2GSokg0Aoytao2GcPBcC6Fkoo,8832
src/detection-rules/rules/linux/persistence_linux_group_creation.toml,sha256=Gg5PSiD75MUJpwW6yTxNDUW44PZ7Ph3dMnz1u6ftVFQ,7518
src/detection-rules/rules/linux/persistence_linux_user_account_creation.toml,sha256=HKezADEGZZSulbYr1rclnqagD9B24Mv7I8l12Rwtrvw,7106
src/detection-rules/rules/linux/persistence_linux_user_added_to_privileged_group.toml,sha256=ET_PUILB4X1RsXrKY2TuCFbpR9L1HRowSsEv70TtqQ8,9398
src/detection-rules/rules/linux/persistence_lkm_configuration_file_creation.toml,sha256=2J8asdiJ5TPeXXFgvLxh3g4rNJPFtFhp10VOvEDvo3I,8350
src/detection-rules/rules/linux/persistence_manual_dracut_execution.toml,sha256=wIM-gg4GseXWXK6tDBUN2Nrfry4XLmcrzidWMa4WRPo,8697
src/detection-rules/rules/linux/persistence_message_of_the_day_creation.toml,sha256=J2iw9jnONXl36Sb7PSZlJzFV-AbzayiFwHLvOF8gt8g,11107
src/detection-rules/rules/linux/persistence_message_of_the_day_execution.toml,sha256=A43dOtdFhmZsLottIv53fkWAp1vqc7_7Qm2vKKB7PzM,12208
src/detection-rules/rules/linux/persistence_network_manager_dispatcher_persistence.toml,sha256=MAu1nE5VJ2AuZOOg82DwXkWs09xU-zIte-Ra1Xks22o,10637
src/detection-rules/rules/linux/persistence_openssl_passwd_hash_generation.toml,sha256=o-nQ0rWkZrqJWXHrWw8tXykLISk2VdSi-UIGzwT4z8s,8512
src/detection-rules/rules/linux/persistence_pluggable_authentication_module_creation.toml,sha256=A7Fj_D5DqPOAuAz0CkHaqaoPAuDuI0C0AEZ1mfDQsZw,9463
src/detection-rules/rules/linux/persistence_pluggable_authentication_module_creation_in_unusual_dir.toml,sha256=oHhPI3TR2vtImKFJUi4a41o6Ip7QxeS5OuU8TeFZQY4,7841
src/detection-rules/rules/linux/persistence_pluggable_authentication_module_pam_exec_backdoor_exec.toml,sha256=GmNGVb9TqMC9ALUd0j-d_hIlIHadkCvCYno_29ALN4w,8404
src/detection-rules/rules/linux/persistence_pluggable_authentication_module_source_download.toml,sha256=PepMkZ_1PPRb3b3q7SsvGVT3NcRwXnZHg7yYV8raEDs,6705
src/detection-rules/rules/linux/persistence_polkit_policy_creation.toml,sha256=37nUvqcG3lZYTbJqSooy6P6IuD0drWZSsvpQBS3mC2I,8740
src/detection-rules/rules/linux/persistence_potential_persistence_script_executable_bit_set.toml,sha256=S5rQlHhYUHX6VVDXecFCSLc0HKimQMoz11-v-h84Wog,10534
src/detection-rules/rules/linux/persistence_process_capability_set_via_setcap.toml,sha256=hItZ2QhDscxSzJ8KhEh9GhyZGzNSSSR1lql_45kZ0GU,8461
src/detection-rules/rules/linux/persistence_pth_file_creation.toml,sha256=bYUdnOxm3ncsWkVvb33kJgVxZ4gFHv_jj2EuSIPqUMQ,10041
src/detection-rules/rules/linux/persistence_rc_local_error_via_syslog.toml,sha256=yri4omnDx7vZvpldUbrV9_S3PxMYMdT6h6-WogEB1gg,8108
src/detection-rules/rules/linux/persistence_rc_local_service_already_running.toml,sha256=1hQQgrMPvdPIBz8oiiFyu8VNJaqIW32qr7T6EbGWBl8,8915
src/detection-rules/rules/linux/persistence_rc_script_creation.toml,sha256=ZOViue-MGDSsAC_0tlwE8NTYG3LQCcMh50_T5LQUxzc,12289
src/detection-rules/rules/linux/persistence_rpm_package_installation_from_unusual_parent.toml,sha256=jDCDZJyIzl-PVvNuZpuTjVC5n7qrhb9eT4YKQ_MPKvM,8419
src/detection-rules/rules/linux/persistence_setuid_setgid_capability_set.toml,sha256=ETNbDYGshGv3QTJFeqNfQ_l2Lr6UzrrweNwwSwjedo8,10592
src/detection-rules/rules/linux/persistence_shadow_file_modification.toml,sha256=mwHk7lI4bSGMb0XcjHv7GHy7gwb9Qp4sC4uWrtYmTiI,8309
src/detection-rules/rules/linux/persistence_shared_object_creation.toml,sha256=ZJGnX7Rrqxo5m9WkTdxsHlExdAoprePz_rnUo1PsKcc,13673
src/detection-rules/rules/linux/persistence_shell_configuration_modification.toml,sha256=1j8-2M7y6t8G6_k_XcRxEeeSoSpTltNObpHXgIVhoDA,11243
src/detection-rules/rules/linux/persistence_simple_web_server_connection_accepted.toml,sha256=_Axah_zgEWS8b1g0ewQ6CSvxqPyCZimUbBgeWD4uBKE,9254
src/detection-rules/rules/linux/persistence_simple_web_server_creation.toml,sha256=xElzl5zz_TpPlqN0JeTOp7dcI1m8ubvw-AeLAWXf1f4,9517
src/detection-rules/rules/linux/persistence_site_and_user_customize_file_creation.toml,sha256=FMedOQWLw9qBAQj1kcBq0WumwQAK_0E3WQa70a31fps,9876
src/detection-rules/rules/linux/persistence_ssh_key_generation.toml,sha256=SOV5QSz_Wl-r1KYd6r98AFMMwfj4-VatQKtlPzPUDHE,6638
src/detection-rules/rules/linux/persistence_ssh_netcon.toml,sha256=LTsjfJqwsMUOdUXZk7q19yNcvLDg4xG5xWImUeZ3PNs,8438
src/detection-rules/rules/linux/persistence_ssh_via_backdoored_system_user.toml,sha256=2woSqdmAww_GNs9bohvXSZFOJz8JgQewbZCPAGBN81Y,9055
src/detection-rules/rules/linux/persistence_suspicious_file_opened_through_editor.toml,sha256=Ai9eXbRfsr9B0-sTMoUD9ZrX8fdUg-VQOTMnL2FAN_4,9081
src/detection-rules/rules/linux/persistence_suspicious_ssh_execution_xzbackdoor.toml,sha256=xr5g_mpZLO_ElEWbZ7-y5JzT55_isiqBhImVGJwS5zA,8190
src/detection-rules/rules/linux/persistence_systemd_generator_creation.toml,sha256=P6Pz-MhvJQSR27tSFd6dGE54gYKMkevsldZUiLtF5eQ,10666
src/detection-rules/rules/linux/persistence_systemd_netcon.toml,sha256=0Jxl8hQ0Tjm55CA7dModpALwEK-whXL3oAZ6ytVassw,10732
src/detection-rules/rules/linux/persistence_systemd_override_conf_creation.toml,sha256=qEYyFkpCYgq6IvjnXPLWB_cFxuTufU9liA4ykqsA7fI,10101
src/detection-rules/rules/linux/persistence_systemd_scheduled_timer_created.toml,sha256=B1uNOGXnyQy6WOdbIq6O29mOWmYTiPVfhXIMSnSU9Eg,13493
src/detection-rules/rules/linux/persistence_systemd_service_creation.toml,sha256=z98LcwvtMC8LzrL38njje59CVCNwUc1sgMDDdgzgSjo,15824
src/detection-rules/rules/linux/persistence_systemd_service_started.toml,sha256=KtUM445pz2rwRSmf1CiPhj9ygrL5sZpIZka6YtsKsHE,13849
src/detection-rules/rules/linux/persistence_systemd_shell_execution.toml,sha256=aNfrGhWPzxkLdIhMfYmhOqxWmrY8cUXrcNgG_PGCfv8,8396
src/detection-rules/rules/linux/persistence_tainted_kernel_module_load.toml,sha256=r4DLzJJbsgbMDkEsgZkv23pjxaockJhU_dQhCXRvhYI,8295
src/detection-rules/rules/linux/persistence_tainted_kernel_module_out_of_tree_load.toml,sha256=b3Gg61Sqpd1-Gxbn_riBjvgjj6mGqG7pJA5fAMIzVJM,8257
src/detection-rules/rules/linux/persistence_udev_rule_creation.toml,sha256=IGeD1FvIiLo1sFox30lxFMVNVmxSXHv24RtbyQP-qWU,10132
src/detection-rules/rules/linux/persistence_unpack_initramfs_via_unmkinitramfs.toml,sha256=-j9HCX1qfrVRL2jufE1gC06zQARaKXiouqS3jYxIhtY,8992
src/detection-rules/rules/linux/persistence_unusual_exim4_child_process.toml,sha256=HnFzkdu4aivB4ao7SeVyN0m0Qf7OD3oWfHm4M18bESE,6644
src/detection-rules/rules/linux/persistence_unusual_pam_grantor.toml,sha256=z3xbXysAYgFl-AvB8bmueVbr7BCrb9HFhMTdw-fbSds,7419
src/detection-rules/rules/linux/persistence_unusual_sshd_child_process.toml,sha256=RjaX6E_y-FRk1G09vT0uQYkgo_UMTAqiq9sNCxqdB3U,7139
src/detection-rules/rules/linux/persistence_user_credential_modification_via_echo.toml,sha256=F0nQnl3FTEF0ahex4O_dhstWf5NKSSX56pODlKY_W-s,7682
src/detection-rules/rules/linux/persistence_user_or_group_creation_or_modification.toml,sha256=517fIU6PU9Jaa79Fmznz5w5XvgeLo1nL64_XuNHquLQ,8740
src/detection-rules/rules/linux/persistence_webserver_suspicious_child_execution.toml,sha256=nl3j3xZXnBQYEw2esgsVs9IKQvadsrSzmEbOmDip8-0,14266
src/detection-rules/rules/linux/persistence_webserver_suspicious_command_execution.toml,sha256=yeN7MzFJA5JsYm5SzC08h8Mhv_7EjJ2t_JsDfFr1uzw,19062
src/detection-rules/rules/linux/persistence_webserver_unusual_child_execution.toml,sha256=_Z66xxPWRI9FsSv1ovbfmxGI_WreyGx4sSnu8_VE6zM,10439
src/detection-rules/rules/linux/persistence_webserver_unusual_command_execution.toml,sha256=Y_3cfA3hXNEizPuVK1QKxGlKGkC46W24eACLa2IqoR0,9507
src/detection-rules/rules/linux/persistence_xdg_autostart_netcon.toml,sha256=vTL1DPqs0X7h9mlxdW23zv7oDrOiP9PcNWAx12rLW_4,11528
src/detection-rules/rules/linux/persistence_yum_package_manager_plugin_file_creation.toml,sha256=dnU9kXsHR_L7otTRCVjI_UqX7aH0oWqz0QsEORMTx9o,10032
src/detection-rules/rules/linux/privilege_escalation_auditd_euid_root_shell_from_non_standard_path.toml,sha256=QrGDniwoLosk1lrPV8InA-_wfwKexTsF-h8Z9uiQNJM,4652
src/detection-rules/rules/linux/privilege_escalation_auditd_nsenter_target_host_pid.toml,sha256=sobidgeuLtKSUxdd8KAQ2prjSfVcsJVKz-0baH6lf8E,3091
src/detection-rules/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml,sha256=lXxtEpf6mUrh_pIw1vMroKigvBCr1akN8PKFdbbmAw0,9371
src/detection-rules/rules/linux/privilege_escalation_chroot_execution_container_context.toml,sha256=1azDfLgXZ0UMLLqcTHMQo9BOIgh6GvuOnSU6ENMVUok,7282
src/detection-rules/rules/linux/privilege_escalation_container_escape_via_kernel_core_pattern.toml,sha256=gYek5h0KeqbC0REGyKuw6QiWL3Wei8Pe9zTo9fsX9qI,9796
src/detection-rules/rules/linux/privilege_escalation_container_runc_init_effective_root_auditd.toml,sha256=5wFM9vlG3ylA9N8BJlhYOcNyabWCs81Zf94AA4D7G_I,3923
src/detection-rules/rules/linux/privilege_escalation_container_util_misconfiguration.toml,sha256=Mli4Yqyoqbv_fHulvkOV1fN992kdMAo0hKDCJPEvhfw,9701
src/detection-rules/rules/linux/privilege_escalation_cve_2025_32463_nsswitch_file_creation.toml,sha256=_kvWGzWA2JfWEjkkSmOEVzQWgZDk7IbHKZ7NY9k9PL8,8322
src/detection-rules/rules/linux/privilege_escalation_cve_2025_32463_sudo_chroot_execution.toml,sha256=uMUubsgpC1W1mPQYgJipFJetvI4QSxE3suEW5TA-tTU,8974
src/detection-rules/rules/linux/privilege_escalation_cve_2025_41244_vmtoolsd_lpe.toml,sha256=o_fmj8_YuyxUq1bpqS_9SMeIcP-3L6MQrseN4Z11L28,10106
src/detection-rules/rules/linux/privilege_escalation_dac_permissions.toml,sha256=3bYMHI4lIhjHvTcN8GmYpt-2lNpxbcJR1KyBRCJ_vog,9677
src/detection-rules/rules/linux/privilege_escalation_debugfs_launched_inside_container.toml,sha256=ZCOEQVFXU0BJEDEPdy9qRiMseK4fN28gdWSJWndQyLQ,8354
src/detection-rules/rules/linux/privilege_escalation_docker_escape_via_nsenter.toml,sha256=ELm_kKA_a6ogrvDSNBXoTn8iWa_ktWEBxHPRsX3hVy8,6062
src/detection-rules/rules/linux/privilege_escalation_docker_mount_chroot_container_escape.toml,sha256=qMcWp3s1qW5JHfPPgyVyTO92xWJwhtBT7qlpNBZbxB4,9402
src/detection-rules/rules/linux/privilege_escalation_docker_release_file_creation.toml,sha256=ZEwpFk_HvFiPtIKP9SArRPsRKAsvxxmUdZ-VhqxbicY,6177
src/detection-rules/rules/linux/privilege_escalation_enlightenment_window_manager.toml,sha256=wVjv2dmu6kaYFivxiB-KJZB-lRD8wuJKvu-2OckSBg8,8192
src/detection-rules/rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml,sha256=_ucWmMGtfDc7h2DdqsrckqvPvOEfdKc4rDnQTmRD5uc,8393
src/detection-rules/rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml,sha256=Ny_di117g0UuFP8o9iDTW5LOAsMCQnin1NhkGIL-rk0,9594
src/detection-rules/rules/linux/privilege_escalation_kworker_uid_elevation.toml,sha256=YQB90V2KJr4n-iIZgbtTij95e6fs_1VhD6BPmPPCQHY,8202
src/detection-rules/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml,sha256=vuoW-VDRQ3HXm4IVfU4wUl91QHOTSN-gsQNzsIFTHG4,10349
src/detection-rules/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml,sha256=7XvuWDX68AqJSl4x4M9AvLqlXfrzhLU5VORtSaV3mD4,10205
src/detection-rules/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml,sha256=V4AnOYE6ND91hxBYPVjmx6wyctI6jGgzrNGpIuuyNJ0,9602
src/detection-rules/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml,sha256=KAdXCOJPfwaBbPmxBBusALQT3mGuXDSV7CLQqFZSnq4,8973
src/detection-rules/rules/linux/privilege_escalation_mount_launched_inside_container.toml,sha256=PAGyHLDFkHFw3Vaq1bNOkos91OE2w9H79rapyouZ14Q,8538
src/detection-rules/rules/linux/privilege_escalation_overlayfs_local_privesc.toml,sha256=-g9FkzaXVBtkCgrI32Gsmbqt05PET-g6UpfPiK5wKgs,6453
src/detection-rules/rules/linux/privilege_escalation_pkexec_envar_hijack.toml,sha256=LCQ2yzPV8Y9eGCMRvNjim5z89AZIQQT4ckvzJBimjcE,8675
src/detection-rules/rules/linux/privilege_escalation_potential_bufferoverflow_attack.toml,sha256=nHc1pS4i9zFdfc2iJtT_P0qtPYQ_-q8QWJY3fF4xopk,6527
src/detection-rules/rules/linux/privilege_escalation_potential_copy_fail_cve_2026_31431_exploitation_via_af_alg_socket.toml,sha256=MT169lIFWvFeD38dZtNctoS9_x4QPqve7mHdcPrAtHg,10481
src/detection-rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_child.toml,sha256=BFNIf-6-wTEUfsLrvXDnYjcdPa-7Gz_PXui0A2PMocQ,6663
src/detection-rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_parent.toml,sha256=scW6JXdndVvnrIPssckynMjewf8JLmfsPf97l3pQy9Y,6856
src/detection-rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_parent_child.toml,sha256=S4fBRKswcYFPkWeUKZUI8Tjndd_iJrSNEfchgle-GUg,6857
src/detection-rules/rules/linux/privilege_escalation_potential_suid_lpe_via_process_args.toml,sha256=VCjbHEJpiuIUtOB9TdjIeMYp-L3iVPRl3479UWKtrmk,3426
src/detection-rules/rules/linux/privilege_escalation_potential_suid_sgid_exploitation.toml,sha256=cIAQClXReIMd6_uStvIk3J0nmt1OIHmMStkLOH2nijQ,11721
src/detection-rules/rules/linux/privilege_escalation_potential_suid_sgid_proxy_execution.toml,sha256=aWTsqLdOLDLXOC5Cb0a60O-p3HkMby10RuSFMIEgcSA,10165
src/detection-rules/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml,sha256=3UXaY2MwmjpNNGPeHCK4pD9aqb_kLbgfyq0U0Ee1fQg,9340
src/detection-rules/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml,sha256=DqQ5bPhD1f0sYpoaAw5ylhOHVxRWsInvECH_Lut3nuA,8400
src/detection-rules/rules/linux/privilege_escalation_shadow_file_read.toml,sha256=KHhFPJFE_Sz2Y2K2tG0uJnVf7LkdmXeJC-vC02o4j4c,8939
src/detection-rules/rules/linux/privilege_escalation_snap_confine_lpe_via_cve_2026_3888.toml,sha256=_HBIr6Prw3ykM9dpt_denu78oqYVoXFodS_iG2bi3Jg,8855
src/detection-rules/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml,sha256=7Rs4y5RFRbS3Gctpse5QE5xwza0BpiCWG8XMRQgU40Y,8533
src/detection-rules/rules/linux/privilege_escalation_sudo_hijacking.toml,sha256=3wTGIr5ScHEGwfw07R_eOTn-DCtARJIU1h_oDTkJOUc,10003
src/detection-rules/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml,sha256=I3rrDVPUaMv479E2B8tmFUuG6wpivxOOBP9lH6CUuuI,9138
src/detection-rules/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml,sha256=r-sm5yP0U8hrZu2oAguL3Y5bVGBJqWD_G5CBps7dCFs,8525
src/detection-rules/rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml,sha256=9sYi_7KSO6IkMdhWz1tzOh0oMeU7nF5pmZE9I6Tl5Ko,8696
src/detection-rules/rules/linux/privilege_escalation_suspicious_passwd_file_write.toml,sha256=CEnq8qlkV6rYNdd4LapYdqHuknCBjI82uHHT7KPyQPk,10421
src/detection-rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution.toml,sha256=Dj2qz4HUyP8RmJrcV7mJb7owNZUkRaVisgvQpli2tt0,3972
src/detection-rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution_auditd_sequence.toml,sha256=l3K9WE8rmD8suE1EhqwgYaZZ2QP2yL89vtFb7VzX7Kc,4226
src/detection-rules/rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml,sha256=WtnmNxzgnMiNTVI5X0xCiRw_yU6dmLqkVD3gG3V6TaA,10251
src/detection-rules/rules/linux/privilege_escalation_uid_change_post_compilation.toml,sha256=GrTI3JyVJfIukuAKmOGrQslN0x8OjCt7KHsvQG54QtE,8866
src/detection-rules/rules/linux/privilege_escalation_uid_elevation_from_unknown_executable.toml,sha256=8l05oYqaYU49ce64gd2n_lZsF689JeVJ7zAKYNyFUP8,9944
src/detection-rules/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml,sha256=mLkyu3JeiTd-vlAbvgbVaBP-0GpYQSEnJ76gxW0jhQ8,9459
src/detection-rules/rules/linux/privilege_escalation_unshare_to_root_process_auditd_sequence.toml,sha256=Dujr7ZWL7bGxHtaseqzzFL3_DDwmKDGNtnBoABcsXTo,5223
src/detection-rules/rules/linux/privilege_escalation_writable_docker_socket.toml,sha256=P-ZaMYgTS4x44XEID60L6l7Vibd9Ac3p60ieQsUPrwY,8444
src/detection-rules/rules/macos/collection_discovery_output_written_to_suspicious_file.toml,sha256=xwDahuEnvInzQNl-YSQDj6apA2DuzJtg6DoVn3PiYEQ,6585
src/detection-rules/rules/macos/collection_pbpaste_execution_via_unusual_parent.toml,sha256=MOuIwF0QUZdKLrEgeF4kgzk_LsjtTW6sNmAUTWPVd2o,5296
src/detection-rules/rules/macos/collection_sensitive_file_access_followed_by_compression.toml,sha256=wqUH5zCiqC3t5TfHw4J322zEEriSEpvZX__yco1zQXg,6115
src/detection-rules/rules/macos/command_and_control_aws_s3_connection_via_script.toml,sha256=j5RvTdRmL8EeUycr7wLuaQ8S1iKzfm8tLA6tWOUo6Nw,7251
src/detection-rules/rules/macos/command_and_control_executable_download_via_wget.toml,sha256=L9a2W_0xlldlGc5k3KsT_707Vy2ham61BC14Gz88l6M,5736
src/detection-rules/rules/macos/command_and_control_google_calendar_c2_via_script.toml,sha256=6TisMYV64z7_RfrG4kk6XinQGb1CVRAxEWe3HrrLKHs,6672
src/detection-rules/rules/macos/command_and_control_network_connection_to_oast_domain.toml,sha256=yMBLf8adcU90udEUS37t4_BNWCe5r6v1rz4hU9bRv4s,6315
src/detection-rules/rules/macos/command_and_control_perl_outbound_network_connection.toml,sha256=JbyGgGKWtd369aLqVsVSbyG8rnCDIQSGbr5VbeK5lp8,6356
src/detection-rules/rules/macos/command_and_control_potential_etherhiding_c2.toml,sha256=HUnosSemPtKXtf_0J0XFRzVb0AFyTX-Pg8q-kw3GQmA,6867
src/detection-rules/rules/macos/command_and_control_script_interpreter_connection_to_non_standard_port.toml,sha256=Rdvm4HyT6ElB8sDd6_mF4S0F3rJed_CCUgtutbdmNA4,7308
src/detection-rules/rules/macos/command_and_control_suspicious_curl_from_macos_application.toml,sha256=Uif-uZTrxwKkylsZXEGlRR04THbshYVEuUiAah1LgY8,6557
src/detection-rules/rules/macos/command_and_control_suspicious_curl_to_google_app_script.toml,sha256=zXkuPyvH0gtre-yotayhTeRg3x0hWQ7B-jWDLRfvegE,5836
src/detection-rules/rules/macos/command_and_control_suspicious_outbound_network_via_unsigned_binary.toml,sha256=2s8CD4kXobynzeODmrWIwRMXbxlb7deFMkJ0zJ_zim8,6275
src/detection-rules/rules/macos/command_and_control_unusual_connection_to_suspicious_top_level_domain.toml,sha256=LN8dHmYMcoYkttyNBU4NqsUQfgPZLaENnkcHjVuFu6E,5965
src/detection-rules/rules/macos/command_and_control_unusual_network_connection_to_suspicious_web_service.toml,sha256=WphYKDvn9nqOyVuTxCMbSJvygAupm3d29bC3Qso7IzY,9578
src/detection-rules/rules/macos/credential_access_credentials_keychains.toml,sha256=dy_0jIupjutCU81DgrEwQ7BEQ3A6r1zv2R41NMtbLOY,8142
src/detection-rules/rules/macos/credential_access_dumping_hashes_bi_cmds.toml,sha256=qepAstJGgNLsbGiD73CXNceyg_7brgJd_aB4ay653a8,7909
src/detection-rules/rules/macos/credential_access_dumping_keychain_security.toml,sha256=s9_J0Ulfo1eTvKajhrw8iYXxsEpqsVAgnq56EOSXq5k,7610
src/detection-rules/rules/macos/credential_access_high_volume_of_pbpaste.toml,sha256=SisKEgfQT4DzJ_2UImkdyoRcKTMKMlI5aLRobiuARLk,6003
src/detection-rules/rules/macos/credential_access_kerberosdump_kcc.toml,sha256=-q3h-0Beeutv-XlsW4UY8lp8RD7aCFvlUo2_3DZNG8w,7840
src/detection-rules/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml,sha256=0piy0-RiarUCUyfIU9cnJJGDWAvPcb8-t1rlli9Ftdk,8706
src/detection-rules/rules/macos/credential_access_mitm_localhost_webproxy.toml,sha256=l3u2tcycx7XUBfCng29HkI1twXENMmUGdfaaTi-JnHw,8384
src/detection-rules/rules/macos/credential_access_potential_macos_ssh_bruteforce.toml,sha256=DUHP0jiMICAPZbUEv5cN7BpiomoMrKYzk4woelzzPlk,6863
src/detection-rules/rules/macos/credential_access_promt_for_pwd_via_osascript.toml,sha256=LNUHFvYwnxcS0m6cwxLKZCiYeDmrgYPXapN2RPAZjbs,9360
src/detection-rules/rules/macos/credential_access_python_sensitive_file_access_first_occurrence.toml,sha256=6udJ1Zv0RpvsYyr0oCPMNMc7iqLjweF_NhS4RBMUTNc,5443
src/detection-rules/rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml,sha256=rkZznN7WcPIffgCzTuo2cjAnrSH8g2A84zZvWh2vnfw,8371
src/detection-rules/rules/macos/credential_access_systemkey_dumping.toml,sha256=3ARfBxKV2v53aXRpZwdgYP_tBheKEz1T0iFUohYI_No,7972
src/detection-rules/rules/macos/defense_evasion_apple_softupdates_modification.toml,sha256=yFV-BoqtU5DTjVn8c3ScavwAT0dFLs2klFWKV7S6YV4,7933
src/detection-rules/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml,sha256=kRhZn-xbNzI1XlZRlBRLHEWIdizNcBNaP9ND3XxoFqw,8685
src/detection-rules/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml,sha256=ehfkbrxCsyGASpi1wu9cTAz_uiHJY44_wXW-DFugs8o,7734
src/detection-rules/rules/macos/defense_evasion_dylib_injection_via_env_vars.toml,sha256=lJP_D2P8N7ZECDCu2K9yP_FPMNh6w5Lp3yZQkXJ0abw,7241
src/detection-rules/rules/macos/defense_evasion_gatekeeper_override_and_execution.toml,sha256=JotZlue8arnAqFmjPGpUa5DtAM_ZZ2Z-PxIKOnl0uc0,5912
src/detection-rules/rules/macos/defense_evasion_install_root_certificate.toml,sha256=xvgo9kKY1acPOjih3Xe3a_Q2HDwhvqdbad1D6xHQXdw,8341
src/detection-rules/rules/macos/defense_evasion_modify_environment_launchctl.toml,sha256=a5DE9lZ9HPP1i1S75urFIjg6d_C7asBgo_-VIZmId_w,8209
src/detection-rules/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml,sha256=63GudLMN52jCOLQ2_-tGopNtci6v5sbYRgbRYfEVxrY,8464
src/detection-rules/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml,sha256=9rJeflU2x0XvKinbXMqi9gjBvALgVPUm-Er0_oEDlgc,8413
src/detection-rules/rules/macos/defense_evasion_safari_config_change.toml,sha256=PS9Quc5Hm2oKpSPkiFmHhQAQLz7pfYdvJtlnvEIZt_k,8050
src/detection-rules/rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file.toml,sha256=kQClhIz-iXOlDAZCsYwHgnlFtOqPsVy9MHhj4MSH1PE,7781
src/detection-rules/rules/macos/defense_evasion_suspicious_tcc_access_granted.toml,sha256=SrdP7KCJ9W0MG1Qm93Tsic2oguvCPyqAZBokIYnDgrg,6494
src/detection-rules/rules/macos/defense_evasion_tcc_bypass_mounted_apfs_access.toml,sha256=ilfSTQWE4z4NRlWyql4U-bE8qq-9-j_0uYHBwf0f7O0,7682
src/detection-rules/rules/macos/defense_evasion_unload_endpointsecurity_kext.toml,sha256=dPnT7UmAw6QDOSGOEn8ESLPrix3c2KcAjLgsVI-e13E,8115
src/detection-rules/rules/macos/discovery_dns_request_for_ip_lookup_service.toml,sha256=NuZGT6z61S1lojntwKEbqdELDeXNDa3w38sB8usRKJQ,6609
src/detection-rules/rules/macos/discovery_external_ip_address_discovery_via_curl.toml,sha256=umZGY6wimNB9vaSo79VKGFwGgsfIHnz01fZl6GKFl4I,6492
src/detection-rules/rules/macos/discovery_full_disk_access_check.toml,sha256=BcZypjOs0QtoEIL6CJ5odY9l_7iIv2xhSzUOMSCskzU,6514
src/detection-rules/rules/macos/discovery_suspicious_sip_check.toml,sha256=lspk--PJ0yFwsmutmBwySBLzbrwZnQFzX7NH3113GQU,6774
src/detection-rules/rules/macos/discovery_system_and_network_configuration_check.toml,sha256=y1ugnHC8mfxK6wKnBn4oLXCSdxLyuJ55INrH8RlFNLw,5933
src/detection-rules/rules/macos/discovery_users_domain_built_in_commands.toml,sha256=s8tFpAEoNnVzmBiNJb6XMVdZxVuycoFHXXZY5V1OLQw,8880
src/detection-rules/rules/macos/execution_defense_evasion_electron_app_childproc_node_js.toml,sha256=gQxwltDO2bNgiKVyGroFtUid3F36ZcN_Xn2-2wsGwpE,8230
src/detection-rules/rules/macos/execution_initial_access_suspicious_browser_childproc.toml,sha256=QmfN2Mne8_eRNspKv_hqYtJdRskLbk10V1wEYLBmELU,9517
src/detection-rules/rules/macos/execution_installer_package_spawned_network_event.toml,sha256=nWtzbSoynTus9KkYnHJQ49ocYpqfFCIlr7SF-mFf420,9755
src/detection-rules/rules/macos/execution_python_shell_spawn_first_occurrence.toml,sha256=eA5zI-gJFTlvfpXZC9Nu8lQ9O-Ymm-gNIuOYMlLShyE,5030
src/detection-rules/rules/macos/execution_script_via_automator_workflows.toml,sha256=5y3Qae-BhuwA6vtpIjtQx575-b1XizDY28Wt9F8GqVU,7636
src/detection-rules/rules/macos/execution_scripting_osascript_exec_followed_by_netcon.toml,sha256=aBH9o_UxMOgDaek1EP_xfh6YOV2_lo74uYEpmRJPjzY,8665
src/detection-rules/rules/macos/execution_shell_execution_via_apple_scripting.toml,sha256=fB8WatbAZwjIuCozGWpM8Io-FYAx0HhbO_sKIKAlePU,8256
src/detection-rules/rules/macos/execution_unusual_library_load_via_python.toml,sha256=mAzuYR87L_l5VTq4InVSegibQlpNEAuRmDARIoF9490,5619
src/detection-rules/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml,sha256=npaM1sesRTrm3sGRwbuq9q3J6cXQgH6ybNbFw5xKMjM,10834
src/detection-rules/rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml,sha256=Zt5wKTU7tKZsit8CJdJlGuxWrq7hSKmiBUCxxWp5KaI,9311
src/detection-rules/rules/macos/lateral_movement_mounting_smb_share.toml,sha256=c1-KZz_e9CoLb-TOTopEwi2QNcJjcGoA9EQp40zG8IM,7912
src/detection-rules/rules/macos/lateral_movement_remote_ssh_login_enabled.toml,sha256=FWVZvpqqPMtUB9LpmszinxhaDGlf2I-7F5njoukHkNs,7933
src/detection-rules/rules/macos/lateral_movement_suspicious_curl_to_jamf_endpoint.toml,sha256=ThmVN7pBYiX_HxFvDGcj1L8YLF8au0Qr6xjBIrYmo2k,6043
src/detection-rules/rules/macos/lateral_movement_vpn_connection_attempt.toml,sha256=7WRi1shjT2Z6I9xbLSkEfTg9RT-uzVigptH8Lp0_UzM,7775
src/detection-rules/rules/macos/persistence_account_creation_hide_at_logon.toml,sha256=aBK3EWXSEsoDYJjs6MK7p-yVPAqRh9gGHZSaK4u34yk,8361
src/detection-rules/rules/macos/persistence_apple_mail_rule_modification.toml,sha256=7CyzXwvQiPDBeb_L3dtgyIHQpL9U_XzQK8MnBJYMRwc,6656
src/detection-rules/rules/macos/persistence_creation_change_launch_agents_file.toml,sha256=optB9gXms9PVgG_qyGkx4FhFdeHiedDVFRihc6kGxrc,8714
src/detection-rules/rules/macos/persistence_creation_hidden_login_item_osascript.toml,sha256=oDX_k5dgN_2VdUNpa-xp0JB8vWzITpOGa1MD0cYp3PE,7917
src/detection-rules/rules/macos/persistence_credential_access_authorization_plugin_creation.toml,sha256=jqf1OnmtwiUtE9OHOtFv3P6m_n0L9JhglnaiX8QmSeE,8504
src/detection-rules/rules/macos/persistence_crontab_creation.toml,sha256=DsNu_8dufOcZApPCdBR49MO56v0tdd6P9zSJ-0eLSWs,7954
src/detection-rules/rules/macos/persistence_curl_execution_via_shell_profile.toml,sha256=tljKoyDVSLeoahmEz-eicSnGNkY7uboG-hQ5IzIhXM0,6090
src/detection-rules/rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml,sha256=wnynnVG-s35wHcBNL98fctXIk33RA-KsqNvOg6CTVYk,8360
src/detection-rules/rules/macos/persistence_directory_services_plugins_modification.toml,sha256=mlJ2aANdykX4qyueKaW0nkM4CObJEzxDEFMBWb3r3c0,7864
src/detection-rules/rules/macos/persistence_docker_shortcuts_plist_modification.toml,sha256=lpwx2Fk_8eRRi1J96CLxxmouR_HVRRkqVb45MyDFTCg,8005
src/detection-rules/rules/macos/persistence_emond_rules_file_creation.toml,sha256=JYS16uMIxV-nVhaf7z3pgWglU8pB8k1uLITem8ubZ9o,8086
src/detection-rules/rules/macos/persistence_emond_rules_process_execution.toml,sha256=1POPnK7n1EB5yuz3dZRXCJYAnU7z7iHMR6X7HNkS6hQ,9106
src/detection-rules/rules/macos/persistence_enable_root_account.toml,sha256=j6uPvGUmetQzi7FcMSCkjI-TuP9XGzfjJi8yrw7vAKM,7266
src/detection-rules/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml,sha256=zcfHQ8YJo1jJ_uSxhDIvmOrW6EkDK3c7UW44YVk1c6U,8309
src/detection-rules/rules/macos/persistence_finder_sync_plugin_pluginkit.toml,sha256=wQNnN10W1sdLOag8Lqakra2HMw4Y9SqGlPz2bETo2f8,7836
src/detection-rules/rules/macos/persistence_folder_action_scripts_runtime.toml,sha256=ge_tMIkAVP1hF3w89Z-evMJXWRMBK7tZJz9ts-BZt04,8229
src/detection-rules/rules/macos/persistence_hidden_plist_filename.toml,sha256=5PQ1eIdfDATzG34UnIq5QTfO0Icl_bqAEmdHiuHI6jI,6323
src/detection-rules/rules/macos/persistence_login_logout_hooks_defaults.toml,sha256=JZZoBxHqVOBok1KEPNcU0xE3V6UOFkPOtZ85Dd2TXUk,7377
src/detection-rules/rules/macos/persistence_loginwindow_plist_modification.toml,sha256=D97wpif7WF8xtflP85iDYGmR2cTupgiE1sKHOsxFPnA,4491
src/detection-rules/rules/macos/persistence_manual_chromium_extension_loading.toml,sha256=mHTjaL04wEQzhhytyOHXhiku72CjOh52UJkcjiv5-9c,6302
src/detection-rules/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml,sha256=EuOo_KJ_BadsO4mpfnWiharCGoEnmsfZDmp0gNUWvew,8273
src/detection-rules/rules/macos/persistence_periodic_tasks_file_modify.toml,sha256=acbzspvAYZ-pRmwWM0xWTnAJS69fl5tsddhGpgDALuU,7859
src/detection-rules/rules/macos/persistence_python_launch_agent_or_daemon_creation_first_occurrence.toml,sha256=rqSMPrOsNIUbMMm3L5TtnZ87Y1jNpfOoiSUdZe3Zbno,4739
src/detection-rules/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml,sha256=gPR2OV-QlPwZvEiqGP8HY80yr4nfBg8ynKGQ9rlU8Pc,4217
src/detection-rules/rules/macos/persistence_screensaver_plist_file_modification.toml,sha256=s5lUQ780NeFtA6b33xrrIGPZ7mlyzf50queKHKIFi9E,4904
src/detection-rules/rules/macos/persistence_startup_item_plist_creation.toml,sha256=NKDSf-jeYjkAev1U9odr8gJ222nUaSwDoz4Fz6kY5xw,5047
src/detection-rules/rules/macos/persistence_suspicious_calendar_modification.toml,sha256=ZnYLMS2ZhEqTX1kGBRFsttUsBXFJ1nVc6p4mpo8DCmk,7595
src/detection-rules/rules/macos/persistence_suspicious_file_creation_via_pkg_install_script.toml,sha256=vlR2bowla5b1GLX1H-LsJlCasC_Lkl9Xn_QH-PcYHmI,6570
src/detection-rules/rules/macos/persistence_suspicious_launch_agent_or_launch_daemon.toml,sha256=i0GZ4P9sYZDJVSddwE9lcH2FK2EzN7NdL1nQiN0UmLk,7149
src/detection-rules/rules/macos/persistence_via_atom_init_file_modification.toml,sha256=TOt93DHMwUEmgS2mzzSGqq6Q-Z9g3qYRHvVlJFQX8nM,7673
src/detection-rules/rules/macos/privilege_escalation_applescript_with_admin_privs.toml,sha256=wuR-mywgSgRmgiQ1BIRhWj8LGpaYmgqDNKILPvW8qkA,7949
src/detection-rules/rules/macos/privilege_escalation_explicit_creds_via_scripting.toml,sha256=EVIsstmTnAg3sjkJ_cN4qYIqfiG2Xce-X8apIYxF0i4,9057
src/detection-rules/rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml,sha256=-99EFGyt0XZ_iUpbaBmg0jC6x9-tVTKFGsuNlLu3d8A,8647
src/detection-rules/rules/macos/privilege_escalation_local_user_added_to_admin.toml,sha256=FXjhhqkOnfC7U4nBNBiVrHip-DLBuf4yqo4Da8hKIyQ,8344
src/detection-rules/rules/macos/privilege_escalation_root_crontab_filemod.toml,sha256=Es9pov7nRqsJ5ZsSFFYuDed5FewpCWYNH5Xv2HDsXC8,7371
src/detection-rules/rules/macos/privilege_escalation_user_added_to_admin_group.toml,sha256=uVJ86E5-SpzdmEzm1aidb3ncseNRRTlxc1fvvkKwEvM,4104
src/detection-rules/rules/ml/command_and_control_ml_dns_tunneling.toml,sha256=ATIAK_x6w-ELpWZob7lRagV87O9tTlYwOmznl71vQFw,9880
src/detection-rules/rules/ml/command_and_control_ml_packetbeat_rare_urls.toml,sha256=Q9ltv6ZWA_AE8C2NsXFE8AzJO9Nxi3Db24CPCSFNBGA,10836
src/detection-rules/rules/ml/command_and_control_ml_packetbeat_rare_user_agent.toml,sha256=W4TrmMSSAloPaUOihWm3EsX6PewswYkj53VoEkCDunM,10032
src/detection-rules/rules/ml/command_and_control_ml_rare_dns_question.toml,sha256=Gw68ebm3nqHEqNvusJJW9jJI1XZ8scOYYY-HNur546k,10715
src/detection-rules/rules/ml/credential_access_ml_auth_spike_in_failed_logon_events.toml,sha256=DaMKXXbj2kmtJGtmuUevuti8grmKfCJBaf9h29n0h2s,9659
src/detection-rules/rules/ml/credential_access_ml_auth_spike_in_logon_events.toml,sha256=CNsQx-cfyh_wH-cW2wc60PjIsPZ8RBeZTz7zAwLlYTc,10849
src/detection-rules/rules/ml/credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml,sha256=9tFZy90h9G_vHQgihtoXcq3PfsRyw_Q3Qdk96CJIEKs,9417
src/detection-rules/rules/ml/credential_access_ml_linux_anomalous_metadata_process.toml,sha256=BkT3jGV6kl4a-S3mI0DpKpYsmBbNHcu_sQ3EgJGG54s,9976
src/detection-rules/rules/ml/credential_access_ml_linux_anomalous_metadata_user.toml,sha256=WtTqiGUunsnWYfE5JQEM6ZU4pMStX8bn5hhfXbTUcTU,10139
src/detection-rules/rules/ml/credential_access_ml_suspicious_login_activity.toml,sha256=hhM8eRvz4uBnyrCX6fL_VuWaMt0ThJcomJDFyFmL7YA,10374
src/detection-rules/rules/ml/credential_access_ml_windows_anomalous_metadata_process.toml,sha256=KTdWZ98SFnUQw-03XptlRtKUEngVbZXYIU3kzxYv71w,9127
src/detection-rules/rules/ml/credential_access_ml_windows_anomalous_metadata_user.toml,sha256=-FQYxq29howmgJnuY7xwa2N_j1wzDgBPkj_sIfo2a6A,9025
src/detection-rules/rules/ml/discovery_ml_linux_system_information_discovery.toml,sha256=wgu-STwrO_VUgAZwM_ezR8LmM_FOsLtj23uDMQQO2pM,9947
src/detection-rules/rules/ml/discovery_ml_linux_system_network_configuration_discovery.toml,sha256=UUOQgpBtx7-kjiW6En5GUod261l1OIhdVTPzazBkkSg,10327
src/detection-rules/rules/ml/discovery_ml_linux_system_network_connection_discovery.toml,sha256=rb-yuYUGQ7e3kiQe6ev-_rFeHjleDD_kwBuS21M52_E,9699
src/detection-rules/rules/ml/discovery_ml_linux_system_process_discovery.toml,sha256=5-nmMdEziQjj-VcFjC71Ok_JeqJhfwJAbtAMI4Ee1qM,10093
src/detection-rules/rules/ml/discovery_ml_linux_system_user_discovery.toml,sha256=xFI6RzxYaUf80AAcRu8Qy-ZLJ80DHx768GPUjWGM1Xg,9712
src/detection-rules/rules/ml/execution_ml_windows_anomalous_script.toml,sha256=Jc6ZJtSCvDbieGbLVK0M1VDuIO0DpKVrc2-UpGYtQzg,9567
src/detection-rules/rules/ml/execution_ml_windows_rare_script.toml,sha256=MGn7aNXMxPhii1VDuN9oTYaILEnsEARf-GZeLg1ukLA,9354
src/detection-rules/rules/ml/initial_access_ml_auth_rare_hour_for_a_user_to_logon.toml,sha256=JlICb1cnsjnoahoRPBprnq9fdyxKAriRxuNtZQaQPK8,8523
src/detection-rules/rules/ml/initial_access_ml_auth_rare_source_ip_for_a_user.toml,sha256=vgFI6yaVcpjaQGO6GmXoTTyipZGjHCFHnzKnUb1fNeE,10789
src/detection-rules/rules/ml/initial_access_ml_auth_rare_user_logon.toml,sha256=v0yg8giuFwq0rjbfgFFuq1BYqHUf8KcnGJAiTyP7weU,8836
src/detection-rules/rules/ml/initial_access_ml_linux_anomalous_user_name.toml,sha256=GxgKAN6ux75R3aEsqemEFusXk09M5MMj8h-VeEgWyXs,7543
src/detection-rules/rules/ml/initial_access_ml_windows_anomalous_user_name.toml,sha256=tItrKb5eueyt5ubj5ou-f4QFs-5QhqcZt2KEfAcE4Sw,7239
src/detection-rules/rules/ml/initial_access_ml_windows_rare_user_type10_remote_login.toml,sha256=VbpB7nU8m5ukGp77O1Q0ghosRyIiH2JQfWWQZZ0u2lA,6205
src/detection-rules/rules/ml/ml_high_count_events_for_a_host_name.toml,sha256=sakXBIZBKlUTEGu1m720amyZ7_C5UvtfFE0swKOeWh4,9432
src/detection-rules/rules/ml/ml_high_count_network_denies.toml,sha256=1ZA863ngdA2zzlVetsUxcEFYZb5SYoMl4TlMAgeUbmI,11074
src/detection-rules/rules/ml/ml_high_count_network_events.toml,sha256=Opp883aStXYGCLFyt7t9Krm1aCGH26IzqFHkWQYIc9I,10376
src/detection-rules/rules/ml/ml_linux_anomalous_network_activity.toml,sha256=rqCWhpGRwV43zvSRl0W9rV1vEgDVgBsnZ9KCYvobpPM,8136
src/detection-rules/rules/ml/ml_linux_anomalous_network_port_activity.toml,sha256=HmM4uNk3c_FsfhCifFb6Lf2Tr9JqsCngsylMNDUG2zI,10673
src/detection-rules/rules/ml/ml_low_count_events_for_a_host_name.toml,sha256=lT5cZixzosLlsY6tdWIdU9k2G9k0ATnLHAZHLK4D-WA,7886
src/detection-rules/rules/ml/ml_packetbeat_rare_server_domain.toml,sha256=WEkaIJyF42Bh5mL-MBX_ZeXF53LjdDsTgN842XUie7g,11563
src/detection-rules/rules/ml/ml_rare_destination_country.toml,sha256=EsiFAAl8-f6JXxRQibGpvqxT1jEXthoZzhRbm4TGmDM,11895
src/detection-rules/rules/ml/ml_spike_in_traffic_to_a_country.toml,sha256=dQszVvTUHbONhECJfrdZqdqf47T4Birjkr4pRDSW4e0,10371
src/detection-rules/rules/ml/ml_windows_anomalous_network_activity.toml,sha256=vb9YMwPUM8fM8BsjpRIJFMAT4xXFKgzxWX-yXwlzMds,8108
src/detection-rules/rules/ml/persistence_ml_linux_anomalous_process_all_hosts.toml,sha256=rmBuY8kF9ng9GJK39fIebrII13Hwu296zZlQhilDNUM,9438
src/detection-rules/rules/ml/persistence_ml_rare_process_by_host_linux.toml,sha256=YZLNJBo2CUr4ZeOPf-0RDO0MUNHUWAHkzcJSa2HE_rg,9417
src/detection-rules/rules/ml/persistence_ml_rare_process_by_host_windows.toml,sha256=P2F3m_Ym-riUQD99CRtaRJm2VQd7pJtfHT6XYQuNyy8,12168
src/detection-rules/rules/ml/persistence_ml_windows_anomalous_path_activity.toml,sha256=EqGtudNBO4GJy4uLb_fWYlOl1tZ_TwX62CwOqvWG_W0,9864
src/detection-rules/rules/ml/persistence_ml_windows_anomalous_process_all_hosts.toml,sha256=hitO0X3wJodJ9gVeNHZJqQ2DdSqJAcgzKjirMpdeaQ4,12065
src/detection-rules/rules/ml/persistence_ml_windows_anomalous_process_creation.toml,sha256=xfshT4xOz0_EbYbqHXG2_TSPGItgImVwNwJ-16h9dSk,12897
src/detection-rules/rules/ml/persistence_ml_windows_anomalous_service.toml,sha256=sEf5s4_H5BjNxUdut8B7qku0Vvz6dsg_yqM5ZwCdCrw,9560
src/detection-rules/rules/ml/privilege_escalation_ml_linux_anomalous_sudo_activity.toml,sha256=0tRdDATJtgTFpoW1qPaeR9IQ_twWsUcuOTPtdr-DUQY,9982
src/detection-rules/rules/ml/privilege_escalation_ml_windows_rare_user_runas_event.toml,sha256=lBT4_R1yw9u_2X9RupEaNzlCTWJxu5_8xxOAYAkyFNw,9238
src/detection-rules/rules/ml/resource_development_ml_linux_anomalous_compiler_activity.toml,sha256=zk4g-3dX4KPEBHCyW5eR2oyFMwYJeVijk43gL_WZioQ,10578
src/detection-rules/rules/network/collection_fortigate_config_download.toml,sha256=kD5Fn2lUaNgreIyL7VQn65yqGAQDpMNI9CXHDrWIY9A,5108
src/detection-rules/rules/network/command_and_control_accepted_default_telnet_port_connection.toml,sha256=pZHiBY3r8jkzkusbYilVOy0_h2A9FBWGY2Sb_2Pxj0A,7717
src/detection-rules/rules/network/command_and_control_cobalt_strike_beacon.toml,sha256=DS85JPqoNunBwJSNyHfKN15QLK1VcO3mchN2qMfQ4-4,6460
src/detection-rules/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml,sha256=8klbMtIO80F__AgQ30MJDUOSGqM7WcJrsRowKmZ_1Ug,6731
src/detection-rules/rules/network/command_and_control_download_rar_powershell_from_internet.toml,sha256=IFTPp1CFPy8L_NlfnyCqk7rJyLGkJKh9OWaB6MyUjjU,6864
src/detection-rules/rules/network/command_and_control_fin7_c2_behavior.toml,sha256=nVRmmw8UP7F8zGjooHU9ag4UdC9efWSO9JLbIMwKCUc,2602
src/detection-rules/rules/network/command_and_control_halfbaked_beacon.toml,sha256=YEkPBNalEzVheow3xoIkoPkVlGyaVqoYTCizhkIEyV0,6215
src/detection-rules/rules/network/command_and_control_nat_traversal_port_activity.toml,sha256=PxZGpIlg-zq4m92pK0jtt00XPEFj4ycBixI5PrGu-os,7724
src/detection-rules/rules/network/command_and_control_potential_icmp_tunneling_to_the_internet.toml,sha256=2xZXeMT6PjQ3KYsYzma7oER8cOu-ZV4MDDzPZjsWne0,4587
src/detection-rules/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml,sha256=d68J2bnCXcv3JOLDI68rcckDbYnzkGATG_fV--pBTxg,8069
src/detection-rules/rules/network/command_and_control_smtp_to_the_internet_port_26.toml,sha256=LLDn_9jNIVBhFOTdI5Au_o6iUohZblt3phja9vpzZdE,7445
src/detection-rules/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml,sha256=myYUsQhq81ZW_BTEYO0OzmncjpiJ8er-CSnvzJI-3bk,7105
src/detection-rules/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml,sha256=nf0DznFejKGF3k42nL8DuRe2tuIbVxsxtOtlHk66rMM,7069
src/detection-rules/rules/network/credential_access_cloud_imds_credential_http_request.toml,sha256=S71dcK6sQlD37v5tAOolBBcRzOgqAEpP2kK4eS4STK4,5064
src/detection-rules/rules/network/credential_access_dhcp_multiple_servers_same_transaction.toml,sha256=QtF8pF3p--oOZUiSRNFdniXbTi1TbT7-K9WQDs5ZANU,7157
src/detection-rules/rules/network/credential_access_icmp_redirect_message_observed.toml,sha256=hBwDEnFthJW1chiBLbL3RVq-rwQGiRkuV0ndC8-Tab4,3810
src/detection-rules/rules/network/credential_access_tls_deprecated_or_weak_cipher_negotiation.toml,sha256=_Et3zH0yeL2DTdSJNFqrKszRQhkEgEBad79P6To-Kek,5609
src/detection-rules/rules/network/defense_evasion_fortigate_overly_permissive_firewall_policy.toml,sha256=qCZPbShuhdKANsOaRAXQt6gP3ex0bgMwjCWzlmYmiV0,4602
src/detection-rules/rules/network/discovery_icmp_timestamp_or_information_request_from_the_internet.toml,sha256=_ibjscNuOYmPaxIZyhk0xJco6WOM52cAB02VYL56uEA,4562
src/detection-rules/rules/network/discovery_potential_network_sweep_detected.toml,sha256=FpyNDnyW6-Vst3rWC2XbdaPRZMbYrQKth7cGF2t77Hw,6752
src/detection-rules/rules/network/discovery_potential_port_scan_detected.toml,sha256=xZNbZ5lWHlpukA5CL3H5WDWUkQP2I9sbuEdEHkJAOfs,7523
src/detection-rules/rules/network/discovery_potential_syn_port_scan_detected.toml,sha256=t4LkcTUWOthb1Ja8IouDptcHGPPLj3nt73PWnTqXYGk,6635
src/detection-rules/rules/network/impact_dhcp_starvation_high_client_mac_cardinality.toml,sha256=XcwtPl3qph_hF2Gbsxseqx-FzDVV73CDiVqUtFVeptQ,5286
src/detection-rules/rules/network/initial_access_fortigate_admin_login_multi_srcip.toml,sha256=tmFdEyR1b_hQSdeLQvfAVg17h-KmVq0IajfiuddCOog,5434
src/detection-rules/rules/network/initial_access_fortigate_sso_login_from_unusual_source.toml,sha256=AlPHHpyOxU3gnxiuKSWZBAkbQAZ0owOXFLafS8SzRIA,6325
src/detection-rules/rules/network/initial_access_newly_observed_fortigate_admin_logon.toml,sha256=wZwXt0UITOj5s2WlH2c7DPtJFuBrFhDibRH0cbRmHTQ,4981
src/detection-rules/rules/network/initial_access_potential_cpanel_whm_crlf_authentication_bypass.toml,sha256=Vqr7NPdktpjQFPrc69gr1CDH58E1m338zJFSq7Fqr3Q,12404
src/detection-rules/rules/network/initial_access_potential_redis_lua_use_after_free_rce_cve_2025_49844.toml,sha256=o9UAU3JA4P97QS6ORaKHmUOcVHNh7uJNdpqbqoWnKXs,6652
src/detection-rules/rules/network/initial_access_react_server_components_rce_attempt.toml,sha256=5Z70AlUVQJJkLqtvCJKCbXUZxTdlO3lYb2Dl1hIbUu4,5131
src/detection-rules/rules/network/initial_access_react_server_rce_network_alerts.toml,sha256=lyq06xjzcpSvGI7f4mJNjQ5PgSm5zBaJh9hKwmy3uxI,5017
src/detection-rules/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml,sha256=naepGfE5TtVLtXtfCIS0J1wvC-HjG7cupTj9tTRth2U,6331
src/detection-rules/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml,sha256=eyBtm9dKqEpjVLtc1peKt_yotppAtXCafkiurI7IYuw,6820
src/detection-rules/rules/network/initial_access_smb_windows_file_sharing_activity_from_the_internet.toml,sha256=yp_LV1hk8rLoYytMvONZrRjC4wY3-8xtHwYmWqYY5Zo,6929
src/detection-rules/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml,sha256=n0Ivv2ohzrk7uof3Zdn9oGmAB5RWOtnMgGQPJre1-ns,6983
src/detection-rules/rules/network/initial_access_splunk_postgres_backup_restore_rce_sequence.toml,sha256=yBPGVI2PrQ-3v7LclSi6iDpbo1nlc2MVjbwDfDAVZ8c,8075
src/detection-rules/rules/network/initial_access_splunk_postgres_recovery_body_injection.toml,sha256=jS-LVXemdMl47u-Xokiri7nfJeo4ev-ypsc1ik2EQbc,10605
src/detection-rules/rules/network/initial_access_unsecure_elasticsearch_node.toml,sha256=rIVKbWx_616f--KgFR6nAYklW3x32SDEYBV595riV8I,6522
src/detection-rules/rules/network/lateral_movement_dns_server_overflow.toml,sha256=P2tGwfB1iXveHr9gs9O1mjqSFnpuqXkISmn99Uoyxzw,6327
src/detection-rules/rules/network/persistence_fortigate_admin_creation_unusual_source.toml,sha256=cqyLDlC27d-ndfXKYlMucx7FS3CIAORrK7raJtIhOUU,4497
src/detection-rules/rules/network/persistence_fortigate_sso_login_followed_by_admin_creation.toml,sha256=lf7O7phwOlv_8mc5eyiU7ZIBTadbAnoPD359mV9_3GI,4916
src/detection-rules/rules/network/persistence_fortigate_super_admin_account_creation.toml,sha256=JKBdgZoVaZX1L78OB1TBOx5lhu48SJCD1_eyRbBG__c,4259
src/detection-rules/rules/network/persistence_potential_redis_config_set_cron_persistence.toml,sha256=nePQ3fXc9HT2ZyA8cwYIFoCilgeTKElvu_z4qIgwTV0,6450
src/detection-rules/rules/network/persistence_potential_redis_config_set_ssh_key_injection.toml,sha256=BmyVEGoR0m07KSorXG-8JUE9BpFaHEHgoHg_92FWcjw,6265
src/detection-rules/rules/promotions/credential_access_endgame_cred_dumping_detected.toml,sha256=z6nBuhaCnYaL-UJtn66PpMIIy0PE8gdaN-Fo6371PlM,5472
src/detection-rules/rules/promotions/credential_access_endgame_cred_dumping_prevented.toml,sha256=fTMgE5OaSeG1ttIY3vNhZcTX9mqmUh0U1z3n9ZliTZ0,5336
src/detection-rules/rules/promotions/crowdstrike_external_alerts.toml,sha256=Fhq7sied6-0CVpFcYL5zGr-X-wpllOFfwJIwCZXdLAY,4625
src/detection-rules/rules/promotions/elastic_security_external_alerts.toml,sha256=lBiECEOwduNwMfnsVOWDea5YUNq4Ptj6_BQus8kn1ig,5417
src/detection-rules/rules/promotions/endgame_adversary_behavior_detected.toml,sha256=kHUD1yWpJ9M5XWnjJTM-obM9xAP4vrXi5xTrv16EHJU,4943
src/detection-rules/rules/promotions/endgame_malware_detected.toml,sha256=qxk6GJYxP4z3A6di71nq5JjKnTzGddjsGIORg52MD-w,4957
src/detection-rules/rules/promotions/endgame_malware_prevented.toml,sha256=yxtTGq6NKFsA0ZmIr5UcToQ0GGv_jQ4hDuX8sKDQlNg,5248
src/detection-rules/rules/promotions/endgame_ransomware_detected.toml,sha256=jzHzaCMGEFRZHaY-vx-qjEvxWP0HTEu-W3JbUPJV1tk,5038
src/detection-rules/rules/promotions/endgame_ransomware_prevented.toml,sha256=NbkC3mYaZo-9BNdCHkIIDou6qtaGjERlIsRVqx1UgHQ,5205
src/detection-rules/rules/promotions/execution_endgame_exploit_detected.toml,sha256=-m18h0GJuJAXgPfZiwrRALgnmTJTAWLoWTTH19KXuC4,5359
src/detection-rules/rules/promotions/execution_endgame_exploit_prevented.toml,sha256=y47pQHii-N72d_R9ZOuBy5o115elT56nnkCgfSuuV80,5925
src/detection-rules/rules/promotions/external_alerts.toml,sha256=ENogaulAUMTAsCPCbT_GghuWhylEyqu4w3f1FmO3V2Q,5437
src/detection-rules/rules/promotions/google_secops_external_alerts.toml,sha256=N-RqHMdp-ShOWRbdjRWAlgpRul7D3HwAMBbTw2_NCtE,5408
src/detection-rules/rules/promotions/ibm_qradar_external_alerts.toml,sha256=u4T2mk0OrqDZY8OIN4_GrcELnLF3swv7C4qSL_pmejU,4599
src/detection-rules/rules/promotions/m365_defender_alert_external_alerts.toml,sha256=-GF7sxPViocmcmu5b30MjDP40VoAnukcnXcLRTpkmXQ,7183
src/detection-rules/rules/promotions/m365_defender_incident_external_alerts.toml,sha256=UeMa79nw8p2pqtfS075tHiQRgU-iUYucndobwUP8DXA,7503
src/detection-rules/rules/promotions/microsoft_sentinel_external_alerts.toml,sha256=579FABDjrD2Bx-HtjVbt9Xx_FbGxLZ6V8lwExUnbUjE,5192
src/detection-rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_detected.toml,sha256=OsC42xvAWZ73ucgomaH2F3Hz-qH2WgRXmhFvZ4UPFkg,5352
src/detection-rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_prevented.toml,sha256=L9F0p1bAIyFqqhvhAh6SrVwXO6sStpEj0RQDpDGyOl0,5404
src/detection-rules/rules/promotions/privilege_escalation_endgame_permission_theft_detected.toml,sha256=s1pE0yK3616W1TZ6fmC09oKNNxOv61YAz60iej1VlUs,5475
src/detection-rules/rules/promotions/privilege_escalation_endgame_permission_theft_prevented.toml,sha256=czsqKGAlh3ZVrjIgnvaKar28U6vz1iQFRS1xCVHpUDE,5726
src/detection-rules/rules/promotions/privilege_escalation_endgame_process_injection_detected.toml,sha256=e6RvjlBLkLA_CSeRnPkMUd7d6nWs6gEVIP3kckyXNBo,5922
src/detection-rules/rules/promotions/privilege_escalation_endgame_process_injection_prevented.toml,sha256=g2LXoq92JyjLDT6xuq3EVmdnmOwezNba2mdaLGQTArM,5447
src/detection-rules/rules/promotions/sentinelone_alert_external_alerts.toml,sha256=ub8zDEBUmVyUF-DwD2Z0WH4hNjZ4-03lLfPSnzwIJzc,5420
src/detection-rules/rules/promotions/sentinelone_threat_external_alerts.toml,sha256=ceyGbQk6Pny24PcURQfR5l-LPMP7CYIP5B5-rcw5vFI,5345
src/detection-rules/rules/promotions/splunk_external_alerts.toml,sha256=FTrly6HfH8b2f0Ev3pzEr94aADkPL2aogz9B13BQj-U,5217
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_address.toml,sha256=sABfe4Vd_YB_dN7k0TwfcEFz7ForztJQfsK24dBdXPU,9398
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_email.toml,sha256=cuh4R_J-fUder7rRHeCDAckV5mC3Tjcw52o0WyyWAko,8113
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_hash.toml,sha256=FSffKHLWay2Jyy5_EVHjg33cbS4iVct4BPH9otI20co,10081
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_registry.toml,sha256=-8NPSRm082kvQpB-gFdnthoCa_1-5eODRRSlnZbfyCY,8355
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_url.toml,sha256=JOmYkXME8BgYPNjCLRJA1mCi-gYEuu9yAemfKHyXWBU,9291
src/detection-rules/rules/threat_intel/threat_intel_rapid7_threat_command.toml,sha256=CG1NG4QEb28hBxQIeBqdugJO2bQWs0Xd14mg4uLF81s,4454
src/detection-rules/rules/windows/collection_email_outlook_mailbox_via_com.toml,sha256=KNbB-x95Y81554YlMpU3aZuPnRndKI-AiQvxdL97ri0,7289
src/detection-rules/rules/windows/collection_email_powershell_exchange_mailbox.toml,sha256=08w3wNiiJIsV90VCiQKjWSleo7jUE7_lINsjKtVIKDo,7606
src/detection-rules/rules/windows/collection_mailbox_export_winlog.toml,sha256=GwAUI4zC5io2SqfRwC0nE7j_t-9eyIdf8sclWxwu1ZE,11166
src/detection-rules/rules/windows/collection_posh_audio_capture.toml,sha256=xDV_uvryl5N_snMCvnmJp2jg4xKgXlwyfGWB6-HABiw,12002
src/detection-rules/rules/windows/collection_posh_clipboard_capture.toml,sha256=kbZmJmKwcMQaHRac7_hav_WSlG-ctH1KbcGgcowVcQI,10651
src/detection-rules/rules/windows/collection_posh_keylogger.toml,sha256=Ya3BjK-uDU9JM7ZAsLJGdFDQiSXh_pgTBh-aqe6OUsg,13096
src/detection-rules/rules/windows/collection_posh_mailbox.toml,sha256=vENDLH3XAX71HbtTLj82gpxi9u3jmFdFsE2tl87Km6o,10744
src/detection-rules/rules/windows/collection_posh_screen_grabber.toml,sha256=oIxSyTOh2hEL3IZZuOqkz-ZEgqSafkmzLQh8qG_8H-k,11911
src/detection-rules/rules/windows/collection_posh_webcam_video_capture.toml,sha256=x-i9ZYYwUZSOyuC-j0dEs76Kdzt5ZpN-Zk_tri1XHKU,9368
src/detection-rules/rules/windows/collection_winrar_encryption.toml,sha256=nxRwFQymTGTnCfhueS2OUUNe8xaT46bBYDrWKoV3YQo,6764
src/detection-rules/rules/windows/command_and_control_certreq_postdata.toml,sha256=fwJu0bdBBokhchp9M3yO6D_4o_61QaaufX3W3l9YIXY,9029
src/detection-rules/rules/windows/command_and_control_common_webservices.toml,sha256=ZXvApwfjPzZmprC-JX78JggW7a3-KBkWWUUrnFGL-HA,17822
src/detection-rules/rules/windows/command_and_control_dns_rmm_domains_non_browser.toml,sha256=564TySnrSkaBifKK8g-n1z-WxnhyYF8QtElJT5JiYjQ,10105
src/detection-rules/rules/windows/command_and_control_dns_susp_tld.toml,sha256=Ov1lo1LkVTX2IrbpA_1ME1uIgC495RIJzaWeNhmv3qE,13769
src/detection-rules/rules/windows/command_and_control_dns_tunneling_nslookup.toml,sha256=XUNTuVd2rGAXCeqeUGBGSdaajOgqeNNFMRhXvgMJ3hg,5688
src/detection-rules/rules/windows/command_and_control_encrypted_channel_freesslcert.toml,sha256=Zybz_gK-5K_k5egAB-9jnzDWyrePPz8XQZw6EPcpxJ8,6331
src/detection-rules/rules/windows/command_and_control_headless_browser.toml,sha256=yvLZiWtx6csFouEbJvFkL9_ytZOBzxyAR8u-kMK7Wls,12474
src/detection-rules/rules/windows/command_and_control_iexplore_via_com.toml,sha256=5YZQwDv9JGYVxuzRGdz8kNzrDIkZ_ZYNMqDFoIK-p8o,8055
src/detection-rules/rules/windows/command_and_control_ingress_transfer_bits.toml,sha256=rwogFlG5zMsbzmfwJi9I84BOd3Iqpz0HCFMRIwqyFNY,9343
src/detection-rules/rules/windows/command_and_control_multiple_rmm_vendors_same_host.toml,sha256=b7_J-O5jbmfkBN8bT-QLK40I5Do4ivtvjrDQUzUffJk,14570
src/detection-rules/rules/windows/command_and_control_new_terms_commonly_abused_rmm.toml,sha256=xzbyjpDaLrH_eyWtlNPeQmv7LvmBEFP8I_lz3XQw-UQ,20178
src/detection-rules/rules/windows/command_and_control_newly_observed_screenconnect_host_server.toml,sha256=KA9QQEUge2-Wsdc_g4JHdVqNMKRwD_DbEcz7qRWtPJ8,12268
src/detection-rules/rules/windows/command_and_control_openssh_reverse_port_forwarding.toml,sha256=OoPDYGEmQrxKGk97rZHZTrvbZy7Kg6Cy4lbhK4ewZLM,10310
src/detection-rules/rules/windows/command_and_control_outlook_home_page.toml,sha256=ie9C1J4AY5nxxGrHwZSPfpPT4dl5uIC9riusCBiKusU,12563
src/detection-rules/rules/windows/command_and_control_port_forwarding_added_registry.toml,sha256=xW7UwgPB2jYeUEgvPpS2M9ZLU4ev56bLy2-AEBzdstM,6397
src/detection-rules/rules/windows/command_and_control_quick_assist_fullcontrol_sharing.toml,sha256=My8sbcU_7ouC2IvOP_3-IO-yOLs7J0vWRnn8-JZxoCY,5155
src/detection-rules/rules/windows/command_and_control_rdp_tunnel_plink.toml,sha256=tCVq5v9pNYmc_J0GiQSK3EUlQyfJ1ItqGfJ6RZsFnTI,12198
src/detection-rules/rules/windows/command_and_control_remcos_rat_iocs.toml,sha256=AZIuYx-fyWB1dATIBI_jAr_yJ9zc1vUna9aie3Hpl_M,11136
src/detection-rules/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml,sha256=-Kod5yf5IcJRHjEz8lJ4G9GcPbwXkRCTGPId4eoPm60,9798
src/detection-rules/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml,sha256=4DnFG6CyGWaAYaMclUVRaU-CWXmpAMxQnKQyHZH_WLg,9705
src/detection-rules/rules/windows/command_and_control_remote_file_copy_powershell.toml,sha256=mix1Ua9jbafKK05EEUttLE0Qu3rtPcqR8Z5_89KocO4,10263
src/detection-rules/rules/windows/command_and_control_remote_file_copy_scripts.toml,sha256=MoWj-cWEbFyFEN9RJ_8zpxBOfNQAlBSv_nEo8PQI8_w,7971
src/detection-rules/rules/windows/command_and_control_rmm_after_msi_install.toml,sha256=2zTjufoeaQ2Ebw-COZr-yWM1Lbb9gcBkO46pXnyNJlQ,4388
src/detection-rules/rules/windows/command_and_control_rmm_netsupport_susp_path.toml,sha256=i9MrLsVrTGlQHMq0XmtKo8jDQTPiUj0dGnBEObcDN24,12187
src/detection-rules/rules/windows/command_and_control_screenconnect_childproc.toml,sha256=40WGSBHjHTD8ghgmTjsZ9xg7FziwzwAXkLjqxxKLXGw,10553
src/detection-rules/rules/windows/command_and_control_sunburst_c2_activity_detected.toml,sha256=zX6nrjA7Zno1-_ECHEo8prLqBuuXeuZcIgxnfVViGsY,8285
src/detection-rules/rules/windows/command_and_control_teamviewer_remote_file_copy.toml,sha256=B0FySvI9_XfLHDIyGmoRrbRSfWZJ4ka8Zmi-jp2quXw,7958
src/detection-rules/rules/windows/command_and_control_tool_transfer_via_curl.toml,sha256=jJp013jpBJ4l7rXXBrX8mT_gZMYG3Hee7kGXh0Q8UoY,6646
src/detection-rules/rules/windows/command_and_control_tunnel_cloudflared.toml,sha256=VYeTOhRHzYojCVS4ellBcLfZlLMy7Y_iYTJw9CrF4rI,4813
src/detection-rules/rules/windows/command_and_control_tunnel_vscode.toml,sha256=5K5JBf6PACS0x7tUMR_0EEjXhvszNpomGzx1MbLHEN4,7282
src/detection-rules/rules/windows/command_and_control_tunnel_yuze.toml,sha256=Oeze7Zo9-9i_awGd2XdmpSljYItcXAkMrguXtxsQXw8,5027
src/detection-rules/rules/windows/command_and_control_velociraptor_shell_execution.toml,sha256=ZzhXTgZvaGh5bBgs0y4EKVYorHddxdD73GM9tEXtdyg,6985
src/detection-rules/rules/windows/credential_access_adidns_wildcard.toml,sha256=h8Sazu2Bvo-g4CG2disN3KRGiDDrb_txCWkBE66oqxE,12685
src/detection-rules/rules/windows/credential_access_adidns_wpad_record.toml,sha256=pk_dlog2aQ2OifQidBFlVVwu0Wktkk3vVadRcDlhEMY,5721
src/detection-rules/rules/windows/credential_access_browsers_unusual_parent.toml,sha256=39ZqsvaX-9x7uopx2qTI0QjAeK7gp9rx_PxbgfQ7Rls,16207
src/detection-rules/rules/windows/credential_access_bruteforce_admin_account.toml,sha256=EH-z9g23qZu5WFZ3k0_LdPq39IOiEYRx8PfQmnWSBiE,8441
src/detection-rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml,sha256=QNMAzyBZRk2TXTXe6IWRfXxk9HooNjp85-PmJ84vDGg,7687
src/detection-rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml,sha256=OVGdqpZpf9Un6aWc4AVrq4mlxWq6aIvR3fajrQT8NW0,9134
src/detection-rules/rules/windows/credential_access_cmdline_dump_tool.toml,sha256=1kT4jzwEKWUu-er1En_tWauBJwgNinc-8AYtGN7hk60,16195
src/detection-rules/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml,sha256=UqhdNgGrvvwlZ-82MHkKkYlfIrtvOYdhcbtVPsVSTPg,15640
src/detection-rules/rules/windows/credential_access_credential_dumping_msbuild.toml,sha256=_VoAPHlrripcoYK6LcIx_M91urlw0S_oT3NubW2SSAw,14850
src/detection-rules/rules/windows/credential_access_dcsync_newterm_subjectuser.toml,sha256=eGdDadLSKfH7Ix_9MQNj5y89hJp31FqtkUAmjIkRAJE,17282
src/detection-rules/rules/windows/credential_access_dcsync_replication_rights.toml,sha256=KRiTUSjGRUcyRvCpSfaDwgBLCsfZ0ZkfHxdNc5H_tUM,8519
src/detection-rules/rules/windows/credential_access_dcsync_user_backdoor.toml,sha256=bMi9gOr8jw6kENinSD_q-RJcj1VmQ3eH0OPcwlB2c3Q,6857
src/detection-rules/rules/windows/credential_access_disable_kerberos_preauth.toml,sha256=KgqgoynZAzaJNi4DA2o1M-NTCx2j7Cf3hUd-wVKaHCI,5997
src/detection-rules/rules/windows/credential_access_dnsnode_creation.toml,sha256=QeeIhP7e58D4DjRUQ7uRaq04nqIRXaMnMrbsPKh5ycY,6414
src/detection-rules/rules/windows/credential_access_dollar_account_relay.toml,sha256=XYXjHN32zPn4GwkgOCoE5rqrRvGTG-Cb6ZY3YEta3Ig,6910
src/detection-rules/rules/windows/credential_access_dollar_account_relay_kerberos.toml,sha256=UkiDlWsmYxuw_LuVM27uRvyVd-rPuSb4fmWyS12XvMY,16196
src/detection-rules/rules/windows/credential_access_dollar_account_relay_ntlm.toml,sha256=89OZQ72SlI3AXMIJdwo08oGF8BFjhzitRQi4J6yYKHc,15400
src/detection-rules/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml,sha256=MxndO075Pzx-TNAv4gYV5QYthaZMT2R4SX49BNeVc4w,15024
src/detection-rules/rules/windows/credential_access_dump_registry_hives.toml,sha256=iugEfzaRkv4dnp3bWJdhVR_vx2RkpOzx-fYP5_HR3lY,15271
src/detection-rules/rules/windows/credential_access_generic_localdumps.toml,sha256=nERz1qjOCmJ5Vtafwo3OObXYYLw4yiPdCF47wTxM7-g,7792
src/detection-rules/rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml,sha256=f-gBxqqcdatLReKSPJQug5BMqpprferwt95bOmneIBE,6315
src/detection-rules/rules/windows/credential_access_iis_connectionstrings_dumping.toml,sha256=z-m63YlKSb0Z0xFG4mGYm3K4PvLap7edTjmBXZ2R82A,16426
src/detection-rules/rules/windows/credential_access_imageload_azureadconnectauthsvc.toml,sha256=RuBUFAcz58KSl54s-XG8fbXWn7Q5CsguJBfSwSah5TA,12813
src/detection-rules/rules/windows/credential_access_kerberoasting_unusual_process.toml,sha256=q5j_r-ZYc3o0rKlBE0y2ZacFpWL6gZuqccQeyBM0zLY,11026
src/detection-rules/rules/windows/credential_access_kerberos_coerce.toml,sha256=8i19ICsz2ClXLZDSCMC8nc4I60tcAgRTRf3Bvk89aq0,14006
src/detection-rules/rules/windows/credential_access_kerberos_coerce_dns.toml,sha256=fljEPgYm9KnpGf29F9-7ZGSZrw4HH5-RVBdmzBKVEnc,13326
src/detection-rules/rules/windows/credential_access_kirbi_file.toml,sha256=_MvA1ZIs4ozcE-8tErnlUk7WgXdfhO9gqOrE-UKiLv0,14326
src/detection-rules/rules/windows/credential_access_ldap_attributes.toml,sha256=UdUGnD_nQedaESxTsqSVB37i73yyb18wdKyfQc4TZEE,7870
src/detection-rules/rules/windows/credential_access_lsass_handle_via_malseclogon.toml,sha256=PKPH6Z9rG9_yRgn1zgs4bnU-54CwVxkPAPAiI3-zwbg,14597
src/detection-rules/rules/windows/credential_access_lsass_loaded_susp_dll.toml,sha256=clMrvv9R7LO5rKTSu1cbKIMkaP6TCQ5hAsT04_bG0kY,10210
src/detection-rules/rules/windows/credential_access_lsass_memdump_file_created.toml,sha256=kBzlKxAAJsl4lTLjvTwmeiqwZ5tCDbF3IA2mSiBp0tE,14111
src/detection-rules/rules/windows/credential_access_lsass_memdump_handle_access.toml,sha256=UqDLp8oRj2gzkhoL8oL0tK9fk2gnbBkV78u5Un0cJGo,9776
src/detection-rules/rules/windows/credential_access_lsass_openprocess_api.toml,sha256=4tm6Aj7Mw8RFAF94K3tIG9XZZONeoQGPcnsuhqj-exI,10771
src/detection-rules/rules/windows/credential_access_machine_account_smb_relay.toml,sha256=l1k_fgyXoHVWs83iYWcXExYD5IW39wcOkeKYMhEgYP0,12533
src/detection-rules/rules/windows/credential_access_mimikatz_memssp_default_logs.toml,sha256=4OZlv0W6gcndiQbO5s6UcZMEIUrCYgILXuaKXD-AArk,13211
src/detection-rules/rules/windows/credential_access_mimikatz_powershell_module.toml,sha256=BhMFEq8hVk3riqew9i_NQkJ9i63nwkGypq2e40C3_dg,17488
src/detection-rules/rules/windows/credential_access_mod_wdigest_security_provider.toml,sha256=jtAft3d8y5e4TnkN0KfCSGZtVa-L2TPUYAZYVWE8fqI,12824
src/detection-rules/rules/windows/credential_access_moving_registry_hive_via_smb.toml,sha256=oc4QgbLtOWDPgc-SQW-vlJqkYqWBOv5RuntGhXssbU4,5635
src/detection-rules/rules/windows/credential_access_persistence_network_logon_provider_modification.toml,sha256=ONX4zLh3t6yH-ZNsGpnjsZqoSGWSYq133d8ePU2OhmM,9653
src/detection-rules/rules/windows/credential_access_posh_invoke_ninjacopy.toml,sha256=wM8S70LgknxKednRHyqWyuk5MGxpuuqcB06UdNoaoEw,13496
src/detection-rules/rules/windows/credential_access_posh_kerb_ticket_dump.toml,sha256=Wb1evsjypBo1aDztOsX1o4BjjZXedzZEHgPmc8ufGbU,14580
src/detection-rules/rules/windows/credential_access_posh_minidump.toml,sha256=6NTFH3wkRChnqDULGxVtTtfKtx90B05OuzTeA4bF6_M,13419
src/detection-rules/rules/windows/credential_access_posh_relay_tools.toml,sha256=fRj92-G_amTk2Yq3QYmy_Dv3Z_wCiL1813ffx183jOc,14894
src/detection-rules/rules/windows/credential_access_posh_request_ticket.toml,sha256=5RqF_TXRacW4ZmpJ6xEoDlTCfYMpt1EqYicgYCcaD0w,13543
src/detection-rules/rules/windows/credential_access_posh_veeam_sql.toml,sha256=0dBx8opJHCxnfkBOagNAHnrSWZUzEAjsD1FvN594WTo,11685
src/detection-rules/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml,sha256=Z3EwZr-W_mkxKQ7F95UPMh5XqB7godK8Aii_s8Td924,5786
src/detection-rules/rules/windows/credential_access_protected_storage_service_access.toml,sha256=pLxXdJ7IrTtJpddfvYd1qiP6LwLNCNlzza3ybPwXb40,4321
src/detection-rules/rules/windows/credential_access_rare_webdav_destination.toml,sha256=wxRBOu_U9XSp3nU3woyXi3rSdSY5KhXiL-8U4GtE3vE,5541
src/detection-rules/rules/windows/credential_access_regback_sam_security_hives.toml,sha256=2eSPEpgj3uMVgepuUNqaopG4tLy5feWJuW-ex780POI,13234
src/detection-rules/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml,sha256=D2en8JU9VaRzy0t_yL9t-bEmNdW3zOX_JO-lwk9W85o,15045
src/detection-rules/rules/windows/credential_access_remote_sam_secretsdump.toml,sha256=PJK13ayo9zzgLbcZLSqy9FQdp-j7mU6QyViGJCJAnCU,12995
src/detection-rules/rules/windows/credential_access_saved_creds_vault_winlog.toml,sha256=b9jBSv-NxFU_eOADIOEk122YzKGZC-cQ34C3tqAK1zs,6488
src/detection-rules/rules/windows/credential_access_saved_creds_vaultcmd.toml,sha256=DlVPbZ4VATrvlM5sFuRUVPdpq_9XRcB_8R28o-swwto,7252
src/detection-rules/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml,sha256=5VMIw8Yomy8NdIZZhNheQeebqo0hTr1L-cDjgRdak54,16541
src/detection-rules/rules/windows/credential_access_shadow_credentials.toml,sha256=NiXPh0dCQOLHuRaaZC8a-VrbiI1ON9jvD4E15cKlEtc,12155
src/detection-rules/rules/windows/credential_access_spn_attribute_modified.toml,sha256=k8sJ5WTE8DzJ5dn25wRk8nHOrtA1RgvqokOc-EQMiMk,5978
src/detection-rules/rules/windows/credential_access_suspicious_comsvcs_imageload.toml,sha256=xjYg7z05dTb5B2TWVBJzbrHFjSzAOWOzd5oq8YKELc0,11272
src/detection-rules/rules/windows/credential_access_suspicious_lsass_access_generic.toml,sha256=qIRaUL52x0F6zHXcc6Ba0pYZh5PNpv4IhZobCC4nsR8,7420
src/detection-rules/rules/windows/credential_access_suspicious_lsass_access_memdump.toml,sha256=AdUaGT4UXjO5_qNvSGg7TAwiZ_In08N43sIHEd7giIg,14181
src/detection-rules/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml,sha256=ypVkQHSayJ-0Es75c6gtLLLhJwLPzTxvwjhRSCiFebs,11532
src/detection-rules/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml,sha256=bnBym0bIWy3eWqxD6vtt2XP_ShmhWp3BS250dDvsFh0,5518
src/detection-rules/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml,sha256=vwL0sRnuCCgkiacf4HqWpAyMcYIuYubtUIMPvcQAJt0,6834
src/detection-rules/rules/windows/credential_access_veeam_backup_dll_imageload.toml,sha256=vWTv2e4Zh8U_sId1Zq1MIC9ODzPqUYBMTho2unvCjN4,7090
src/detection-rules/rules/windows/credential_access_veeam_commands.toml,sha256=nr7E1Lj0CUJwXerErWcl3Aej6bgc_GGodvAdDw3YyqE,7819
src/detection-rules/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml,sha256=5dQ4NVJm8Kd-5zK3667ee5PFl5awrWu1JD3ZqGeBIu8,10493
src/detection-rules/rules/windows/credential_access_wbadmin_ntds.toml,sha256=0zUPi0dhi1WcpK5vYdm1FvhaUVwtVKhCKNu-slb65OQ,7141
src/detection-rules/rules/windows/credential_access_web_config_file_access.toml,sha256=F8iKKneK-MMClQomif8rjGOQO39zqh8wIrQt9iz9NPA,12585
src/detection-rules/rules/windows/credential_access_wireless_creds_dumping.toml,sha256=ZJjEW_SW0NUurhElhJzKerTt_Hl4TI7Ub0SCOFBG2Ic,12232
src/detection-rules/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml,sha256=dJ9TuJ8pKhp6zygm1zS4AjkJLDxeSjci1pcsJXrM6fo,8686
src/detection-rules/rules/windows/defense_evasion_amsi_bypass_dllhijack.toml,sha256=-rfD4YBMw1cfJle4PB6kunP1xmgbZl8asqM3RDNp9Fg,14186
src/detection-rules/rules/windows/defense_evasion_amsi_bypass_powershell.toml,sha256=bCImqyHCGQ4KCAAq1hpNdi9aVxS8darrzFNeVlvip8M,12836
src/detection-rules/rules/windows/defense_evasion_amsi_bypass_rpc_ndrclientcall.toml,sha256=NdCNDWW5qpUBSVP5Es5sleAqzS1Mx0Wxq9JyWrgNBIw,6175
src/detection-rules/rules/windows/defense_evasion_amsienable_key_mod.toml,sha256=-avcMcnHCdTLWqIx4PlszAMBzD2lECbVRzvlC04k6HQ,12762
src/detection-rules/rules/windows/defense_evasion_audit_policy_disabled_winlog.toml,sha256=4Fvx9k0tEHfaRVjaecaht7eA9EbSQPGTr6FwWF7sKFk,5593
src/detection-rules/rules/windows/defense_evasion_clearing_windows_console_history.toml,sha256=BhBKLCqcXqLMUIz9VzKJDj4A4BgNqfgBk-_kIBUeXBQ,6447
src/detection-rules/rules/windows/defense_evasion_clearing_windows_event_logs.toml,sha256=k7uwb8g__t2tR6wz0WMlhDaMBq0DLN4Fu4omUNnL5Ls,6202
src/detection-rules/rules/windows/defense_evasion_clearing_windows_security_logs.toml,sha256=3WRHFXeuDvxPHk4GbjCMJ-vv8eyXq7jPi-0GNqmobW8,3850
src/detection-rules/rules/windows/defense_evasion_code_signing_policy_modification_builtin_tools.toml,sha256=iRt2x9oDElkxg67xVqivI0FjXT3i36rK0r_8aY5XE8E,7806
src/detection-rules/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml,sha256=T8Kih-8dO5gr6legQrfom0adHQ1kkbIto6154EYYnVg,7941
src/detection-rules/rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml,sha256=eopSBGPjAySJQ-uxifOZyzARu7GQLEXF-MNQGlJXTUw,12550
src/detection-rules/rules/windows/defense_evasion_create_mod_root_certificate.toml,sha256=Y92TViJLt37My1geKXDiUH9fipBe1N64QsisBB8I2Ns,10273
src/detection-rules/rules/windows/defense_evasion_cve_2020_0601.toml,sha256=99o5QcoF9MLNQkS6xUrPF0ggt7L3H1qalz5zm8DobCw,5453
src/detection-rules/rules/windows/defense_evasion_defender_disabled_via_registry.toml,sha256=v72K6hThukM8rZ-0gnp5oWDRzQGABCgQtGqUX2ebcQ8,6084
src/detection-rules/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml,sha256=rpw5ld0TAKn3itAguFKo1mIPiFVa8ph_P7BhLCyXXN4,7682
src/detection-rules/rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml,sha256=jz6rOCwg-Pe9VoYAJqES3HhreBunMYYHB9OZcnZzMp4,5596
src/detection-rules/rules/windows/defense_evasion_disable_nla.toml,sha256=CLkJjCbVNY-NJR73Be-VVv15-xF-FRW-_xmMsjOodRw,7911
src/detection-rules/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml,sha256=CNUgSgvA7JWs1INDLBjaI55Kt6zcsDffbias7eCeh5s,10731
src/detection-rules/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml,sha256=5OvuZpf14NMn-sKRSkjGMgQN4fqgrgG-Agx3bg6JdD4,4872
src/detection-rules/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml,sha256=kUjc2uFKp54ksGgPm10hnbEwYgLjOruo3NhHbpFdVhk,9313
src/detection-rules/rules/windows/defense_evasion_disabling_windows_logs.toml,sha256=mmPik56a9Gnl5nlx3V-ELkSUxYSLUsQip5d3mxg5Z0g,6272
src/detection-rules/rules/windows/defense_evasion_dns_over_https_enabled.toml,sha256=UgTQUmkSBQTTQ7uSOJ32VFo01rOVN75yRPi7BASy9pI,6842
src/detection-rules/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml,sha256=2mN0YH0LEEGBBdIiRp5hhTFMw6jlT83JY-Y4xZ8OXQs,8755
src/detection-rules/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml,sha256=yrHO4O7uOBNaCJgdXSeYlYA-zNzB2uMwcTL75P61uD0,5801
src/detection-rules/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml,sha256=c46IcpQ2N6ARj3mQeATS0iGIBbgq-2a3B4ITrR3GsD0,5361
src/detection-rules/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml,sha256=SSYXE115Qr_Y3dWX6b1Khly_GkandI24ZXIZMEGcrp4,14089
src/detection-rules/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml,sha256=OOo-RN-To8k9nTbXK4IY1FLrZ5pXyiEsiujFgAq8Ti0,8764
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml,sha256=P14Zg2KKG_ef-Jykuj3rKE3eNQZmeR1fUACyZvwxxIY,13356
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml,sha256=qix_BoyrSxRBz4RYuZpUP96wv12JPSfLL4aXpZFpNZM,8751
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml,sha256=Kp5Y21ahDEA5AAETaeM0OcDpLV7rYNRQN7fTua_1LrQ,7082
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml,sha256=73SIsqEVf-O_c2Yr9AVJ3I6vo0biS8ZhMA6H_Rcljnw,7932
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml,sha256=LhdY0Ql213XXFmG772NnskX9Qli3RuOXMVvZreEzegw,7500
src/detection-rules/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml,sha256=kmUFN75bP45XrqNUew3oXwDMqLcSpW--u8nBar4qKcA,9164
src/detection-rules/rules/windows/defense_evasion_execution_windefend_unusual_path.toml,sha256=kmOEhAtz02QTrFFljBaLdzQmfADANiLc13UcW7L0Lag,15245
src/detection-rules/rules/windows/defense_evasion_file_creation_mult_extension.toml,sha256=LomELdW-35aeLOqjks9YafCnxlk6KYg45jjGpkkzRtQ,7771
src/detection-rules/rules/windows/defense_evasion_from_unusual_directory.toml,sha256=83126QOKCnF40J5ftaUF4_6VJkRpKA_MAeprtLi2Az4,11072
src/detection-rules/rules/windows/defense_evasion_hide_encoded_executable_registry.toml,sha256=GB6H4uXOQVTeqpiVYLE0Zx2ghCQJnSFErZafHjo7gf0,6671
src/detection-rules/rules/windows/defense_evasion_iis_httplogging_disabled.toml,sha256=_nzgkTCZmN2bdMSXLZrrXXjR33RcqFSoo3QSYsuimBA,11168
src/detection-rules/rules/windows/defense_evasion_indirect_exec_conhost.toml,sha256=oRxGpt4B2FMs1zfRGVF_sRlICtyTlHDMg9z1B2Df16U,14289
src/detection-rules/rules/windows/defense_evasion_indirect_exec_forfiles.toml,sha256=b5PY-nEfYd3s3i5AxdwXVvRqd1AMSuOJO28uNcfJYZ4,4578
src/detection-rules/rules/windows/defense_evasion_indirect_exec_openssh.toml,sha256=SwzrOt-X8onpVJJqcStCp22jbfxPVXh5qKW37xSXHp4,15257
src/detection-rules/rules/windows/defense_evasion_injection_msbuild.toml,sha256=e4337dauaOngqSMozyyUth6Z0KfFzCt8X9Qyv6AiWFw,6506
src/detection-rules/rules/windows/defense_evasion_installutil_beacon.toml,sha256=q3Ry-35jp7ZrKb6rQ23QkRhfOtKpZZT6LBOl-wzbU6g,6600
src/detection-rules/rules/windows/defense_evasion_lolbas_win_cdb_utility.toml,sha256=wHJ7tEHkSUND4ggh6NXIPoaWki0fJNyt635Rt-sAtWw,7037
src/detection-rules/rules/windows/defense_evasion_lsass_ppl_disabled_registry.toml,sha256=yop9Y4aGPYjsR1S9VUnTotSlQKKAVcg8HtTYLay3mXk,13718
src/detection-rules/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml,sha256=b0h-3ejEyDYr9SHbmGPjT0IqAHrMCfE7QyWAtM4SImo,8248
src/detection-rules/rules/windows/defense_evasion_masquerading_as_svchost.toml,sha256=jD1t_zxrjqlWdoi3PtJP8k6yunR6wl4xS0zBnuYPnAs,11253
src/detection-rules/rules/windows/defense_evasion_masquerading_business_apps_installer.toml,sha256=fX9lVlXmx1TtNEr6ezCWlpooLLj2IVXdavbFSycWLRw,12164
src/detection-rules/rules/windows/defense_evasion_masquerading_communication_apps.toml,sha256=B81piCXS-o8aBXcBq1hkn_sDkFTaXJ5E8JP7j6I4mgk,9268
src/detection-rules/rules/windows/defense_evasion_masquerading_renamed_autoit.toml,sha256=-MrWsVyfqoJ0SuombqqBs-Au4c9sLDaBfCOHv6jwWx0,13321
src/detection-rules/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml,sha256=KhmutFpOXJUIlceFbWeNpx6LDKK__dBMen5TSdITErA,8050
src/detection-rules/rules/windows/defense_evasion_masquerading_trusted_directory.toml,sha256=p6S3XinjHEDiIlfhTIkMXByn7qar5feSnkczlUn3E6E,7755
src/detection-rules/rules/windows/defense_evasion_masquerading_werfault.toml,sha256=yQRxfYTabnCrMz9nTLjomJQeiOYJSGQQixlBcou4LYc,8177
src/detection-rules/rules/windows/defense_evasion_masquerading_windows_dll.toml,sha256=OZkdGsFrhBVD_xZx2yUinKNi5cjMTNyPtZoNgz1bmNo,53674
src/detection-rules/rules/windows/defense_evasion_microsoft_defender_tampering.toml,sha256=3Ny1gLFWr175Lf9eflaPVjLrCQkt8Ba2IY5ZVL5Q_AU,9175
src/detection-rules/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml,sha256=yusyaH27e-KYjxBe0kXdaFRESedIyYMedGPZye73V3E,8593
src/detection-rules/rules/windows/defense_evasion_modify_ownership_os_files.toml,sha256=rGC49LuuqCiDmQ1cwu5vGr1Xod7gFesvT2U-vLiIGOs,5330
src/detection-rules/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml,sha256=A6c1vriVX2AnUnhaoykTuU8qySwj4QwwHYm--5zms30,6847
src/detection-rules/rules/windows/defense_evasion_msbuild_making_network_connections.toml,sha256=zzm_f6jW2i8b8okvFWtqUeKQ33unaYHXZg4-tEYdU7g,8706
src/detection-rules/rules/windows/defense_evasion_mshta_beacon.toml,sha256=-mOFpSVjjM0MJUB8NZUDHa-UXp9ocdvukh0xlMQwmbg,6523
src/detection-rules/rules/windows/defense_evasion_mshta_susp_child.toml,sha256=ZogmPKQjxFO04srQi2CVjMCod7-IoLvvbB5zWprr3eg,16436
src/detection-rules/rules/windows/defense_evasion_msiexec_child_proc_netcon.toml,sha256=BPOs4_NSSvbtoDFR1bnTIhwSDATYWwqbwvekcZ49-us,8463
src/detection-rules/rules/windows/defense_evasion_msiexec_remote_payload.toml,sha256=1r1FBj0iHloBpWF56FYu-D4PfyorCn8s13Y38ndFJTU,12481
src/detection-rules/rules/windows/defense_evasion_msxsl_network.toml,sha256=0QwQLlUa6iEopiuptnS6Du_4aER1kWGXsfZ0F4k62vs,7012
src/detection-rules/rules/windows/defense_evasion_network_connection_from_windows_binary.toml,sha256=Q8ROGebqEA_30tX5g6VAhAkFm2Z4iu09qePA1tpn5mI,11267
src/detection-rules/rules/windows/defense_evasion_ntlm_downgrade.toml,sha256=s65GSrSd4NLWP_-YuP5i4f0rYuvL6w-PbBE8MadhFGw,5726
src/detection-rules/rules/windows/defense_evasion_obf_args_unicode_modified_letters.toml,sha256=wntzzSDHBUdLE5kcDji-17cUURw9vjSWBBRGYI_wd5s,14760
src/detection-rules/rules/windows/defense_evasion_parent_process_pid_spoofing.toml,sha256=4AP2iZD_Yqz1qtka5fLwj1hsIdyxyr6ZuqPhO62shIQ,14125
src/detection-rules/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml,sha256=jEu2nVGF7leivvLmmgkyFYSkXpo66MdUlgQCkQ7ABkY,8633
src/detection-rules/rules/windows/defense_evasion_posh_assembly_load.toml,sha256=y7CKUP2W-PVI2fkdPZdhluxyTkayBCjKB8ztst1T3rc,11802
src/detection-rules/rules/windows/defense_evasion_posh_compressed.toml,sha256=zpbfhbf33e7A69__vcmwJpYzUsU_eccHHxd8N_GXNBc,14023
src/detection-rules/rules/windows/defense_evasion_posh_defender_tampering.toml,sha256=7_I_yI1MFttsvshrfrBBw94XhifkgL59od0Mbz8vVSI,11053
src/detection-rules/rules/windows/defense_evasion_posh_encryption.toml,sha256=QEq7LlZsWSJMZAV2lWjhGcRC0aatGXJ-Yx0eWM-STW4,11394
src/detection-rules/rules/windows/defense_evasion_posh_high_entropy.toml,sha256=Ny4gYBaViSwBIixE1vB5pY_NYTrA3KueA5ym-_ZrtKU,12548
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation.toml,sha256=8yXIqA7KPCRUolTVeUnMtdmFlAKQ1LLQA2N300_QZmk,7856
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_backtick.toml,sha256=twRkpnBw3dmwS-OavaAqlzzY6h1poNdj7kAFTwdcYtk,12924
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml,sha256=EfV0QWqlhiE7xbBPPCxQ-eGl3UfVhg2D17YoJHcRwNA,14134
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml,sha256=OMiC1lwe9pIQYtVBYm-ps9oiRveVX-po7O5By8jVZBY,15555
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml,sha256=ivCad9nWbiU3tJCxcdoEa3_XBIRfi4_LnnkmAW_I_1Q,16362
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml,sha256=aFFzWX4kMgYe2udU57Dq_Rrr52o-c7KZD_NRLBcz_t4,10968
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml,sha256=L3XyVGAu3AeIGWiIyyRkb8D85Gmxgu71td-5S1fL-YA,12307
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction.toml,sha256=BcJGpyhUbGV9FzKZFIduoK7Ewf8UkKJyrFY0zPcGevs,12263
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal.toml,sha256=qoFcw_USTEt_RNdQH_8za_PGLI7azmHt3k1d2lNZYm4,11092
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword.toml,sha256=bj7ZI6khHKDeFYfI57bnp9xzp_MlbXUu3y4ySzED5-w,12876
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_string_concat.toml,sha256=CwcMFO_AIts1pf3wn6hMysqlzvrvhj1GUDcIpEdrOYc,16292
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_string_format.toml,sha256=HuuB6gZq2pwZQFYqFRZ60rkFeyl9xz7Z5OthZZZf6nw,12944
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion.toml,sha256=1QfwDrp6dNG4bxp-y-pyJTCIPqxIzEcQeluxgy5yGLg,12711
src/detection-rules/rules/windows/defense_evasion_posh_process_injection.toml,sha256=cxJXWNgsjM5KIEjzFTxS1W7l4LGx2-w75TjRPCcXcSA,16155
src/detection-rules/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml,sha256=pHpuZkUAuEAzpXMNtnhjLt3ghlxq6pFsChhXzkYYlwY,6647
src/detection-rules/rules/windows/defense_evasion_proxy_execution_via_msdt.toml,sha256=H7oi7eeu0worj4cDUivbyS41wDVFgn4froRyp9qzWRE,15017
src/detection-rules/rules/windows/defense_evasion_reg_disable_enableglobalqueryblocklist.toml,sha256=F03BoPPH2hz6tOooxZo7ehX4b5QesKBeRay7hLsN1fs,7701
src/detection-rules/rules/windows/defense_evasion_regmod_remotemonologue.toml,sha256=oPPwAjuri9s9kaA2haXJ9f3mYYkgV5AfyN39oKZsg60,6475
src/detection-rules/rules/windows/defense_evasion_right_to_left_override.toml,sha256=NmKitI0ZJ-X2NXw6IxRX0MRazO20XOkVHL2B_fKCNEM,7294
src/detection-rules/rules/windows/defense_evasion_root_dir_ads_creation.toml,sha256=kE7WGlS5poaTf6sSmSMWhKZSwVpbgThEj6CNUTyNVSE,6863
src/detection-rules/rules/windows/defense_evasion_run_virt_windowssandbox.toml,sha256=sxSzlBZrM7sAJqFOBs6pxE1w37Wycukd5pyjoExOBso,7203
src/detection-rules/rules/windows/defense_evasion_rundll32_no_arguments.toml,sha256=ugxHRYOikI0ooAqbwEWw-36qJryAJYnBlvzL4CFdiL4,11526
src/detection-rules/rules/windows/defense_evasion_sc_sdset.toml,sha256=WlK21HzxT4jz3whoqQ2SXWi8_V1VIYQZwzO1xJ3qh18,7554
src/detection-rules/rules/windows/defense_evasion_sccm_scnotification_dll.toml,sha256=9uY8ZXV6aJiOsQnCoDscY2UUp_LOyje7ahkAD_da4Gk,5639
src/detection-rules/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml,sha256=FuqTmm6WXF8ZPSakys7ZKzxqr0L8usNOSpGmHJf0_8Q,7078
src/detection-rules/rules/windows/defense_evasion_script_via_html_app.toml,sha256=Y4ckHrNKK-W4ADEagHT6lUMg73oP8BjtdvvTFhx5yyU,15198
src/detection-rules/rules/windows/defense_evasion_sdelete_like_filename_rename.toml,sha256=lZROPVHE3_OtEZhGQi5-DAcHQUjqu2v09nHxD5r7yoI,5551
src/detection-rules/rules/windows/defense_evasion_sip_provider_mod.toml,sha256=omboQlPKLkUoWf7Hn9YkyWoqfSTI9nSXvxSMCN_Td2I,7272
src/detection-rules/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml,sha256=LAfJDUKqANdEOWe1l14Fb9OPV7axooA0IEDCKPcO45Y,7965
src/detection-rules/rules/windows/defense_evasion_suspicious_certutil_commands.toml,sha256=7kRHIXpgNiBJ5E2mND1t1N1i21zt8-0O4RT17AG8XQ0,9052
src/detection-rules/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml,sha256=lYGSw2DBhLiWUAhQHGH-TlgMsDy7HxGb3y6woHmkWtA,8363
src/detection-rules/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml,sha256=CtERBk2AG63yf0xq_xG81L7W-refA9PjLom38nHHeHI,15003
src/detection-rules/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml,sha256=iMtRRrkWtUUGSVTnBXXqscSVTb_cpjp32cGEUM_B2kM,14640
src/detection-rules/rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml,sha256=P1RRsRuroBRpHCxSWDmLuCGgwt7GUfthBglXCxKQm4k,5492
src/detection-rules/rules/windows/defense_evasion_suspicious_scrobj_load.toml,sha256=wrvByOSqgsa4jbij3qrovmavQT2UIPvfL4Hn7U3zH4c,7051
src/detection-rules/rules/windows/defense_evasion_suspicious_short_program_name.toml,sha256=LTBa_4KiylZVNYIIfrmG0zkr37E7qGkH-wa3lQHTCLk,7218
src/detection-rules/rules/windows/defense_evasion_suspicious_wmi_script.toml,sha256=MK9HJRYEBOvLjEg13JcX8BqJRpTTFUjZs338_8tjlIs,7088
src/detection-rules/rules/windows/defense_evasion_suspicious_zoom_child_process.toml,sha256=BKt5qQTNHp0_MQV69WjFbUGo96CNhdg6LvmxjtKTXtA,8561
src/detection-rules/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml,sha256=yHB8zQbhODHex4J93dFnDkS8FQAQDKTzrR5Gjn-jMsE,14178
src/detection-rules/rules/windows/defense_evasion_timestomp_sysmon.toml,sha256=uTsmt2QPSNUwaH9Rxv8yaCoJNjOFQk7imzMXeOTIO54,8224
src/detection-rules/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml,sha256=9wjmf5tPmn0ihbwBYLPBy2ecRvTdLrluMx-YoKnlAns,10076
src/detection-rules/rules/windows/defense_evasion_untrusted_driver_loaded.toml,sha256=LUgfheS6RwnyrQvnOHwKW82fPxK-xrlIwq9Vxo_yG9Q,12772
src/detection-rules/rules/windows/defense_evasion_unusual_ads_file_creation.toml,sha256=BzqEMK7Ws8FFndHmflsgNrm-x7DgxwYWAnZFjJDKfzs,12751
src/detection-rules/rules/windows/defense_evasion_unusual_dir_ads.toml,sha256=6j1qSjuHeYpBUO2H-LoG0k1iDci-jokpf4ih4zoOEM0,6455
src/detection-rules/rules/windows/defense_evasion_unusual_network_connection_via_dllhost.toml,sha256=8Zh9IW2cV9dEm440OAHzdUjdO0M85D8HToa_aFEMrUw,7001
src/detection-rules/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml,sha256=JxIxDWuoMXjsGu-X3EGBS7o3k35trvNZZKnB9qFHRH4,6151
src/detection-rules/rules/windows/defense_evasion_unusual_process_network_connection.toml,sha256=NG8qXJBLysJR-bmPtAdz6ds_VhqPKU3qhUZ2BBqWfCI,5751
src/detection-rules/rules/windows/defense_evasion_unusual_system_vp_child_program.toml,sha256=Am5O9QmpV922qkpKR-8gRmL-pkfdXwizutnDvroBSmY,11292
src/detection-rules/rules/windows/defense_evasion_via_filter_manager.toml,sha256=49bo76mJ2hEbrGxXcsgsSJiWDKBgnnrTBhbxSzQ5n78,8547
src/detection-rules/rules/windows/defense_evasion_wdac_policy_by_unusual_process.toml,sha256=VBv5KrSVdSUlrdY6P96pAGDcQimNhR9dIiklXVak39w,13826
src/detection-rules/rules/windows/defense_evasion_windows_filtering_platform.toml,sha256=mW-jhE837ZjHFKJehxkrtnjs40TVyTZ_OBAeI47Isww,10825
src/detection-rules/rules/windows/defense_evasion_workfolders_control_execution.toml,sha256=KR0anOPeWfPm_xVIofEa7ffShZEP5rjvAiOkbYO6j1A,6040
src/detection-rules/rules/windows/defense_evasion_wsl_bash_exec.toml,sha256=RfSu2LHsp2gUooyAhImNLgrSsihJpT7WtiqwZfa-dWc,8182
src/detection-rules/rules/windows/defense_evasion_wsl_child_process.toml,sha256=5Ln4-S0EheBwNbTj5Lb7e_OrEnka9JBTd4rA8o1fb2M,8523
src/detection-rules/rules/windows/defense_evasion_wsl_enabled_via_dism.toml,sha256=P_Q54_nIZfLaJ4O3vDwwJtgJy1FKq7iWySnoJuLijfw,5586
src/detection-rules/rules/windows/defense_evasion_wsl_filesystem.toml,sha256=hHPV4UbA7CeHpxf1HIKqscwzTQdfP4Ll8fzgo2hc0FM,6824
src/detection-rules/rules/windows/defense_evasion_wsl_kalilinux.toml,sha256=7tBISEc5GE_qcg0IFgpM7KHTjfPY_bZZaJnIZhEEjj8,14275
src/detection-rules/rules/windows/defense_evasion_wsl_registry_modification.toml,sha256=uiL14M2QuNwid_tv1qeWe5bwW3fcbRf9tSas7g-zOko,6122
src/detection-rules/rules/windows/discovery_active_directory_webservice.toml,sha256=52WZuo8_gOtzjcOSzTuL8JcZ5tu15p1hmlnqPstBDKE,6995
src/detection-rules/rules/windows/discovery_ad_explorer_execution.toml,sha256=NwmnujJWYy1Z9yDwvYROtEgTTM0LgDjkK4gTOLWbacg,5639
src/detection-rules/rules/windows/discovery_adfind_command_activity.toml,sha256=_ivYoSFaMH5JTNSi8DPdqZ0eRKnB9ivaHi1h4ED36FA,7669
src/detection-rules/rules/windows/discovery_admin_recon.toml,sha256=Ex8tlMm9WxO2vGg_-y-kAF0EtNRjVVux161PXjCiHMo,5942
src/detection-rules/rules/windows/discovery_command_system_account.toml,sha256=cLA1wWPZr7iEjfvQEcO0ODEf0_5Tc0-rzWXioEDczu0,6482
src/detection-rules/rules/windows/discovery_enumerating_domain_trusts_via_dsquery.toml,sha256=oM2YqbKyNE1X6gfSdq8UZiG2MUoJOjNQD0Iyemlp5Hg,5494
src/detection-rules/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml,sha256=3wYfrV4ExBjI3s6YwfTVzt3p1rcqYCBIKIgnPZtxB-4,5772
src/detection-rules/rules/windows/discovery_group_policy_object_discovery.toml,sha256=f82x5lis6gbiFQ4JI2L9bG2lxph-V3VVYivLpoVd8kk,5927
src/detection-rules/rules/windows/discovery_high_number_ad_properties.toml,sha256=dwnhQ2hTMWbkBg9OS7A5vjA3cYnJm44B-t2V2pDYMog,6158
src/detection-rules/rules/windows/discovery_host_public_ip_address_lookup.toml,sha256=gf_C-5dSGEUcCBz_llir0rMytJcSyibQ_7_tFpwRUYY,15440
src/detection-rules/rules/windows/discovery_peripheral_device.toml,sha256=dwz6W2i7AT6LQVA3UI3GtVxcd8nU9KVY162d8KDtxqk,5105
src/detection-rules/rules/windows/discovery_posh_invoke_sharefinder.toml,sha256=fJ1OXbastSqnQZPNQY0zOADqOaJ6sLVhRJYVI9RcV8I,13688
src/detection-rules/rules/windows/discovery_posh_suspicious_api_functions.toml,sha256=DoOH3Ufb_ve7tFuRo3Yj9IkcOtu3bR076psUPBDLFu4,14556
src/detection-rules/rules/windows/discovery_privileged_localgroup_membership.toml,sha256=umrfFtJa3fwCLHW_dmQFPzE0SWj7_8u2jrvliHXZMZo,10143
src/detection-rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml,sha256=Gj1vJ6zUmgL0imGWKEAjmWEabtKqt0KxNrYZ5-DK7JE,5733
src/detection-rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml,sha256=yDoMV7s3ssw7ZhVoD7uVLBePdWg304HsxwMpzWIFm4M,5341
src/detection-rules/rules/windows/discovery_whoami_command_activity.toml,sha256=Ao_OkmvbMr0VZHUKRxuTCCgxAB7AqfGzqA9vfN3XDrs,6280
src/detection-rules/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml,sha256=AN3mQn2ytwdGdULyRBURiIGkNZ4MWDiMvLgOe1BjAvg,8222
src/detection-rules/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml,sha256=u1Jh-tRA_QrLJMS2EjS3hNSidMS0wVJEcu7dLK83CPk,7572
src/detection-rules/rules/windows/execution_azure_customscript_extension_suspicious_descendant.toml,sha256=IG1WTmS58NiTPpaSu525VCdmr-vA3BkL9NxkdIUjI6s,7449
src/detection-rules/rules/windows/execution_com_object_xwizard.toml,sha256=NZp1tGuTckTsaooggvJQlAXawMbH9GgFizC9pmC9E2s,7770
src/detection-rules/rules/windows/execution_command_prompt_connecting_to_the_internet.toml,sha256=B8wwkaq83eVqLurgYJAiU2x-paDKDuEM9mWSQ7DKQig,10610
src/detection-rules/rules/windows/execution_command_shell_started_by_svchost.toml,sha256=oF2yUITKB7SHQSrw1H6YyVFU22DRGfOK7O5SrJ_PYiQ,8541
src/detection-rules/rules/windows/execution_command_shell_started_by_unusual_process.toml,sha256=pmTjtcZPgze07LUVs29qi3vEyYYyispZ47ngxVtD6Kk,7292
src/detection-rules/rules/windows/execution_command_shell_via_rundll32.toml,sha256=DO_-Q8BSKPOVEsfKNssd6gu3IlORb_kyoW6xzeIZy1U,7274
src/detection-rules/rules/windows/execution_delayed_via_ping_lolbas_unsigned.toml,sha256=AalCQg0i7KzEZYq88PuxFi2CpRTn1gNktHhNrH0N4GE,9932
src/detection-rules/rules/windows/execution_downloaded_shortcut_files.toml,sha256=yJvHSFSmgzanAiof3tFbGNIoKpTfG5dDXAZF0gVLf2c,5902
src/detection-rules/rules/windows/execution_downloaded_url_file.toml,sha256=OGQsG9_nRQDKz5Y43lNuLLgjqJI66tnJ3GeVHEU1WCs,5952
src/detection-rules/rules/windows/execution_enumeration_via_wmiprvse.toml,sha256=bOYdtSAaz8WZnXeDdrdoPDQxEi_ppErAGurxCFYdbj4,8970
src/detection-rules/rules/windows/execution_from_unusual_path_cmdline.toml,sha256=xmLggCjV6eq5hSJuPW6mRGzXOKr7iWyt5mRs6aF1AlA,14008
src/detection-rules/rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml,sha256=VlC2ClCz87bnn5ygiFihkRc6WNAdi2-TW964vc7OtVA,9848
src/detection-rules/rules/windows/execution_initial_access_foxmail_exploit.toml,sha256=0TKPA-0LowkL7bYfrpk42TOs4sz_dRPcghIHGbUxqaM,13779
src/detection-rules/rules/windows/execution_initial_access_via_msc_file.toml,sha256=WLhZ8VbkLYpM9gMApZJs8NREzfC2AWeighPGRQzVoaY,14382
src/detection-rules/rules/windows/execution_initial_access_wps_dll_exploit.toml,sha256=kTwATvfnMguLoi_ChR6j_YKfkzhqMmBeNlZExwQxMeo,12718
src/detection-rules/rules/windows/execution_java_dropped_jar_immediate_dns_lookup.toml,sha256=AP-7KtkvydFGI_Li8Uw34nlOSCAoQE9tMpp7DeSdHT4,5014
src/detection-rules/rules/windows/execution_mofcomp.toml,sha256=7GyeMeK0npA1dxxK0uvFq2Z5-7t1hUpePwMP_8Jo0uU,6559
src/detection-rules/rules/windows/execution_ms_office_written_file.toml,sha256=5aFx-wkvaadektLlCL60yaOw5_pQP0675yWIrODU6xw,12408
src/detection-rules/rules/windows/execution_nodejs_susp_patterns.toml,sha256=UFCXb7_4pOsPKOgqZc9UU7YlOV7Th-_g9v0LwPYqn20,13973
src/detection-rules/rules/windows/execution_notepad_markdown_child_process.toml,sha256=L-yMKjjxbBuW1-KMq1O39YJF4jXiLRPMyfKtGVdj7Bw,13718
src/detection-rules/rules/windows/execution_posh_hacktool_authors.toml,sha256=bxWQ7I3GPnuPJofUp55qkMX-NzNUt-CqtIJw_3hxF2A,14629
src/detection-rules/rules/windows/execution_posh_hacktool_functions.toml,sha256=9DLHiLSGtNL3ObT4QOVJ0geeP9Jikpepaj95_z0nxW0,23701
src/detection-rules/rules/windows/execution_posh_malicious_script_agg.toml,sha256=BBO9aOiORqwAxBw7Ld3HEoUpKMqhvv4EKIV268RwXcw,11431
src/detection-rules/rules/windows/execution_posh_portable_executable.toml,sha256=e4Q3EgRYX9VzxP2-g5on4M-n7CYTCvIQ8LZUhozw5yk,10224
src/detection-rules/rules/windows/execution_posh_psreflect.toml,sha256=EBKyIlGZU0OvZLP3oNSt36iAW3PPoSu_CulV5TD_jk0,14026
src/detection-rules/rules/windows/execution_powershell_susp_args_via_winscript.toml,sha256=BnrjmrzeZ6OveOBM6WJtACLzFttIV-7tD_s20YNXGrU,16229
src/detection-rules/rules/windows/execution_psexec_lateral_movement_command.toml,sha256=RWSBz6kghrNEn40aWl_tD7UYVaT7f9jehKtBCJjghvo,6463
src/detection-rules/rules/windows/execution_register_server_program_connecting_to_the_internet.toml,sha256=9yazugQ_aofYT0oKc2wTA16YpKDFDaIj_bBtbRffN_Q,9161
src/detection-rules/rules/windows/execution_revshell_cmd_via_netcat.toml,sha256=nXA8ZUnA7KS_6jSG_2c0Qgj9i9Ao7-gQhy4tOtrGDyI,11544
src/detection-rules/rules/windows/execution_scheduled_task_powershell_source.toml,sha256=ckxEheJS7ZwlYFjfyhO5JxZfAkC37iYAnt_IQ6Cmpg8,7434
src/detection-rules/rules/windows/execution_scripting_remote_webdav.toml,sha256=AvAtpjPHkU16gIBTOb38IjPFKFauhPM07Oz5oMIh5k8,15185
src/detection-rules/rules/windows/execution_scripts_archive_file.toml,sha256=YBzZluEMbZtj_yJeyDIfT6S8A7kqNfpH9SW2u4e2cWU,7797
src/detection-rules/rules/windows/execution_shared_modules_local_sxs_dll.toml,sha256=dmv_4_YXxAlxOjcvssUHv87uYOOW-cVw_Wg8eIr1ZmM,3374
src/detection-rules/rules/windows/execution_susp_javascript_via_deno.toml,sha256=OdgJ81LcoRck8H2jUA2kce5mRYN8LWyvcJ5Vh3F4mgQ,14296
src/detection-rules/rules/windows/execution_suspicious_cmd_wmi.toml,sha256=fMcu359Bc05jcl09bJSwUkE4YK5FBfcOqZku1dGZ6dw,12905
src/detection-rules/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml,sha256=CJDWy-AB9alvsAnSrMFEw-UlLU_udZGVXP_EdD2gXiI,6276
src/detection-rules/rules/windows/execution_suspicious_pdf_reader.toml,sha256=luDAT0QKmUyw3lL4A1konvOCBGjLsjpCxv1iGuHdR7M,9780
src/detection-rules/rules/windows/execution_suspicious_powershell_imgload.toml,sha256=3YZXTOwxT33rOgRvrnZC_qe_Xya7Cfcsi5kP0_ZubYo,7107
src/detection-rules/rules/windows/execution_suspicious_psexesvc.toml,sha256=kwxzPXGmLfnXXOc8jB-lLhqWIP7NgIPTBGdjAxKNwb0,5996
src/detection-rules/rules/windows/execution_via_compiled_html_file.toml,sha256=hVHr1BMS1-k_ekdF2bjEHEmWPqWGsHHuO4GSdk1-HN0,9879
src/detection-rules/rules/windows/execution_via_hidden_shell_conhost.toml,sha256=Wg_blrOmQkFOhrngTbbYQruKQfjX3SdvmVoejD_i3Fs,16259
src/detection-rules/rules/windows/execution_via_mmc_console_file_unusual_path.toml,sha256=Ed04mfbFrZubbtMzZMjdva9w1KJ7h7gI-Op8Jt3PIvk,8139
src/detection-rules/rules/windows/execution_windows_cmd_shell_susp_args.toml,sha256=xIn7sKGBOxmucpGsDqLlQUxpOYwFMzwt8SrFSRc_sZk,18943
src/detection-rules/rules/windows/execution_windows_fakecaptcha_cmd_ps.toml,sha256=85zRdudsn0V39aYUA_jRpX_J5eD-hA_cMJD7qyormOs,15275
src/detection-rules/rules/windows/execution_windows_phish_clickfix.toml,sha256=EI_Lta-P7byIHMnY4A9qwj0DgYMj-hdcPUc8Y1Fet1U,15896
src/detection-rules/rules/windows/execution_windows_powershell_susp_args.toml,sha256=k_NN6BUL8W1RoopKyoI8axjjdGjHLlhxJM85dDPioKw,10791
src/detection-rules/rules/windows/execution_windows_script_from_internet.toml,sha256=rmxaSSTfXsVBpQe2qcMtR6IFENR9Q2sOlfuCxiRJZ9M,8440
src/detection-rules/rules/windows/exfiltration_excessive_dns_queries_by_process.toml,sha256=qSemDH1699keKnjFm_QrJ1Z_prjq47h-P3nIaf5Wv8M,6017
src/detection-rules/rules/windows/exfiltration_rclone_cloud_upload.toml,sha256=TZ5VHpceFRIfN5cXA41ZcgTKY8XtCaWnW9YV4pKNh-M,5636
src/detection-rules/rules/windows/exfiltration_smb_rare_destination.toml,sha256=gjX3TE5dlzTZm_ueLFdszSDvpvzfpLvzDF0Cl0UK_f0,7477
src/detection-rules/rules/windows/impact_backup_file_deletion.toml,sha256=hBHBaR2-T27Q0yKoJGx6MkmGgQs0H2CV7M-Y23DD9Ak,6094
src/detection-rules/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml,sha256=kjtar8R9T3HW_WIggaIf4AsK7AaLu3F5sX7_cPOfbys,5603
src/detection-rules/rules/windows/impact_high_freq_file_renames_by_kernel.toml,sha256=qvJBW4qwcNRILSHZprJmUMe0VP1yk2M0J3r7gQ1dLkQ,5667
src/detection-rules/rules/windows/impact_mod_critical_os_files.toml,sha256=UPUZAXEj774w2WtKMk_3mm3v8Nu2LivcPdGzJTXtOSA,13736
src/detection-rules/rules/windows/impact_modification_of_boot_config.toml,sha256=9I-4kq0WpbvITj9BB40ERaKqDTc_JMjFQSPFrauiCD4,5401
src/detection-rules/rules/windows/impact_ransomware_file_rename_smb.toml,sha256=J4D9BIQaIeW5dcAnD9gJ1mG0EKnqCExCRWywGBCmBBY,10262
src/detection-rules/rules/windows/impact_ransomware_note_file_over_smb.toml,sha256=Wa0w9ADkK3WIOWirYcUPRl6F2juuiKej8DIv7bbhb0E,11816
src/detection-rules/rules/windows/impact_stop_process_service_threshold.toml,sha256=Fy-NyR_FfTEvrfKk-Puqd-22c5y-onuxoAd89XGGgVc,5304
src/detection-rules/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml,sha256=2IyYGbYkQHwrhb32WrfrCOnvUI8QmsaQRoXKJfIMC2k,12012
src/detection-rules/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml,sha256=jfDr2JH0YKs3_AvzXq20AwWjyk3YufppsMn45ooGrRA,14778
src/detection-rules/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml,sha256=rIkGIRSrr5ThPrrvyogEYIotYz4KkfkntjtX9VlO2Fs,10640
src/detection-rules/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml,sha256=b-czzo6-TevMWTp1HuoRA-BKWX1FPKVPNTzbEjd9x80,8860
src/detection-rules/rules/windows/initial_access_execution_from_inetcache.toml,sha256=YeaNEVEQZPM5j1Fs-MGDEEZ6F3Dl2-Obya6DpOFqAD8,16105
src/detection-rules/rules/windows/initial_access_execution_from_removable_media.toml,sha256=swpWH4YYTvl9dB0zVdiVmhN_Z2I13CNg_LHop5qFg2Q,6254
src/detection-rules/rules/windows/initial_access_execution_remote_via_msiexec.toml,sha256=ZAjcPLkTA8MH7OzHhFNnbFmoT27CioX-56Zhc5cXH9o,9037
src/detection-rules/rules/windows/initial_access_execution_via_office_addins.toml,sha256=3ocUVffGEYmU6p6JcwHcGF8JB8UjDLTx01IwVApF43g,9640
src/detection-rules/rules/windows/initial_access_exfiltration_first_time_seen_usb.toml,sha256=owU6ZNRnbpunoD1A0Ke_iQENPRO74djn6j6d9N8pd3Q,6823
src/detection-rules/rules/windows/initial_access_exploit_jetbrains_teamcity.toml,sha256=Vz9e3NNFvzO5p2DfHPJImhznHvY0912ToRQmklfrIDc,11375
src/detection-rules/rules/windows/initial_access_mssql_potential_sql_injection.toml,sha256=a-xVAcnYAXZjfurvrSph7xyui3CHmMXCGL402_IAkzQ,5691
src/detection-rules/rules/windows/initial_access_potential_webhelpdesk_exploit.toml,sha256=r7VIOEsTlTw6CBM48J3oat0QzpuHSqL3vrU9_CMNOQk,13543
src/detection-rules/rules/windows/initial_access_rdp_file_mail_attachment.toml,sha256=EaH0KuueCvT1aOZea7h0dkAN-VLADjSsKeShgs-O5BA,7950
src/detection-rules/rules/windows/initial_access_script_executing_powershell.toml,sha256=TFukjItA3K4cgIBsiaX32wEPVmgi4B7f4QJe0fooYQg,6978
src/detection-rules/rules/windows/initial_access_scripts_process_started_via_wmi.toml,sha256=C9i2-xBpFVh4PAtW9rQNZem_TK1dEq0l0oY-_8BE7kY,8110
src/detection-rules/rules/windows/initial_access_suspicious_execution_from_vscode_extension.toml,sha256=btg2-ixw4tAjph5BC78PtLdvfu-A9Bx_rvndTgPvk0M,6894
src/detection-rules/rules/windows/initial_access_suspicious_ms_exchange_files.toml,sha256=7K6GImMi9jOfobahvUG-poL3sADzEMbrVLRFdsMeVsY,5040
src/detection-rules/rules/windows/initial_access_suspicious_ms_exchange_process.toml,sha256=d7oEXI4JPRgqF34QpQuGeQccyNGzAwi28oMcQ-NJYjU,9027
src/detection-rules/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml,sha256=d_HKC46afraALfPCOHth8iNL_QAdyo_BAVTvRGSZ3SI,14698
src/detection-rules/rules/windows/initial_access_suspicious_ms_office_child_process.toml,sha256=yqnjc-bWy14TSDgG5LPyhy1CQX3fsoVE_JZIT1hvy60,10915
src/detection-rules/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml,sha256=-VcUH5wOa_wP3TlltD67Sxg9uK3hjpPH63e1pMEeGJg,9038
src/detection-rules/rules/windows/initial_access_suspicious_windows_server_update_svc.toml,sha256=zozLa6-GOg-vH66stA8TqjTbsycoxH39zIsu9AAL_PU,14316
src/detection-rules/rules/windows/initial_access_url_cve_2025_33053.toml,sha256=TDDhjGTfyxEMKD8VBE0JwMmSxrWF9Xn0aUBrpfh5IhQ,16019
src/detection-rules/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml,sha256=S8Y3F4PaiQRUlUFz_nBkWW72vy0mRXmG1GFVKMM4nG8,9317
src/detection-rules/rules/windows/initial_access_webshell_screenconnect_server.toml,sha256=7un05Bo0HpSTKvbRyB_qqnCh819NlSvd1nbpIOdJkoM,14876
src/detection-rules/rules/windows/initial_access_xsl_script_execution_via_com.toml,sha256=2L2D47R-9SQIK0fy-Z1cWg22ZjUTqcABergfVir-Fxg,7715
src/detection-rules/rules/windows/lateral_movement_alternate_creds_pth.toml,sha256=QwVCRyre6DnP3dUp9uDRvgEYHkX5eJwfjoaa6_SIGdc,6155
src/detection-rules/rules/windows/lateral_movement_cmd_service.toml,sha256=wjk0CT1bjnau4d-IT-LCRW_x8Ui8X5Oo9wPxNKwJljI,7281
src/detection-rules/rules/windows/lateral_movement_credential_access_kerberos_correlation.toml,sha256=2l99jKngMNThE9R84H_1hiuGx72D1WoxI1QPc-lhIv0,13483
src/detection-rules/rules/windows/lateral_movement_dcom_hta.toml,sha256=vTQJQhUUPY4daQKYLfqZXlvUMQVly3Y-lkKPerQ9sYo,14239
src/detection-rules/rules/windows/lateral_movement_dcom_mmc20.toml,sha256=JAmVcO5G8v_KTyXeEUdtG4twvA4dcutREzqVMozmKvw,13140
src/detection-rules/rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml,sha256=YtFN0XzqeafeLgkheNijsW4GuzSW-f9drm7uZO0JNio,7390
src/detection-rules/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml,sha256=8qSxnpBiJc33n7TWH0aK0ZESduc1V2XHEVR_1DpDeYU,7408
src/detection-rules/rules/windows/lateral_movement_direct_outbound_smb_connection.toml,sha256=RRynh6z3d36Di85ywVQfDS-8Ut6B7poZPyzdtAOUGus,8714
src/detection-rules/rules/windows/lateral_movement_evasion_rdp_shadowing.toml,sha256=yCiilTG3gukXctaiHt7cpbz7r9XHNEsGUeI743SOclM,14367
src/detection-rules/rules/windows/lateral_movement_executable_tool_transfer_smb.toml,sha256=cBGyOzRTjrJ8-93a1XfMabif_QbPkyzyh3auVRRm6Kw,5686
src/detection-rules/rules/windows/lateral_movement_execution_from_tsclient_mup.toml,sha256=CrZoGuFw1Z2znxXqCj1OSHanmLIjlWj4qUSYa6_qU5M,11815
src/detection-rules/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml,sha256=zEY-7xoAn6ZnTSuVdUL1fZzABkgjLs0Dc0XC9P8NWJ0,8229
src/detection-rules/rules/windows/lateral_movement_incoming_winrm_shell_execution.toml,sha256=o2WnNlReID9dxeAE396c_XLZTdt-VmGUHJNzNDfqfrk,6828
src/detection-rules/rules/windows/lateral_movement_incoming_wmi.toml,sha256=oOtlQswkm83ydctaNNTXMdCl5aXeCuXEWFsYOPUEF5Q,7778
src/detection-rules/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml,sha256=N16w9PZLU0v28SQ7ObFtErrkmw3fOD7Wr811wOQ_MZE,7830
src/detection-rules/rules/windows/lateral_movement_powershell_remoting_target.toml,sha256=QiQE4mDTlaxUMzudo48U3v9HbTZZKtuF28OO1qKpzng,7442
src/detection-rules/rules/windows/lateral_movement_rdp_enabled_registry.toml,sha256=WBOKLe1BQbqZTOxygoYV42D6m8P4mNCMyctfC_twP4g,6281
src/detection-rules/rules/windows/lateral_movement_rdp_sharprdp_target.toml,sha256=MgcAfpGmjV3mqVDlkFZeEmwDOarkgxBuxbS1GBL0jbc,11303
src/detection-rules/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml,sha256=wQhjOgAHpPpAzD-0Mv4JYDQZtbdH8ThFMcb3zUYmiNo,7327
src/detection-rules/rules/windows/lateral_movement_remote_service_installed_winlog.toml,sha256=g4ht6f9OxCCMswi1yrEX4MxSMx3kgeVbBg0gn5QYPm4,8518
src/detection-rules/rules/windows/lateral_movement_remote_services.toml,sha256=cAVyfgtMZu6s3Z3hZdCNT5L1WLag5EMJmxCk4BAT718,10644
src/detection-rules/rules/windows/lateral_movement_remote_task_creation_winlog.toml,sha256=_p4plmmjaMu5pFkrgQ-St0UxhclI0Kdws6U8dMxXmS4,4297
src/detection-rules/rules/windows/lateral_movement_scheduled_task_target.toml,sha256=x-y0ruRIc6XoPYEDMNE9CcY2SV3zP0MZar7ryLskOZ4,5477
src/detection-rules/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml,sha256=zopuVc2qMxDs18IX6fVcxhjt9LIWK40n-uFBkgRqxk4,6753
src/detection-rules/rules/windows/lateral_movement_unusual_dns_service_children.toml,sha256=txv04Avxj86cpbSVNxTh9rOjIckEGW51k6Z8PqKaaIY,13962
src/detection-rules/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml,sha256=TAVTLCsulXtfKiNCnKKRzj7trycI--eWMr9aI9mx6y4,6798
src/detection-rules/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml,sha256=hLPhxfbCnKvCGFIXoLlKxJrchY8f9-9cOEMEvw8xRB0,12641
src/detection-rules/rules/windows/lateral_movement_via_wsus_update.toml,sha256=uuGKeS5PCogAFtx6oL0NVwP0m6j0CoIltmDpWp1TYVI,7265
src/detection-rules/rules/windows/persistence_ad_adminsdholder.toml,sha256=nHaOXXhe0NdYk5De3mdGvF3MvzFFj7QFXHMgSVLgnuc,13747
src/detection-rules/rules/windows/persistence_adobe_hijack_persistence.toml,sha256=1QdhJHUpyZc9vie-MMJBwQPRJFsSGkPGar9UQO3A-Vk,8093
src/detection-rules/rules/windows/persistence_app_compat_shim.toml,sha256=iCX8uDze8qPjGb0AVVn-cVPyHfdK-IKoS66Yc-iGnns,7548
src/detection-rules/rules/windows/persistence_appcertdlls_registry.toml,sha256=8muuLt2QmkPTj5KmJuLln-Sqbz9S_YVguarrO6Nmnd8,7687
src/detection-rules/rules/windows/persistence_appinitdlls_registry.toml,sha256=LT0tL2Am8kfjyGsIk7d9BsfMWEwqXKg1aDi6-ADS9f0,10210
src/detection-rules/rules/windows/persistence_browser_extension_install.toml,sha256=nrGrzMOz30bvOI6bhR98_yOI4VJnhI-cIiLb8W6gzA4,7414
src/detection-rules/rules/windows/persistence_dontexpirepasswd_account.toml,sha256=ReJ6N8z0vev9wf_RJBE0oU0xCNjUNrkY_0J40H6oIPU,5414
src/detection-rules/rules/windows/persistence_evasion_hidden_local_account_creation.toml,sha256=Zoo-fP7XrtoWjCGjbELRYZvPpapXU23A8ws0o6_9_3M,12886
src/detection-rules/rules/windows/persistence_evasion_registry_ifeo_injection.toml,sha256=N-pQGESvpDmAwtvEX1zx79V17mdIcXrZ6zRtAsl9rhM,8422
src/detection-rules/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml,sha256=lLp1zqo7-pW9LnF-Id6umGGVKqxy1TAA8iV2Wxi4KDQ,14292
src/detection-rules/rules/windows/persistence_group_modification_by_system.toml,sha256=6LCQqVl-evr0wwtdwocxKXh5p8Gu7WI0x6IWZCydjOU,5888
src/detection-rules/rules/windows/persistence_local_scheduled_job_creation.toml,sha256=V4Ym4S0S6neAhe6dev8g53V4XFpivv7XE6kIP_EOujw,7123
src/detection-rules/rules/windows/persistence_local_scheduled_task_creation.toml,sha256=WlZIg3pFLBlvCs_-EvfskmLHvpeNxP8lNCUN8ScWqnI,7686
src/detection-rules/rules/windows/persistence_local_scheduled_task_scripting.toml,sha256=VjbzlXwoK6aiW-9f4_qFjWaNmGnm7ESg_Rht8I2IcHo,3579
src/detection-rules/rules/windows/persistence_ms_office_addins_file.toml,sha256=c5cAoln9TQQ8PAu20QxyutD5k5J_TCliX7fSIXQDzVQ,13726
src/detection-rules/rules/windows/persistence_ms_outlook_vba_template.toml,sha256=W5ECZ5G2DDRlNuETPwDc9Z5jgTeV26Ia1AJIgyjtP0E,6900
src/detection-rules/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml,sha256=wu6n0Cq0dc2o6olIPlur8LjjIxCk1PmwpJwbpTyB7H0,13594
src/detection-rules/rules/windows/persistence_msi_installer_task_startup.toml,sha256=5PMHpSDVw5r2qeTD2B2GBCgfdxVpmq1rHatN5Cefmio,9871
src/detection-rules/rules/windows/persistence_msoffice_startup_registry.toml,sha256=_dHQe9356_vmEzEolB5A2QNit-txF6aVUM3pDqy2piY,6791
src/detection-rules/rules/windows/persistence_netsh_helper_dll.toml,sha256=UXOb7Ibl2gKS_uHja-kAIMVNTj0E3hBoOSIeytf3Kx0,6615
src/detection-rules/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml,sha256=EZKhJAXCpfnLBs3HmtF3OiKwxwvGy7I9SO2zy8cOHN8,8100
src/detection-rules/rules/windows/persistence_powershell_profiles.toml,sha256=qu0_PW2QdmcZTmaOG3tBYWp4e9rrb8Jl-QRgPWgoQzM,9783
src/detection-rules/rules/windows/persistence_priv_escalation_via_accessibility_features.toml,sha256=zSMnrFdqV3_X4qSXo7xMBorr02I0dV-b-EeSECZ_xNk,12486
src/detection-rules/rules/windows/persistence_registry_uncommon.toml,sha256=u4gzAE-1DyVxwseefxGweGYUhO5qYaJvc1-Zi25b0wQ,13280
src/detection-rules/rules/windows/persistence_remote_password_reset.toml,sha256=9LCyqF8Dw4ilyRZxRbE5wlYHVDBMavBhFg_41_ePPE0,6952
src/detection-rules/rules/windows/persistence_run_key_and_startup_broad.toml,sha256=8yUDwpkbB7O2s-CbGfGQzV_tuyMy2rzGEMnWUjLdWjM,11442
src/detection-rules/rules/windows/persistence_runtime_run_key_startup_susp_procs.toml,sha256=5yFzwc58S4NGoDPUXXY0jiLIMdzGlfbk705C5l4mRys,9019
src/detection-rules/rules/windows/persistence_scheduled_task_creation_winlog.toml,sha256=dsbAh9AjwtrsLRquE9AC0w9ZlZ2xVWcuxp-0ZGphmyw,6487
src/detection-rules/rules/windows/persistence_scheduled_task_updated.toml,sha256=kd3uuGWgumWdjmRpXYdPP92y_qTzwim6Yk7DlQKO1Os,5674
src/detection-rules/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml,sha256=933jG_6Ei8zILXuiqbjcgP7rULpcqCuztysXxdQkf9Y,13731
src/detection-rules/rules/windows/persistence_service_dll_unsigned.toml,sha256=AZ4CmjHu6WRXHnLOEYoJHW5KwTQiQeYoJt744BFTHgQ,10876
src/detection-rules/rules/windows/persistence_service_windows_service_winlog.toml,sha256=A44D_5QYMJwQIapFiT1kWwLdR4CU9AvgBj-ong9oD8I,8401
src/detection-rules/rules/windows/persistence_services_registry.toml,sha256=YKGgCWusw2nl92myYz3qz8ORN76zCEirlkvClfyBM1U,8817
src/detection-rules/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml,sha256=2Zu73PXLb-SHbGJXSx2021v0OnAAyxlbVJyYNv4vO3g,8760
src/detection-rules/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml,sha256=ttn7QY-LI55FUpQEjwbymV0_DoSSYtFYketYrwx1Vm4,8392
src/detection-rules/rules/windows/persistence_startup_folder_scripts.toml,sha256=Cm9WfWAuzNYLC8Q-y4UNAt0K7TBDlphSBwJHaPa1zyU,8734
src/detection-rules/rules/windows/persistence_suspicious_com_hijack_registry.toml,sha256=u4s3C0GVj7RMYnCt2gJCFaJcdFLvvNGeJQ0A9QbnVfo,8777
src/detection-rules/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml,sha256=jMfpk-N_HdlnHkq8bQonl1mxM0ulMP0uGJvBpgB_E6w,9343
src/detection-rules/rules/windows/persistence_suspicious_scheduled_task_runtime.toml,sha256=AIoel09lFJ1ybj8MByOa0O5cFbfCvjb2Q9fhGkNsW2M,8811
src/detection-rules/rules/windows/persistence_suspicious_service_created_registry.toml,sha256=WBiU35MFf-uk8x4rfKVbRRCpxLHygSTiN2qL7tj_BP0,13042
src/detection-rules/rules/windows/persistence_suspicious_user_mandatory_profile_file.toml,sha256=HrQ7tejXUXIrpbNSO5AckgRttp0pm16p28xGLcnRMTc,6205
src/detection-rules/rules/windows/persistence_sysmon_wmi_event_subscription.toml,sha256=cd4WRGUXQ6P0XxZ6hMp3RJ12YGLw0fcj7P6nnriLyIo,6772
src/detection-rules/rules/windows/persistence_system_shells_via_services.toml,sha256=umcNbAemN2SlSYBqbcX0YpGMPil2Y9wYnVTB3a9ZhTE,7902
src/detection-rules/rules/windows/persistence_temp_scheduled_task.toml,sha256=uWrtwNV8AyEyV9J81wcHHec0qRxEpCbW4uVgI_GJQNM,6336
src/detection-rules/rules/windows/persistence_time_provider_mod.toml,sha256=NRYGwhx9kTnt8x82BYPOtEAfTVzF2PJ8KpW02Tyzoro,8778
src/detection-rules/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml,sha256=nP_0kFxgsV7Na0KS4RTUCVEk69trwt4iQj3zLz1uXoM,4657
src/detection-rules/rules/windows/persistence_user_account_creation.toml,sha256=WTSHDNDER59QAFfK6B1Nc5C9GF2K8bwK_7ucYStskBA,4859
src/detection-rules/rules/windows/persistence_via_application_shimming.toml,sha256=KMwoNUY-x-qRACoGPHdClJbyf-QeNp__gE_Jt3UWQEo,7981
src/detection-rules/rules/windows/persistence_via_bits_job_notify_command.toml,sha256=z3C99QuwXAWawC_O3s9viPlKV0v9i_Uq5TURFPu3TU8,6986
src/detection-rules/rules/windows/persistence_via_hidden_run_key_valuename.toml,sha256=9xC0w0MvjseikNpQyR4M2PdJaZcrZfCPZSqfGiSTDyo,14747
src/detection-rules/rules/windows/persistence_via_lsa_security_support_provider_registry.toml,sha256=kWwjv6uGn8AZnPYGONBtwPe60dHnkwRFeRD7K0jLjC8,7663
src/detection-rules/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml,sha256=noV2P0JfGgFukSW2EvMhHbfyUwkk4jXP1CqhES-LQTg,14627
src/detection-rules/rules/windows/persistence_via_update_orchestrator_service_hijack.toml,sha256=TbX-5qjKaGL6KXkOZ5UsaWAueGG9VRoqCmPribMGqAE,15984
src/detection-rules/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml,sha256=bPRgkLwMpze0v0Kbl4ae0oGcnOzC7tPraL4qZP3Yof4,7389
src/detection-rules/rules/windows/persistence_via_wmi_stdregprov_run_services.toml,sha256=1iYmktMzjSlqXAdZuKljfOaB8aCl4P6l597QcPZg5Sk,17504
src/detection-rules/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml,sha256=zyz1J12iIqFH_IixsobfjQAHYINeRDkog-RZG3s6368,7854
src/detection-rules/rules/windows/persistence_web_shell_aspx_write.toml,sha256=gblAgtQBv7IxyMqJ-fyODvIZbVfkep1ZTAb2gtKlnrw,7326
src/detection-rules/rules/windows/persistence_webshell_detection.toml,sha256=KjiR-DeUKRdKhPrENhynQYUxJNRcsqaWMIcEJglKrhA,18333
src/detection-rules/rules/windows/persistence_werfault_reflectdebugger.toml,sha256=0_nVzxHdv-iHBbarorgTeXnhGkIGw6lGsDdTrP-ZevE,7279
src/detection-rules/rules/windows/privilege_escalation_account_takeover_mixed_logon_types.toml,sha256=Bl2-Q1olKCi16Sti3xIplj46eL3CIGYfwArRLmrqN70,4446
src/detection-rules/rules/windows/privilege_escalation_badsuccessor_dmsa_abuse.toml,sha256=dcplLPD1aIFSza7y694QjppUZHTpX87hsTrRr7nLuLQ,12963
src/detection-rules/rules/windows/privilege_escalation_create_process_as_different_user.toml,sha256=iy9morl9ZFTER_cRFxDLy4fOg82YELrENbMgk78Q-GA,6219
src/detection-rules/rules/windows/privilege_escalation_create_process_with_token_unpriv.toml,sha256=gZ3bCjHZcfKUK7koM87IA9FGZfC-tpIZJm1mKe0lq8g,8409
src/detection-rules/rules/windows/privilege_escalation_credroaming_ldap.toml,sha256=90xcpsuAeL7B_NvmN39CyO45gOMJw3_jaXFnJ-eNFgg,6377
src/detection-rules/rules/windows/privilege_escalation_disable_uac_registry.toml,sha256=1BcsdMEdS8MpV3I6jLnFANK3YNBfkS5joXEs9UesgeU,8051
src/detection-rules/rules/windows/privilege_escalation_dmsa_creation_by_unusual_user.toml,sha256=4_JkmYZsKoFhjFgx5l9ZuJUgik8qzfi0kiiPuc4bIRs,13275
src/detection-rules/rules/windows/privilege_escalation_dns_serverlevelplugindll.toml,sha256=vJ4WBiPZC7eseuuNp5K_WpEA4dlFW6FEeED7-ZA9l4U,7021
src/detection-rules/rules/windows/privilege_escalation_driver_newterm_imphash.toml,sha256=wNkS-0AOi14ei8WNbRjksz-iNQNi6pVhxfQFM0TZmsI,9001
src/detection-rules/rules/windows/privilege_escalation_expired_driver_loaded.toml,sha256=o1OfhinINpXgnhIpWBF3Y12aIihjS2NvbecipPTLl8k,6262
src/detection-rules/rules/windows/privilege_escalation_exploit_cve_202238028.toml,sha256=I6combW2n1dZ3tQeJt9iR3wPglMjfBukNNAgduCI_0E,14433
src/detection-rules/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml,sha256=TcUQAuTy9fjTgMlAwhc49RIyyJ9fVr_KppObjvR1Tng,7930
src/detection-rules/rules/windows/privilege_escalation_group_policy_iniscript.toml,sha256=Hi_ECVxn2fQIJZ4UliizEhO0mr4AP-b2lhowaOQyIq8,5108
src/detection-rules/rules/windows/privilege_escalation_group_policy_privileged_groups.toml,sha256=4EV4NYEcbh8lPDcYYS-jFFDrU6DDtOz0A9fJw5ZXEo8,13263
src/detection-rules/rules/windows/privilege_escalation_group_policy_scheduled_task.toml,sha256=QqJ2P9J5b9y5DBMpu2IWAEFbRPedaFOss1PigpDUcsk,5205
src/detection-rules/rules/windows/privilege_escalation_installertakeover.toml,sha256=68p_jfVL1fzrfmRt_UylDpNtAJLzvu3vrLIIo5ZFs9I,13552
src/detection-rules/rules/windows/privilege_escalation_krbrelayup_service_creation.toml,sha256=XctVfL5rF4TF524pWIU2ZYgka46EMVFa0fhdGFDM73c,13866
src/detection-rules/rules/windows/privilege_escalation_lsa_auth_package.toml,sha256=3ZX4cEeFIHSWvcH1bKZuOe2zp0FbxG9fahd8jZuwNSM,6692
src/detection-rules/rules/windows/privilege_escalation_make_token_local.toml,sha256=f2U3xCSL_qgvUt91focyTTtGKWUjVBHAt5MGtNUG0T0,13286
src/detection-rules/rules/windows/privilege_escalation_msi_repair_via_mshelp_link.toml,sha256=254BRsG8tFskJ-yX3W-Clf2H6v6DPFDuhPLB1kEVHyw,13213
src/detection-rules/rules/windows/privilege_escalation_named_pipe_impersonation.toml,sha256=J2UyMHpys76JwA3f6VDoaVv3vuvXokyFMq9436Dc0YI,12207
src/detection-rules/rules/windows/privilege_escalation_newcreds_logon_rare_process.toml,sha256=SzZ_2vFd8wl7G262xSzz4G1iIJUxPCWR05iKBqkmA2k,5905
src/detection-rules/rules/windows/privilege_escalation_persistence_phantom_dll.toml,sha256=pn1Cc4bNIA-YtITNIJ5GgLLm13R4_iBiVT8bkw1smSo,10080
src/detection-rules/rules/windows/privilege_escalation_port_monitor_print_processor_abuse.toml,sha256=RzR24aMUBi3ayuhYEm8dZE4TB0UXtTCQ3DMQx93om-U,7843
src/detection-rules/rules/windows/privilege_escalation_posh_token_impersonation.toml,sha256=xSDXgEEl5HiuMPNc1NO5b3v4HIWOe9xJDRZNzCSGoSE,12420
src/detection-rules/rules/windows/privilege_escalation_printspooler_registry_copyfiles.toml,sha256=jtzCesFBfceOmXqrwA4tHyTmVizAERT-7hbl-CriEak,11467
src/detection-rules/rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml,sha256=p2c9hBa1oSD8R75F-oKYmZgTc0aggJHbsXBhPVH4LEU,8316
src/detection-rules/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml,sha256=bvqrsYy75-FQJAEs9XLDBqMi0uo3UKJeZ_u17WZy5lg,6924
src/detection-rules/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml,sha256=w1B2OZSLVYVkKn2juzMqwy0CUOXsPVfA_SYFdKOx-iA,8486
src/detection-rules/rules/windows/privilege_escalation_reg_service_imagepath_mod.toml,sha256=IQL9wy98Ci-134vvBLdP-zq_V0RfBUHV_YOL0oZPDhs,10111
src/detection-rules/rules/windows/privilege_escalation_rogue_windir_environment_var.toml,sha256=v9rspi0wbGnLJmtWPBc7YhCQCjLC8MEhhtgyluWua1g,12838
src/detection-rules/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml,sha256=F8xPnspYmdGT36c2It1ND_bcaRiQ4yu7k-b1P4KTJkk,13556
src/detection-rules/rules/windows/privilege_escalation_service_control_spawned_script_int.toml,sha256=75QPMRNYEi7VubUMkg_Gwc5KVFka99UiLsWQAy97YLU,9068
src/detection-rules/rules/windows/privilege_escalation_suspicious_dnshostname_update.toml,sha256=VY2x_5WL5hGJ-WctZ06OAPdvRdXiqvQRe3hF_oYb41I,11464
src/detection-rules/rules/windows/privilege_escalation_takeover_new_source_ip.toml,sha256=K8c3V1drqSJ-v2Y6Uws4fojiwTNK8e4e-GmVjPe94-c,4353
src/detection-rules/rules/windows/privilege_escalation_thread_cpu_priority_hijack.toml,sha256=2KLUe9_87Wq5Ds0ulWwdunYXwTc9_xAXkWjxwD-fXXk,13281
src/detection-rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml,sha256=IxPqf5sUaI-SeSy5suBUSKNehITNSDfYEtr9iZgf2to,7132
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml,sha256=KHAwAfZ5oTo84IMQRoBEpJE-6x68Zh0hImrxpFE49A8,12652
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml,sha256=96L3uwB6ufRp1X2jPgXtqxLGZ07IqBV_tBiUPjsYdwE,8080
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml,sha256=yVc1mtnVmm0KUMqu4SpJ0SIxQgwulHxNYggzEkd81I0,13134
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml,sha256=c6ZkQFuw6FWUe0x8mUpjVRm8w7LFe-fCXVqH2tLAiGc,8238
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml,sha256=SDin7Z7M5tp27LpvWTBZDN9fKQCIEcFHMNSWZAZJm48,7236
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml,sha256=pBV58R1eHo-ZWcrn_6OSrK2Tp66q-WqKImI3bCGhjgM,14514
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml,sha256=Qibv5iktnTTrHlmZsB60_tRkjayQOZqXqbrgjv4TBdc,13976
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml,sha256=yyR-RS1He52DvmTINBKhnwmzAGpKMQcIuVt3L2LcQlE,8912
src/detection-rules/rules/windows/privilege_escalation_unquoted_service_path.toml,sha256=acZj2p0bko6XtMkubQW-jw1pYFwayScKPY4RhmCcqvw,7150
src/detection-rules/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml,sha256=6GagLaZDRBTqYoEJsBeJYx04WEvPgm4R-qJ3T4YusXY,11544
src/detection-rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml,sha256=nOuQInCQJx4GdEvRtbvMATHD576X-trxJI7KHk8lOuU,9387
src/detection-rules/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml,sha256=gjSW--KV_mSuy8z9UBCCuNN7E0KzBm0zFMul-d058UU,8494
src/detection-rules/rules/windows/privilege_escalation_via_ppid_spoofing.toml,sha256=qgpMFxUUPlyYAM6ctlmJD80t-3qDX_G_uLek1YbsU4g,13966
src/detection-rules/rules/windows/privilege_escalation_via_rogue_named_pipe.toml,sha256=EjW1Rs_RDcAlpXGDJ1kjdDabQYG-5paN8hwQLTySssc,10417
src/detection-rules/rules/windows/privilege_escalation_via_token_theft.toml,sha256=_WnClSD0CGMMhq2LabUw6dYc3Frx9DpuL5sxGEecdlY,14368
src/detection-rules/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml,sha256=TZEN2qqCjEfjz8NrBbewz-gevLIFXu62u3LjBdGvlG0,13397
crowdsentinel_mcp_server-0.6.0.dist-info/METADATA,sha256=U7NOF2fdW7OaUnzi6YRvf8WUm83izu_37sCokfMHNVU,68061
crowdsentinel_mcp_server-0.6.0.dist-info/WHEEL,sha256=lCkmxWfQsSc9CfIClYeavTdQeEX2toPqufh9gI35EQA,87
crowdsentinel_mcp_server-0.6.0.dist-info/entry_points.txt,sha256=W1ohzQLof2Ig0sMej7Y87in7_XVwXnvGzUUWhSP6Lo4,186
crowdsentinel_mcp_server-0.6.0.dist-info/licenses/LICENSE,sha256=5O9dP-RG0_9vBU0fW_zafFBNC2aR9SbY6DbfiyLgfYQ,35150
crowdsentinel_mcp_server-0.6.0.dist-info/RECORD,,
