nldcsc_elastic_rules/__init__.py,sha256=6dHqq7-xt4ue7Df8me8LQ6zzfDOvMqEwY9SrBhrLsCw,26
nldcsc_elastic_rules/utils.py,sha256=sxGwPsOgrJbAYWOes85I0FXabGIRwI5e68yhRowl2dE,415
nldcsc_elastic_rules/rules/README.md,sha256=FsDrLRbMS1GiLtJxKEeB2etL1U0JZ053xE3T28iDNIY,2862
nldcsc_elastic_rules/rules/_deprecated/apm_null_user_agent.toml,sha256=P1Ob5RxPCMFTR8Z_fRaFpfLNgZmJekBbg1ihzeuHpeY,1466
nldcsc_elastic_rules/rules/_deprecated/command_and_control_connection_attempt_by_non_ssh_root_session.toml,sha256=L9n522sl79myzYEWozsyKhrtM9oD9n7xlHhsOq_-D-4,3405
nldcsc_elastic_rules/rules/_deprecated/command_and_control_dns_directly_to_the_internet.toml,sha256=qlYl28lEc69nJXQRHz0Z-nstI8SKLXttlll_4N_rnio,2841
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml,sha256=Ch4I743iqDRnHQBDzBJKPMvGxfD9cscKyWkNHkjChEc,2559
nldcsc_elastic_rules/rules/_deprecated/command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml,sha256=Owf2oKiHH5RMdHs16mdW5NGlZfqacps7HCUB3NE2WJc,2506
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_chisel_server_activity.toml,sha256=BaEtM6vHm5lT-Q6LjfAGz3Ke-TH3rShJ_0OO8mmYtG8,10398
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_iodine_activity.toml,sha256=ik7mymIg2c2SRv5OG5UqT-rSRKzJmrcwxRTwLAo8tkc,1841
nldcsc_elastic_rules/rules/_deprecated/command_and_control_linux_port_knocking_reverse_connection.toml,sha256=17PowWGKOMFk8t2VMfTD5IBbPKYYAtAp4RVMyVJnlQY,5148
nldcsc_elastic_rules/rules/_deprecated/command_and_control_non_standard_http_port.toml,sha256=AI74O9bJme8VnypTjmfu4QQMiZIHPfre2Tk4f5z75u8,7807
nldcsc_elastic_rules/rules/_deprecated/command_and_control_non_standard_ssh_port.toml,sha256=SlMBF29t6TwpyGCMKrK3WLKnj7Pny0swdvaS46ufHw8,6704
nldcsc_elastic_rules/rules/_deprecated/command_and_control_port_8000_activity_to_the_internet.toml,sha256=jgENNsuzg4kMtoUEaeBlpqG5F-3eCtwUVBUU4du7cXQ,2010
nldcsc_elastic_rules/rules/_deprecated/command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml,sha256=uzqvyL_JvKsDojc_TCpVZW_4qUhuJ38kwUbsJwUkn4k,1568
nldcsc_elastic_rules/rules/_deprecated/command_and_control_proxy_port_activity_to_the_internet.toml,sha256=N123c9tBYL3PqNd2xMKyRTZpkWdX9gQ4p8b2G7Q3N1Y,2443
nldcsc_elastic_rules/rules/_deprecated/command_and_control_smtp_to_the_internet.toml,sha256=OmyIkHqqO3OdQJLBLARCht0UsqkRlUjOkXUX7lXOHE8,2119
nldcsc_elastic_rules/rules/_deprecated/command_and_control_sql_server_port_activity_to_the_internet.toml,sha256=KDNeLrIR2fb2FNdMzS4mH_Mw6Ky7EhIttMD57ccXiCI,1916
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ssh_secure_shell_from_the_internet.toml,sha256=dT3rK50ocmiI9aTi2AO9kK7SgczzjsAxOFswYRynrjk,2757
nldcsc_elastic_rules/rules/_deprecated/command_and_control_ssh_secure_shell_to_the_internet.toml,sha256=EfQzNOi7HQFnTMZT5QrVj50Sgr6iY6GOYrhLumicXcE,2151
nldcsc_elastic_rules/rules/_deprecated/command_and_control_sunburst_c2_activity_detected.toml,sha256=pNaQkWVGoZY35lRLznl2xv6ZH9mdJNzICpGtKgS_rPw,8473
nldcsc_elastic_rules/rules/_deprecated/command_and_control_tor_activity_to_the_internet.toml,sha256=NF4Fl59KsJLdABK6K5FwmXr1tdu7NXaedQfVnuhTaDw,2329
nldcsc_elastic_rules/rules/_deprecated/credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml,sha256=0gn1XEwiyKKC2FAt2-86ONDaxDYB2Hue50-8xstoxd0,6831
nldcsc_elastic_rules/rules/_deprecated/credential_access_gcp_gke_service_account_token_created_via_tokenrequest.toml,sha256=0gtvNBTLD6kNS8w5cFyMrRsDvJeHxfzHBuF1X8Fg-fA,4754
nldcsc_elastic_rules/rules/_deprecated/credential_access_microsoft_365_potential_password_spraying_attack.toml,sha256=ieBRSQIw3hk673O5dGw1hx8_JAklxKCYcicpjYjlTHc,1815
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_linux_ssh_bruteforce_root.toml,sha256=t_1U00NJarwzYBhpUkhLxdhiV2ZoPaNUOZWbY3Wq6Dk,3966
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_successful_linux_ftp_bruteforce.toml,sha256=5KZIG83OEzbv7XQlFPM2k9HvSTRuO1DK_BPxK52mGn0,9451
nldcsc_elastic_rules/rules/_deprecated/credential_access_potential_successful_linux_rdp_bruteforce.toml,sha256=IIOsk4fCYS3c7XspD_Cw85mb2TnW8cgftuQYHfDV5r4,9703
nldcsc_elastic_rules/rules/_deprecated/credential_access_tcpdump_activity.toml,sha256=HjMr6vfU4ptYXikdukMUug9Um8DBKHXRbBwns9RriJw,1662
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_agent_spoofing_mismatched_id.toml,sha256=lp9561MSJeqCyFJCbkvnqGJrOooZ6wbbnPvGwEHBRqU,5723
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_attempt_to_disable_iptables_or_firewall.toml,sha256=xmyL9oBeFgVTsQiHxVhe6hGmu1nYihiHP_kb8Rz3j_o,1530
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_base64_encoding_or_decoding_activity.toml,sha256=sZ_95szs8hOpomQmmlSUVgG96KgfH9C0YRBS5icSmMw,1477
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_code_injection_conhost.toml,sha256=G6Yz_j7i3ly8I_QxT64BDHoVSIi2aeeVRaZjfIotC68,5188
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_elasticache_security_group_creation.toml,sha256=Jbig4QsukegVaLhlQJPVk_3YiZ2mC16Z-cA6tFGP8TM,6876
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_elasticache_security_group_modified_or_deleted.toml,sha256=oCwORGOoEJ5FEtpeejX5ws89GGYnOiBEtBScxq0rW2U,6681
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_execution_via_trusted_developer_utilities.toml,sha256=0DIN1D3-hRuLx57AlgtkBAOFDQUAEZ_BNMf1TG7rX9Y,1342
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_hex_encoding_or_decoding_activity.toml,sha256=JtVxnHzgZ_O9fPb5DxmRoiFW-Gxqw7ihShvbv4zorMM,1431
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_hide_encoded_executable_registry.toml,sha256=xk3Vjgcv2gyZuI303rhDOFshEJSHM2s0nQvxfiIOBx8,6933
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_ld_preload_env_variable_process_injection.toml,sha256=N12tqet7lSXN0_AL0_CZAc9bbJlZBSyBZ2YMcjXm_Po,6018
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_mshta_making_network_connections.toml,sha256=-beMtzmAlThKxAhtC1QrgL6AQt76_S0sCHtgg1NeNJY,1491
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_posh_obfuscation.toml,sha256=b2zghB8WMYbtriApHNXb42uYJZrDl-mHeGYnKDUd7og,8037
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_potential_processherpaderping.toml,sha256=CrMLt3Zcji5ydCGpt-_p17w8NGWvdpC4i1uQ2vh-Vs4,1842
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_process_termination_followed_by_deletion.toml,sha256=kjpsgmi8BzvNoQCRJJLy0oW61hhZ26cFzxYazPapoxw,8481
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_rename_esxi_index_file.toml,sha256=lkVvaepEX8VSY-h1Z5_VDEXeYcpWSE-oTTopcVCKjGo,7730
nldcsc_elastic_rules/rules/_deprecated/defense_evasion_whitespace_padding_in_command_line.toml,sha256=y1xyhawly-MX1X7wU8r7H33s61qjifj3O7MPD_9qHdg,5213
nldcsc_elastic_rules/rules/_deprecated/discovery_denied_service_account_request.toml,sha256=bT2Roery3Z62Y6m_JRynlpz5fdk09O4dJuY_UH4oKFc,7014
nldcsc_elastic_rules/rules/_deprecated/discovery_file_dir_discovery.toml,sha256=x3H7E_TjCpMrByzKuW5gFWFiSy46etE8-wfW2wy8tNU,4102
nldcsc_elastic_rules/rules/_deprecated/discovery_process_discovery_via_tasklist_command.toml,sha256=xsfztpMiMrhlVsKSJs8jpbpIr-ifl5-kWmYHjXgniSk,1357
nldcsc_elastic_rules/rules/_deprecated/discovery_pspy_process_monitoring_detected.toml,sha256=aYcip-UzP4DUeQcyKKjuy6P1Nxt5AaocUmbFDnuc9XM,7457
nldcsc_elastic_rules/rules/_deprecated/discovery_query_registry_via_reg.toml,sha256=yaFFIcpM9z2Z_xFL3zvhHcLyV9RU8BFtJtE_uhVhZko,1134
nldcsc_elastic_rules/rules/_deprecated/discovery_signal_unusual_discovery_signal_proc_cmdline.toml,sha256=EWTew-GkkXVVxHuhKio4SnW_RWXcJ7sFOxMiH2vn6rU,5847
nldcsc_elastic_rules/rules/_deprecated/discovery_whoami_commmand.toml,sha256=NEUGhhng629IInRexo-_TVOgkNCVoLvO4uaXJ4tlsqk,1256
nldcsc_elastic_rules/rules/_deprecated/execution_apt_binary.toml,sha256=FGsJSS6bii45TNR3PfSXcSXmUqRRW4g0Y01xBzzDpEw,1831
nldcsc_elastic_rules/rules/_deprecated/execution_awk_binary_shell.toml,sha256=jEchJX9Jf9-VQeV1-vssqVRqdQPza-Pcanw-556MCBE,1729
nldcsc_elastic_rules/rules/_deprecated/execution_busybox_binary.toml,sha256=IITvx4ReXM1up2gjvYa8Aec7QUgeDfILHFHeXC58zrM,1665
nldcsc_elastic_rules/rules/_deprecated/execution_c89_c99_binary.toml,sha256=5VLXlYDqDHGC7A9hJDtKHai7WMhCzUzF1-lB1MfyY9M,1791
nldcsc_elastic_rules/rules/_deprecated/execution_command_shell_started_by_powershell.toml,sha256=0SGoxLXFNej0Ffb8VvVq3PCqyvE4Jbay4eC1PifB8FY,1228
nldcsc_elastic_rules/rules/_deprecated/execution_cpulimit_binary.toml,sha256=Za3MQfcjwp3en5LUJsVZEPZxkv-Em2qjubwTLF5G5as,1792
nldcsc_elastic_rules/rules/_deprecated/execution_crash_binary.toml,sha256=-wz6LJVZUeuLHLm6ZPEpavzyPZWbX2IQWyhpSg609i4,1606
nldcsc_elastic_rules/rules/_deprecated/execution_curl_cve_2023_38545_heap_overflow.toml,sha256=zrasn_JYmeB7KA3xDBiFzipxcRYoVJN_L-8TDqosg38,9360
nldcsc_elastic_rules/rules/_deprecated/execution_env_binary.toml,sha256=2qq_ndk9zYy2_D3bli2eyWzNhSgJw7glh1Zq7r5wTJ0,1666
nldcsc_elastic_rules/rules/_deprecated/execution_expect_binary.toml,sha256=BIU_NjT5DFy7XrtG7MJJ_zfkL1YkoKIN9bhbmraY7Zo,1856
nldcsc_elastic_rules/rules/_deprecated/execution_find_binary.toml,sha256=PKvMdNYz4AEJ0ZfZxkwPLbCmQs1OVsBQ5QSZKLD3l8c,1719
nldcsc_elastic_rules/rules/_deprecated/execution_flock_binary.toml,sha256=cePqGZZf4f9-0GobaxgxMcEByc9I7pTOju6KyakcOq0,1769
nldcsc_elastic_rules/rules/_deprecated/execution_gcc_binary.toml,sha256=hqaGdpJ0pDyfe9Z3mLb9YQwRiSvAgiKyJbL1TtS6QJ8,1760
nldcsc_elastic_rules/rules/_deprecated/execution_linux_process_started_in_temp_directory.toml,sha256=Of0Ynl54K-ToNotSxvqmX7ZjEOpHOA4jPJwiTYAWvNs,1495
nldcsc_elastic_rules/rules/_deprecated/execution_mysql_binary.toml,sha256=DhCMP0edAa6Z22WuHQxlg31aDSFfUWOVvG38eMr85m0,1728
nldcsc_elastic_rules/rules/_deprecated/execution_pdf_written_file.toml,sha256=y_Z5_xAnD0GP7W-DNFS_GRhkMxjQ8yg44F-SrLqW6WM,6119
nldcsc_elastic_rules/rules/_deprecated/execution_pentest_eggshell_remote_admin_tool.toml,sha256=YjiX7lVLc9t84kG7zJJj1v3eFzSnJIrIEEACT3WciSc,5396
nldcsc_elastic_rules/rules/_deprecated/execution_reverse_shell_via_named_pipe.toml,sha256=ho8lidMGBTNyv3f5AT29uMlDs5PmO_UEhW0EPNLW9QI,2876
nldcsc_elastic_rules/rules/_deprecated/execution_shell_evasion_linux_binary.toml,sha256=BDWRIS4g_yhCUjj5a50kXAK1vejq0l6gAISLvMTe9hk,12652
nldcsc_elastic_rules/rules/_deprecated/execution_shell_suspicious_parent_child_revshell_linux.toml,sha256=M6bJXbB1RxvG7sNJifxwfKe8rn2WqRU2LOO1apmj17s,5431
nldcsc_elastic_rules/rules/_deprecated/execution_ssh_binary.toml,sha256=wRBTyH4Z06Qgf7uSefoQzWzR_yZLZRXrTAqdu00kkcg,1915
nldcsc_elastic_rules/rules/_deprecated/execution_suspicious_jar_child_process.toml,sha256=g7Y6xvGgfo0MTj6EGYxdDRUtE8VHgTVLnHEU8NSW_w0,5143
nldcsc_elastic_rules/rules/_deprecated/execution_unusual_request_response_by_user_agent.toml,sha256=QvGLDb2997whHyyPUJ6n5F1G7lT8vsWq9IVBVV1baT0,6628
nldcsc_elastic_rules/rules/_deprecated/execution_vi_binary.toml,sha256=rVx9fC5neqddpDzHI3cauhBO0O8eHaW1yeO0GqmPzm8,1693
nldcsc_elastic_rules/rules/_deprecated/execution_via_net_com_assemblies.toml,sha256=WoQfkdoC-v0pHjs5Z1CSF9JdwbEV-N3yiKzIfcZ05Yg,1517
nldcsc_elastic_rules/rules/_deprecated/exfiltration_ec2_snapshot_change_activity.toml,sha256=1G5HDecNxC7OnjHHAmJgTABviAJu6m5l8hrd94MErLQ,5984
nldcsc_elastic_rules/rules/_deprecated/exfiltration_ec2_vm_export_failure.toml,sha256=KGk9FAieIO1d6lNH3b6fBTeWvRrabD22uyL__lW5Tqk,5943
nldcsc_elastic_rules/rules/_deprecated/exfiltration_rds_snapshot_export.toml,sha256=sWun5b-ABOXGlkaBRRU4D7IAhq0oxcSzRiARSbzyVrs,1587
nldcsc_elastic_rules/rules/_deprecated/impact_potential_linux_ransomware_file_encryption.toml,sha256=lOEgZWwU381xlheYMvcJFy9gO17FYaWP720PAL9IlUk,4275
nldcsc_elastic_rules/rules/_deprecated/impact_rds_group_deletion.toml,sha256=mD95apuRrUSCvGO7SUZ8e64qLhoOmAiKB_R_qdV9gtM,6128
nldcsc_elastic_rules/rules/_deprecated/impact_rds_instance_cluster_stoppage.toml,sha256=7qRnEu_TD9VlHR6kud8vFX5BD2D8I1zOulZCX0zd2Lw,6067
nldcsc_elastic_rules/rules/_deprecated/impact_virtual_network_device_modified.toml,sha256=C1-KzN13Hafw3A9-Fg-37R4Bd9STq0xPe7i-vBfo69M,6954
nldcsc_elastic_rules/rules/_deprecated/initial_access_cross_site_scripting.toml,sha256=QzRJdE2DmDPRpcI1GD05Zmv8ouf4zjpWvZFFtp57Nts,1617
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_failures.toml,sha256=_kOXSQ4PleBgeG68TjvkHXKMUomjZlIqBcP01JwEkPM,1382
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_location.toml,sha256=tz_uUjcVOnqB1UK96KKBXIbDjYBNfzaWgbis3_6XeSs,1370
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_sessions.toml,sha256=ANcZlbHYI9rAPIpTOVoBornOTDsvfhgikW-299X-CqY,1358
nldcsc_elastic_rules/rules/_deprecated/initial_access_login_time.toml,sha256=_kljdiUN-qkj6Cl_sl-1JkYo3pxrfmPDQLWq8v9ndWU,1361
nldcsc_elastic_rules/rules/_deprecated/initial_access_rdp_remote_desktop_protocol_to_the_internet.toml,sha256=Qwqv0Iuf1XK8f5-qP2KftZBIVXzV7Rwha_8MtLLG3uE,2587
nldcsc_elastic_rules/rules/_deprecated/initial_access_security_compliance_user_reported_phish_malware.toml,sha256=SpXddEF9aM-zwtgekM6BKIyhU36wurOBk8Xq5foKT_g,6647
nldcsc_elastic_rules/rules/_deprecated/initial_access_ssh_connection_established_inside_a_container.toml,sha256=8IRjm-KURyYajs2vbpg_vlAUEQRwlXN5gpA0DlzcVO0,6893
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_malicious_remote_file_creation.toml,sha256=9psQ-KiT-Mi4cB1RCSHQ-Iy9adDa1vbLqdmG0N3nqh4,1489
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_remote_file_creation_in_sensitive_directory.toml,sha256=cIF5BJVeQFXhcmk-oKcfIu5re0tjf_klOdBctLEIWXA,1956
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_a_container.toml,sha256=tMNkzlHomJ5txCvbGqU1ee9DtSyhLJM2Nsf3rKkEJaA,7081
nldcsc_elastic_rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_container.toml,sha256=GvLLvGW_QVueYL4Ykj8OkA4_KNUhUXtzEuyF3YiK5Jc,8813
nldcsc_elastic_rules/rules/_deprecated/linux_mknod_activity.toml,sha256=AtOAcnSD1gRdU8oeF1nL7vR-8st7W6Cx_FM9ZqYU5fU,1252
nldcsc_elastic_rules/rules/_deprecated/linux_nmap_activity.toml,sha256=4krPC1MpI7NrhqLNP_CvUd_WpeI7V4Wb_IFbB8xH7Co,1250
nldcsc_elastic_rules/rules/_deprecated/linux_socat_activity.toml,sha256=fpPixypMYwHucgfqOZtKJesiqM45VL5AJ3tm3djHPJE,1283
nldcsc_elastic_rules/rules/_deprecated/multiple_alerts_different_tactics_host.toml,sha256=aRrg5h0s4Q7j2z6jax5wQn5J5_nFWURrHOQrMwygnFQ,5277
nldcsc_elastic_rules/rules/_deprecated/persistence_adobe_hijack_persistence.toml,sha256=2nP_f4Og1giGpAHABBTM2o11PX_ny62lhG6jzQ3jjks,8291
nldcsc_elastic_rules/rules/_deprecated/persistence_cap_sys_admin_added_to_new_binary.toml,sha256=elaLLLJeNPPC2ysluHFsPWClEWUpkkDu4J84UzJ8SnM,4004
nldcsc_elastic_rules/rules/_deprecated/persistence_creation_modif_launch_deamon_sequence.toml,sha256=nl0Jd4DRJzV8ZcFDsu1iaFLsQTpK_EXo5281JPx4jnI,7985
nldcsc_elastic_rules/rules/_deprecated/persistence_creation_of_kernel_module.toml,sha256=28DM-mMhCvG3RwE4aBN9tFNeFebjnkHlxwpCl1fkCgU,1562
nldcsc_elastic_rules/rules/_deprecated/persistence_credential_access_modify_auth_module_or_config.toml,sha256=8qPbbDdQ3xZLMDVVha2djk1F9qEVnN9jLkTvBtwSOSY,7618
nldcsc_elastic_rules/rules/_deprecated/persistence_cron_jobs_creation_and_runtime.toml,sha256=9NuZqZnlMzwYsrsHmFaCufJDQ_EvyjmFm1F0pV020zA,1948
nldcsc_elastic_rules/rules/_deprecated/persistence_etc_file_creation.toml,sha256=aJuHvXlPf_fsjj4kyttJnRq8-7JJgBiZvnDU182TjCI,13625
nldcsc_elastic_rules/rules/_deprecated/persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml,sha256=YHdUhvXuabDtrsacccM1Js8ZjkslHGFALmVMHwNc56A,3682
nldcsc_elastic_rules/rules/_deprecated/persistence_kernel_module_activity.toml,sha256=NAumTSTdPVKKxNj_eawEiJj1O7NBc1BWsK95DlnIuuo,1570
nldcsc_elastic_rules/rules/_deprecated/persistence_mfa_disabled_for_google_workspace_organization.toml,sha256=zjyRwJ_YE4oN4uplodAuwa6Moi65wJYOSV5Yto9PSwA,6755
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_cluster_creation.toml,sha256=qSHGYAesdQea2dCWfeBRM4xHwl-b-POpjWht64aO2no,6748
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_group_creation.toml,sha256=c2M-d7tBZpTZHitlXsObzTNhRlp3WuG2YQ0ojGNOvy0,6138
nldcsc_elastic_rules/rules/_deprecated/persistence_rds_instance_creation.toml,sha256=V3Pf2qnZ4_JVdgIowqXUhcs39hZ5OxWuIhfDagZDdJ0,5917
nldcsc_elastic_rules/rules/_deprecated/persistence_redshift_instance_creation.toml,sha256=F89f3HXUsjlkYCYx56zhlCgjybt78tEe28LKeNHAcoU,6164
nldcsc_elastic_rules/rules/_deprecated/persistence_shell_activity_by_web_server.toml,sha256=1XiZc6_XUztm5qrZuHU01sEh6QAS9TGJ4-SDVR1Vkmo,4985
nldcsc_elastic_rules/rules/_deprecated/persistence_web_server_sus_child_spawned.toml,sha256=d3LOCNIhCW4o3SpIVJ2CfOSYMH1aUkE0_M9K10mNnL8,13193
nldcsc_elastic_rules/rules/_deprecated/persistence_web_server_sus_command_execution.toml,sha256=oYIHBX7v7dh6GvGFaS0ZIrghK3L-bxC16JUl2r8JX8I,12443
nldcsc_elastic_rules/rules/_deprecated/persistence_web_server_sus_destination_port.toml,sha256=MVRMIA-NasK9q6oZng3gvYyiRxq0FkiYPeq4FunggOI,10108
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_cve_2025_41244_vmtoolsd_lpe.toml,sha256=S5h78uR1GeanlqqdW7Vi4EdZM-yyCkxPMmDHE605Mk4,10325
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml,sha256=FPINRz6iSlfk2sHVKA30AmwBavmIuhKHmxFxms6kFh0,1903
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml,sha256=z0OxMwyBUuyP95zI2UFyJTJbPG-DgFxGjLpRP6HWKro,2361
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_linux_strace_activity.toml,sha256=jFqD1L6vukg2SZmd_9Dl7BOlyvneLEp73MLrn8sPjKQ,1505
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_linux_uid_int_max_bug.toml,sha256=GhGncqe62MCvlD_he-9coa5ZC7Rk_IPmXMHw9bkTsFc,8113
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_netcon_via_sudo_binary.toml,sha256=S4Wp681190UbtXAZRfuSVLtZeO9hz2HsdP_rdes23vU,8775
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_printspooler_malicious_driver_file_changes.toml,sha256=lpOfEQ3OwDo_dF1nPSHEf8PZOfLsszfNrnDDIRoajHs,1608
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_printspooler_malicious_registry_modification.toml,sha256=AlNF4rCdfNWp4xVMpUYEYHtYq1vGiWwb5-9VqY54qKI,1709
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_printspooler_service_suspicious_file.toml,sha256=qtpAqD1iwGZ1olWm6JRqrjG3GwoXkxrz1JUdSbhidUM,8518
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_root_login_without_mfa.toml,sha256=6kHzxusnxxfrjOoAVzHg0ar3eiQfLdnoc35nbxqQFjc,5377
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_setgid_bit_set_via_chmod.toml,sha256=ByHDIGHwpb4ynYkU_6ZBQKW4Sn5nyPB6yLdtmPcojaE,1779
nldcsc_elastic_rules/rules/_deprecated/privilege_escalation_sudo_buffer_overflow.toml,sha256=pjX7W3KL3ESCm9DBJMcGV4ekW2iVrMXQbzzG6gZKwVs,6845
nldcsc_elastic_rules/rules/_deprecated/threat_intel_filebeat7x.toml,sha256=PgkZ1AHtQPmjxdB3aoq29HBkSf9Z3hesx-_1S2ptQas,6963
nldcsc_elastic_rules/rules/_deprecated/threat_intel_filebeat8x.toml,sha256=P2To_aycPXS9uQVquiZWjQpl-XZGY4DUggWiyuwf3qQ,7564
nldcsc_elastic_rules/rules/_deprecated/threat_intel_fleet_integrations.toml,sha256=apK4wtHuBhL5vRGdIiG5rYIVKca4gYicu3yPdEA9HdU,7588
nldcsc_elastic_rules/rules/apm/apm_403_response_to_a_post.toml,sha256=lUqENVvLn-2nICbv98lVUHHxIaHV3tQjgOL_3-8qI4c,5389
nldcsc_elastic_rules/rules/apm/apm_405_response_method_not_allowed.toml,sha256=4lWDaAch8hIaT9DOzam98cx5Bhki0p956l2I9gTIGWk,5437
nldcsc_elastic_rules/rules/apm/apm_sqlmap_user_agent.toml,sha256=ve7rC9DCkXACIDut3VmwyKBcMFm3KHeupQSuVZZ_vfo,4988
nldcsc_elastic_rules/rules/cross-platform/command_and_control_common_llm_endpoint.toml,sha256=X4G-mfOUpv2jQf0FUEsEe-dNb_5h1gdEFkyFD2fFkxE,9414
nldcsc_elastic_rules/rules/cross-platform/command_and_control_curl_activity_auditd_llm_triage.toml,sha256=2icGlVC9JZvYdFDZLEzy7iWvwpn8Dm0cMsUwumQ9nCI,12365
nldcsc_elastic_rules/rules/cross-platform/command_and_control_curl_activity_llm_triage.toml,sha256=ekYn1r_4khbLW-JP-LN8lTlRA2co0dXTwEFMl1y_d1I,12408
nldcsc_elastic_rules/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml,sha256=RDhbw_HQ55pfAHXd_1ZoWAu6aGCE651iijoCu48gOfI,8813
nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml,sha256=BKVqtlMe7fcVr5PkpKteWdlYo6Oteg_hAWN2JZHgUXM,6397
nldcsc_elastic_rules/rules/cross-platform/command_and_control_genai_process_unusual_domain.toml,sha256=8CQPztn9FcbjJtL5Zxzs1Gn_QA7nlnzQNXMplba7gK8,7480
nldcsc_elastic_rules/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml,sha256=qeeWGd7LGqWyt6KU1CrH4mAwzvxdUGL94bleyvvLAKM,6768
nldcsc_elastic_rules/rules/cross-platform/command_and_control_kubectl_networking_modification.toml,sha256=ld7kPxNohHHd3ndxhQ4WSBUIF3NBrK7PD8a-AC3E0oU,8876
nldcsc_elastic_rules/rules/cross-platform/command_and_control_pan_elastic_defend_c2.toml,sha256=Er0ZMHjzcFCuFN-cL4zM9l3oa5DNYpUlqwqIk0YwRpk,3383
nldcsc_elastic_rules/rules/cross-platform/command_and_control_socks_fortigate_endpoint.toml,sha256=RvCW7g_FjbYRqna8l9UjQpgiJ0ZNrhRCjq5zT9EVvOs,3727
nldcsc_elastic_rules/rules/cross-platform/command_and_control_suricata_elastic_defend_c2.toml,sha256=QQ7of1Pc7v_3AZhO_PlmZ4wwkwbsp7rYk6vY_Lyn34Q,4265
nldcsc_elastic_rules/rules/cross-platform/command_and_control_tunnel_qemu.toml,sha256=AqtLStOGqglJTFi36Xl0_Rk5knMTwImkb_0TeZUztnI,5052
nldcsc_elastic_rules/rules/cross-platform/command_and_control_tunneling_via_tailscaled.toml,sha256=v4NgGxgpPemF7-DQ1-_Rrk9JVdCASoAFnpv_Ysg3p9E,6643
nldcsc_elastic_rules/rules/cross-platform/command_and_control_uncommon_dns_request_via_bun_or_nodejs.toml,sha256=JGoyAq7dypgRW6ArPHGa1LNH7CFnSSQZSuiPo8L7cGw,6682
nldcsc_elastic_rules/rules/cross-platform/command_and_control_wget_activity_auditd_llm_triage.toml,sha256=JbFoEfekzPEAngvYSSAwlCIsfksG5uhGFdqKu0BlFuY,12334
nldcsc_elastic_rules/rules/cross-platform/command_and_control_wget_activity_llm_triage.toml,sha256=4KGDiEKDg5CQYVVxxkYtK-p7GP8AMiRk2cVZHFya920,12381
nldcsc_elastic_rules/rules/cross-platform/credential_access_azure_wireserver_unusual_process_connection.toml,sha256=bXQenL0oCTPk6-08bhJi_s-tnZHlFVdWD-hAfUAkW6U,6849
nldcsc_elastic_rules/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml,sha256=75dymchyj4WHz22Gv3kDQWG6RqvpwRGa11T4BWMS3IY,7096
nldcsc_elastic_rules/rules/cross-platform/credential_access_forced_authentication_pipes.toml,sha256=ugym8D5Da7gmNMQC-E5VEZWNht9yHq7Z0hJKwjLkWdM,6688
nldcsc_elastic_rules/rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml,sha256=QyojoA3BxCNn9ycGBZcpxXK3aKqGMSkHXP1BwO_t-Pc,7533
nldcsc_elastic_rules/rules/cross-platform/credential_access_gitleaks_execution.toml,sha256=tTvijaLNKZy1SRwTUnaPxY5VVcWgsVBZMBYKEE2QuuY,7528
nldcsc_elastic_rules/rules/cross-platform/credential_access_grep_recursive_credential_discovery.toml,sha256=ckkA-BiXx2cxEVd0q6vVhd9-OV0hNnXomaNi8MaBxc0,5756
nldcsc_elastic_rules/rules/cross-platform/credential_access_multi_cloud_cli_token_harvesting.toml,sha256=09mYtD00C9xxtFLhyRv3SDh4DKQvedUcpvBe3ffLWOE,7221
nldcsc_elastic_rules/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml,sha256=fyxbKuQFiIBcHt4MxtnolR2eo5A-JbD1wNhrVQyjcJo,10385
nldcsc_elastic_rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_cli.toml,sha256=7Ilepfo9XH4sOHDoLxS03F9ZgBgaV2Ro7Qd7zO0l_00,8630
nldcsc_elastic_rules/rules/cross-platform/credential_access_suspicious_instance_metadata_service_api_request.toml,sha256=KlNv5tTx2IZQN9G0ROxVmf8Apy5kAk79_1Bz6usZIMI,9072
nldcsc_elastic_rules/rules/cross-platform/credential_access_trufflehog_execution.toml,sha256=tm15hoYsD69UwdRoQAp0zAGLsgTLCY61HqUwzNRJ__0,7514
nldcsc_elastic_rules/rules/cross-platform/credential_access_web_server_cloud_imds_ssrf_request.toml,sha256=GrGE883LfETDmihkldwHS06_0nZq7Wnsa54CxguVbUE,6819
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts.toml,sha256=8lIylS9eZyQoFPOkrcj1VWZrrvFftgrNVhNk5-2_a9U,6034
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_claude_cowork_vm_boot_image_tamper.toml,sha256=Cfvb-cbXDp8s6kicoHy3a2Gcn--w2NEp-GY349NlAEk,5920
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_data_encrypted_via_openssl.toml,sha256=3sRz-a_uZg9L0Vf5cf6ZqDXttrH5CtT_zEMEEIegjoA,7165
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml,sha256=gJeDBFKlcK-3w2hp-6pnWZdVWBtjABgZlUxoSF_jMv4,6027
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml,sha256=-NAhR3IdicHZVbBot86XbaPZx2kFTdPjhfeMBHSIBr8,7438
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml,sha256=HkrjB-77r98SF20qJsxBVWsvon8x1wxwZESpE4hGIWQ,9263
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_encoding_rot13_python_script.toml,sha256=TzMnyNDzzut6CRQuVJoh7SjCj_Io3NPbSIc50hYmXzI,6613
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_first_seen_network_flow_exporter_followed_by_suspicious_source_activity.toml,sha256=6lBY5S_tmPnErTCkp5aKe0BtFdPUHQ94vvFWt_5WkxY,9080
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_cli_unsafe_permission_bypass.toml,sha256=0vulbYU0yU4AvEuLeGMqv6vG7IoRsp-hYYzlnfEM64c,6243
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_config_modification.toml,sha256=Sa0IdMd8W7yF45s9X0_PAK2FATRU3EaLnuOuUfmqsec,7690
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml,sha256=2DEx8UoIwWq17XtpCiH6B6ZZ5CHVw7JLhvWheOFkJ5s,7036
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml,sha256=JIBZ9TPBdFwjAGsOVXMtgbbCV6j_Fpm0a8IBZPMUyl4,8468
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_long_base64_encoded_interpreter_command_line.toml,sha256=0Yr2RndoWF3AetDdkE_N73PwU8n0mCtqxpXNdiDMHvA,6161
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml,sha256=WfqT1VR8YKGD_9JDRCORXnix-TITQAOEUcMmfAeX5To,7182
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_missing_events_after_alert.toml,sha256=jGnIklIN8PO-ZqT2eB7AuVn2iDUG06HY1KDnN3X_HRQ,4119
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_http_downgrade_attack.toml,sha256=q1iHcOTdEi2fQu3UWdDLYC66qQ_yHShHqrm0gfqQL6Q,5986
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_kubectl_impersonation.toml,sha256=2AJ5J_irJc_MVk2OxOQVQkBHSvQr6yk0zWfpAyGW9bM,10493
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_potential_kubectl_masquerading.toml,sha256=W2vWreBzyFAFYH2HjmPA3qXAfdE4DIJuvQH37fc90G8,10841
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_processes_with_trailing_spaces.toml,sha256=KxFtuQXvNyeCmzcLdjfsJ5WVxmWV_AwvHLQNdcCy7E4,5692
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_timestomp_touch.toml,sha256=oZpPFRcKo5Nn77ovNn_-RZcWHoXLnPuiL775qDJhAd4,8289
nldcsc_elastic_rules/rules/cross-platform/defense_evasion_whitespace_padding_command_line.toml,sha256=ANvcR-DZ7MOZUh_E6claLJEMzU42_Pz2RLLjA8OhZas,6010
nldcsc_elastic_rules/rules/cross-platform/discovery_kubectl_permission_discovery.toml,sha256=Xvyo3BP3ZBGUqUhlVVpBh0pJtM8uuz2wNjEqmEgvZp4,8426
nldcsc_elastic_rules/rules/cross-platform/discovery_kubectl_secrets_all_namespaces.toml,sha256=NUXpiLvV7e8SOlabo04Pc5wF1uLj7ws8LGbIHDEic8Y,8418
nldcsc_elastic_rules/rules/cross-platform/discovery_security_software_grep.toml,sha256=wPLqyesa9L1zZXDntoAHzyR3ZYqBRX3bwKM31FTazes,6509
nldcsc_elastic_rules/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml,sha256=X6G0OcnF6NKvhtYEhczckP-FbPp9WdAQ_UTvSEIVTSc,6776
nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml,sha256=RRdcKE3KEhxgDFUeq0AdJueI7cxlvYSUXjYAk6vpZRs,11804
nldcsc_elastic_rules/rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml,sha256=jlWd6anXnMv6FPL8QU61OgNYP9ae2NXgBxGa47e0bBU,8281
nldcsc_elastic_rules/rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml,sha256=NlcCyCYKlXZgzv68WowmIpdbGrQMJTl6o5sBmh9STJY,12667
nldcsc_elastic_rules/rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml,sha256=Xgg2w47O4RlcGLeWaBTQrCaNsPIIAaVc0o4A7P1GnFE,10041
nldcsc_elastic_rules/rules/cross-platform/execution_aws_ssm_session_manager_child_process.toml,sha256=y315JndCZs7pMkYvb7EHqcsCAXVBTYNaQnT8oLr1O14,6618
nldcsc_elastic_rules/rules/cross-platform/execution_azure_run_command_script_child_process.toml,sha256=lDetUI2vJNGBCTb2FB7iTj_7SERj5eb-68ixE6DZfNE,4347
nldcsc_elastic_rules/rules/cross-platform/execution_azure_vm_run_command_powershell_unrestricted_script.toml,sha256=P3mAF2VlxCh3OI2gTVzCt0Kqj8Lin4GrQ0xraqoWAno,6071
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml,sha256=_wsm9ctADET4ImQxuCahkaaUj7H_dP4GoOhTIuQXNkM,8650
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml,sha256=YEYDikdupHvvBOrLp9YLXWQ2915JZJSYBxgIraBtltQ,9357
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml,sha256=98TG0oMlmZeMdIpU-FnJV_07Va_NtbAK8BFBVaQ23nA,10568
nldcsc_elastic_rules/rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml,sha256=FrLahOQQqYox7ersSVMEYgWoNkVU2onRu8sevACUXK4,8553
nldcsc_elastic_rules/rules/cross-platform/execution_git_exploit_cve_2025_48384.toml,sha256=J6Hh9BIDxT-Mepm6OKS9RqAS4VT6FFojhfQiAe6ARVs,7426
nldcsc_elastic_rules/rules/cross-platform/execution_kubernetes_direct_api_request_via_curl_or_wget.toml,sha256=SwKEs7k-pyXQ0KQ8u4EltyAHE_0iIIcX0rDvkol3MXM,10479
nldcsc_elastic_rules/rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml,sha256=x-f08OBt4H2yUM0M5TTvu-Qv3bjsfOPKYlDQxNlBzcY,6116
nldcsc_elastic_rules/rules/cross-platform/execution_openclaw_agent_child_process.toml,sha256=oLlSUVlqyjUPei1bYqJOfbQchJSfY52VoXe2RL6tkro,6447
nldcsc_elastic_rules/rules/cross-platform/execution_potential_widespread_malware_infection.toml,sha256=XQND6j-Zs14LOyvRAJnQjUWxtFfsahu6WhMSVReqANE,6169
nldcsc_elastic_rules/rules/cross-platform/execution_privileged_container_creation_with_host_reference.toml,sha256=krI-WZmt_A8dYeg-WrJgBjNIc_oi59r5yWQ-qIItNeQ,9458
nldcsc_elastic_rules/rules/cross-platform/execution_register_github_actions_runner.toml,sha256=wPmlEFr-gzaaU4n67wQH02DipsCRAku2yivvnRW6dWc,5164
nldcsc_elastic_rules/rules/cross-platform/execution_revershell_via_shell_cmd.toml,sha256=dFDIykJg0lJex4129mE-IkvOAX_gZAfFcfC9_7GVOIw,5540
nldcsc_elastic_rules/rules/cross-platform/execution_sap_netweaver_jsp_webshell.toml,sha256=vxf0-FlUJ5ucCdjMOfASEJpDLsTtxN93-drnbQYHkOo,4517
nldcsc_elastic_rules/rules/cross-platform/execution_sap_netweaver_webshell_exec.toml,sha256=6rpK0qHh7RZVKsMRR90DO01M4_tl5foG2DuUcPnZ-bo,5842
nldcsc_elastic_rules/rules/cross-platform/execution_suspicious_java_netcon_childproc.toml,sha256=BJUKdPJFUW_f2Vb5YuPC60XLwq5dvx4bPdihNZt6g_c,8044
nldcsc_elastic_rules/rules/cross-platform/execution_suspicious_process_execution_by_zoom.toml,sha256=zUAFPIne2kbZIgrAJvEpTJYoLFRV9_wnXTesZiymwN0,8655
nldcsc_elastic_rules/rules/cross-platform/execution_suspicious_python_command_execution.toml,sha256=FXjiipN6i1XRIeRfE64-hQ8qh0082DRVj9i2mDjOgRk,8191
nldcsc_elastic_rules/rules/cross-platform/execution_via_github_actions_runner.toml,sha256=XMlbGihqwy8LB2H3AjiPcWPiIFU8YwxMV64BjW7VVwA,10841
nldcsc_elastic_rules/rules/cross-platform/execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml,sha256=n0_IJhw0xPYU_Zp8bDdnu4lygby69frUgOxVIWCi7ac,10448
nldcsc_elastic_rules/rules/cross-platform/exfiltration_potential_curl_data_exfiltration.toml,sha256=mXs_r8Yp6h2FnKEXdkAZbK0OfsB_hTRxqoZ8umkFogQ,10749
nldcsc_elastic_rules/rules/cross-platform/guided_onboarding_sample_rule.toml,sha256=NtDSN0KFir6j5_so1YBsGVOnIz0eLkppIlQ8Hd_tRGs,4427
nldcsc_elastic_rules/rules/cross-platform/impact_alert_from_a_process_with_cpu_spike.toml,sha256=NeX8nZxbtB9_-nQ1r91Pt7VpHVdxVilYP4xy_8qL1YM,6863
nldcsc_elastic_rules/rules/cross-platform/impact_alerts_on_host_with_cpu_spike.toml,sha256=5znPSz_VMcZLFq3ZyB0-AksWa5GOAx1hQCryNBb9oss,6640
nldcsc_elastic_rules/rules/cross-platform/impact_hosts_file_modified.toml,sha256=jd0JmI7AkiXXFA-rMj1t7AgGPCv58ZYJ0FDEK2xPl3g,8176
nldcsc_elastic_rules/rules/cross-platform/impact_newly_observed_process_with_high_cpu.toml,sha256=U_7CjunFspKJ1hhEmAbCskEAqxsiRBKtWmqOzjW9884,6246
nldcsc_elastic_rules/rules/cross-platform/initial_access_azure_o365_with_network_alert.toml,sha256=9T7_bCk-d-WGBDT7KFFtmEwe5k7br6nSfq3gMpk_De4,6964
nldcsc_elastic_rules/rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml,sha256=gTruxwTumLXrTqLvN8VJaPJIfwjbwL7PBGVkZL93xNI,5717
nldcsc_elastic_rules/rules/cross-platform/initial_access_elastic_defend_alert_package_manager_ancestor.toml,sha256=xjLgbtKbKB4jC8ovONU6WTd42hyi4maYBl23-8eRrc0,5894
nldcsc_elastic_rules/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml,sha256=2Rr-iuspFog5Eq0Fr-wwHJJGRT40ksOQnBXC3nSvuoE,10954
nldcsc_elastic_rules/rules/cross-platform/initial_access_exfiltration_new_usb_device_mounted.toml,sha256=_atxJ04H-CB9WaczRN3EGkMyZI1JE28xzHw_Q1qUc6Q,6517
nldcsc_elastic_rules/rules/cross-platform/initial_access_file_upload_followed_by_get_request.toml,sha256=iLD5WwxPiJWlMyB3RAIzXBuuHryg2K6H54qJP8VdLMw,9422
nldcsc_elastic_rules/rules/cross-platform/initial_access_fortigate_ssl_vpn_login_followed_by_siem_alert.toml,sha256=mbB5_vgnc4Bjo5RgwoYWQ_CeTHjOZ1KUzvImxmlRKEg,3322
nldcsc_elastic_rules/rules/cross-platform/initial_access_ollama_api_external_access.toml,sha256=HCSRDcadyPeX6IVnqezsF0iKVHsJQ06EKAOeEn-b6MA,3835
nldcsc_elastic_rules/rules/cross-platform/initial_access_papercut_java_class_file.toml,sha256=k_pTQahbPRHVgFdqcVWVj3wV8oLB5OQrAt6j1Ra9vEE,5767
nldcsc_elastic_rules/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml,sha256=RniOGSSt3eEuJ0wPNVrlTUFhGkFsTUty-otufJ9NLNs,6150
nldcsc_elastic_rules/rules/cross-platform/lateral_movement_multi_alerts_new_srcip.toml,sha256=odGiTXMih3GrFaXuo-LPFg3JJLLBwDxbkCwXXdIWRFs,5234
nldcsc_elastic_rules/rules/cross-platform/lateral_movement_multi_alerts_new_userid.toml,sha256=bRRvxw1aM8yX2j9QsX6cERgeElTD5XGNnrVTK4cOOQI,4532
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_by_host_ip_and_source_ip.toml,sha256=FbmkCY4WXJSB8xU7ghS2E150cAvVRTxGMCF_be9-1U0,6488
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_edr_elastic_defend_by_host.toml,sha256=Ol-v1Z14cyshw4VwNKnoQsD8G8QZbSmxX0ceVtxnygE,6567
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_edr_elastic_same_process_tree.toml,sha256=96xfEV7LFtxfLsQs63mNHXgihOe8BO6Li1lRxuyhmtE,6198
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml,sha256=ZqEEhdfCVf-OGB6vBJYSIFGnVCVCm2TCUqursGnTJqg,7768
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_email_elastic_defend_correlation.toml,sha256=GNqf3BiuIQp62gBIn3P6O7agAX4CRsso8OqEKXsfGdg,4504
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_dstip.toml,sha256=3fhyIIyMcVBt7FR3AtTkb3IpQUr_kJQeD29_EEZvdOc,6086
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_srcip.toml,sha256=6e3bV8LvEMggaFfET6JzajC-DhTv96Q-99zdeuHkfQ4,6004
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_from_different_modules_by_user.toml,sha256=3yWqtZHx1Jj4eKJtET9Ban7o1liz-l2duAKX9B0xnlA,6856
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_involving_user.toml,sha256=2rWNZIAlL0riQYZEwnjFEV7Y6KZsDPt0zO31CAMMDDA,6652
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_attack_chain_triage_by_host.toml,sha256=NpXPpQZ0EvT-a3h31-rnrHAzODZByV01KXMreg_ky6s,10552
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml,sha256=FAQsMrDbg2FqHwy4QOW_tpVj9Q7uSZ0V6EWsv7yoGco,7509
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml,sha256=3kZuYtCzmLfXCne_BVBSl7Sko8MSyhqVin22W0L9LhQ,10347
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_risky_host_esql.toml,sha256=8r279dVXkkbJ_iV8dyDKspzY95SKHTKG9XKDmBoXfzk,7478
nldcsc_elastic_rules/rules/cross-platform/multiple_alerts_same_tactic_by_host.toml,sha256=DN5NdrNbCqOVOUCYYjTSxmocFK8GrQy80TYCzIWrMCU,6769
nldcsc_elastic_rules/rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml,sha256=_run0F9BMQ_21csISVwl4x7LH58UeWhH23yn_poPQG8,4973
nldcsc_elastic_rules/rules/cross-platform/multiple_external_edr_alerts_by_host.toml,sha256=wykdwC1SYi711azQx6UqCyzG9OZLDUmBMVrYBsLQXxk,6884
nldcsc_elastic_rules/rules/cross-platform/multiple_machine_learning_jobs_by_entity.toml,sha256=vUShRz4J3f7joPrAyd-kY8wnOLveHKH_Rh_ruJ04roA,5547
nldcsc_elastic_rules/rules/cross-platform/multiple_vulnerabilities_wiz_by_container.toml,sha256=_3CC3nS8SNZ9EdycJZBVKvCG2IKRjBJdT-QvFFtDCCg,5223
nldcsc_elastic_rules/rules/cross-platform/newly_observed_elastic_defend_alert.toml,sha256=HXRI9FwWQ5CNASNLmNdv9pXfX_wBUcjzYtipj4oRlXg,5229
nldcsc_elastic_rules/rules/cross-platform/newly_observed_elastic_detection_rule.toml,sha256=SodwJwaoAJbvzSxNpbNJwzRnr-REStcIOv9gXPR-QzE,4796
nldcsc_elastic_rules/rules/cross-platform/newly_observed_fortigate_alert.toml,sha256=BXqpe0x_31WHo8a_gdiQ-Hghupie7bk5WYxC-yvnQh4,4262
nldcsc_elastic_rules/rules/cross-platform/newly_observed_panos_alert.toml,sha256=RjFVX-dBji1MgBXSpsq1G31XRjmcArVe-GwD8OEyITk,3879
nldcsc_elastic_rules/rules/cross-platform/newly_observed_suricata_alert.toml,sha256=1CkzxEqxBJFeNZxPDKO8yDbQdCWfdRTN5Gq9uvRz7n8,3867
nldcsc_elastic_rules/rules/cross-platform/persistence_shell_profile_modification.toml,sha256=rjNEYK2xMydvns4ZPmFU0mfXrek1VmYyCxH-xScmLew,6430
nldcsc_elastic_rules/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml,sha256=kx9IrGwj7Jo3bvAW8Xkhs8YYplmfJs4ETgeYEms-KdI,7067
nldcsc_elastic_rules/rules/cross-platform/persistence_web_server_potential_command_injection.toml,sha256=nS-hGvYkgT5OBOY4lDOcedhGsDgYGxGLqcqOk4dpu3I,15392
nldcsc_elastic_rules/rules/cross-platform/persistence_web_server_potential_sql_injection.toml,sha256=JUbGsEjDF5p6Fs5G-63j6Uu2yr7YQsR7k7soQE1a48M,12426
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_echo_nopasswd_sudoers.toml,sha256=UFYeE2bQ6wI_nxwE84lnihIrQXes2VhDSyExG2tX9LM,6371
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_setuid_setgid_bit_set_via_chmod.toml,sha256=J-zzXcW3VxsF4yFDUKN0BWs9YfCRLHBvCox6TyuH10M,7363
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml,sha256=LJ0ncH_AY2GMh7G8DUPeABXxZRRyV_wTZMq2b-IDNto,6612
nldcsc_elastic_rules/rules/cross-platform/privilege_escalation_trap_execution.toml,sha256=Cb01bkID3xn6CP2XiZEjjweBZ6Zn1aSDv0jRq0Hlooo,6008
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml,sha256=lUuG3c7twsFmc7fo213u6MxUEBg2HqKHvXVEEm__bkg,7029
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml,sha256=WLOlBVd6c16lcJJgNO3sj2e8nh1AOThoKkcz55i4fwQ,6541
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml,sha256=Y5sh-aa5bQzI4up73rlEmSODQpqSXhfmi3zF0c59UsU,7198
nldcsc_elastic_rules/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml,sha256=BTyeizSJ22uzNH_wuJaZMF2_6dyK_XorWFWpUAqqEHk,9584
nldcsc_elastic_rules/rules/integrations/aws/NOTICE.txt,sha256=J_TLlzy-3FynutCsreov6dyNdxzN0cayBHv4dv9HzbU,1307
nldcsc_elastic_rules/rules/integrations/aws/collection_cloudtrail_logging_created.toml,sha256=hHE8HBHW1Xt7PYurJgeLwTFU7g9w8kRCI4Cf4402bbU,5549
nldcsc_elastic_rules/rules/integrations/aws/collection_s3_bucket_acl_public_access_new_identity.toml,sha256=YGeDiJ-8jr_eVvhnHLOt1nkJ4r2VI6iedlde5JyRRlQ,4805
nldcsc_elastic_rules/rules/integrations/aws/collection_s3_unauthenticated_bucket_access_by_rare_source.toml,sha256=rgEmS7QuatoII_S3sUgo_8RK_7qc56YL6IhXOMLukjk,8045
nldcsc_elastic_rules/rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml,sha256=wzYVGCv8Dh-UVS1VHsAeJdZthKWXketP-qiH3PPMSNM,6572
nldcsc_elastic_rules/rules/integrations/aws/credential_access_cognito_unauthenticated_identity_pool_credentials_issued.toml,sha256=ZqCGK_g0tt1Qa43KsvE8-SgB1OQ54WdJIkz1GXJqliM,8181
nldcsc_elastic_rules/rules/integrations/aws/credential_access_credentials_in_s3_bucket.toml,sha256=Ev0cTzURbzjks4HcWdqi6lOzJD5ZHOBZmoQ7XHwGyTw,6430
nldcsc_elastic_rules/rules/integrations/aws/credential_access_get_federation_token_followed_by_console_login_via_federation_exchange.toml,sha256=9AUZXVFMdpnIsIP9sEV43pE6lNsLSjRsohzt4aHpGDA,5216
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_compromisedkeyquarantine_policy_attached_to_user.toml,sha256=xxII-jcmEPUDVEv9OSOjox87OBx0D6pBRIqW_ejJ614,5460
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_long_term_access_key_correlated_with_elevated_detection_alerts.toml,sha256=04TKL548VMB4QWSnIq29qlgK_1_VGmZYlxnioZa1nqU,7472
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_long_term_access_key_first_seen_from_source_ip.toml,sha256=P73_hAw7bbeFLkjYL0jioJVPn7Epvd3wTPFdcKLgtAY,5641
nldcsc_elastic_rules/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml,sha256=dBFbpfapQeo_fcDhtQs0tk5uvB6nItU6Iol6o__4cvM,6099
nldcsc_elastic_rules/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml,sha256=kFZV4K-wCZN3SuPR5tGJd-M4WP_xELkBmwpBLCPBHZE,7966
nldcsc_elastic_rules/rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml,sha256=kzfjAtNUKTdAWuiSSE4xFqzv05H1Lbk2VORLT6Pe84Y,7458
nldcsc_elastic_rules/rules/integrations/aws/credential_access_retrieve_secure_string_parameters_via_ssm.toml,sha256=VSDjaYoUjzgUMmDhl7C9TKfHGiucRXXE4-bcaWY9iYw,7789
nldcsc_elastic_rules/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml,sha256=LSFJ1gFYA-dE_2oapakuPv39xcktfxoScXKlZkkStbU,8314
nldcsc_elastic_rules/rules/integrations/aws/credential_access_root_console_password_spraying.toml,sha256=h773y-XGJQlQFv2VBLFDD7Ie5JJPSimTJEIDYd7jBHM,7159
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_bedrock_automated_reasoning_safety_policy_tampering.toml,sha256=BW1-V81yZxlD65Slz4c03lkmuq6J1MKipFzL1AT_VOM,6377
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_bedrock_guardrail_deleted_or_weakened.toml,sha256=bhfxXKc0TpQoL21EwwTJ952-RrM1RL_I_EQSQV3V3PY,5634
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_bedrock_model_invocation_logging_disabled_or_modified.toml,sha256=3spropHpEDEa3Ok90tUI6zoBR2gZ7OFhm6RlGOu6h3A,6420
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml,sha256=SZMrLjao2H9VZmPyuFtcNGEpRVAnaOCf3073qYaRh3Y,4932
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_evasion.toml,sha256=l88RfoDK5t4MScICJjrITPpplPBCEPOK-p5baYeZFCE,7619
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml,sha256=LXQrDNiUSNoQXpeAE8khfiqnvGHcpfxUoOZ_hsZbXCY,4873
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudtrail_management_events_disabled_via_eventselectors.toml,sha256=Ek2ILEZ6tlGeIrA-wTHdn6yX2bR4DKbmqdVwTkazSLk,5801
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml,sha256=K7eh94XR5xiwGVSnPKAp2AdzFeQyKtFyCU2pJC06Y2I,8656
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml,sha256=PlX70Tp1erFTuitEs5Fpe_D97hirRU9J_i4zkhgENg0,7868
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml,sha256=evrnSyqgFE6L0lFLkyGlNM6-AbeVRd0oT7KqPGQ68mo,6730
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_detective_graph_deleted.toml,sha256=Ok7k7POHz-dT-1PUeh96C4c4s84Ny1f0b2rlmcNtuX8,4384
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml,sha256=-VUdKDqqLono-Yu38_bItW2DN4VI2ZhEK-WTHHJJyxU,6442
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_nacl_all_traffic_allowed_new_identity.toml,sha256=V1R-t0Zyn5jOZNP99m6H5COqsx9GckqoFIuqZJY47YU,5581
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml,sha256=_tEbDFL6XwFPZ9dmzGqFKrm3-sSd-cvnL4X0Y2bNaF8,6703
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_ec2_serial_console_access_enabled.toml,sha256=Wotr6yRWHWuYZlmk-i__a9Bm-B6KE39GAhiPxw3LkjA,7398
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_eks_control_plane_logging_disabled.toml,sha256=N-f8kFQLOZGXDeGIeVxIvKDv_wLxcGtDwCQtz_P3MlM,3795
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml,sha256=q5kPmOn_huYzkU4L2Ul_7mrAfhfRvC24nqOhS914Jns,7205
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_finding_suppression.toml,sha256=MkKB3KzNGDB4HAUSOZwhtCpG3PTQn-CwJFum9LHkt0A,6593
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_member_manipulation.toml,sha256=FrZjeiORftl8O30WXLDeULawfbRN2F9AOUv7RrGHnQ8,7722
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_publishing_destination_deleted.toml,sha256=zBbSUMTYRB-ZM_0dd4vw8qrGYYVp0Ak0yFZT6F_rchI,4655
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_guardduty_threat_intel_set_deleted.toml,sha256=vuq2Is1JgkorrXeJXbRCU5RmwM1vbfnmu1Zk_Ddeia4,4344
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_iam_account_password_policy_deleted.toml,sha256=_c-S0SQkCiRqYLEH0R0xrYFhb9YxMqrC04P7mc1KF34,5400
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_iam_managed_policy_deleted_unusual_identity.toml,sha256=qKnn8-L045VOMTMUi3xjHkn_QtBgTL1nnspFSR2WCBo,5809
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_organizations_leave_organization.toml,sha256=39DdD10ubj2xxUMYPwzOUceyxyhW_xyaH7pkbs81f-8,6316
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_rds_instance_restored.toml,sha256=rk0jQoiF5YkcmAqUgy9j7pgWxoeQXh2zXmliVbF9WrI,9575
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml,sha256=y2f3bhN9m3QVI5RCgnI6PZgER4d-4WofhQ-Hx5wttuY,7498
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml,sha256=lUTVarkoB4iPcbQOWcIAmOGvqDGxlZ-jqWTF8TiD75o,9311
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_lifecycle_expiration_added.toml,sha256=jOtciwNA2ctfmcHdG5SmePmsHWKsEN-HBamBtWhB_CM,9320
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_s3_bucket_server_access_logging_disabled.toml,sha256=D9J-jTL9dvQ1TJbQF7HiKdZtujac6XwN5GNM_E2Q0nU,7540
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_securityhub_disabled.toml,sha256=QAYbrtzqUt4PaYQsdiKCccPW8Vh_4R0k0onRwGzRxMM,5425
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_sqs_purge_queue.toml,sha256=2mjGfec_CkfAomOW8JCGXbLhjTuJFUjTAeSsLu9juS4,6371
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_sts_get_federation_token.toml,sha256=W2zL7Ur4LUdoczPT68CGofRw2Xna3Qx6Uyjz3fgMEgM,7181
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections.toml,sha256=MIZWTFB-ROtv8ZvB_XkzTiDPiUd_Qlxlen8Y4fcEnvI,6938
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml,sha256=3NkPOqONS9rXFbu2r9IuhBzqzdoOVeNkUSW3_9VkaFk,8740
nldcsc_elastic_rules/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml,sha256=juDkl4lAe-pIDI2SaPz4F4vIBFIgvoS61v_t_AMhJf0,7927
nldcsc_elastic_rules/rules/integrations/aws/discovery_backup_enumeration_via_long_term_access_key.toml,sha256=rhdk3kRQ1aLyTnUP2Kqkwk_m8LpUjNv2dEBPzF6t9bw,5002
nldcsc_elastic_rules/rules/integrations/aws/discovery_bedrock_model_recon_and_invocation_via_long_term_key.toml,sha256=0odWTtDKluJRLe6QQqojEwBgfjWUAG50wvzj_5Y0lN8,6664
nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_deprecated_ami_discovery.toml,sha256=XuTjz7SQ-l2zTb0UJMS_fJWFuLiy7fLkJCG9KyFrffQ,6268
nldcsc_elastic_rules/rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml,sha256=-rnURGqqbZVJTWjoKLOuuCBH7ic7De0K9v34aScRn4I,7304
nldcsc_elastic_rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy.toml,sha256=FEi_uGtoU3OVUadBZuzmuM2fVe7rgTFpvZvoee8laLI,8484
nldcsc_elastic_rules/rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml,sha256=n_qwcAQIzf4ZmZv-oRPa5ZN-C30YekdaJIijR9TZQlo,13099
nldcsc_elastic_rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity.toml,sha256=-EjQ8zXZz2zk6hdkcV6wIvc7_qe9zYtdYzv_EA6IVHo,7457
nldcsc_elastic_rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity_ec2_role_new_source_as.toml,sha256=MIix0zmGDp-RnI9F1BQdozV6Ec380q1zEZ4fnsgABqk,5695
nldcsc_elastic_rules/rules/integrations/aws/discovery_new_terms_vpn_asn_discovery_api_calls.toml,sha256=J5P4WHEFHbzvl-06v70HH-Nn2IXODUkqiuqyTklSHQY,9684
nldcsc_elastic_rules/rules/integrations/aws/discovery_organization_discovery_by_rare_user.toml,sha256=62bpnCPEWbVFOyyY0638V3-3m9LD1gdegou4lV-lJGk,5728
nldcsc_elastic_rules/rules/integrations/aws/discovery_s3_rapid_bucket_posture_api_calls.toml,sha256=HwKChzhNgearfsCAAxXMyJgGmoCZuofM4Xpqg7H60PM,10582
nldcsc_elastic_rules/rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml,sha256=9aL3rzF_3kfNTkLi_XgpW7KhJ--t1Xcr5HujWZ1iJ9E,9578
nldcsc_elastic_rules/rules/integrations/aws/discovery_ses_enumeration_via_long_term_access_key.toml,sha256=iCjcuemuli3MgQvYd1uQOh7V1INVFC4EDLXuRkeMUNY,4924
nldcsc_elastic_rules/rules/integrations/aws/discovery_ssm_inventory_reconnaissance.toml,sha256=EJVhIVoc-alP9q3snu-YbVjz6Z5vsgUU-dEno0nDuzk,7198
nldcsc_elastic_rules/rules/integrations/aws/execution_batch_job_submitted_container_override_unusual_identity.toml,sha256=6PljkpnOCPM-e9uMYi3p3B7iGsFVP1dh3sDOxKiTeKU,4999
nldcsc_elastic_rules/rules/integrations/aws/execution_cloudshell_environment_created.toml,sha256=yBmkBrXNFxAiT1JK74yRNhS3UDisuAPYo1TvgcSWq2Q,6543
nldcsc_elastic_rules/rules/integrations/aws/execution_ec2_stop_start_with_user_data_modification.toml,sha256=QQ5sgdnifYyRoBKoE-o0ihGFZkF6vhHIOxuHCuYlmDM,7788
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_external_layer_added_to_function.toml,sha256=uhove1pj4uyoCOORzz_CHp7zCUEux-DOlTU3-_MZVgw,6847
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_function_invoked_by_unusual_principal.toml,sha256=3farcAZ20ZMB1_BAI9PMhZU58-qfpOYy6XdSpUGXTpg,5965
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_function_invoked_cross_account.toml,sha256=Jees6Ts0OYEviBZz1Km0a3vYbbPvWYkN5ml1YcQiT1M,6065
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_function_invoked_from_unusual_source_asn.toml,sha256=DqqHLUtTlTit2uE1OWEO0fgLobBqvYlvZPsyC64UCxM,5816
nldcsc_elastic_rules/rules/integrations/aws/execution_lambda_layer_shared_externally.toml,sha256=-PEYPYrPJ2ZwWC--vNjv6UtWJFP4OKOpGgvu7ZRGb0U,5976
nldcsc_elastic_rules/rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml,sha256=qMsWqoJ-WRkam0XkDwlWXGbCqMU86sTauT9YW7ArB-A,6592
nldcsc_elastic_rules/rules/integrations/aws/execution_ssm_command_document_created_by_rare_user.toml,sha256=qpLv47mulB_C2ONPiPVUCjIdAGehqut1a7_e2yy3M3k,6372
nldcsc_elastic_rules/rules/integrations/aws/execution_ssm_sendcommand_by_rare_user.toml,sha256=IyvOtF6FAvWm_Xlwx69T1IYdZVmc9J4WcXJGBV98NeA,7682
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_bedrock_high_frequency_inference_api_probing.toml,sha256=Npn3to7BhxqW_cw2A5qLCzJsVbEVIJkWB1CuK3dQkF4,7109
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_dynamodb_scan_by_unusual_user.toml,sha256=fjfXBfXwqF5AgPCsgQDS1_GTs384fAWXOsLIi_J38fU,6870
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_dynamodb_table_exported_to_s3.toml,sha256=V6BEvGGT-9fLaCGt-x5yr3O37KQfBiA5veA8AhQWW-0,6579
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_ami_shared_with_separate_account.toml,sha256=yOje_aeAax1x5JFEpJzPDMp6hBT3uFPHhJmwh5IqMX8,6726
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_ebs_snapshot_shared_with_another_account.toml,sha256=XeJnxm7s2IN3E4qAesVThH2-91awJq_HXrk9nrIS6XU,9072
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_export_task.toml,sha256=FvoLzFbGq3ljwp5teCwlzQeVzdtN3lBCcK1jqYFkxc8,7329
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml,sha256=R2zMTw39Pw4cB6NJ-v7mndo7YdxkZGnHOQ3RX7DNtSE,8492
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_ecr_repository_policy_granted_public_access.toml,sha256=3mevqjuQSS2cLpHdLJdF_3lzoBwZkDxq22rDCwssj74,5590
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_export.toml,sha256=_vO9GwFNTxkdmUMBSc1KeRI1g6nPJBQbn1lxCW6vImk,8486
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account.toml,sha256=h00K1Gf5BI1f-9BBKTpXno9XZgHs7zGb4AzP_BwhWpo,8163
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access.toml,sha256=J8tZD86WVnKfBUC-jZZtPMCMc7D1aCPXij3fgwrTrIQ,10124
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_public_access.toml,sha256=gh9YHneWI-XIepqw5L05TfRagSQoHu7og8-dxn7bCzM,8833
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_bucket_replicated_to_external_account.toml,sha256=9YH2ByFu90k0gnTBY9YHszynlExYaMWuDaoVFD9MsZs,8600
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_s3_uncommon_client_user_agent.toml,sha256=6zAdMM9PtRfVy1BPhELoLMycu3tIUdkygPyOwEjro1c,7425
nldcsc_elastic_rules/rules/integrations/aws/exfiltration_sns_rare_protocol_subscription_by_user.toml,sha256=iebsmlnTp5ddIWLTurXG0AA-JqvKHcftajDAWxfQ5y4,7868
nldcsc_elastic_rules/rules/integrations/aws/impact_aws_account_closed.toml,sha256=5UEBjFTkG54YXwIexk4kYLrIpPAOc-LjF7yrjNy-uMA,5601
nldcsc_elastic_rules/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml,sha256=uYqfWtmV1H9IoXHGMNGuA3bfvzjMrlV4GtHsf7bpZSk,8173
nldcsc_elastic_rules/rules/integrations/aws/impact_aws_s3_bucket_enumeration_or_brute_force.toml,sha256=vft0u0EReFr92vWGCm3_LEtie-wt7z6PIlDl5jScGCI,8166
nldcsc_elastic_rules/rules/integrations/aws/impact_backup_recovery_point_deleted.toml,sha256=DbNFQtCWEM_xrN4gms762Yga18Wr1QeskLey57WJYQc,5511
nldcsc_elastic_rules/rules/integrations/aws/impact_backup_vault_deleted_or_lock_removed.toml,sha256=m6nmut6AFQM-yiKqKM0k4-fSqblQXeiucEah1aIaymg,6087
nldcsc_elastic_rules/rules/integrations/aws/impact_bedrock_api_key_destructive_action.toml,sha256=z3UPhz-E4WZfHjCFkmxeNMYzbWQx-9LH4Z6nxdAjgtI,6084
nldcsc_elastic_rules/rules/integrations/aws/impact_bedrock_knowledge_base_or_rag_data_source_poisoning.toml,sha256=gw35nQzYCr7aKtGZiJi_fCu2U2hsd6ZHmCQUhCiU6ZI,7415
nldcsc_elastic_rules/rules/integrations/aws/impact_bedrock_provisioned_model_throughput_tampering.toml,sha256=wZfBw8Tvij8rXrjPrQoNikpgS8uafDSq_WIeUpJUjbM,6913
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudtrail_logging_updated.toml,sha256=EDv2pkMgEycnhd7HlnjRW_fz5i1YHjM1BjeBgU1_VR0,5592
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml,sha256=loIaSn7JBKuVerWVFXCypdnfMCSSOrzCqXGtyMyqf8g,8335
nldcsc_elastic_rules/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml,sha256=2TkuGKWOgwWa0slp5yn270UVoxzpqmDAPj0eXpTgH7U,8126
nldcsc_elastic_rules/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml,sha256=qXVAsTcpQMtB9qc6u3H1HcmtIoZuAm8KESSO1Fwr_CA,9697
nldcsc_elastic_rules/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml,sha256=8DCIHfj2YubxrKWVFZJp_ArGHBPV2uraEhjDUyumBLc,9783
nldcsc_elastic_rules/rules/integrations/aws/impact_ecs_cryptomining_task_definition_deployment.toml,sha256=UO5DqZLYYAKtmy8E__FDls9FmqKE5R8nrjh1X1NPK-E,7523
nldcsc_elastic_rules/rules/integrations/aws/impact_efs_filesystem_deleted.toml,sha256=tYgMivdZ6xdK7UtOqWKTGVqc8FbtBxbufhUqY9wT84E,7957
nldcsc_elastic_rules/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml,sha256=F67gfhfSNb-V4x_WDOyI4JK9xMaH7trriJOaycYACyY,7952
nldcsc_elastic_rules/rules/integrations/aws/impact_iam_group_deletion.toml,sha256=qBGXHRHhp8PotUZAVVtAN0xtsEE7r8NYYbOcuBnEWZQ,5060
nldcsc_elastic_rules/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml,sha256=TTtoJ_i-I7V7LzZ92bc5QnPovPo_c8binBktraFnI1Y,8209
nldcsc_elastic_rules/rules/integrations/aws/impact_kms_imported_key_material_deleted.toml,sha256=TqS8NmndJ0T5eGSuZlvISfixZ5oJXPYBYZxaxCC3ESY,6705
nldcsc_elastic_rules/rules/integrations/aws/impact_lambda_function_deleted.toml,sha256=Akom8OLWV-Q_7NLZfbM2uBuflj_EBG96IrjD7lXbynw,5596
nldcsc_elastic_rules/rules/integrations/aws/impact_lambda_high_frequency_invocation.toml,sha256=B82TncvsaVWR2qpEHt4CAoomlWmIbVRsElBWYEnLgoc,5238
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml,sha256=Ihj5Vcf6eLUCNwo0tghKtztMeBcD642GJydU0j54TSI,7431
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_instance_cluster_deletion_protection_disabled.toml,sha256=xWRCTh0hnex4jAiJsnhJUKxuelrpM-BMiWHeA_O6-EU,7124
nldcsc_elastic_rules/rules/integrations/aws/impact_rds_snapshot_deleted.toml,sha256=PTBvn97oPzmOPi7j5Mx6xRj5N2XkX0N8Y4o81ne4QLo,9436
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_bucket_object_uploaded_with_ransom_keyword.toml,sha256=BZW8DN49FGpTnc6GVq8A7qGWAzsg1BZ0wfSWH1fZNUQ,10030
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_excessive_object_encryption_with_sse_c.toml,sha256=voFULUyfFDwEcPp03r-GsiGj96N_dhIn4YKaQd77780,6143
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_mfa_delete_disabled.toml,sha256=zDhP8z7gJfem5d2qy2wYrwEOr14QqKVrbT47I8JWrts,4777
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_object_encryption_with_external_key.toml,sha256=Dqm3x4nlP86skAqQIoe-jQtgr5iuiQQnS3unik1T69E,10634
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_object_versioning_disabled.toml,sha256=XvuJYakFh2V6uD54VPdU-2TS5mM1uKi-1-5vfpZCj2M,8421
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_static_site_js_file_uploaded.toml,sha256=8RO6Z0Z5chE0oWx_bFAtoGYgUe2hRktXfBQKmPBoOJc,6157
nldcsc_elastic_rules/rules/integrations/aws/impact_s3_unusual_object_encryption_with_sse_c.toml,sha256=Rnudrmy0oH8C0C39sJqh9B2rOR7h97-D7xjFE5CDX_M,6692
nldcsc_elastic_rules/rules/integrations/aws/initial_access_assume_role_with_web_identity_kubernetes_sa_from_external_asn.toml,sha256=TcsND19RWMRqDnXOU94HqE8uNu4xTbyBCc6fW6Zg0Z8,5502
nldcsc_elastic_rules/rules/integrations/aws/initial_access_aws_api_unusual_asn.toml,sha256=4CYcvjIMC8apEP6PdjDd940P5FTRpuMYtrzd8EqcBlU,7568
nldcsc_elastic_rules/rules/integrations/aws/initial_access_console_login_iam_user_multiple_geolocations.toml,sha256=JRmmyDWJKNGxst-cSwjBJYvunhy9p_A2Rh7b_GJcZ2U,6179
nldcsc_elastic_rules/rules/integrations/aws/initial_access_console_login_root.toml,sha256=dSOhJBxdRFUkoe5XVD4Vv2EzwFAk3qznCTkt551QcLc,7952
nldcsc_elastic_rules/rules/integrations/aws/initial_access_github_actions_oidc_credentials_used_from_suspicious_network.toml,sha256=KssnTS2pQYJxeQcMMGHw7-Xatje4LOWG25aG79YNeH8,6815
nldcsc_elastic_rules/rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml,sha256=7EyqObyrcdQblwWk9XJ73U9MTwzu2GmOO-4AA3ceulc,12779
nldcsc_elastic_rules/rules/integrations/aws/initial_access_iam_user_console_login_without_mfa.toml,sha256=E3OLStbn3nzZpd4Asdw-oADV8SgPh2mZnAm_O4X1Myo,5759
nldcsc_elastic_rules/rules/integrations/aws/initial_access_password_recovery.toml,sha256=XyXtd2h7Pe28UozzNvwrtWxZs0bJM2MODG-2efniaRk,7057
nldcsc_elastic_rules/rules/integrations/aws/initial_access_signin_console_login_federated_user.toml,sha256=aKskvDezZn6qeSC2t2chi4fuyLAFe65_DaP-K7qQPeU,6762
nldcsc_elastic_rules/rules/integrations/aws/initial_access_suspicious_user_agent_detected_in_cloudtrail.toml,sha256=4f3ddPyq1-5EQs7cndLoDA15kzkKEqz1XXyxjMfUFFg,8254
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_aws_ssm_start_session_to_ec2_instance.toml,sha256=nIH6dogeS9XaNhNZ3Ds36RZU35QLCFS5mlPt3YzvXWQ,5895
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_ec2_instance_connect_ssh_public_key_uploaded.toml,sha256=YczUtI7zDjTpVw6AkKSzAKdYP2JMfQC5z1Wde1piRaU,8590
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_ec2_instance_console_login.toml,sha256=-SnmhDli5Lvjs6nmEZJbApfbskxq7-JYhZtz7-0IrK0,10055
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_k8_assumed_web_identity_session_with_multi_phase_api_use.toml,sha256=loyiMr9Xd-__n7iy0PanZOEeDxUPbK4T5Ivauj0VOx8,9418
nldcsc_elastic_rules/rules/integrations/aws/lateral_movement_sns_topic_message_publish_by_rare_user.toml,sha256=PpvRuYsDvtPBWeIVz8gmfrfziqWIxBd-xy9P4ltM4Bk,8878
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml,sha256=owJxFqK6F6ZEWuVWwZVjxVAZgYCqBrvdmJIL9hTTSMQ,8325
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml,sha256=yF-PAS2wddTJGZ79Agq78ieCKpjSINct1cyOmLEfOhY,8970
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml,sha256=JBKOOWG-p3gepqT59T2OMIndZvGmGfOKiCaAzRLNkXY,8883
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml,sha256=S_s-Y4GpCavWOqebjXcAQG_HQouHqiuN9P6SGBamU8c,8476
nldcsc_elastic_rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml,sha256=YMYaaV1NSR-laACmg6OqoV8wzpeD5AoNarsr8s8lbQE,9884
nldcsc_elastic_rules/rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.toml,sha256=tbF4KJB592e9Yg9RP2ZITw4uCKU7iAtSHfdjoJ3NZK4,7929
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_agent_created.toml,sha256=-MeFDpXHRXYrbMzgpFWyQ_6w8CH1GvEks61BRYUnCHY,5304
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_agent_or_action_group_manipulation.toml,sha256=dqgUsS2P6tdWhXBA4LrL4azQLpbNp3rlilRF4RhujOg,7259
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_foundation_model_access_denied_attempt.toml,sha256=rIhvocUGUKLtdm-_lvRzhi9EVpPF-saQCk2eSdEhHXE,7226
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_foundation_model_access_enabled_or_entitlement_granted.toml,sha256=KOopUiJ_jWBzCBX82GVhGZy1B_GOD2xn6LVcoGMQwCk,7340
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_resource_based_policy_denied_attempt.toml,sha256=E-f_fv4jB1uTDRez6csLIPVE5OQpO58-QOvkLXDwUdU,6557
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_resource_based_policy_modified_or_deleted.toml,sha256=ArPr-ByJz8LUHG61ttD9Eqj8HBMLHiupEbVwR9VRyPk,5909
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_third_party_or_external_knowledge_base_associated_to_agent.toml,sha256=Ahaei7Cj5aqfIA7q1_d6aINTl9z0ogd7rF5iVOkOrdA,6228
nldcsc_elastic_rules/rules/integrations/aws/persistence_bedrock_untrusted_model_imported_or_marketplace_endpoint_registered.toml,sha256=9I8ioe2inJXmvY2g6OP9cLv77AeHz3r2FfS7G9WeN78,6636
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_network_acl_creation.toml,sha256=BYGKUcgX7djmCw1biWKDovmqXNULJzp2xxrWVt-arrQ,7534
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_route_table_modified_or_deleted.toml,sha256=GmAEQmujA2Q7EsekkbK-5xI-4H5JWwE3zDby6VPAzFg,8852
nldcsc_elastic_rules/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml,sha256=Ip5hl7EV5K1onr_espqXLLJURn_ff82iYAIjRxgE6Zs,8343
nldcsc_elastic_rules/rules/integrations/aws/persistence_eks_access_entry_granted_then_deleted.toml,sha256=XEVy78PC5TbZ8oBMqN1361yBbKG8p_520g5ZPu19DQY,6191
nldcsc_elastic_rules/rules/integrations/aws/persistence_eks_access_entry_modified.toml,sha256=1bOnoZnmEcTsXixkXhuPPhAX1bLLL0czn4mNrywttHs,4728
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_api_calls_via_user_session_token.toml,sha256=GWtdyGFDYVdDHJrmulXDm6bAw-aCcsMZpJbfIuetcu8,8564
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_create_login_profile_for_root.toml,sha256=VZyBXWvJOugkdgkKtVNspuGAdIQ7ZE87Jl442rJ34Qg,9711
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml,sha256=Gf8lbwbToy1U_BBt0Uw6HQ8_RF8VcejyJLYI78HaGrg,7159
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_group_creation.toml,sha256=JUh_HFuiebrpuavhcVu8PKfNvdvPpXIZ6vQ3mKxBsik,5726
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_login_profile_created_or_modified.toml,sha256=PjbSjxZeYL0lFQUh6zrd0v-1JQlchQX0rJmvoyqMRPE,6804
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_oidc_provider_created.toml,sha256=lt4i5blhAJVPkK7Fk6lwTLCU5IwHr58FlUizP3OqAFA,7630
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_roles_anywhere_profile_created.toml,sha256=shrtd6KF7SUk6RA593YhYeDDQhY11CRCGF3HPiMolME,8350
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml,sha256=zrQHfkrZMMlj3rHpaSRRqHEldzHr91rD2TMYZPu_hVY,8058
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_saml_provider_created.toml,sha256=WDErtdKx0pRAJG1SQbXJUevid5fg1JzXho-x73qi3YU,7220
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_ses_fullaccess_policy_attached_by_unusual_user.toml,sha256=uUH4Sxx3fTYmtvsN7ibSNizZwcV_d9H7dX2jegy83xU,6984
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user.toml,sha256=QSsSbWihmtPY5JN8c3OdNG70pcktmKft0WNcVhdeluo,10074
nldcsc_elastic_rules/rules/integrations/aws/persistence_iam_user_self_created_access_key_subsequently_used.toml,sha256=8iE65yZ2BZy3Kcsbajfzohx1IWH9CbqD8c8Y5VNs8U8,11147
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml,sha256=fKIMrYP9XDUOtMwMfZJ5sJjvyXZQNrK-Khmud8-a-Io,7695
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_cross_account_invocation_backdoor.toml,sha256=550CF53a7jxZHh9cqPDzaBziXQYBSN20fjam_skEyms,6462
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_event_source_mapping_created.toml,sha256=MwMb3FXmA_SlO0b7zBn9kth_vF1hsAHH5mtaG9N3GzM,6696
nldcsc_elastic_rules/rules/integrations/aws/persistence_lambda_function_url_public_access.toml,sha256=u4fG5xjwkEdxYcDoPUs-QVtlHRSQXuA7PtgJ6G45l-o,6346
nldcsc_elastic_rules/rules/integrations/aws/persistence_new_terms_ec2_create_keypair_unusual_source_as.toml,sha256=EY_-R3RyG0WNybui9I93vVOvgzIGp2IdLnlywsK4D5I,5623
nldcsc_elastic_rules/rules/integrations/aws/persistence_organizations_delegated_admin_registered.toml,sha256=EYoAIvkamUhsqIQYY-scBCShFYjYEac4X5CfuqxP38Y,5885
nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_db_instance_password_modified.toml,sha256=Z1F-jYdL0YT6A4aE3GhPE3Pp6o70QxMhZbw-9svoqdo,9074
nldcsc_elastic_rules/rules/integrations/aws/persistence_rds_instance_made_public.toml,sha256=M2Vfi1Xhu65nhXYbuqoOdChbb4H5BA66TtHx_uiqm6s,7860
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml,sha256=5nVIZKQHtJxSK7ErXBHpvjNMJ4QIiISk6F2eJpWNosU,7534
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml,sha256=Zv_MGMX7MAV6QJjknq0J4lQX5hpCKHhcBA145r3NQk8,8263
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml,sha256=8roWss_dhSIBuEI0Dwryn7amqJqODO-OLt88MRZPbR4,7674
nldcsc_elastic_rules/rules/integrations/aws/persistence_route_table_created.toml,sha256=D4FrXPPtPoF8avMheqdDgh7Z7TU4-Vl4XnvbWVbIqK4,6969
nldcsc_elastic_rules/rules/integrations/aws/persistence_sagemaker_lifecycle_config_suspicious_script_content.toml,sha256=W6y7wIby1vPMb7_2RkT1q2UUFgN-DxC5zuJE5qGPx6A,6481
nldcsc_elastic_rules/rules/integrations/aws/persistence_sensitive_operations_via_cloudshell.toml,sha256=V8IEoNq02ZYzwJlsm2TReSAq8Yq3u9ioa0kSN79CeOo,7659
nldcsc_elastic_rules/rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml,sha256=wjX8y8oOk1RY5DtZ53UYPPgf-RwDUGKEGNyXvpx_Roc,8383
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_bedrock_agentcore_execution_role_used_outside_runtime.toml,sha256=UzIVFVgQLRq7aos_D5ueOiKHmENxzIAI7IUXxX41rA4,7538
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_bedrock_agentcore_resource_created_with_role.toml,sha256=8wLawQxKHkczfwcOrz2G81WFmozfh_lKiyo1AxTQWzE,4986
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_bedrock_phantom_user_activity_outside_bedrock.toml,sha256=1FHuNHO28v9CCr5myQnNjDryNKorWmpVzw2mb4G0umI,5569
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_bedrock_phantom_user_credentials_added.toml,sha256=iFpjweeiqdDneWmSukhPgak7dWfDyNr062hC5BeaLdU,6523
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_ec2_instance_profile_associated_with_running_instance.toml,sha256=u7fitZScCR5wkfQ4kCLsEiHFYdK5FoH0d0VoPjXC07E,5012
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_eks_access_entry_granted_cluster_admin_policy.toml,sha256=ssrfbb-ZFbLFdRMvPn9f50N6K_ZOKzDAPfwyqI7c-qg,4967
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml,sha256=A5bNdol3ou7FvwxGA2r1bXSl5Y8Q9l8-sTiF6T7pn0c,7212
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml,sha256=6p8ijiHpw3cMnXmTjoybi-Q6BAh4ve1dBu4jeEEadD0,7143
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml,sha256=VhJz-xe4mvt5hdLZQQPx4VlyHN2dVm-aF-G-MzxxL-w,7882
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.toml,sha256=haU1GVw6ab1JYkYZ0hIwDXyqRuTxAAYgG0e1XcY2RT4,8453
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_version_created_or_set_default.toml,sha256=458FdV5ynoM_GKqAOjH36BzImAlXt7Co9XQXei54J0k,5131
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_inline_policy_added_to_group.toml,sha256=wlNT_nbVB7GJ3wAwYNkpsW1VLq6Krx2xmb126RqiWrg,6184
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_permissions_boundary_modified.toml,sha256=2JGT759BkVcIqvi0bHFcmlPIxWe8jZOm37Br0Guz3NI,6106
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_privilege_operations_via_lambda_execution_role.toml,sha256=DMfU3RwLmif1mFbasIEvqnFHiw-ejJEUD8MlfpzrZn8,6293
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_saml_provider_updated.toml,sha256=9a-B8KKLf0KUptNtj6DWb2Nn1JQDiV48hxRevdnYn7o,8319
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_iam_update_assume_role_policy.toml,sha256=ccLRSWwkM_VAnNEYc3tbu5Sx8GjKLwJY4xOG93SwfvM,8161
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_kms_key_policy_put.toml,sha256=uEYT5THJSdwJA0KhdvKS6K56xd7R4Id6PHJum1KdBHg,4666
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_role_assumption_by_service.toml,sha256=mjCQ7ueaGSMuFb9hPSHLTuToziD1A1plGuLri1T92rI,7950
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_role_assumption_by_user.toml,sha256=83-VOsZeBxabB2Jmj8par_d3vjA4CZagebRAFl_7gs4,7786
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sagemaker_execution_role_passed_by_unusual_principal.toml,sha256=6bzUtEzZ5lxANYomi5Mhv8sHOSqdjc9mwJctn0QhM8w,6811
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml,sha256=JnrD4oXhrwkvYU7jtAal3KGRfoPaW8-9-nabcb-2vtA,12871
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_get_federation_token_administrator_access.toml,sha256=_bMd--b-G7ZKAwBa23ACyhqh7WNCraPeOIOF6nohqRk,5438
nldcsc_elastic_rules/rules/integrations/aws/privilege_escalation_sts_role_chaining.toml,sha256=32t2PNSA3MsegOZWeU2vDF3u_TkfG1bDTSfVS-7-mrI,9287
nldcsc_elastic_rules/rules/integrations/aws/resource_development_service_quota_increase_by_rare_identity.toml,sha256=HqT0sy5DnNDe4CzNArNXZdnGHyri76PG1_jGxUuxoKM,4714
nldcsc_elastic_rules/rules/integrations/aws/resource_development_ses_account_sending_enabled.toml,sha256=LP0E3SJ0zvaGHwsKzXhyuQo6Raa4JnkgpJ4IgrN1FjM,5808
nldcsc_elastic_rules/rules/integrations/aws/resource_development_ses_identity_verified_then_deleted.toml,sha256=4Sbrh-DA89A0n7rfvJTqTNGFfhYyguOASdMgb8074Zo,6668
nldcsc_elastic_rules/rules/integrations/aws/resource_development_sns_topic_created_by_rare_user.toml,sha256=L2bbAaSIncA438soL5GAmoJtIpU7nEc0xxnhSKWC0JY,6555
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_execution_without_guardrails.toml,sha256=Lre_hBp4NE1moZ2M0D0oJNzTz4XGdU3o_q8NmtuT2vM,5095
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_by_single_user.toml,sha256=cF-KANy_qnJeDfMqHOnWYvYJ2QPhqTqGcBujVjyk16g,5105
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_in_single_request.toml,sha256=lv4flO1JXoH-AmqQL9dd141uK34Am_hzeh-8V1Wh_r0,5487
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_high_confidence_misconduct_blocks_detected.toml,sha256=cjerOwvflVHnwqXxUX3IcmVouqUrcmNbZpriN6otKkQ,5495
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_high_resource_consumption_detection.toml,sha256=Rr_ST0z_Jp_LP3Le2Zw4x9xEB7Qw8B6t0KnNFKTyoUU,5219
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_attempts_to_use_denied_models_by_user.toml,sha256=a-c3zwD38Y456UQnDuYWdym2h3Iuc66_oKV7X7as994,4814
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_sensitive_information_policy_blocks_detected.toml,sha256=Qfmm1F3ZViPZVE9-u5B8DZtUt7GjPCbW1N-5yBYHQbk,4929
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_topic_policy_blocks_detected.toml,sha256=BnYyoY5_8OUo7W-ojF-LpzCbmy4TdTAL-0Awuy7UhVA,4819
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_validation_exception_errors_by_single_user.toml,sha256=h4EVZBdKDriPxsK_wm-VtLq11Kp40FaGBY8OGopXwg0,5265
nldcsc_elastic_rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_word_policy_blocks_detected.toml,sha256=TxmgHpc7huR-QA8BDv6HblAug2eyP_raySh9xAyIYBE,4835
nldcsc_elastic_rules/rules/integrations/aws_bedrock/credential_access_aws_bedrock_credentials_in_model_prompt_or_completion.toml,sha256=zLTyNTRPm6T4M4lSIGXgP-b6u4d64G67bKETXeRXtVo,5387
nldcsc_elastic_rules/rules/integrations/aws_bedrock/execution_bedrock_high_risk_tool_invocation.toml,sha256=3mFJFZ3xcgD0_vSUIthnboYC3mXM8gdiIBelBuW0evU,6210
nldcsc_elastic_rules/rules/integrations/aws_bedrock_agentcore/credential_access_bedrock_agentcore_runtime_prompt_containing_credentials.toml,sha256=synwIHC31YFqu8954py3v0vg4nYuXSUb7RlXEuaXUbg,4986
nldcsc_elastic_rules/rules/integrations/aws_bedrock_agentcore/credential_access_bedrock_agentcore_runtime_prompt_credential_harvesting.toml,sha256=gTVzj_fbrQvJpkXFOQWtZhn1AweOp98FK_Y6-8g1OAA,7371
nldcsc_elastic_rules/rules/integrations/azure/collection_azure_storage_account_blob_public_access_enabled.toml,sha256=0rG8PQxawM3HSTXTXybUbRMQ35UC3Q2DW4BYwO2Snw0,6222
nldcsc_elastic_rules/rules/integrations/azure/collection_entra_id_sharepoint_access_from_unusual_application.toml,sha256=wxLV7p55vWY2n7IqgfxxHXf2mjpWosjg3Bk5GC8BzOU,9995
nldcsc_elastic_rules/rules/integrations/azure/collection_graph_email_access_by_unusual_public_client_via_graph.toml,sha256=JY96AjHciAw28zr6s-j1a8-RElqkK3dDOit8Gu5TXCM,7679
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_aks_coredns_configmap_modified.toml,sha256=KLLr-M52pbImAItcvUnJxef7fLYVMwdEu3tA0Z88I6U,7135
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_aks_csr_created_or_approved.toml,sha256=IVzGkvY2tJhHmdBnbeOvULZr3r1NDvn1v1X5j9yll5c,8108
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_aks_secret_access_suspicious_user_agent.toml,sha256=rG0lOTn820JIj0-fyGvsJxpqPISq2BTO6wIjYbEQ8NE,7593
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_aks_service_account_token_requested.toml,sha256=iMOecb5WpCuzvTXHMtvwmYIvLw4dPhuJSEYnArNuhcg,6850
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml,sha256=-D9ekEC8wknxUvUC4qcsgk1MvMfgvhw7aGuN2UL27e4,7895
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_service_principal_signin_then_arc_credential_listing.toml,sha256=c9JK-_JedL-Je1srsq4UBHSa41euUg9zkU5wB_XAluI,6649
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_storage_account_keys_accessed.toml,sha256=-9aqfjXaNpMWZ8yey0ZJfxgGWTUX-ECvT6KQ9hqZEjo,7397
nldcsc_elastic_rules/rules/integrations/azure/credential_access_azure_vm_boot_diagnostics_retrieved_unusual_principal.toml,sha256=aX39ziZuIBxV86dhbFeGgZ4ryg-0n_wJgjpYcr2dbLc,5209
nldcsc_elastic_rules/rules/integrations/azure/credential_access_device_code_signin_aad_graph_enum.toml,sha256=WTnu5rxi4znZ98izIR8EJtedQolBX9JnSEWp5x00p10,10147
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_brute_force_activity.toml,sha256=Ytv9hL8x7Cg5HeVjYutd8l6HFQfB-PFfr0zHIllGrIM,14371
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml,sha256=oDg5szUFE3skemeRiJhB4BkDv0E4oOCkoUoG642JMH4,9055
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_prt_cookie_replay_unusual_ip.toml,sha256=punXRDwb-mCdE9NEdCHo_6BccO4Z6C-gyQ1Bzyk8sUM,15009
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_prt_from_unusual_device_ip.toml,sha256=_vvQiL6t6OtqmF5-m6QUkb3jX6zGoVjpwVYAY3JB5_I,10328
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_ropc_unknown_client_id.toml,sha256=ZWpzE6OV2vgkgIqoQ7L_CR7k4ShlGFXMgelSdOFGLqw,8890
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_signin_brute_force_microsoft_365.toml,sha256=25jyfUIUj3RuzmPYzTsr1uz6MaWt60Ef-XM4fiOauHQ,14780
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_suspicious_signin.toml,sha256=dmRQHPGIa_T2EeLFvyU16-L6wk6wizGPe2Qi_D72GQc,8591
nldcsc_elastic_rules/rules/integrations/azure/credential_access_entra_id_totp_brute_force_attempts.toml,sha256=k-nylH5clWMB2flOSEZ70bOG4G52jZt3IT9bl5n1m48,10469
nldcsc_elastic_rules/rules/integrations/azure/credential_access_key_vault_excessive_retrieval.toml,sha256=fB2ymK2m-o7ttv-wNmavcKRV_TpFnNCvf7dEciTfEGw,11379
nldcsc_elastic_rules/rules/integrations/azure/credential_access_key_vault_retrieval_from_rare_identity.toml,sha256=w0MHv55PdwyrpPKQ1ZdmkeVfyIk83GQkAiiE0tms9QA,8598
nldcsc_elastic_rules/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected.toml,sha256=beor0jai-64zTGzb0UMSpdFTOW4Ym7dDa9KkUhDN3Qw,6431
nldcsc_elastic_rules/rules/integrations/azure/credential_access_storage_account_key_regenerated.toml,sha256=UOlJ0lsMBlprLtttzyjsI1d0YzidN982h-1lQE-FmZc,6816
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_automation_runbook_deleted.toml,sha256=9CJD62EKH8w6oRwwH6sA_vZ4NvaQuEjbnBCcgDM2lzk,5905
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_azure_aks_events_deleted.toml,sha256=-eTaUxql0KR_etRwyq2cCU-HPxS2bW1_cNO9laxL5EA,6336
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_entra_id_ca_mfa_bypass_first_party_graph.toml,sha256=lXcNxs90X1qRo3Haf8OcvkUhCGRldvW-aMgjhqKZo90,11426
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_entra_id_whfb_key_from_unregistered_device.toml,sha256=rsccaPAl9Q0kCqwRcy59EEwlAmU74yZVpggUblS3Yoc,6637
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_event_hub_deletion.toml,sha256=hWfonlg-k7v2NOXaAUrtjj_dtaOMLcqTOPFrRD0OtSw,6812
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_insights_diagnostic_settings_deletion.toml,sha256=DcLrjMlVDAe9Up1wcy-IGFINm_zlQ7u4ANULP0BzhZE,7057
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml,sha256=7DlnQ0fd5gIDE9LKzB1xXHk_q2FhxY4G2hKJ3amH6DY,6640
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_firewall_policy_deletion.toml,sha256=qZvmxdi22hkyCQogknX1tx7FE54Cn1tiOQyOeegvO9w,6410
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_frontdoor_firewall_policy_deletion.toml,sha256=FMx64Qjd9kn8D96MfmwgvLagpmwL9GvbTz9_sNoWS24,6140
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_network_watcher_deletion.toml,sha256=tkEIZpRnzdpvn8xMfxgVss4Fyob6Z-cnFpc009cFuEU,6285
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_security_alert_suppression_rule_created.toml,sha256=a-TLE1fGWT8znVtkPOXQrGXN2G0T3woB1kNjqLZUeoU,6845
nldcsc_elastic_rules/rules/integrations/azure/defense_evasion_storage_blob_permissions_modified.toml,sha256=WIKmM08udLKSjAynLnxq9aEytDEXXp7-zLIByRYuhf0,6391
nldcsc_elastic_rules/rules/integrations/azure/discovery_aad_graph_high_4xx_ratio_by_user.toml,sha256=43jCWAvc7z8I5I9DiVgWEtkwRO0gYtH5nvnp3bme7Ps,6184
nldcsc_elastic_rules/rules/integrations/azure/discovery_aad_graph_roadrecon_aiohttp_enumeration.toml,sha256=UkiL8kNiqRLpiXLQhPHtbIWsOVNrLq4GiK3RJ8Hu4xE,10423
nldcsc_elastic_rules/rules/integrations/azure/discovery_aad_graph_suspicious_user_agent.toml,sha256=ovrtMA7ecj6OuQzpPW1uDJbjyZBoNM_XkXlWzGNt1HM,7667
nldcsc_elastic_rules/rules/integrations/azure/discovery_aad_graph_unusual_client_for_user.toml,sha256=Mf0IGSEFdFcezib3CNWknyJDfcdiONcFKUBTpDXHgZQ,7078
nldcsc_elastic_rules/rules/integrations/azure/discovery_azure_aks_api_request_failure_burst.toml,sha256=FbKwPYzfLgXtp4iBQlMOklgoavg-lMixvJKE-xV5IeY,7604
nldcsc_elastic_rules/rules/integrations/azure/discovery_azure_aks_suspicious_self_subject_review.toml,sha256=PnTWAvEpwR5OHYwNfd_JPDWWzqifwRuFzkXwKmGhuGk,7630
nldcsc_elastic_rules/rules/integrations/azure/discovery_azure_storage_anonymous_blob_access_unusual_resource.toml,sha256=6Ms0Gp0QHSDkMz6N_O8alsd0xpm3pdwzHJmAlzBgA_U,5049
nldcsc_elastic_rules/rules/integrations/azure/discovery_bloodhound_user_agents_detected.toml,sha256=wkuCEeFuLc3sq1fmuN8rAH8Aov0alM-oC5fCJ1R7P44,7578
nldcsc_elastic_rules/rules/integrations/azure/discovery_entra_id_teamfiltration_user_agents_detected.toml,sha256=Rdrs5arZTd5eFmDUyDvWJLNNWi766C3AFNCRMF-rX1I,8084
nldcsc_elastic_rules/rules/integrations/azure/discovery_graph_activity_delegated_user_multi_category_recon.toml,sha256=6KqGcRig-ydfu76dCc2UFNXrDVb9n1t_igxTgiXVOVQ,6920
nldcsc_elastic_rules/rules/integrations/azure/discovery_storage_blob_container_access_modification.toml,sha256=yp1Ke_Qi-M_L1uJWyoYGjstOSfsJfT7W1EuwuhrGS6M,6722
nldcsc_elastic_rules/rules/integrations/azure/execution_automation_runbook_created_or_modified.toml,sha256=RM-ar6oriK_ZGdDog08SrUgWaaHijSyFVPP0pSm6CFI,6774
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_aks_ephemeral_container_added.toml,sha256=fSbsv6GOPt7bXR7T4LjFPvOAUYlddj66nUlpnnGWsgE,7065
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_aks_kubelet_proxy_command_endpoint.toml,sha256=NHa4HVYsbul_zPBMkUnUrvt7zCCWIcsmUOld_Q6oQYA,6431
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_aks_pod_exec_potential_reverse_shell.toml,sha256=qR8XsA1wVoiLsfOk9DFHX1lY2-Lje78Fj2g8AZUcJ8w,9259
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_aks_user_exec_into_pod.toml,sha256=5purVJyETAkxxbSXG8h4TxfFXngKUxl_gPkeTT5RUaE,5305
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_vm_extension_crud_unusual_source.toml,sha256=LcUDaiE8qMQHwJJI1WG_GC_RcRwY4kFDrvGZ3cONzlM,7293
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_vm_extension_unusual_for_host.toml,sha256=ZnynVfLWE2-qu4bfpRBXfgVRotBGdbFxK39_4KK92Nw,8669
nldcsc_elastic_rules/rules/integrations/azure/execution_azure_vm_managed_run_command_unusual_identity.toml,sha256=LhvGvNqSulKbJOSTQm4hkQUDFBh2SWW9xauPjfSuknk,6078
nldcsc_elastic_rules/rules/integrations/azure/execution_compute_vm_command_executed.toml,sha256=29SGS0nae_7MagdbFrgAUPb-e-jz2WrMJWaXIQO3bcc,7301
nldcsc_elastic_rules/rules/integrations/azure/exfiltration_azure_storage_blob_download_azcopy_sas_token.toml,sha256=TBNA-D8tv9m4FYYLrDJVlABRGW73WDV1isxwh4h4zug,7767
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_restore_point_collection_deleted.toml,sha256=Zn_F-1TM4mzqE6rr-Stpa_u987RDtgSUgjMnuYYIewQ,6274
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_restore_point_collections_deleted.toml,sha256=3ZZT0k6Doh-hbjRAQ4-nDoipBg0VB9FUQFlcFjCI8Sc,8045
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletion.toml,sha256=kVauo51dVa8os7jDsqzYobJUQtfCxSmPdQoSN6BjOPs,7511
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletions.toml,sha256=pl0Z-GiN8jucYOMiMQdG3xQqGhVwV5uyj6b0KxI5J6s,8534
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_storage_account_deletion.toml,sha256=1bUc2FDrvvEHPUksbKd3r-YOTM01HbHF_x473A7D2i4,6294
nldcsc_elastic_rules/rules/integrations/azure/impact_azure_storage_account_deletion_multiple.toml,sha256=kaaYLZ7J4n0MiofwbXWGLvamDB6pXfZZ8iSP9Pcwuao,7168
nldcsc_elastic_rules/rules/integrations/azure/impact_key_vault_modified_by_unusual_user.toml,sha256=mzNjZA1J6w9B28xMtPpsfXClQSrNBrlIQ6p3yhDZjZU,6383
nldcsc_elastic_rules/rules/integrations/azure/impact_kubernetes_pod_deleted.toml,sha256=k_khtMJzdQJhzBbQOigNA6njLP8YlTkdR3zk2SVFnKk,6209
nldcsc_elastic_rules/rules/integrations/azure/impact_resources_resource_group_deletion.toml,sha256=khyo7XlAV6OVjU0VKPABE2wIT3S50SbxRIyGDjXPXHI,7283
nldcsc_elastic_rules/rules/integrations/azure/initial_access_aad_graph_unusual_asn.toml,sha256=n2Gpa67FkHMtjCfA_A--_wiGTINrydXPzFJw0-R_5ss,6171
nldcsc_elastic_rules/rules/integrations/azure/initial_access_azure_arc_cluster_credential_access_unusual_source.toml,sha256=9FJlOLRG-kls5vAtVPHbWP5hLzQ82GKFJWb78gyFQP0,6173
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml,sha256=sPtF842wRbxDw-donzC6oFN7hQCwa-SUmSHxH0Tx32M,6754
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_device_code_auth_with_broker_client.toml,sha256=aPs-rt_3dPmovteAwoLLYLQ5hyXbdbVVP4GdoH5Rmhc,8039
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_external_guest_user_invite.toml,sha256=m7bEB8kjqsQ6l83ju_fZkrnh3PoGnbuIABGGdFzPK5E,6857
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_federated_login_by_unusual_client.toml,sha256=v2UR9IrnMQPsteLbNQakZs7QSXg0T2L75FY_amw5LPg,8108
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_first_time_seen_device_code_auth.toml,sha256=7tgmQP7Xp1KiZ2qXeoN4zhY8lNsxJkL8FvNtZSygQXA,7888
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_graph_single_session_from_multiple_addresses.toml,sha256=7Oh6A9ehlvX_fl3NJsBwAdgID9JzB1DOC2WRWODvRe4,13121
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_high_risk_signin.toml,sha256=UC9H5n6eiblba4USArpZwh-zTCzfmBSC_K_97CPHQNk,5570
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml,sha256=wtR_59uOZgIppQOm35IGkZTk9nPaVgWQCqOe3-yi5i4,9981
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_kali365_user_agent.toml,sha256=2RwxBvQmQOAEZVnpiRekGE7FbKTw26UruSTPbjHHP1Y,7845
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_microsoft_auth_broker_nonstandard_user_agent.toml,sha256=23qHOl4hHQ4GF5w7rKsgseygFRXtUZIKsa-QmXeOPyE,6048
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_microsoft_auth_broker_unusual_resource.toml,sha256=4kSowtTJhrPZH5j5RKM-vVbrxS-ZHV5mFmDqMSeJpvU,5650
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_auth_code_grant_unusual_app_resource_user.toml,sha256=2ehIs5EmX1MsexFtNPCQjdQN2SEyQMVXpuV7lgw330A,10162
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_device_code_phishing_tycoon_aitm.toml,sha256=RKyXh2TtQppNO4CTqFO_w3DSaK8Ts0ZGPx7Pm8UlHRA,5406
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_phishing_via_first_party_microsoft_application.toml,sha256=3zaDvnLTzkk2SrZcwrVUCVChdYclPPaetb-iyQvIvP8,9491
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_oauth_user_impersonation_scope.toml,sha256=gzuWrm2_5RAR3x1flr9mMAFCwBPhhlQIkVapdPkEcNA,11769
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_powershell_signin.toml,sha256=MTRqy8wCipOjs1gzdZg2bEI6KlACt8sPG5_z4tFbwp4,6158
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_alerts_for_user.toml,sha256=ID1auHdoeOtSGg3lfc0eqLba5EB-qkIzozVA-wYNguo,6379
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_confirmed_compromise.toml,sha256=JndGKSdxWEnEX0XTi98_LjqFtL-FYhgIhs0ZBXPsda8,8280
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_sign_in_risk_detected.toml,sha256=jJKOL8IErThCBqsDhfODbcUOWzkoJwlaRokIrC8c9hQ,9006
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_protection_user_risk_detected.toml,sha256=ImZoelqpxajwYsp2MSzaWzB0C0O70q2C0u64SniRZUo,8760
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth.toml,sha256=dzov8S5BnNfQrNjXKSHjCJembe_VoYOmmr8okLQIdrE,15413
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_rare_authentication_requirement_for_principal_user.toml,sha256=UjUXDxa9uM0PyOG0pCnj-r3w5I99yBXGFNpr98duCbg,7382
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_risky_user_or_compromised_sign_in.toml,sha256=WMVtM4uffVddKQ9Q2he-DqhytNc83LbBpW8JrVMhDuk,5339
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_service_principal_signin_unusual_source_asn.toml,sha256=cFDHUFubyuZdYX-DROL1Ob0c6kd0t-BFCZSMN2zNSZg,8273
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_signin_impossible_travel.toml,sha256=CV79u8JtGNYj-ci3rjzwndx1aIEUYWulv2knyR6Auuc,15740
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs.toml,sha256=WD8YN7bq1k7tbcgfEowY_lfTPJbwxtEmaFZKQhej0gw,13860
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_temporary_access_pass_created.toml,sha256=QCAuKEE5wCT6UiF4SV6c2lkOTZ6tL1OZCXt_lX5NoTM,5148
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_unusual_legacy_auth_client_signin.toml,sha256=6eHNYOLWwFrgsUusRMiE21mgzLDDJ1BOeJj6TeIk0n0,7229
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_unusual_ropc_login_attempt.toml,sha256=Jj32WZUFFLZbbkNC1t_apzBSCxe09aYykRNog-S55CI,7243
nldcsc_elastic_rules/rules/integrations/azure/initial_access_entra_id_user_reported_risk.toml,sha256=1Yc-XICkohRjnyP7wjiLsxQPbFVgGji4UzR242GgAIE,5265
nldcsc_elastic_rules/rules/integrations/azure/initial_access_graph_first_occurrence_of_client_request.toml,sha256=RsZ7-jB8BW7CCqE6C_BRzORWRcK8s22QPk_tdjqAxLg,7636
nldcsc_elastic_rules/rules/integrations/azure/initial_access_tycoon_entra_id.toml,sha256=CNN6Ck_k0s_v3Fzg_h-B01JjsSfJY3FO5FhucT_Avlw,4756
nldcsc_elastic_rules/rules/integrations/azure/lateral_movement_azure_aks_api_server_proxy_to_kubelet.toml,sha256=vjfuHeNQQnIJpazcxtgroj7lyDtoisfVZyIH6yAfuNQ,6783
nldcsc_elastic_rules/rules/integrations/azure/lateral_movement_azure_vm_serial_console_connect.toml,sha256=I6kjC1m2UqMlmbHJ1CM1f8LvuOJIHCVvnnO2UKlDaio,6685
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_event_failures.toml,sha256=EURY1fcUugoFuVPCbq8p6AhsIRuw_7XkIp_wk-gEk7A,7755
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_event_failures.toml,sha256=zlqEo36pHCiyXaamPKtGgfBQGNDkOUVCaL0hq07xi_Q,7983
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_city.toml,sha256=xdYzwrWdjoLxDaOvnnZJ8hARxmp9B1yWW2EDy9pZlrc,7918
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_country.toml,sha256=NTlvmpMcfp1_RG8mGRSp3WALmXILBBJTywIQTz1nuAE,7505
nldcsc_elastic_rules/rules/integrations/azure/ml_azure_rare_method_by_user.toml,sha256=c0zE8b-sUN_I8jN5OuUbP3cKeHqbCgV9-3LxQIxbmWU,8581
nldcsc_elastic_rules/rules/integrations/azure/persistence_automation_account_created.toml,sha256=3B185wAIKrV8iZC4Y4-UH_pjpxw2A68j7aH8sZFKVe8,6244
nldcsc_elastic_rules/rules/integrations/azure/persistence_automation_webhook_created.toml,sha256=HfVQdGOfzPgd4Y7Bd6xRhl4LGrp7AviHaF_jvErNQFo,6086
nldcsc_elastic_rules/rules/integrations/azure/persistence_azure_vm_extension_deployment_by_interactive_user.toml,sha256=Xatzl6IixLDm7iMrE3VLcyGgQGOrX8PTYVQFoUEtrw0,5357
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_application_credential_modification.toml,sha256=cHhA61M4V7e3k2_NR3KqIM7tp6uSZVjSs_IT0E3b9e4,7028
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_conditional_access_policy_modified.toml,sha256=KWTNgN1ba9_C567_PwqAfE51IGrnqQ5iO4y5D0aCdOU,5773
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_device_registration_to_prt_chain.toml,sha256=4r_7tU6gYwzi7yK1k9yWHctMrm3uUAQFFX9Hrk9UKF4,10692
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_global_administrator_role_assigned.toml,sha256=Pi7IoRLmUrNFEXai_WmeW27fS_2rKO5Aqq1YJQxmla8,7137
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_guest_account_promoted_to_member.toml,sha256=lk_5H49uZfY6GjIWfKeo_kej_VS6GtTsjnmVps_xbpY,3802
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user.toml,sha256=HxklrvRhccaVr2azxytLafarenO-9-bqZAE1od79GVM,6579
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_microsoft_auth_broker_drs_signin_from_suspicious_asn.toml,sha256=PLfzR8VgnPcXYCtWKHp5ZhU1iYlP9S3FKiolViR0gRs,6230
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_multiple_device_registrations.toml,sha256=Lg7cVJoqvVbFXU5a22V1QR7GDR8ZAJe3yu_g8LazzBM,10723
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_oauth_app_redirect_uri_modified.toml,sha256=K8ihPBcEmFjYLNbH089NxJT61gkuZNUnSBhfr820_WQ,4620
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_phishing_kit_default_os_build_device_registration.toml,sha256=y1bor6Wyt-n3ETKrQhhG1ZYaPscDSBP5vPs9SrVw5yA,7874
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_pim_user_added_global_admin.toml,sha256=RWP3bzCiMQoaqauvujc993dWSsnOKRUPYMGWdhYQRx8,7060
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_privileged_identity_management_role_modified.toml,sha256=foszRiSDTcYqkcd1ayMK3AKaUQdxBib4DDHq689ousY,6317
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_register_device_unusual_user_agent.toml,sha256=1JbVJpBxNndzSSjeDHs5LxoUMhkqLLDdmZ5O5Y04r7g,4247
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_roadtools_default_device_registration.toml,sha256=85UDJO1ERenIWaJuJPdHCZWDT578A9TxsLJVklJVhB8,7040
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_rt_to_prt_transition_from_user_device.toml,sha256=lbNc344gF3ap6xE8Mm6XWHRaWGSD8XbW39Q_ExQ7oaA,7682
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_created.toml,sha256=plKcsilesSC9-wJlx7mxdYor14em3ahRtFkVxTJFSL8,6477
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_credentials_added.toml,sha256=DiEVz0xGsEP1KgmFPFXEZe_u5RPL-5ojzxyfTYp2pDc,6553
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_service_principal_federated_issuer_modified.toml,sha256=g_4vAPj_awjYklGRAHmSR4yOuabqzQ2M-OdrLPTDjHY,6850
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_suspicious_adrs_token_request.toml,sha256=5lletFEskGZH2uSzzgQTJgzlTf4NmLJDRdq2U5WO218,6599
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_suspicious_cloud_device_registration.toml,sha256=mGwOKa4hbOmpyAB8Q3EA-aI7Bdwuov1q7TePFd9blN4,7162
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_application.toml,sha256=EW94PFrTHEjEYppFLIXeXI-ECOFavKaU3cwFiWrTIxc,6084
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_service_principal.toml,sha256=eYxGO_rQ-P_B6OLlGL53t9AYU0i3n1cnPeedunBoAz8,6291
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_user_signed_in_from_unusual_device.toml,sha256=UmV1XrRfD-poR3zuk4o9FBNOdnFa4OyZB8IVj2TUxGY,8281
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_whfb_credential_registration.toml,sha256=-smqNt1sTIFZsK47I1C3kkHSJTi5Awi3K-LZXok8At4,5084
nldcsc_elastic_rules/rules/integrations/azure/persistence_entra_id_whfb_deviceless_signin_to_device_registration.toml,sha256=y5Bj8rRE-fKSy4MvLvP-9VDyhTSA1je67hbelpJajNA,10467
nldcsc_elastic_rules/rules/integrations/azure/persistence_event_hub_created_or_updated.toml,sha256=gS8h0qrWcX9VFzA8EFsxHW2ozijH5N18oqqsu4Hk96c,7042
nldcsc_elastic_rules/rules/integrations/azure/persistence_graph_eam_addition_or_modification.toml,sha256=wHm3ui202EPDudgRsJZO3FFsiMCEvD1WQ5H-dw04cp0,5940
nldcsc_elastic_rules/rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml,sha256=qNBo8y7GACK8qtu6BJvq898T9RKJIMT8OcI5S_Fx-U8,6242
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_azure_rbac_administrator_roles_assigned.toml,sha256=bJl9tM4O2u92T4y06BIubRP9CSKWGrjCDnxwy2NvDiY,7320
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_entra_id_elevate_to_user_administrator_access.toml,sha256=Flyk6Q97ybstLaX5CxI-dmMmJnrrgnWTiunIpX1K7fE,5984
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_entra_id_tenant_domain_federation_via_audit_logs.toml,sha256=m6QXXgH_hGFrXGRC6kQ8YyCyx7VyqKcIIcEfBodwsmM,7882
nldcsc_elastic_rules/rules/integrations/azure/privilege_escalation_kubernetes_aks_rolebinding_created.toml,sha256=fVo2w9OkNfVWO2LiaiJEqohAIz7aelbpHTkOg1CMj9E,7419
nldcsc_elastic_rules/rules/integrations/azure/resource_development_entra_id_custom_domain_added_and_verified.toml,sha256=Hl4IJrkQMkQUW0kzSfbicm-6bmItR-ZDEw89xIdYhAw,5894
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_denial_of_ml_service_detection.toml,sha256=lTX7lbaj8LhEjmsTkjsxA3haE7Nk6LqLaXUPQDGfwQI,6255
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_insecure_output_handling_detection.toml,sha256=oAIDdWWsDieoJsIsWpWXAFR4m0_yW7hvWICF4NF5L8Y,6049
nldcsc_elastic_rules/rules/integrations/azure_openai/azure_openai_model_theft_detection.toml,sha256=S0SUzKXKbUJ3E9jSSrSQwAIXx4EOoR-JfjNQrITd_4g,6039
nldcsc_elastic_rules/rules/integrations/beaconing/command_and_control_beaconing.toml,sha256=iK6RJFeICexTSxYKuO5E4wZPdvvhPvVm7o8O8-nlbUk,7905
nldcsc_elastic_rules/rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml,sha256=IxS-5qQ9VQRLSwCGLggRbxMMdkWLaV20YOFFGqLqQLw,7283
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml,sha256=F2QE8NSwE4iqPRHCPzZfgjONmotC7DJdMSBjp2RgYus,4870
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_interactive_file_download_from_internet.toml,sha256=Vsz0nGdaPaqMHZyXncHiHsmwXEW9qEVatbftLn-ZvqQ,7484
nldcsc_elastic_rules/rules/integrations/cloud_defend/command_and_control_tunneling_and_port_forwarding.toml,sha256=pfmvNDZISg2J4Fsl4wooULdTXp5kXD-U9lmuKjUlbSk,7447
nldcsc_elastic_rules/rules/integrations/cloud_defend/container_workload_protection.toml,sha256=0Zi-cisWGPlRV8egCLvHQK6Gj1l47gc0J-nlmMzrcBQ,5154
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_cloud_creds_search_inside_a_container.toml,sha256=jkpF2r9_qgrsShZJBon-CtoyuvLViPtg9BCLph6XkX8,4249
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml,sha256=sreBbfLunSWHfrQE0rHMFaUN8coOcMhFaGbgUuJGex4,8581
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml,sha256=d7qkM57-5PyN_WScArUn1bD8k7QUFdO8sLO1-7l3x_s,8621
nldcsc_elastic_rules/rules/integrations/cloud_defend/credential_access_service_account_token_or_cert_read.toml,sha256=P9sL6w9NCh2l4EqSLuqTkm-s_nMJDANFFtJfKxSYafo,7596
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_decoded_payload_piped_to_interpreter.toml,sha256=T8az_AzaOyp44i_iymdGJA4MBQNxKkJ7F3CgDz6bPVI,9425
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_deletion_of_shell_cmdline_history.toml,sha256=HKfQIAhNNuUV3dOj-XOb-VSTug2cMVB_xkpSQp1PTkw,6908
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_file_creation_execution_deletion_cradle.toml,sha256=11PHmcuyKLy_OVIQdfjozg97eZPIJ2d3aY5JbNbsoSA,8951
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_interactive_process_execution_from_suspicious_directory.toml,sha256=2H43ngd9JvyaE-CHhaDZ86ilwXvi91S00e3ZbrfuKjs,6393
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml,sha256=h0ZF91bkVPz1dFkiSTDCgbd4yKoQciX-TKAzH9X5VXE,7638
nldcsc_elastic_rules/rules/integrations/cloud_defend/defense_evasion_potential_evasion_via_encoded_payload.toml,sha256=Get7Anmf3aPKZo4zP0rmteyCcJy1vmAsEh71N3KEdrM,7471
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_dns_enumeration.toml,sha256=RYHHCE7_pntc2-3UhlO79uzx-ERbms3nORfRHrI1tgU,7706
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_environment_enumeration.toml,sha256=3G5fkD4femQvzI9gOvb3qMaGljWRsfCE_we4yKrb_-s,7121
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml,sha256=Q1EOBhzAgRnr94dxtc1vAs05n7-Gpl8azJwBIsQBKaI,7859
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_kubelet_pod_discovery_via_builtin_utilities.toml,sha256=M7tLcfLy6YI6PPrgkzgR8-qpLm2BG07qxjzOabY2afc,7163
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_potential_cluster_enumeration_via_jq.toml,sha256=Ig74XzsulP_YAsp4YdmkiK-LpF_NIBlFzEef9pizZKA,2163
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_privilege_boundary_enumeration_from_interactive_process.toml,sha256=NZkedqxjUiK6LbCU1MFecxRK2Wq_95tQjBWPw7GhAnY,7635
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_service_account_namespace_read.toml,sha256=jGqUGYZBgLAHcHmtZXIUq0Ga_0mfOKI3eHLphjWmf7A,7165
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml,sha256=xHc6XLqW8RN3dkEVp3KZK4JgV-nW2TCUij3howxGsgQ,9068
nldcsc_elastic_rules/rules/integrations/cloud_defend/discovery_tool_enumeration.toml,sha256=oUnXtuRSy2xVIkgNVYdhxKxXYFCE48ZvdfyZuvGHepY,7283
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml,sha256=MCN3rXYmMiSxdL2cXbSFi0WYr6PukR9-Fe5kUzQ8zhg,8189
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_container_runtime_cli_suspicious_args.toml,sha256=eE8_IjDfGhpmsn68H42DYEOnAnPcwggMgDepCsaFphY,4285
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_direct_interactive_kubernetes_api_request.toml,sha256=kwTbmdXTWDfPVM62WtMnv1zME9kMJKr32_JUbggQaXY,9026
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_exec_to_container.toml,sha256=wj4UKBVOnHTGlkPytDaWj4CIb6m49QPwmpzQC-pdMwg,7588
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_file_creation_followed_by_execution.toml,sha256=hGchAdJLkfIfa1r4Iy4XGFGHHl46BXCahc6dsnHDmeM,6315
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_file_creation_in_system_binary_locations.toml,sha256=6Uq4MMipXH_jRt1rqhdPidriQI2O2M0qPSoIu_LCa7o,6885
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_interactive_shell_spawned_from_inside_a_container.toml,sha256=pzBDLTa6puawKzddOUEj2Kl1mXyPkYASWEUsZBRK7Ys,6775
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_kubeletctl_execution.toml,sha256=6AaGIfIiVGIdwe7ciJjgnRftvctpSZ0lle2jmqBjq4c,7406
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml,sha256=yBIPhclL45WxDXy-hX-83brZXDryoXtJ4KIHM4i7v78,8765
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_payload_downloaded_and_piped_to_shell.toml,sha256=PVakRLae39U__TA8c9rD1SMkpPONQ403HqbyaNRtmSg,7915
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml,sha256=hZ_QR9bAYoIXbE_Ko2dxSse1t4mw9S4fhCpEeeAEj4U,7297
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml,sha256=XW9dXP-oQpL7eQxW_ZuL6-_bMOZNdjhJYNa7ZpynQQQ,7972
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_suspicious_interactive_interpreter_command_execution.toml,sha256=60DxWyyLpC0wz6gMHE_kqLbhliB-NadK8c59kjOZ71A,10282
nldcsc_elastic_rules/rules/integrations/cloud_defend/execution_tool_installation.toml,sha256=AKYwZrbxoElSD2OcFd8AeLLC8tF2PVTTZpZi-oAj9Zg,7023
nldcsc_elastic_rules/rules/integrations/cloud_defend/impact_process_killing.toml,sha256=76_tLXkH7eU6zplCdvj5DfjJ7cxRPLb3A1v8URxVQy4,6815
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_modification_of_persistence_relevant_files.toml,sha256=J1EBg5ki2zmYOrnV0d3L47FGwferXrK6MPwiHciWsMc,10991
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml,sha256=-JMTY3nQT05IWo5fEDeXGQ5pqOD3EUCIX6o_C7WnNI4,6971
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_suspicious_echo_or_printf_execution.toml,sha256=G3ToOEER-B0peRWJjK1LBf63JAXOaUN-FSbF7j3rMFs,10981
nldcsc_elastic_rules/rules/integrations/cloud_defend/persistence_suspicious_webserver_child_process_execution.toml,sha256=bGUI51qEs_prQtK_CcU_Chp4jdTEmOBZgsrix01yES8,14298
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_chroot_execution_detected_inside_container.toml,sha256=71pdwfsO2A2abXOqFXlsxkYUO47GQRN1E3QoRI50rx8,6418
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml,sha256=eN-JAOhtIyofLrYNumvYfTa5PlUgflmQ1BI1A7-gdKk,7317
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_mount_launched_inside_a_privileged_container.toml,sha256=AbGeA4nkAKfv6sGgI4Fj9Rx-Rymd4AT2SW0mI_bft0o,7040
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_nsenter_execution_inside_container.toml,sha256=0IL7S6WBebd__BrIXhxio4-FoSEeK3C9X8P-w6FUTKo,4010
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml,sha256=OR29Baw25pSCmn-JXqAHZi3YoaUL5CY0Zv-adxkpYZM,6446
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml,sha256=H3DJmG4ONU8MHDK2qQOayUWGzfoeIONmkCAqAPcZfzo,6567
nldcsc_elastic_rules/rules/integrations/cloud_defend/privilege_escalation_unshare_namespace_manip.toml,sha256=YGEwLlxk5lS07gcF0Kh8J4Vqj0DVeYPrfcqSB7f9P2c,6193
nldcsc_elastic_rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_error_audit_event_promotion.toml,sha256=u50ur5dO-j2uZrhTEDfU191kkw42CHEShpIRNL6Z2vA,2168
nldcsc_elastic_rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.toml,sha256=fhO2ycMKRpDFYnNdlxWzV7hEkl5saddDUv9OoKnLUMs,3051
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml,sha256=kDqqYELiiuEb40k0vMOwmkBa9gRGK6GGDb7HXR7mRbo,7247
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml,sha256=dYjejq3xKE5d9XJGfw--Nt3TQlwtlShEApKimhtS52A,7358
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml,sha256=4osCOO4-BDmyvBuYMRMyQz1sPIN6cryobnBlsAi5aPI,7471
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml,sha256=UV1YWBVE85XwEaawHfRdSfYerKpsC6WKe6-XeV0AhdU,7285
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml,sha256=0TEmLUoyeTPg1g17dL3VJMJpEW9cT0yC2-y_Ivpr7aU,7046
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml,sha256=3INxG4KVn1O4hvzEGQjN4474lNR3-Nwu2mAAAlmPinA,7250
nldcsc_elastic_rules/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml,sha256=a86XUno_WGL2nCJ9F40RScwVY3SrEB_Xu8Oz6wwWMBg,6916
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml,sha256=2Qwf2CE4qzqE5HsBqQLiKkUG5d8DrLsSINWrD0LjYAc,8232
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml,sha256=crDoUdCcKXejfKeJ6oSeeRmSXqiv4lCjV_fKuj8idFw,8791
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml,sha256=lSa9BQHLkKoAbGy7fABd0kIDA3OruQxd6bedf__mr_o,7977
nldcsc_elastic_rules/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml,sha256=ypEUcs5ZIsKh_T6z50bOqcrGOyhVGV7Es_004Gr3o7M,7992
nldcsc_elastic_rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_detected.toml,sha256=nW-2TIxgV3vXQTtDFLA9zemRgojrC6dpkpHwM5T-qFs,8913
nldcsc_elastic_rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented.toml,sha256=YY47ghr-7DTbTTUmVq9hNVre1QyW2d70JcRX359RMcs,8890
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security.toml,sha256=46X8VMLOYQpJ0cqutTIgARQrRM5bdGKN5SLjqQ7_4e4,6964
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_detected.toml,sha256=CSMFT25UqRa3gKjX0JMkbOq7DVuw5GwwQRGxY7EuAvg,7000
nldcsc_elastic_rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_prevented.toml,sha256=npkO3yXnzImw-L0AEWjzyQpvRlKOeGlp1OJ6YjlsgRQ,6979
nldcsc_elastic_rules/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml,sha256=i1C7utu_Kf1bJbi89UD8wHZ4fRFj4XVw_OBkhikwz6Y,8795
nldcsc_elastic_rules/rules/integrations/endpoint/execution_elastic_malicious_file_prevented.toml,sha256=DuDoG-Z-EbHC1BwNfpvolrTjSDBvzBuEg5gfoeyzix4,8773
nldcsc_elastic_rules/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml,sha256=tbkJuMLmIkNAOnOOZnwtOlYfNtYGpAqloLawWRC34lA,8750
nldcsc_elastic_rules/rules/integrations/endpoint/impact_elastic_ransomware_prevented.toml,sha256=dcSJ_Y5umZgF2Jc7dVJqb8X7tkJPP5nVmK6mTN0p7B4,8735
nldcsc_elastic_rules/rules/integrations/entityanalytics_entra_id/persistence_entra_id_device_phishing_kit_default_os_build.toml,sha256=gbum73RyubOHo3j9b5dPetSXmLkpWScy6epC_u_VV_I,7847
nldcsc_elastic_rules/rules/integrations/entityanalytics_entra_id/persistence_entra_id_device_roadtools_default_os_build.toml,sha256=z3SLCQwJodHiKezadcCg-Roev49gjOnqZtPeLqrEn5A,6817
nldcsc_elastic_rules/rules/integrations/fim/persistence_suspicious_file_modifications.toml,sha256=eJtrbtEFPbt4qmh712XnA-YVwvyOgCmOXd15k8_xcmg,16285
nldcsc_elastic_rules/rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml,sha256=VCfyV6J1xlDVKb6uSeB8esDqyZzVkSPIziZebPObgdc,5853
nldcsc_elastic_rules/rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml,sha256=27WbQBqR_wy8_Ycj6Ba9HRPU-RuvQpDRr2OC6Q1aZ84,6171
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_pod_exec_cloud_instance_metadata.toml,sha256=v3-qpK5h-NoSLzSvR1z_HtOfAYILrjRBeGYVvItnTZQ,4577
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_pod_exec_sensitive_file_access.toml,sha256=rAF48cEjV68ibwYCWI8QC_OZV1K7rPCqnzF4yQiLK5Y,5260
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_rapid_secret_get_activity_against_multiple_objects.toml,sha256=gWy4xGEvBJY51Na3gIDVJZfn0Fl5ewzI55MmABbVQGc,4836
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_from_node_or_denied_service_account.toml,sha256=0_GmvJgXNXt3b-XhDSH-IhEYLITi8aO0nxqLJHRcaAI,4459
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_suspicious_user_agent.toml,sha256=gaKzWXz3Xlb3LDrOjEtHSbCrZKp2SvvWSxF2bkCNhgI,2727
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_secret_access_via_unusual_user_agent.toml,sha256=vznChYv7hdbHMv27b2dyQvM4r1__B0diT6WtutO0Zqo,4283
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_secrets_list_unusual_source_asn.toml,sha256=ZszVn8zNmrhj6jaUb46iRDiPiV0kK2KZLivq64ogiK8,3360
nldcsc_elastic_rules/rules/integrations/gcp/credential_access_gcp_gke_unusual_service_account_secret_get.toml,sha256=9J8hwI-JqXw1Ivu4yh82kL4TFZyddWRVyKl1O3DlAKg,4412
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_created.toml,sha256=kRCQcL7L651kp4NbookLFYX4h09uls7zB644hpYPsx0,6727
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_deleted.toml,sha256=YYAqkeCcZIer-dmPRfaqODv1VcPFdW0ziJMHjlOpRC4,6186
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_modified.toml,sha256=-O_7mlTvE_1eHTwvABbL_9lI8ldyv-roui2nz0ZMRJc,6310
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_logging_bucket_deletion.toml,sha256=VRbIRv14ebpDwvM_HT9b9SLqadA78gBa-FhUZchwgL4,6413
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_logging_sink_deletion.toml,sha256=oRpqBlB__6jzxPMuyyl8IVZKUnrz7PEghFvOI_zNG1s,6148
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_subscription_deletion.toml,sha256=7Ewnou5CzkGoZq91J2p54S81-KnFbJeQRy3oKDt7flc,6096
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_topic_deletion.toml,sha256=XYIujGtLIoJh_ymC8oUNC7kntsgqw-5ua1Phn1VBOVM,6277
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_configuration_modified.toml,sha256=lSQlhWhBYM-oX2ItAcgdUTfTjveI2v3FnRtlwaPO5FY,6347
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_permissions_modified.toml,sha256=5eOQ43dIj0eHA9TYaxCBa7QsTlphEup22LmUpRYLhCU,6879
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_network_deleted.toml,sha256=q8zVrghI3yKOvdc6pQhPy_SKsXcGmAqTYQ2aqWXfK8w,6253
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_created.toml,sha256=wHOsTwapw-kx4o0-zZXffyc3ME1_j_7zXnjgr26_nds,6673
nldcsc_elastic_rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_deleted.toml,sha256=DBnjw4jHT9tUmr-J6fbAP4k2DGVWEWy_wB20k4mvvCE,6581
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_anonymous_endpoint_permission_enumeration.toml,sha256=MjUkNTy0gynCdVG0M-5Q9-bvEbO8OQvraVuFP_y7oiM,4289
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_api_request_failure_burst.toml,sha256=jSs9mL3Z9b9HaRGsxOuQ68RifDJHZ2xm-V6NImejpoA,3067
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_endpoint_permission_enumeration.toml,sha256=xx5Ma4Vo7zrnscHapCO5VArg6LsgRUi8awrpr95YNUg,4963
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_multi_resource_discovery.toml,sha256=EgfrWjfGIzcnVx4sQh_SSqCkVYfLoxVPChaz1Z_fONY,8648
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_gke_suspicious_self_subject_review.toml,sha256=3Sc0Dhc0Ec0G6zDJVlTsuXgVLsiQ1Qo9uUi5zplQsBQ,3037
nldcsc_elastic_rules/rules/integrations/gcp/discovery_gcp_secret_manager_listsecrets_across_multiple_projects.toml,sha256=-3OeWRvMo9gWu0g3PeazRQT8p8JTbwDFb2ZT3ooc3f0,5845
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_anonymous_pod_create_update_patch.toml,sha256=37Gnq2astksQuf9kNtyv10GJrEm3yLHRa2aoty3JZaY,3376
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_forbidden_creation_request.toml,sha256=WXL83A81CeaUGwdu0GaWtyuqr74KkzyMgzueZHRhOuo,3229
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_forbidden_request_from_unusual_user_agent.toml,sha256=DCN0com8UyBjPHOoP8EvyuzJAF3bBBUjKxa32j0dA0A,3823
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_pod_exec_curl_wget_https.toml,sha256=om6NgdEDhYzD3M3MKu9DSmLacyUWNdLQEb9xkdH7aUs,4590
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_pod_exec_potential_reverse_shell.toml,sha256=CuaWtoRm7RFCIGSrOy8tpvCHCLbex8zA07R0k4G3O7w,4884
nldcsc_elastic_rules/rules/integrations/gcp/execution_gcp_gke_user_exec_into_pod.toml,sha256=k0QXiZHAKHYclwmAuwMBKW6Aq1xsh4g5ThQu80nzI9g,2655
nldcsc_elastic_rules/rules/integrations/gcp/exfiltration_gcp_logging_sink_modification.toml,sha256=BF9cQYcZPQkKOHEom9uP51u7JSe2tUJ-Y2a0kDHqUyc,6666
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_gke_coredns_or_kube_dns_configuration_modified.toml,sha256=YtJE8CRWQhmawmSPayRWht_FaAzRvDaJ9K5pXHmYxRk,4448
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_iam_role_deletion.toml,sha256=1BE-_A27avHna0NF6qKM6lLEpe7wdsu9-Tx0MtOAkGk,5841
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_service_account_deleted.toml,sha256=739zmHPzI67RXg0uYmRywLl3B2afsGMBY9HKSSrc7Nc,5831
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_service_account_disabled.toml,sha256=2UxbnP6BKsJzJUkMscaMr1yBUyjMaA7XYECowHspNVY,5752
nldcsc_elastic_rules/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml,sha256=NtWsPxUstoaLiF8jeXrZx7k5qJGx2x_msqWZuefNe6M,5624
nldcsc_elastic_rules/rules/integrations/gcp/initial_access_gcp_gke_anonymous_request_authorized.toml,sha256=2G7gNaR8LThrDocgwuPc95ubySVT8t_4uHrCjQeB63w,3940
nldcsc_elastic_rules/rules/integrations/gcp/initial_access_gcp_iam_custom_role_creation.toml,sha256=ril7eDc8vDwDKMNZHGg55jrEeDyx21csI6k2RyAOnLE,6829
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_error_message_spike.toml,sha256=d-Ypfs63RBvwF6z2MKLoKU7I-yOAsWq_BOsm_MfCbIU,3543
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_error_code.toml,sha256=EZ0y_S6nMb8CqzeEd4Qpn55KwhrMwiV8YgfzDAcnfNA,4056
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_city.toml,sha256=_2XZTvuBVCm3qDzXnVEauRiM4zrc-j9D2Ra0g5E4RiE,3763
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_country.toml,sha256=2FT5EUxbYapqyoEEzPlGp2V1eLvMhVmtwPT7ubqM36A,4191
nldcsc_elastic_rules/rules/integrations/gcp/ml_gcp_rare_method_by_user.toml,sha256=GhigwGcWA7KgRzro6w7v1OCtNtNrChZTP1B8ti2Lzrw,4811
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_admission_webhook_created_or_modified.toml,sha256=8k_J0vAZkYzlpjRvQSJqvU5tGsTT12aJe0zgX9-DZ6c,3600
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_certificate_signing_request_self_approved.toml,sha256=mGbwpdoUr2hWPwgBDt7Q3b8lHxlI9Lhw4VSfXIeIhj8,6963
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_client_certificate_signing_request_created_or_approved.toml,sha256=UaVILSAGRlX2TdGi1cGqIDCh6Z_sLwOkDq_w2R4y4vk,7250
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_cluster_admin_role_binding.toml,sha256=9Dkj7xfczeG32FBqgOcMEKI52L5Gxsq3cLSUnev0law,3690
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_exposed_service_created_with_type_nodeport.toml,sha256=PtfDT0FLQFklGLwkfcxF3n4Qj4rn46nBuz5Q0Qd3OZc,4502
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_role_binding_referencing_service_account.toml,sha256=w_zAOK1XpsbI9w_FqIBFKc0VLE6LIzU5J35GRcPJocs,4260
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_gke_sensitive_role_created_or_modified.toml,sha256=3c33q2oYD1vOmvwgWKzyRUoW7EJVwEXxUAjhyJ6aBsE,5685
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_iam_service_account_key_deletion.toml,sha256=WFctEv8W6l6BchDt9lHOpVCr7v0if-0as9_6cuKoLiw,6097
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_key_created_for_service_account.toml,sha256=y8-RLOYWmg76GuEpwQH_Zl71js9Gzoihddq0MpOX-3M,6396
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_service_account_created.toml,sha256=LDpgnNVOYwvlbLV9DFMZBxUmQj_7wSXGMAJj5iisV_0,5856
nldcsc_elastic_rules/rules/integrations/gcp/persistence_gcp_service_account_impersonation_role_grant.toml,sha256=WU3GEb_6XUfc5bnWFWTb41RJYbYd0gLj6DxvtWir0kg,6727
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_api_proxy_to_node.toml,sha256=tYRvk1m4li5o_9PJCvXtSBXidskAmkzZUCtSnJlxnsA,5461
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_api_request_impersonating_privileged_identity.toml,sha256=M8u4v_bEecUPxxF8xDnV7dG2G1HgceJRzRDclJOjNxs,4973
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_certificate_signing_request_api_client_signer_requested.toml,sha256=l4GCD4pMEZvSoMAafj2Ct3u0QTQZOazVuDGockBZcqQ,5970
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_certificate_signing_request_privileged_identity_requested.toml,sha256=XI0F2wP_HnqajK5gm-erzvN5tjVWglfBMRmwBPX-zqQ,7225
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_ephemeral_container_added_to_pod.toml,sha256=hTgiKLlCvY-MVAcBaV5YSgGG4kZ8SVroQDXEpk0fpMY,4151
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_excessive_linux_capabilities.toml,sha256=bOmhWY8VQbhFwKJsY_QMbvVUs11cts4EjFPqIkL006I,3189
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_ipc.toml,sha256=UwlXl8zfWIHYbEwhC8AfqhlyQyj9hJEaPxARkW5jTks,2907
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_network.toml,sha256=NFGtlvbT5WDYZE1p_mUdskL3DU9jL3V_O6zG-2qAAO0,2978
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_pod_host_pid.toml,sha256=JB8ZTYmGce3XuVsjMjLeeyxR-rLbVv_fOe_m6nxFWXI,2915
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_privileged_pod_created.toml,sha256=U5p2kkO5uF9pm_AY8yGg5EF7BeCvDKAwJeMbCitvClo,3185
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_rbac_wildcard_elevation_on_existing_role.toml,sha256=K_K4cQgRggTNU63Qs4LcFWeHJSHXxAUUC4Ul4yZ8qEw,4135
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_sensitive_hostpath_volume.toml,sha256=hs5wqZJO3CuTJBCucwY6I57qM92U2a9GG58mW4k4Ci4,3467
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_sensitive_rbac_change_followed_by_workload_modification.toml,sha256=HecUHMy3lWI9WiacTfyKQTQ0k0P-RgJ0wtiUgs9xuy4,8234
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_service_account_modified_rbac_objects.toml,sha256=LKzxHA3A7yhsb0eq9YWKuVaLDV_FaKJmcNPBMmkUfRE,4892
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_suspicious_assignment_of_controller_service_account.toml,sha256=RjiISbKvRRiYlZ8eDYjBvTzTFk7N0GEcT9xp-Pi3R88,4698
nldcsc_elastic_rules/rules/integrations/gcp/privilege_escalation_gcp_gke_unusual_sensitive_workload_modification.toml,sha256=RTww965OXsOczF_Vls1X9_l3oe5sHTmLMowf9XaiEV4,4364
nldcsc_elastic_rules/rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml,sha256=shHIamMDobSQDGCtss8wYm1VfdcyTqKCkKKF2TyBnus,5576
nldcsc_elastic_rules/rules/integrations/github/defense_evasion_secret_scanning_disabled.toml,sha256=ngIrl2tpFZX6yPLjFWdPOYHHjWfJScV51Q6VZR1Dy5s,5570
nldcsc_elastic_rules/rules/integrations/github/execution_github_app_deleted.toml,sha256=NjJ8bdc7W4AaptCok8bYXAr0rKkAzkUGB0rmvzlEwYA,5426
nldcsc_elastic_rules/rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml,sha256=qYMRbnIAGIOSaHkxKyIP9lk3LGhSzh3r5Xr4ldJFoOc,5683
nldcsc_elastic_rules/rules/integrations/github/execution_github_ueba_multiple_behavior_alerts_from_account.toml,sha256=Ig0RD_U_wiIyKIpTeI1u3dggxZ8P6CPONi3FEgKgsRE,5259
nldcsc_elastic_rules/rules/integrations/github/execution_new_github_app_installed.toml,sha256=CdMYcsgMUmiI7lJbAd2Z_IA3cjCSTUZgzsL5XO06wLE,5773
nldcsc_elastic_rules/rules/integrations/github/exfiltration_github_private_repository_turned_public.toml,sha256=TbHhrpM53rup9Wqoz4SE0UWTuwTfagb_rYOhXPoFE0U,5677
nldcsc_elastic_rules/rules/integrations/github/exfiltration_high_number_of_cloning_by_user.toml,sha256=xEX7Cj8Z_myc3_sFV8R1br95qBh5wRK58D4bBIHvFUY,6620
nldcsc_elastic_rules/rules/integrations/github/impact_github_repository_activity_from_unusual_ip.toml,sha256=34A571vFOYuMXfwrtbcsJ8AvE-YbW9lToRvWvyyXHAs,3257
nldcsc_elastic_rules/rules/integrations/github/impact_github_repository_deleted.toml,sha256=YAd128cTN9mJQiDWnUm250GKM83G5ZNkvYYThuym_8Q,5421
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_closed_pull_requests_by_user.toml,sha256=MpscGRWut2UG2ITWssaAP-nJ5gqjyRNZ_D95pG97ock,6951
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml,sha256=fDHlaF4qbqU1eL_E7moMG0rNlgqLBxzdYRsYrTLPrRM,6927
nldcsc_elastic_rules/rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.toml,sha256=tiEnTgEVeVbyWEcOUO8cauHrQDGiWDU_YQEzz3866JE,7500
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_actions_bot_first_push_to_repo.toml,sha256=bEwffSnIy2-_7J-OQcGZUJiWRMRa0A6O4lKbnjtHxnY,5224
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_actions_workflow_injection_blocked.toml,sha256=qdNFg2K7ebgMP5VllYAs70CdnxoWJYL0Y2BYltDlfME,5475
nldcsc_elastic_rules/rules/integrations/github/initial_access_github_register_self_hosted_runner.toml,sha256=Lf4dAr-9tZh38hOCUx9rvuYToJmsqxnPoOMqS1_6U68,3851
nldcsc_elastic_rules/rules/integrations/github/persistence_github_org_owner_added.toml,sha256=NvUhu6KFQLPFwEO2xpUmzdnExK_DGuNcW0m0ag73Szo,6227
nldcsc_elastic_rules/rules/integrations/github/persistence_new_pat_created.toml,sha256=y86IRrvUPmaKKb1ZJEwIh2QNlVlXc4l8Q5JP24uszL0,5901
nldcsc_elastic_rules/rules/integrations/github/persistence_organization_owner_role_granted.toml,sha256=60aagcOhoUM3Lq6jfK686iML7mVu5cY-hdAO6vw8d8Y,5742
nldcsc_elastic_rules/rules/integrations/google_workspace/collection_google_drive_ownership_transferred_via_google_workspace.toml,sha256=LUBvUs5x9WNmGtzI4JjyTdDew0TkrmTKBeH9lwUdpew,8376
nldcsc_elastic_rules/rules/integrations/google_workspace/collection_google_workspace_custom_gmail_route_created_or_modified.toml,sha256=3ddJECK8pNSVTWw7_vcHl_mz8ntG3tiFhbVOVpBflRA,7714
nldcsc_elastic_rules/rules/integrations/google_workspace/credential_access_google_workspace_drive_encryption_key_accessed_by_anonymous_user.toml,sha256=S1JprMK-tGnpVELbgb3lUrun9Pn-k4dVNtVx8foTfpw,7275
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_application_removed_from_blocklist_in_google_workspace.toml,sha256=uV8jjaTB4to1kWm3XtoXqfK6i6RKYZBYR0RW6mhg9gE,8379
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_domain_added_to_google_workspace_trusted_domains.toml,sha256=aiZeo7AlsHegsLj5GRSlUIUZV03W2K_CAid_ZwXrBd0,8106
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_google_workspace_bitlocker_setting_disabled.toml,sha256=1ug19BAhbH6XvvLG7G16bTDFlE6UG0d2VTFdBpmyFs8,7099
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_google_workspace_new_oauth_login_from_third_party_application.toml,sha256=oi78c8FCYJr4A01Lh-5nG67gh3wIHPKhInK6YWX4PlM,8713
nldcsc_elastic_rules/rules/integrations/google_workspace/defense_evasion_restrictions_for_marketplace_modified_to_allow_any_app.toml,sha256=5Fkbc0pV212E4O1OsWBGTi5XQDFUbzZrm3pwPJVyOyI,8332
nldcsc_elastic_rules/rules/integrations/google_workspace/google_workspace_alert_center_promotion.toml,sha256=s8meFhhZnDsWMTRhL-EmMEKGXbP5kppD8hZ7CyWhXTE,2369
nldcsc_elastic_rules/rules/integrations/google_workspace/impact_google_workspace_admin_role_deletion.toml,sha256=q0v7eVXisJIb1ThAhgsE1hHvbXZJTDA2jroXX78i-3c,8418
nldcsc_elastic_rules/rules/integrations/google_workspace/impact_google_workspace_mfa_enforcement_disabled.toml,sha256=31p0cRAIM9W47sLs9zBNzGnOChMwwe7KWaOELBBuetY,9709
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml,sha256=328-Ehl5IPupK4SqndhK8JGqYfT4j7IkRu7Jty2PgaE,7778
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_google_workspace_login_from_atypical_asn.toml,sha256=9aRMDpi8E61LeotgXTl_IW-9e3nTH7FvB4Oj8noPo5c,6793
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_google_workspace_login_impossible_travel.toml,sha256=dS3owPDBWrTeniwiReoBjnFU2EVjPxUQFtJWlNl3ekE,12448
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_google_workspace_suspended_user_renewed.toml,sha256=M63_qIf0RuQpu7P8SDJY1PySIdmTtTroTm112w9-ebA,7843
nldcsc_elastic_rules/rules/integrations/google_workspace/initial_access_object_copied_to_external_drive_with_app_consent.toml,sha256=oQ5KdZGF2IHlB-eWC6KuqCnna5qgNPY59HM6NrHBHSw,11258
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_application_added_to_google_workspace_domain.toml,sha256=ajL4sxj-LCpBWe6fWibECypxRIBy96fTC1iyuKE-5ZM,7827
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_2sv_policy_disabled.toml,sha256=5TxoAZbGXAZYIzg7_fgrpMSCaSo30C_TrCiPYZJvseE,8216
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_admin_role_assigned_to_user.toml,sha256=XUCFJ_cvwuxixTiPl-afyobvsuqCbPu20A3qa2yqd3Y,8470
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_api_access_granted_via_dwd.toml,sha256=M-OhN2YoDpoY5CsWQdTT5oqjKw1P9LRt0wtYhEKoKnw,9071
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_custom_admin_role_created.toml,sha256=ebMPogHInlOfw2BBA8T3l2Ruto6NmPwlEp6Wpm9wZP0,8604
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_device_registered_after_oauth_from_suspicious_asn.toml,sha256=qJQPSpeAM8TdbihpacoSq0NUAd_GWKGtDO_vjbLX3q4,4664
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_device_registration_atypical_device.toml,sha256=6bEJdqT28z-E15Ng5EtpiIDmwR_47X4WbHjLdjjjE80,8748
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_device_registration_burst.toml,sha256=thCBpGGnfak0C77fwdB1fM_Ap5sVnrc9G6eT3y7RObw,10084
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_password_policy_modified.toml,sha256=mROO5e7bIWAtOwqcLRh297_utPEn1csx-swlbJjNmyE,9527
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_role_modified.toml,sha256=6oyfkQ4E_WE5UjJP1RG6lV34snN0Hsc4p9PHA0ez7ks,9469
nldcsc_elastic_rules/rules/integrations/google_workspace/persistence_google_workspace_user_organizational_unit_changed.toml,sha256=F_J7gSyAM20YJ6BK-XubXf38hEMVKvQmJ4PrwMfT09k,8239
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_azure_arc_proxy_secret_configmap_access.toml,sha256=FsiTfTDtvNexGct1QibWfgfkSqlfn5wMYrxLOaRt0Hg,7530
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_get_secrets_access.toml,sha256=oA5burXIly3HTJOo33djJ-Bz6JeFKRK_f5D25TT3Jzk,6173
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_multiple_secret_retrieval_burst.toml,sha256=O91kk9-YqIZTNeV5OumkHav6gnZ0pE1wIktq94Th_TA,4461
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_pod_exec_cloud_instance_metadata.toml,sha256=lq_DKbP_QjA2_hKV0CA40AfTiIqVL6ef6yOM4_thamc,5707
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_pod_exec_sensitive_file_access.toml,sha256=hsB55C-5T3x6MbtFmXqT4rNq07YXa3KlOHxy_tT3IbQ,6747
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_secret_access_scripting_http_clients.toml,sha256=3amNfMxfr86_4l3bGi-N2XyH7STY2Fw7qBkZbkXWDss,4591
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_secret_read_by_node_or_pod_service_account.toml,sha256=8ojspmlaS-7Jgkrh0MGgZv971fAVyM-EFRc5imjwId0,5919
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_secrets_list_cluster_and_sensitive_namespaces.toml,sha256=NuLLCVwfVMFPtucQ68La7wDnB_vWHx8vVz63AfrU6rc,3714
nldcsc_elastic_rules/rules/integrations/kubernetes/credential_access_kubernetes_service_account_token_created_via_tokenrequest.toml,sha256=Mz_GgPHOBsHzP3rXLy2UhjcuIz6GGWM3zgnViJjPpEM,5172
nldcsc_elastic_rules/rules/integrations/kubernetes/defense_evasion_events_deleted.toml,sha256=xIQd7pN2OIGBxeWh5w5moVgL5aE9-LuGfHm50OGMNvE,5829
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_anonymous_user.toml,sha256=BjPl0FlpmIBWyMUZmgcIIonbxuBn7Z4tiuHDwNDXcgQ,9708
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_user_and_srcip.toml,sha256=371b2Gb-8_gnbluXIRxldHxh6DyfN6_8PaEbsJQhuUY,7564
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_kubernetes_multi_resource_setup_recon.toml,sha256=PKtZFvRZ2ARzN2zPdnrJZMcqcb_a9FR6mtMcceYgmZk,5456
nldcsc_elastic_rules/rules/integrations/kubernetes/discovery_suspicious_self_subject_review.toml,sha256=4TMUQwq-b5rZX4SKkJVkHB02hOP7b4b6jfsNCHhL_wQ,7522
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_anonymous_create_update_patch_pod_request.toml,sha256=IWfg4SyAUPH5bSudjJamWJZL3mWHJvENZp0gPsrHd88,1827
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_forbidden_creation_request.toml,sha256=L8xarE-hbXogUpNVCNey2t-ca8vrm2iI9BSq7hul7qU,6635
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_forbidden_request_from_unsual_user_agent.toml,sha256=-rK55mF3Zbz8PFSt6vY9elty_TwOuGjf_Iw7u3y1ogA,6154
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_kubernetes_pod_exec_curl_wget_https.toml,sha256=HMPgLAs2Xc-pUbaptyOEfLI2MpMjfpQqj-8T01Jp9Gs,4909
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_kubernetes_pod_exec_potential_reverse_shell.toml,sha256=KWFDdQpCd-XaUYee9elnG_fai8hnZCRo16uL4T7LlLk,4397
nldcsc_elastic_rules/rules/integrations/kubernetes/execution_user_exec_to_pod.toml,sha256=8_OcIIiFTtSzYcVsRC5g5eksuZzdRJrbVVa6W6XFKOE,9468
nldcsc_elastic_rules/rules/integrations/kubernetes/impact_kubernetes_coredns_or_kube_dns_configuration_modified.toml,sha256=75nVjIXmLIOqYMvorYGG1m1TfBFIDD-5rAdPXKPr8hk,4340
nldcsc_elastic_rules/rules/integrations/kubernetes/initial_access_anonymous_request_authorized.toml,sha256=lXnreoUjlQfvPGy8fx6F1biOR-jFnc_Qp5xXuHa2PMA,6472
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_cluster_admin_rolebinding_created.toml,sha256=s8xtD1Xii3Jbah7s7kCONeRKkXJU2GSmQL0is2hRLr0,6627
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_exposed_service_created_with_type_nodeport.toml,sha256=CJ6fEVOqT39zMEuz76tWsWPQFd-VwnzOj4HR5tWEEeQ,7863
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_kubernetes_admission_webhook_created_or_modified.toml,sha256=LowZNrzn3he8m2iB4T0e0FQiWibR4u-nJnrm7AIYwkg,6169
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_kubernetes_client_certificate_signing_request_created_or_approved.toml,sha256=KjeRqegxtc9s_CDVYDFLWdoqisomkR0fwm0Vz3F6vMg,5807
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_kubernetes_eks_aws_auth_configmap_modified.toml,sha256=fNuk29X0odZQIi2rjFgx5lYyGoUZ6ftNm2zMaqJZWaQ,4637
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_sensitive_role_creation_or_modification.toml,sha256=r04JKPn2tRHVRLncblqEYw6JhENhiJVmeQ2f4ClmecE,8914
nldcsc_elastic_rules/rules/integrations/kubernetes/persistence_service_account_bound_to_clusterrole.toml,sha256=6auEt6nC4sqtuPp_ruOHXCuGzDiEvq34HXs3vrbOWSY,6874
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_api_proxy_to_node.toml,sha256=djDBjuqs_G30AXuUfG-lJ9QVliGyovytmoWNe4lNVF4,5844
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_container_created_with_excessive_linux_capabilities.toml,sha256=R_mBz5DBKmt-OEeWCSo4uyD7kzgplXfqbeSdXTXQfbQ,5977
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_kubernetes_api_request_impersonating_privileged_identity.toml,sha256=wbwUKHb3tzE_8q7Sqf4gRbLOjATdII2Hra5WR2HaLOM,4967
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_kubernetes_ephemeral_container_added_to_pod.toml,sha256=xWiskdoh14EYwGmkQk45-uJPppr7WUqrGPOYLYGn1zk,4000
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostipc.toml,sha256=1LaehJFcRSSWz86eGvlvpATZue1czi7ie5BCgIrcRGk,7540
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostnetwork.toml,sha256=fNN6bPdNheQMWrnFEppaqQCgh-acQez2pTldJXBgltM,7629
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostpid.toml,sha256=tm6wJ4Z5sUZi4SLg4W54EKJRcZp3U9PlAspqS1HHiYc,8301
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_sensitive_hostpath_volume.toml,sha256=VnV8ENGLRpF-ubITDRU9tLhMz3YnIiL1FOtZDpwDA7g,9069
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_privileged_pod_created.toml,sha256=XqIDYNjtPgFnOk0p6s8frVqTrFGh2xS6cWDVNyf66tQ,8594
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_role_patch_wildcard_verbs_resources_response.toml,sha256=5bzYG-CcjKEtDnkcqScVEZiXWAqYNufimehAmqvJnYA,3988
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_sensitive_rbac_change_followed_by_workload_modification.toml,sha256=BOHKOKbPVsP9saErlhKOeLlayw7ZAjsAgcXTreJsKUs,7307
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_sensitive_workload_modification_by_user_agent.toml,sha256=iDPpJfxoqodU2A_zHuInJJJLZnMNteXmrZxHWIK3yCM,7056
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_service_account_rbac_write_operation.toml,sha256=yLMbYjs1GcsGhS49qAy2Corq9jB6iGyD6DyuD0t6RR4,6594
nldcsc_elastic_rules/rules/integrations/kubernetes/privilege_escalation_suspicious_assignment_of_controller_service_account.toml,sha256=VpSPGVmYcAYCDrTcwmjUhpApggEmsTWtK-MhafxcH2c,7439
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml,sha256=0TyqKXvbrhI3yf_H-RD0Lv47EEdLtsJA6NqUSjmRPV8,7672
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml,sha256=LDJKAQwPFHtV3vnMt-li8DDhJzokddyoD2UwyG6BNhI,7525
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml,sha256=oMN1FEwoAyZOqlCVDuIVh-WGgdA5NtctPpHdASy1q6s,7846
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml,sha256=sAlyUWlVFJ1OiHv0KwcNQEZOjIB9FyVQuG21wJlMa38,7609
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml,sha256=c-B3I3RpY_jC5r5kpP8qVVkIxkog8enfSFRwSBzVAc4,7686
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml,sha256=PqLpBWEgm2dYH4xnrBpKQXEjufhKxrfFbXaoNvQcaxs,7190
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml,sha256=prD2XKTObzxDqv5SqPm6IzjoVM-Lx0bmUQF3XftwUCI,7640
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml,sha256=5EvGerP_rsHYZKqY4hF3PLnAJJZcWLbFQ2hw7doIzUM,7445
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml,sha256=0N4TFZxt28Vc11RehWZFhLeY6s7t3XmqU2LzJkGLIn8,7527
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml,sha256=aouk7YIGBUyOgT33GP9xYLZNQJsN8PU7vm0UG_Zc3v4,7602
nldcsc_elastic_rules/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml,sha256=KYtLNpd7lohTLZHoepdCSvJUtMwrJ_Gl0ROTzu6jLGY,7596
nldcsc_elastic_rules/rules/integrations/macos/credential_access_potential_macos_ssh_bruteforce_via_security_events.toml,sha256=8VtXOfYEcrfbCuc56px9VrSSzi1wODrH6C83OH9I4FQ,7497
nldcsc_elastic_rules/rules/integrations/macos/credential_access_potential_successful_macos_ssh_bruteforce_via_security_events.toml,sha256=9kgBHHPGfdEdd5hXQQC5kuf6njQJc2dA0Cds6h5-Q08,7664
nldcsc_elastic_rules/rules/integrations/microsoft_exchange_online_message_trace/initial_access_azure_monitor_callback_phishing_email.toml,sha256=fV6TXPoWo3zI40EPAq1JpUqGRAyWDqS22c1DZ_6hHYA,6587
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_excessive_mail_items_accessed.toml,sha256=PiEeIH86gu2_o1-3nJOd7rHsopL78NUPcheooP3mgsQ,7700
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_mailbox_access_by_unusual_client_app_id.toml,sha256=UMxna5LSOxIbm-ylYeAEf1hzyIzxjrppXtlCGmSSW7c,13299
nldcsc_elastic_rules/rules/integrations/o365/collection_exchange_new_inbox_rule.toml,sha256=ECITC5PuwEeigrnb5A-ezZEo3mOLUUdZIFJ67xrlEAY,8297
nldcsc_elastic_rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads.toml,sha256=GmNBWa_xIHssoCbcBkyRdkjHU660jZqJse4Mg0mp8DM,8860
nldcsc_elastic_rules/rules/integrations/o365/collection_sharepoint_file_download_via_powershell.toml,sha256=mhEp82BBhGSdr7HWiHr4dsMqksM5WRYtYXP51sOTz_w,6212
nldcsc_elastic_rules/rules/integrations/o365/credential_access_entra_id_device_reg_via_oauth_redirection.toml,sha256=LwdgLOHazBHdgaaR7XPaRbJKQs9Lp3IzSMchqtTHKnU,5963
nldcsc_elastic_rules/rules/integrations/o365/credential_access_entra_id_potential_user_account_brute_force.toml,sha256=0CQCsYkF6iNbTiRL5csYi0h324-vak7DRiaqVnOqk_s,8913
nldcsc_elastic_rules/rules/integrations/o365/credential_access_identity_user_account_lockouts.toml,sha256=1h7YXs7EyspnNRIDbb_pDUSZVRdcNTgQy-IzkhsgbVo,7111
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_entra_id_susp_oauth2_authorization.toml,sha256=R0fpNiKfNbTwjvXYWfVCb42IjrBODoFRNLA8wXMui1A,10986
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_policy_deletion.toml,sha256=4cqNLsvZSIiC4gaPwrZxrIlCvJCIKtpQVyJV-bxziA8,6313
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_rule_modification.toml,sha256=LYyQaUT3RCcjcN4HDz5JbTTiG4dNfPDqCmrvnL2I1XY,6311
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_dkim_signing_config_disabled.toml,sha256=CefEj7Ki0cG9Br0zxmpV21Fw7LkYmaEN7JAMeDQuVNE,6978
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_dlp_policy_removed.toml,sha256=iTYCOixpI2bpMbkM5ca8sK5oaGTETkUBJ0jdhTWKBQw,5571
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_exchange_safelinks_disabled.toml,sha256=D0-cLY3BrFqJmPRbxMKh7hoS5EtTiqlQ5s6xoCfSJSE,6382
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_inbox_rule_obfuscated_name.toml,sha256=Ngy2l3Dfi5dbCTs3NS_oe1Q_tWwbGoubBU9iIHt6jG8,5638
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_mailbox_audit_bypass_association.toml,sha256=BBFNBpRhg-09_Eho8zYqVl3DE2uAmmDkMSCSX0P3fMM,6703
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_policy_deletion.toml,sha256=IpBFvK6b-SJqrrvxjDAx81fDMCi7MOjadLsksZ8szyE,6264
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_rule_mod.toml,sha256=mlt2868XqQfr-SJ4LwPn5EyLo0HG5wqBdWnEXIRaKoI,6403
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_new_inbox_rule_delete_or_move.toml,sha256=diPf2kDdrVq7csAL59vp8kehklpa1qJ1-PHx1YaEXeY,6625
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_exchange_safe_attach_rule_disabled.toml,sha256=-g25Ic-R6tAFNzX4eFBV_MazJzZWhI2EfPAk347t6po,6312
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_mfa_notification_email_deleted.toml,sha256=-ySreHLp9u8zeS3hBNTmp29-MkozcMuM4iucbb3btv0,6492
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_sharepoint_sharing_policy_weakened.toml,sha256=i6cF1Yr2Plo8cWbo0Inm_nd5c6eEAg5Fab_CgLF270o,7718
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_teams_custom_app_interaction_allowed.toml,sha256=KDZlxb6V2N9Mjg_j3_NMLyrOyCW10H-KrDwsESY4aDE,6935
nldcsc_elastic_rules/rules/integrations/o365/defense_evasion_teams_external_access_enabled.toml,sha256=VJPUpUzBlhdhUY8C-RURmkbHWUzuLQFBasaeiVjTq4o,5939
nldcsc_elastic_rules/rules/integrations/o365/discovery_sharepoint_sensitive_term_search.toml,sha256=e55iNyHkQnBitpvNxC3QgNu7CC6-lbTyAkPcJBfCdmY,6246
nldcsc_elastic_rules/rules/integrations/o365/exfiltration_exchange_transport_rule_creation.toml,sha256=4ZwcYH2ZjMQp7moczObNIyzypNcz5PG8fS7wjyqYQPk,6244
nldcsc_elastic_rules/rules/integrations/o365/exfiltration_exchange_transport_rule_modification.toml,sha256=RJq1flJO9rLEIEOBOzdf8jW9B3smXkU7I0btVQF34yA,6857
nldcsc_elastic_rules/rules/integrations/o365/impact_security_compliance_potential_ransomware_activity.toml,sha256=MJJNE16Ou5TJ7ezzRdkvfY6mYGYwg0MLmEKwIkpYmjU,5975
nldcsc_elastic_rules/rules/integrations/o365/impact_security_compliance_unusual_volume_of_file_deletion.toml,sha256=wFLxej0mnMtu53dSzEtRTCiWy1UazjguuJWISFX475M,6056
nldcsc_elastic_rules/rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel.toml,sha256=-gwDmEExRJYV8qZSgSrgzoApdWZ1gqdFKtzi7v2-hI0,6566
nldcsc_elastic_rules/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml,sha256=7kvVWLdE8Scc8yCxLkelhLDkV14fxW54g5gUNpVRRQY,5781
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_illicit_consent_grant_via_registered_application.toml,sha256=sa0QZEeK7TjNtdRPPo4sqAVhl59MkNT-OatHG11jka4,8215
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_oauth_device_code_grant_unusual_source_asn.toml,sha256=-NCVRLpm44VtmDP-nDcJJ8wRJhSdc__n5qxSVkTjMvw,8134
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_oauth_device_code_grant_unusual_user_noncompliant_device.toml,sha256=gQ8iEqe-RAjlFXITjtAs3qzY5pdRnmEWfcGkq6SrSUQ,8165
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_oauth_phishing_via_first_party_microsoft_application.toml,sha256=VQWGf1YTHkcvWRw7bJcOyPdLeQxuKqMt73ceDKAV8eI,9252
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_ropc_grant_via_legacy_authenticated_client.toml,sha256=pZnofI1Fgd1GhRNYE1UnhPP4F3BpIzOMLhiba-VQ_CI,6595
nldcsc_elastic_rules/rules/integrations/o365/initial_access_identity_unusual_sso_errors_for_user.toml,sha256=w-vyYlvOae8WKVv_fKYgG2cBiBXcZFDRF1IDwJqbWFI,7349
nldcsc_elastic_rules/rules/integrations/o365/initial_access_security_compliance_user_restricted_from_sending_email.toml,sha256=0Pue8pHJDFbJfuT10TBiUzRsNVingJmFu6i8wllZRI8,5821
nldcsc_elastic_rules/rules/integrations/o365/initial_access_teams_rogue_helpdesk_chat.toml,sha256=xITWFZN_jJyAoNvfyuiVwzf19xHvNRSXkn7_9SmnNAE,6423
nldcsc_elastic_rules/rules/integrations/o365/initial_access_tycoon_o365.toml,sha256=Q7bCo4IU94tVVoGAgugOl3dpP-dBsnawxvwvZX_mjeM,4540
nldcsc_elastic_rules/rules/integrations/o365/lateral_movement_onedrive_malware_uploaded.toml,sha256=boqWyVbVzVqW4U33eYgjifTAoeFYbW2HYxh8dVTxGbw,6852
nldcsc_elastic_rules/rules/integrations/o365/lateral_movement_sharepoint_malware_uploaded.toml,sha256=qaRwafEYCLfU97FHxTwgo4_JgfHDaR5CrFcQnLuz4II,6856
nldcsc_elastic_rules/rules/integrations/o365/persistence_entra_id_global_administrator_role_assign.toml,sha256=KaEECqe0RSHFIBDU08r-98kkK4bMytnZ-JZnOsMtIdw,6094
nldcsc_elastic_rules/rules/integrations/o365/persistence_exchange_management_role_assignment.toml,sha256=0iZ5ApsaDCGpCZl9Z8AkJLVtq9ocZk85IjFVRN0ms1Q,6390
nldcsc_elastic_rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation.toml,sha256=iZ_K-ohUZcwxwjgN6Wxehhl-phfPD0NQ7NxuKyCXxDw,6613
nldcsc_elastic_rules/rules/integrations/o365/persistence_teams_guest_access_enabled.toml,sha256=oflXM377-w-A-01fMXrPl65poDLzqLUTDpR2uldoJUA,6188
nldcsc_elastic_rules/rules/integrations/o365/privilege_escalation_exchange_new_or_modified_federation_domain.toml,sha256=fcRT34zCw9DSr6Zb_BjuVHAgr57-U_O0KUQ_scGX6Oo,7193
nldcsc_elastic_rules/rules/integrations/o365/privilege_escalation_sharepoint_site_collection_admin_added.toml,sha256=o1fTi6drUiobp6o-T0xO9JaJUKkGfzuv5QL6Nz-AKDY,5925
nldcsc_elastic_rules/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml,sha256=bSTtbhAyLTFAmhxhhTezWJUDcbAS4E1DPAsKV5z6iVg,4736
nldcsc_elastic_rules/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml,sha256=Ep2feW6aPtNYA6EarD2Rr3whhL78EMlqaVvYkSItcI0,4939
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_auth_events_from_single_device_behind_proxy.toml,sha256=CW0e8_hV0jUE8Mk2IvdbjNWcpohe_MOfsRB3FesSZkY,7134
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_device_token_hashes_for_single_okta_session.toml,sha256=wq3xlgZXk7ud-FM30voWwYT-vXlFgx-BQqnCUYIgCDY,8802
nldcsc_elastic_rules/rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml,sha256=CqLqS9MRSoAPblfQCfwsyM3ZTC_BfuH78JVf2ChwQn4,4897
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_aitm_session_cookie_replay.toml,sha256=eaLAt_Qn6g7GvVgHY-j7AZXBnrJimlUlQzwMEKi0SC4,9646
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_with_the_same_device_token_hash.toml,sha256=8FI4xBbNJ-oDM6b8hODcvsEvPXNCW-zRnycUD5bVYpU,7849
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_brute_force_device_token_rotation.toml,sha256=3hs0SUtdBiTHNqbrQeEwTQKEce2DhfI7pNrrj_rPe70,6865
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_brute_force_multi_source.toml,sha256=YheFcecuUeklmNxkHVEbY06trJJ73-sfWe-PL8OZksU,6472
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_credential_stuffing_single_source.toml,sha256=nY21N4PmVh5C59u5zf_4S5d8hhKJ_Bhpm_FF0lhnAJQ,7919
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications.toml,sha256=29cBYI17saqt48Gqf4FgwT8mnzzyK612SPBmNRXkIKw,5502
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_password_spray_multi_source.toml,sha256=rQ5XI2WLqQAqFiXF1saz300q2d-3vYQiCkEbD9Czb0U,6796
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_password_spray_single_source.toml,sha256=QmPQ20BSpE87kk-EgcvrFIUdcBoNLjMEq0hb5r6iqY0,8140
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml,sha256=4nXZBC7RlpUzcOLQ6bUL0uigBFojvdcY_8jlMhGrQYA,5649
nldcsc_elastic_rules/rules/integrations/okta/credential_access_okta_successful_login_after_credential_attack.toml,sha256=_I9v2Bc2YzUI46M_HaUV3ckBON9s0x9w8-SQu709dYg,10118
nldcsc_elastic_rules/rules/integrations/okta/credential_access_user_impersonation_access.toml,sha256=iO32LBAvIgp0K5I6lYGNdjVohZrpOtx2gtDuFXUq74Y,4490
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml,sha256=-_Lp86PyW23oqCf8NGYMkS0ynfoGzsIzSeRs2wVlTq8,4790
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml,sha256=4-5-ZXAomb1qkj1a9YXZR4p4ycEzjbYtrO0yTZ09gG0,4521
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_first_occurence_public_app_client_credential_token_exchange.toml,sha256=fux4gciCJJo0UwyspR7TK-wFNVz1mefe-ubBYUUZKSE,7266
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml,sha256=kmhoubJxjJ0JwzHZVNhQ9mF7COR0-fAOb4MuHT8t7FM,5681
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml,sha256=BPBTOEFvsgQANpEBwfKqw8kl-yjW2QluuHAZrVKIfSI,5506
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml,sha256=X08bX3mWldSw9WbuB7ZcbdUL3TFT19_jHyVrtSneb0M,6009
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml,sha256=z8MQrOO2D4MLi_9_mWqvycmqLQu3dGd0PXn9nJ3g2CE,5332
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml,sha256=ut7FiMw_PK8Ze6k6c2GQv8t5RiaSXiHnrJNX8FDETZE,5346
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml,sha256=n2XlD62Gb6UnW3MZ3dW9mSsbI2kokM5x-GBaGfpCXLI,4623
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml,sha256=Tz6xRFio1Yp0dAQiuY8zmP3g4-ilZT_gpSZqV8S5eC4,4909
nldcsc_elastic_rules/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml,sha256=2OVFL0m8q1FOXusmNk4NA0dA7NBGVD3abEo5GpHccCo,5918
nldcsc_elastic_rules/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml,sha256=PPoM6ce6H2U5zeJmAr0mccjM0Adq0LutjK9tSFnUvow,3763
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml,sha256=9OZ91gKUN6uzubjwXY0xQvIdGPJ58bJl8JDejwCc5uQ,4531
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml,sha256=FFcztcOIf7gQXHR4QRA5_giXs2v9PBYgdgw63VgOieE,5922
nldcsc_elastic_rules/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml,sha256=-AfpemH--llP39UqS1jXW8TqZuEqfkPvLx5nYrzWcl4,5830
nldcsc_elastic_rules/rules/integrations/okta/impact_possible_okta_dos_attack.toml,sha256=iEUt9gBpY5M2G9t0Nx4kwpgbD53ZnoClLfcwYHHPyDc,6487
nldcsc_elastic_rules/rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml,sha256=DJPYMceWj_lHWV_V89RuHTeWStvD_iVOvPbAbsJv8r4,4761
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_fastpass_phishing.toml,sha256=NLa8jUG4trv2aTGSN9fg5_eh13PkcvKpqFx-IbGfrhY,6371
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_suspicious_activity_after_proxy_authentication.toml,sha256=jcIGYzYCEJmK641zyElZ4nOoQaravEm4K3C1tWEgXUw,4975
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml,sha256=MkUUdZnPr330LF49-VN4TidZACsENgAPJomYvoLVSec,5951
nldcsc_elastic_rules/rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml,sha256=lz7lEmv2Cf3A-Nc7otLYOmsX93grjiPLNhop63aeUW4,6516
nldcsc_elastic_rules/rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp.toml,sha256=VOeZNhv_0Ol5LkhI2G7Vx8HH1Tu4ghvVU7-hHEwi7KQ,6651
nldcsc_elastic_rules/rules/integrations/okta/initial_access_successful_application_sso_from_unknown_client_device.toml,sha256=W5c2OICSVnKYuOIn5mbPgIBzhQr0AOz_edwLc5pvGbI,6081
nldcsc_elastic_rules/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml,sha256=SdAQUyMUReGnMAzNphVlEZCi6WTG4jwmPU9VOqrjw6M,6745
nldcsc_elastic_rules/rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml,sha256=q8ssludAkSDkkc3UBEeQyXi2ROCLKNJYx1mm0Y6nc7w,6585
nldcsc_elastic_rules/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml,sha256=eviWFTIe6FEcNvG8uLqQnWY5TXqnfCqRVw1u4NyeOhg,2571
nldcsc_elastic_rules/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml,sha256=qxMtAs1Q8RtmbuLJGMKbLVTtz5ogSVD0N8_pS62Yb38,6604
nldcsc_elastic_rules/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml,sha256=JqJQ0NFYsEPfdmdatRjT0atcliBj9Gb5S2cZnldfTSM,6740
nldcsc_elastic_rules/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml,sha256=ofh5GyxlTXZMHHhU9scLPxNrKoLCUEgQru3WfJxMq_0,6036
nldcsc_elastic_rules/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml,sha256=zbStzYS4zr0bnjyB-FrdtNezJ__yDP8NskMJpe7xAUU,6268
nldcsc_elastic_rules/rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation.toml,sha256=bdNFTAvEa84Gc1N9Pu_wTa_N8YosB9NWKv41ddUEuTM,5507
nldcsc_elastic_rules/rules/integrations/okta/persistence_new_idp_successfully_added_by_admin.toml,sha256=blLWiHTd9yINaVNXaVXJ8GAEIAYvsaNmd7ckkTG4tzg,5253
nldcsc_elastic_rules/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml,sha256=AFu0P4p4qVbXQmbh6hhiV8811hSnLIt3xvk__HIRWV0,6714
nldcsc_elastic_rules/rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml,sha256=75IXald3EpRcXnYQeualgZeZGBVnDbXVyLsrXcAST8E,6024
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml,sha256=xBoFrcDgiLJeEq1irkFrIbscdgvybhQ8ut-cwQW4wuE,7592
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml,sha256=A-upCbEyeRwrahG2fwmSSwZCCBSSvrttoXZCS6sBFvM,7247
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml,sha256=Qz7cNHt43Elb4ppL0sBa8u67g1KNzqxzRqXXWXFgAGw,7067
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml,sha256=Drzn8YWDqkAcEgBuvjmqO1EABoQ6MpKf1GzzZpXVkpY,7628
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml,sha256=j_17kCOkaG8mIEA60LedhXX2YCS4_D4CbFlz_0uHm7Q,7583
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml,sha256=9-7lGiB-jbGNRZ54uBycLmSRyEXBPTpearyjC2mtwU0,7490
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml,sha256=-ZdCs5fszNsDOQqz1YjkVmZLeG_TpNYxQlFSclfjgZs,7135
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml,sha256=iy1yj_PH5O6r3JtBIHIrOdzD83gdF_DgZWLss6_sEI0,7195
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml,sha256=uP6p11FvEQmydFS8dSoJWeFnxxHh8-8Fe8z-bMDBeUk,7826
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml,sha256=u90waGw3ZqygXMfru8E0bvRU9iqbJLcxZaN-_XOjxgA,7312
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml,sha256=EDo3oszWfCqaMF2NVvcjhLagVbRmBm-KRiPBeCFo6sQ,7175
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml,sha256=hV2wmAi4Ju-aggIARAr7P7uwIxcfecB7qZo5REsTqLY,7394
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml,sha256=zOeJ0Ipj5gIwqKtUn-hR1f9Iwvv1OywNpBvL_pXIg8c,7433
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml,sha256=Qmz0RL6EPZuF-TDEYWCSA3-ycYxF1zTFYRr65hg5Cgo,6995
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml,sha256=jl99dbpUEGQXUwJKq9STcHIuRRNRkKL7UJXFnJSTFJI,7399
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml,sha256=g1sUDepSBdB-aQHsH64UQ-SblIu72krYaXyUzZbuKe0,7856
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml,sha256=2Dm0ym2-_sG6ezAK5sW6-VE0eGKcQW_fS9kyJYODWng,6986
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml,sha256=ocLvF53T460yMeqVDScTpX7CeSbX9BP84XojEkw36vE,8419
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml,sha256=psDzMS9Wv6PHpdxJ6wXeMHzCuDVeP30aWdcHgujvMrc,7503
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml,sha256=bC4FTi0ZsDobZ-FKcXXQLMaCmEMdIv97dXQO12SAhIQ,6960
nldcsc_elastic_rules/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml,sha256=sFmBx_mQuBxPwI0SOPckR6hWE6jTUf_1nlTgd_Q7fxg,7238
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml,sha256=5WNbgXdjpEvUHpZRq84NbhknEvdOiBy8eh1CywjG89U,7288
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml,sha256=rugvRCQdyW5Wq93YfgnO9zKZYxFJFsDS-uO7IQNfBjs,7391
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml,sha256=uTu5u2XQjgVNjiES9g310ZrpcazB1PiJx2aAi5siqh8,7558
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml,sha256=g6dK3QRum61tflAStP04yWFCkpVQhkbvVYw0OlcNQkM,9279
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_low_probability.toml,sha256=ICC1LuyD8m-ld_vPe3nUJvOlqssjAkB2Q5MqAuhWIBs,9157
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml,sha256=Tb--83dhJTJyC-8b4NWWC-YfkD1E27tjaqWEBRCPY9M,7773
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml,sha256=QQhhZ_VxqU_k2cRaXWvPZmMqe7NmZMff5nbipfMHpbU,7964
nldcsc_elastic_rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml,sha256=iQDWqO89U1MRy9Q6pJzPaR7hqKheq8ol6jLEyVy2Tpk,7708
nldcsc_elastic_rules/rules/linux/collection_linux_clipboard_activity.toml,sha256=LNmjXhjTTl-5cdZsN91waC0MWV6d2bse0fzbP3gb670,6029
nldcsc_elastic_rules/rules/linux/collection_potential_audio_recording_activity.toml,sha256=RX77kOLhRISYrBs7MGskbe3lwb0bJiR_LKLPESnjJ68,6216
nldcsc_elastic_rules/rules/linux/collection_potential_video_recording_or_screenshot_activity.toml,sha256=E9f8mOsOeUYTeW08SODkwL6aAFaQIZYmngno15cWDxA,6175
nldcsc_elastic_rules/rules/linux/command_and_control_auditd_curl_wget_from_container.toml,sha256=r2VXesm-w3UBlRr7lJ1yUYIAoVywz0hhljrSS_D8ySY,5516
nldcsc_elastic_rules/rules/linux/command_and_control_aws_cli_endpoint_url_used.toml,sha256=-5xqoz7o0oPPRpkIotbEjXZNMTD7b87xdaWF5j3QviI,6333
nldcsc_elastic_rules/rules/linux/command_and_control_cat_network_activity.toml,sha256=wThEhDW7AjKvc9wlYuBu15bQ1eKKjlCJ3zZeb5IAeT4,10514
nldcsc_elastic_rules/rules/linux/command_and_control_cupsd_foomatic_rip_netcon.toml,sha256=K-jxAJ46Kb2y127xs3iUg2oQl47RaRv2c6pDR2phZXg,8706
nldcsc_elastic_rules/rules/linux/command_and_control_curl_socks_proxy_detected.toml,sha256=Kwl22v4ckFasy-hGCJK3VbEVNRxaL90QV0YSBVJu0tI,9755
nldcsc_elastic_rules/rules/linux/command_and_control_dns_query_to_sus_top_level_domain.toml,sha256=db8Ugjj9Tzef4dnMEqFvt4MkPRoERZCH79KZecvCcx4,9027
nldcsc_elastic_rules/rules/linux/command_and_control_elastic_endpoint_shell_execution.toml,sha256=IWFnQWHObZRl-_gkubscTwMjsTxBg4JwhIbpJvfOe_U,9182
nldcsc_elastic_rules/rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml,sha256=1hyZ1L5vPAXVlQyBAez_PDXbukaMW_DWIRHsDh68UKQ,10228
nldcsc_elastic_rules/rules/linux/command_and_control_git_repo_or_file_download_to_sus_dir.toml,sha256=FYU6eAtirwL6ZtPXklABo3ltTp5wnnT09PAvcUiO3rc,9340
nldcsc_elastic_rules/rules/linux/command_and_control_ip_forwarding_activity.toml,sha256=SlGg2PTZcmskxqHzXFHag08J6XuFxBqPmthcIALT3Us,6950
nldcsc_elastic_rules/rules/linux/command_and_control_linux_chisel_client_activity.toml,sha256=6Jfqwg5dYzaYyF42ZO7P7fB3fUf-9KOKOdUxkGrclU4,10689
nldcsc_elastic_rules/rules/linux/command_and_control_linux_kworker_netcon.toml,sha256=TxHqsvh-wHq25INzYjlpik1MyMw0MSp5DQCeV3WTtbU,8736
nldcsc_elastic_rules/rules/linux/command_and_control_linux_proxychains_activity.toml,sha256=gggER7A2C4wypXpGUPE2NlA1HTfCsvW05lnN0bYEmEI,8221
nldcsc_elastic_rules/rules/linux/command_and_control_linux_ssh_x11_forwarding.toml,sha256=C6tVzW_u65sUXHHLtc0DM4BeJrvfeE3CHNuFEzowgks,8100
nldcsc_elastic_rules/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml,sha256=wV9wntGu2PPKqSQGWw-oEfr-nhHI1wZXuW-P3lEb8-Q,10711
nldcsc_elastic_rules/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml,sha256=EJqRr8R8IGqTtY11Z1I_2F73DBcJFcsThNLh98efgS8,11884
nldcsc_elastic_rules/rules/linux/command_and_control_linux_tunneling_via_ssh_option.toml,sha256=0dmxz4I4dSStSRsqmqjTbqISgiwUT3yaNmAkmLhGEOs,8590
nldcsc_elastic_rules/rules/linux/command_and_control_netcon_file_creation.toml,sha256=NJANuaUzN2B5VeHn58j3eCLEUnawRou_PnM7hBbNKQM,10460
nldcsc_elastic_rules/rules/linux/command_and_control_potential_tunneling_command_line.toml,sha256=FTRzKEVibz-i6WK2OGzpycK6tscP4cQwuwMDqo93r2Y,10786
nldcsc_elastic_rules/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml,sha256=fLd5Iw-iOuidfzBGvkrLr5-RvRRY1JfHy3hqMbIDPTY,15832
nldcsc_elastic_rules/rules/linux/command_and_control_telegram_api_request.toml,sha256=9P3wUyhTQ_yZ5jFDTlr10UKwHvOerIums6aqxh0c2cU,9113
nldcsc_elastic_rules/rules/linux/command_and_control_tunneling_via_earthworm.toml,sha256=JqFSB_d-byJEOQR7aZHtgoY92nwpgPl_BbCiurgXRIw,11734
nldcsc_elastic_rules/rules/linux/credential_access_auditd_sensitive_cloud_and_host_identity_file_open.toml,sha256=9_kHH5Z3GPSpUCJEibZm2pu1N9bCWSzuGal_vJyJTlM,9857
nldcsc_elastic_rules/rules/linux/credential_access_aws_creds_search_inside_container.toml,sha256=fDN7FvFcUO1JHg1bSxuSTsaAN38HtXFYAKYUi29Irdg,9051
nldcsc_elastic_rules/rules/linux/credential_access_azure_wireserver_openssl_cms_decrypt.toml,sha256=VHe6IPa55Ljq2pJZtdcRyarwR6Iz5SUFyjWrkMAPa6s,5319
nldcsc_elastic_rules/rules/linux/credential_access_collection_sensitive_files.toml,sha256=vAau7HLvTQJtZdSyCYd3j1fjTgnvdPkGSvVNseIo8Xo,11258
nldcsc_elastic_rules/rules/linux/credential_access_collection_sensitive_files_compression_inside_container.toml,sha256=mGCYNlAAtqV8Iq1PrM65RYp9qeBRCAulQK0-Bjccl9w,8696
nldcsc_elastic_rules/rules/linux/credential_access_credential_dumping.toml,sha256=G4jl8Rv6FFKYSOewcTMUlCSt2Z2hzYk2BI_ukozmcCQ,8569
nldcsc_elastic_rules/rules/linux/credential_access_gdb_init_process_hooking.toml,sha256=CilDggmE7T1dBOKGyfL3IG5US4SwODq5ZufTxRo4GBM,8417
nldcsc_elastic_rules/rules/linux/credential_access_gdb_process_hooking.toml,sha256=84F6ZV6I_2Gbfh0WLk4hB3cVJSwZPrI72709AEmbol4,6513
nldcsc_elastic_rules/rules/linux/credential_access_gh_auth_via_nodejs.toml,sha256=w4-OXiqTfYB87b2tUhIX4NqmmOnSgbn3-flefQHJjyA,5216
nldcsc_elastic_rules/rules/linux/credential_access_kubernetes_and_cloud_credential_paths_via_process_args.toml,sha256=iRSrZGJz4BToEnCvsj2Bp_kLJX7E0gluKGDHS_16Jow,5483
nldcsc_elastic_rules/rules/linux/credential_access_kubernetes_service_account_secret_access.toml,sha256=Xds_H1ummfK0lXrdWch7YZnEnqQ_tDGfIVFic9ArPLA,10110
nldcsc_elastic_rules/rules/linux/credential_access_manual_memory_dumping.toml,sha256=kQutwGWPK_hv60oGVphovlqJE3ZcVN6EVzngqJvq2ec,9120
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml,sha256=AK-YCeKjyjJZ6auPE0NbsHnUQvXNXXXT8pwt6-b4AhM,9035
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml,sha256=IFU0WuwCJ-djDkpjiNWiutQiu6Seifw1Bb4MB2otllU,6466
nldcsc_elastic_rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml,sha256=q9ILtHWAT2LARji-uKkkHuz3moLzX-UXw4qaaHWBbtM,6442
nldcsc_elastic_rules/rules/linux/credential_access_potential_password_spraying_attack.toml,sha256=0igbT1LqPslFnHfKnqsn0qTL5bz2zdhb-mgM7KZJEY8,6590
nldcsc_elastic_rules/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml,sha256=Xg2OQZg8ac5GaOs__DkCKTeB6aL5s-GXhmb8wxjnR0Y,7310
nldcsc_elastic_rules/rules/linux/credential_access_proc_credential_dumping.toml,sha256=ei0mK-UutCcrMXKIo5txSAuYahn3B0SughWZ83MyxII,9327
nldcsc_elastic_rules/rules/linux/credential_access_segfault_from_sensitive_process.toml,sha256=_W5tOMl9CK0R7grCSn-tOsec_N8AImeIjA7WMpYt-jg,7116
nldcsc_elastic_rules/rules/linux/credential_access_sensitive_keys_or_passwords_search_inside_container.toml,sha256=bGkG6k4X_ygXDr__4SRGL1iez4kfNwALDMkjJx0rnKM,8675
nldcsc_elastic_rules/rules/linux/credential_access_ssh_backdoor_log.toml,sha256=tRxmN_42JCGp1y-fNfKn9KVPWpGRvcIX3vJc2My3gOA,11617
nldcsc_elastic_rules/rules/linux/credential_access_ssh_password_grabbing_via_strace.toml,sha256=11ivfE9udSPMY1twtdowbS8M33HRoz9_x0-P71D3Z50,5841
nldcsc_elastic_rules/rules/linux/defense_evasion_acl_modification_via_setfacl.toml,sha256=-Dq4T0k7k_1m1HzpSI2tLJZBi-S1IExmA9eURxVNoiU,6277
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_exploitation_via_sys_fs.toml,sha256=yIurqlUD_3gSDnFh4gkXeE8kwW35yxm6iZvsqv0QNuo,9384
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_policy_access.toml,sha256=JfFf3S4aRQ1VYwlO3XPxjd_5Yu8rQm5jYoJcdFD01IE,8481
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_policy_violation.toml,sha256=uNKDRHiSzbjBtGoRCd9aeEfXm8-vGSy2g3SPhNWA3Gc,7852
nldcsc_elastic_rules/rules/linux/defense_evasion_apparmor_profile_compilation.toml,sha256=0RE6DMtXPUk93x_WNn9GMPif-W06oOcK2FTAIU749rc,9057
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml,sha256=O9AMMzF-iTIoojSPychuI1A3NSfMTcbk5wgddsr3Z9Q,8279
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml,sha256=IJQdPYrQagniCys0RLGXtPVpCWzrHFyA9mL5Cu1s_mA,9276
nldcsc_elastic_rules/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml,sha256=3pg2skTiKT0_K6snMFYdqfC9l49TdhitdzT0yrwKZgc,10354
nldcsc_elastic_rules/rules/linux/defense_evasion_authorized_keys_file_deletion.toml,sha256=U81HQ-bauWaELikC5odssHkjx4AwcqicsfjGMT9o_q4,8246
nldcsc_elastic_rules/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml,sha256=U7xasl7y5xxhjDi7vqQMT4ED5SeHZyoBaSLXRAzCG4k,10301
nldcsc_elastic_rules/rules/linux/defense_evasion_base64_decoding_activity.toml,sha256=OBkhdBpPH5LynBeSOEUAVLr1SL_Z_2VvbBm1kzIOZOQ,11313
nldcsc_elastic_rules/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml,sha256=7M1XAUP6JFDIPlaOrwYxX8XJO0AlUyocLPs3eB6Yd_s,8536
nldcsc_elastic_rules/rules/linux/defense_evasion_bpf_program_tampering.toml,sha256=o_9aUPOdY_smqjaanXyxgLSBM4fj4VaWliHwHj2F-Vs,6839
nldcsc_elastic_rules/rules/linux/defense_evasion_busybox_indirect_shell_spawn.toml,sha256=eG0cITNohx5oF_Ulk0w1GR_Ne4EgSluzGjgItrddU88,8996
nldcsc_elastic_rules/rules/linux/defense_evasion_chattr_immutable_file.toml,sha256=ht71B7tYxpeeORh7eszAFPZsVDwZX4otSGmWSrQkqPg,10538
nldcsc_elastic_rules/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml,sha256=NAW9lpnKiqO0G5tox-JDa61xPU0qaPR-AJh3Qfvqlik,8164
nldcsc_elastic_rules/rules/linux/defense_evasion_creation_of_hidden_files_directories.toml,sha256=_UUIATds-D2vy3TSFZF85RtIlX3DAYU3RtfJvkUmm2w,5647
nldcsc_elastic_rules/rules/linux/defense_evasion_curl_or_wget_executed_via_lolbin.toml,sha256=ssj7K-I0REm2wM0mfjjhRqDAKCAtj22mihxpUYcyWW8,12798
nldcsc_elastic_rules/rules/linux/defense_evasion_directory_creation_in_bin.toml,sha256=ojykpCYf6OZ2-RJc8lb-sphLXKNWE8NaHGMxA7-BAIY,8801
nldcsc_elastic_rules/rules/linux/defense_evasion_disable_apparmor_attempt.toml,sha256=CtKIj7RAtyW94xiI479awafFspCf6yXbfMkdNL8uq-E,8837
nldcsc_elastic_rules/rules/linux/defense_evasion_disable_selinux_attempt.toml,sha256=IWC-Pniez9vXF7v5z8-tENCFlt70o_rYhaI13SN_PcE,9383
nldcsc_elastic_rules/rules/linux/defense_evasion_doas_configuration_creation_or_rename.toml,sha256=lCv-6mGsK_1ZrVIYPEy1l50CKd4Zer8CS13e_7Zkv3s,8143
nldcsc_elastic_rules/rules/linux/defense_evasion_dynamic_linker_file_creation.toml,sha256=LQsXfj2OleckOiXwfgdqpDHowV_IsdnGsNtVX4HttY0,10828
nldcsc_elastic_rules/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml,sha256=FromAI652ArQ76-GjaGWUjpZucoq8x7GVGPivTl0sIk,8510
nldcsc_elastic_rules/rules/linux/defense_evasion_execution_followed_by_self_deletion.toml,sha256=XEV-4CNYl1a31y9IknmGk7vfYMX-7PWFZu5_4FHxQcY,7641
nldcsc_elastic_rules/rules/linux/defense_evasion_file_creation_world_writeable_dir_by_unusual_process.toml,sha256=L_46JivoDQmfwKLjJhmqfBFiRAv5a3L29mp6CqBSbsA,9403
nldcsc_elastic_rules/rules/linux/defense_evasion_file_deletion_via_shred.toml,sha256=LMWpi8elreG3-yg_-EdJbg2w0JPxg8xq8nXnF6Z54rs,8197
nldcsc_elastic_rules/rules/linux/defense_evasion_file_mod_writable_dir.toml,sha256=Wq_KBcq-huNKOqruqPbKOOGth-F27O_pQ7PqRT2aLDY,9946
nldcsc_elastic_rules/rules/linux/defense_evasion_fileless_execution_via_o_tempfile.toml,sha256=FOGVKfEQJE423AlGP6lp2agtYRTITn68JkHXvh9f_X8,7927
nldcsc_elastic_rules/rules/linux/defense_evasion_fileless_execution_via_unusual_memfd_create.toml,sha256=noQY3pVzAxrQ0JtOM-lMblwFJ2Nw6ShimdxKC4-b4H4,8637
nldcsc_elastic_rules/rules/linux/defense_evasion_hex_payload_execution_via_commandline.toml,sha256=9V97KT9-tRswTvpvpt6mqTxcShX1S4bmxK5KfHnumog,8827
nldcsc_elastic_rules/rules/linux/defense_evasion_hex_payload_execution_via_utility.toml,sha256=PxjC_31zo3Dn4bSzoWuBkm-z69JDZ4W0s88aUK3C7y4,9773
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_directory_creation.toml,sha256=2d4ijzajj4mANHOk2PB7FRNU0Atbf7NCiQXTqK3nRgc,8847
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_file_dir_tmp.toml,sha256=mFjoLYohWc3i29VpjujKL-t8AIyeGnXgufBkmPt2a8I,10346
nldcsc_elastic_rules/rules/linux/defense_evasion_hidden_shared_object.toml,sha256=4aHUe6S0_73FwfWD5In49R88Fu6a_oDp7BxtVOMP2bo,9550
nldcsc_elastic_rules/rules/linux/defense_evasion_interactive_shell_from_system_user.toml,sha256=nKIlm4OOc8MVP1ftWNio_a3lI3e8HMN5lqsSLQyHDdk,10271
nldcsc_elastic_rules/rules/linux/defense_evasion_interpreter_launched_from_decoded_payload.toml,sha256=pM1PS5LtqbmNF-Qs7_PCvy1RNXrJ2XgOzsTMJ7cmDOw,11144
nldcsc_elastic_rules/rules/linux/defense_evasion_journalctl_clear_logs.toml,sha256=8emP_jiTSZMpbOZyPJdfmiikmXr5kowKIo95gHqDS10,8639
nldcsc_elastic_rules/rules/linux/defense_evasion_kernel_module_removal.toml,sha256=2_tPCLYRIxIbEjhs8UdERsmm4w1CZwXPIHG66Oz6Yv0,9187
nldcsc_elastic_rules/rules/linux/defense_evasion_kill_command_executed.toml,sha256=WLs7K6-_hVTtNXXgLFPIQo1xzM0ANvAn4FVAcjnA81E,9678
nldcsc_elastic_rules/rules/linux/defense_evasion_kthreadd_masquerading.toml,sha256=OAl3C7vFdGWimrHsbP92ACQY3isBS6MLZcCADx4knU8,8620
nldcsc_elastic_rules/rules/linux/defense_evasion_ld_preload_cmdline.toml,sha256=X28q3kVAKISqNNdkLAEhD8eNYFuPystpXW05HoQ31mk,10001
nldcsc_elastic_rules/rules/linux/defense_evasion_ld_so_creation.toml,sha256=yy2SwfRn4gVz1rTUTKudWvqBfjdnwzr3DIZSjzIe3Tw,10510
nldcsc_elastic_rules/rules/linux/defense_evasion_linux_firewall_rule_creation_or_modification.toml,sha256=lwrbpTkccZH48aMXrG6-GCGXL9YYzrn_5CKn4J0Lcy0,8836
nldcsc_elastic_rules/rules/linux/defense_evasion_log_files_deleted.toml,sha256=i9R3M7VQoWYVIAVsK7-ZPHARMgglEhg1w9BzgpkUEVQ,10271
nldcsc_elastic_rules/rules/linux/defense_evasion_lolbin_so_load.toml,sha256=Q4TChyMwgYRun9xmnaRMWvOlai_UYAvbXbcNnQuQ11U,10449
nldcsc_elastic_rules/rules/linux/defense_evasion_mount_execution.toml,sha256=baPfi6u_j_f5IOKUoEahxt0yYBZxxwfUFoERt8-e0dY,8576
nldcsc_elastic_rules/rules/linux/defense_evasion_multi_base64_decoding_attempt.toml,sha256=YfUacQmJ6PIsnmAKzxkqnYrsXwahm1-TBLRShVDfU4s,10183
nldcsc_elastic_rules/rules/linux/defense_evasion_potential_proot_exploits.toml,sha256=KTfWnK3vh1nDxKzyrO7eD8qz_1yaRl4X_PHhJFO_N0w,8521
nldcsc_elastic_rules/rules/linux/defense_evasion_prctl_process_name_tampering.toml,sha256=z1-eKpuFuLSyt67Wen2oQOR7oU3CXL6D9kuNmXWXuJY,8026
nldcsc_elastic_rules/rules/linux/defense_evasion_proxy_execution_via_systemd_run.toml,sha256=4NSGPKWVFSUc4M7oCv_xFL-AquuyVV723WbA50-VxR4,12267
nldcsc_elastic_rules/rules/linux/defense_evasion_rename_esxi_files.toml,sha256=G2mnNfS3CZBKXdRuwtmaC52DgYtDk24TpqfJVeoxjnI,8736
nldcsc_elastic_rules/rules/linux/defense_evasion_root_certificate_installation.toml,sha256=RYwmD403w4_1bR4bglN30omUP6CtRc2giq1hWLuIkzU,9297
nldcsc_elastic_rules/rules/linux/defense_evasion_selinux_configuration_creation_or_renaming.toml,sha256=SdpLUpIJWh5X9Ih54Uk62W8ah932Sb6zr-qCQ5A4u98,8519
nldcsc_elastic_rules/rules/linux/defense_evasion_shell_history_clearing_via_environment_variables.toml,sha256=3Dh6G0MdTDcjYMX5AFdGFibUCCPrMJTTfn7HBjFN77Y,9393
nldcsc_elastic_rules/rules/linux/defense_evasion_ssl_certificate_deletion.toml,sha256=TmS9RUtAeaTO4910pOeK2HVsEptHNz8sQo9Dg8LM0DI,8235
nldcsc_elastic_rules/rules/linux/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml,sha256=DrBulx4CRWnLCkqW9Ok03YfPTHazGdB6gM4f3fh_VBU,7029
nldcsc_elastic_rules/rules/linux/defense_evasion_suspicious_path_mounted.toml,sha256=1ZWbguJaFHME-W_76_cdjymOG_FYZY8zjehlYd77GBc,7935
nldcsc_elastic_rules/rules/linux/defense_evasion_symlink_binary_to_writable_dir.toml,sha256=PN0bpre70UwEJydDWKfpP7GyXacmO6QS_O_HsJeTgI8,6863
nldcsc_elastic_rules/rules/linux/defense_evasion_sysctl_kernel_feature_activity.toml,sha256=lgAbz76Qtq_I7XoyzAMclE3MnNvohPqu7tBGafIX8tw,8679
nldcsc_elastic_rules/rules/linux/defense_evasion_unsual_kill_signal.toml,sha256=2jlWRF8KB5h1F4tvDHKIStewjlAAwiNgqbGPWzBBUnM,7187
nldcsc_elastic_rules/rules/linux/defense_evasion_unusual_preload_env_vars.toml,sha256=qxf2CCwVEoKFley7YqZOh4GrXcADUHaw-df3gGgc_hM,9747
nldcsc_elastic_rules/rules/linux/defense_evasion_user_or_group_deletion.toml,sha256=thuWEcuPYWlImd0g4Vppk-x0M8g3ajV7S8-e5sk1TiI,7366
nldcsc_elastic_rules/rules/linux/defense_evasion_var_log_file_creation_by_unsual_process.toml,sha256=SKwyF3hV6DPzWPtiNjApPVdeZAaYhFfvqoXmQjcpnBw,9267
nldcsc_elastic_rules/rules/linux/discovery_curl_external_ip_discovery.toml,sha256=X5fhR0TOJI8dM36Cy1aaDFodkQ7YkCyulQ89jDtOiBA,10318
nldcsc_elastic_rules/rules/linux/discovery_dmidecode_system_discovery.toml,sha256=iZu4tvfaXeM9qDtuhRCunqljvQJ8q09H-GUSnGZDmeQ,9708
nldcsc_elastic_rules/rules/linux/discovery_docker_socket_discovery.toml,sha256=Hilmlb6nj_vKlbv91CYxW3tglsjJ5QxMxv2gCRRgyW8,9171
nldcsc_elastic_rules/rules/linux/discovery_dynamic_linker_via_od.toml,sha256=VOXo72nF8Pmom4kBgPKbqGNFhsfJZfDJNrnq3koiiXA,8736
nldcsc_elastic_rules/rules/linux/discovery_esxi_software_via_find.toml,sha256=TaIeay51Dau8jCzk-OTyAS_YvajadrXXxrHAhoQOIZ8,8214
nldcsc_elastic_rules/rules/linux/discovery_esxi_software_via_grep.toml,sha256=9GouvkboS8qSA1xuKGwW8MkBlrs-43WQmEwPMiwrPqs,8311
nldcsc_elastic_rules/rules/linux/discovery_kernel_instrumentation_discovery_via_kprobes_and_tracefs.toml,sha256=b1wBs80_vx-m0kmwxCBbIShx1rOZK7KSKeiXwV35TYM,6764
nldcsc_elastic_rules/rules/linux/discovery_kernel_module_enumeration.toml,sha256=3hCMyf8DgsHDIz2oX3WqOOdefShVV6N6Ukyx5om1Bho,9017
nldcsc_elastic_rules/rules/linux/discovery_kernel_seeking.toml,sha256=SUOoHw-Y5TzTvFye-yYzBwot8IySwfDBF6VRr4KKEw0,8795
nldcsc_elastic_rules/rules/linux/discovery_kernel_unpacking.toml,sha256=YPJXPdAvxPEftoP3itt8WRU-e5KWQ5xjr4GlZFKYnG4,8492
nldcsc_elastic_rules/rules/linux/discovery_kubeconfig_file_discovery.toml,sha256=RXoxWP7xfhOMYQWGHQ98zh5Gf-upnCmkgjeCVRWpW6E,10065
nldcsc_elastic_rules/rules/linux/discovery_linux_hping_activity.toml,sha256=lOlJ0IzSw65bpSMjJMqkrjdci9_x77fO6ptq9DAi2ek,9735
nldcsc_elastic_rules/rules/linux/discovery_linux_nping_activity.toml,sha256=9xQWCD7webqYbLI1qXFaXjxiltz4O1SYD18kLLgbTuk,9751
nldcsc_elastic_rules/rules/linux/discovery_manual_mount_discovery_via_exports_or_fstab.toml,sha256=YmiyKQxfL-JADKtanM7-7R6wbwzXPnb3FSUjC-9STe0,8269
nldcsc_elastic_rules/rules/linux/discovery_pam_version_discovery.toml,sha256=zXpiSQNUCh4ndOba5h54ETnhNJKMOPYEgsNYYr81WQE,9574
nldcsc_elastic_rules/rules/linux/discovery_passwordless_sudo_probing.toml,sha256=aVVNT_Vm16lviQhupXn-yZBFKxNcD7ch-NGNKcO2rUk,8004
nldcsc_elastic_rules/rules/linux/discovery_ping_sweep_detected.toml,sha256=eCxyHe75HL4sAMYAmW0t4dCCGfvDf4p1gbF93bVRNq0,8487
nldcsc_elastic_rules/rules/linux/discovery_polkit_version_discovery.toml,sha256=y97QZ3RNdfQJDVQdFI2Lln6pWQ1f5KJbVxnQkXgu2EI,8389
nldcsc_elastic_rules/rules/linux/discovery_port_scanning_activity_from_compromised_host.toml,sha256=FFiuYY5icWbgp3qBpwYvJ4wZw6LaoJ_ddwBWnnUV7IE,10161
nldcsc_elastic_rules/rules/linux/discovery_potential_kubeletctl_execution.toml,sha256=2OcqEBQ4-UY_yg7gtrc9G7qWzth28YZBj8ExKzg7HoE,4552
nldcsc_elastic_rules/rules/linux/discovery_private_key_password_searching_activity.toml,sha256=BjF_B36oS0VSje7meU2nDi2pNmyiH_qq8dGEHE8tjhU,8684
nldcsc_elastic_rules/rules/linux/discovery_proc_maps_read.toml,sha256=QlydXaVkmjJvnBoP8Q00UCfubn2pvr2yMf3eLVmaD-w,9382
nldcsc_elastic_rules/rules/linux/discovery_process_capabilities.toml,sha256=VY24mNoiRj6wtelwPAGEiOC5uZL2C_NQk8p8ic8duyI,7481
nldcsc_elastic_rules/rules/linux/discovery_security_file_access_via_common_utility.toml,sha256=eYkJoFGBxbIcKSASj6gVKdqM9nJoBI65TUE5ckJcU1A,9805
nldcsc_elastic_rules/rules/linux/discovery_subnet_scanning_activity_from_compromised_host.toml,sha256=Q0zuVfSvID3aWEifiyYJ3Wt6w5w5ehWtNbEKfBe4ECY,9545
nldcsc_elastic_rules/rules/linux/discovery_sudo_allowed_command_enumeration.toml,sha256=eGoUAAju6cFTUHbARA60muuP5rcIG_AvN_LKyIrx4os,8264
nldcsc_elastic_rules/rules/linux/discovery_suid_sguid_enumeration.toml,sha256=FS9LkVoV3SfBgt5XVMS-qjdMBGq8VIWou8H02ynFpIE,8807
nldcsc_elastic_rules/rules/linux/discovery_suspicious_memory_grep_activity.toml,sha256=ul_7G5q_ZbKmSENC34DWNB8nhSZmaVLLkiPfj9rQibw,6136
nldcsc_elastic_rules/rules/linux/discovery_suspicious_network_tool_launched_inside_container.toml,sha256=EMsGqwUkF6aYoK3NLU7k1WG__3L4y3PlH0k9WFLwM6I,9275
nldcsc_elastic_rules/rules/linux/discovery_suspicious_proc_pid_syscall_read.toml,sha256=mDjZokMm5JlzlGBTVqjhrg__lVFTFCscPEgimLacYtU,6186
nldcsc_elastic_rules/rules/linux/discovery_suspicious_which_command_execution.toml,sha256=iO3QEV_s_7WcqZPMIqPURKlGqN0O_QQ6mhrImgEPhpE,6187
nldcsc_elastic_rules/rules/linux/discovery_unusual_process_connection_to_container_runtime_socket.toml,sha256=2VlQ_qRPtV_SVcGOePxhka2CAFSXwWf4hurN2P7R_M0,5450
nldcsc_elastic_rules/rules/linux/discovery_unusual_user_enumeration_via_id.toml,sha256=dL-dLkzBXU5MT_rFVpfNwwqGkWnB6qFuO3DAcvgSt5s,8433
nldcsc_elastic_rules/rules/linux/discovery_virtual_machine_fingerprinting.toml,sha256=Cer5cQwJ61-UrNQh-z7t_rGZ0lmjq6SeH_Kfi4F8Aos,10811
nldcsc_elastic_rules/rules/linux/discovery_yum_dnf_plugin_detection.toml,sha256=HC8PHZv2wkAk1y8FWH5WIa64qi8sH8ppXGPmadbsRLU,8639
nldcsc_elastic_rules/rules/linux/execution_abnormal_process_id_file_created.toml,sha256=8OCsTGXqbURaBp7xB6fNGyam3e_RpePjPS8R2POGxWg,9770
nldcsc_elastic_rules/rules/linux/execution_busybox_unusual_execution.toml,sha256=Vbssb4-peb0vLzOSN24c-Flz12MTMda8AVll-_KFfLI,10125
nldcsc_elastic_rules/rules/linux/execution_container_management_binary_launched_inside_container.toml,sha256=MysSPjH9yJokOQEQ50QjrolvT9gnfzoFZVHRHEw5d3g,8790
nldcsc_elastic_rules/rules/linux/execution_container_runtime_cli_suspicious_arguments.toml,sha256=hlJk0wzBV_RgjLIRPKqYKhKpGhY2SjI1R5mK6ThdB8M,4656
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_file_creation.toml,sha256=DnPU8WmnnABYGXmgO9e6DeNG8OFnGC8QDtF2ywE8S-g,8455
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_lp_user_execution.toml,sha256=r5TJmPyxQxs4Dquj4F3WpiQrFVqmyihGpBw9nbEGhs8,8678
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_shell_execution.toml,sha256=VEtiUztC15-VeU4iO_ovQqsMZHOJ35HwKwqMKCJsicA,8485
nldcsc_elastic_rules/rules/linux/execution_cupsd_foomatic_rip_suspicious_child_execution.toml,sha256=RzvWcku-GkOq2VBrJrH6_lsovv8VlkNYo2CWM3_XKuA,10486
nldcsc_elastic_rules/rules/linux/execution_egress_connection_from_entrypoint_in_container.toml,sha256=QFv4GksS0D6XrEPrxn9jLGMSmPb0jaNQtPZoWnRZmeU,7614
nldcsc_elastic_rules/rules/linux/execution_executable_stack_execution.toml,sha256=S7SK5rSQdxJS_ZoBF-A0uNybLj_6YCwQxm6X1wFYjRE,7346
nldcsc_elastic_rules/rules/linux/execution_file_execution_followed_by_deletion.toml,sha256=2j_raMEkI3py4wt58ltIuEbILHeQd_f_RTzxsRz-rs8,9431
nldcsc_elastic_rules/rules/linux/execution_file_made_executable_via_chmod_inside_container.toml,sha256=-qvGTPe-1c3XnwmRXaXJXE401sfqKjYZJUXno0ivxwY,9478
nldcsc_elastic_rules/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml,sha256=BRSp5j0pfM6oFKM6Q_exNL7RdMbT6C_OSM1dIswiGik,10382
nldcsc_elastic_rules/rules/linux/execution_interpreter_tty_upgrade.toml,sha256=o5KtYPNg5zrHs3IjjEqI3EhHz5zw1QjDkJGOwblZ99c,8138
nldcsc_elastic_rules/rules/linux/execution_kubectl_apply_pod_from_url.toml,sha256=gd27-nm--IPC_Crk0AcHOM_Wz-PZQQHPE-7manVfY6U,8660
nldcsc_elastic_rules/rules/linux/execution_nc_listener_via_rlwrap.toml,sha256=aaLw6106WgQn1Vwts-NWUZH5yiBlTvzjwxcJ2dqj_AE,8428
nldcsc_elastic_rules/rules/linux/execution_netcon_from_rwx_mem_region_binary.toml,sha256=46-IP12-b4B7H-h4ZQDb5tGReOpVbvjkTgtcSsBChUk,8811
nldcsc_elastic_rules/rules/linux/execution_network_event_post_compilation.toml,sha256=u_Dw9V2HOFZ_yFcCg0H5Z3hVH6bTjJbJFHQ_CC-R2NM,9186
nldcsc_elastic_rules/rules/linux/execution_payload_downloaded_by_curl_wget_and_piped_to_interpreter.toml,sha256=r961L3ncLm_C45W5Rgs_feqeZhaRv4FNWE39Wv0n9xk,10282
nldcsc_elastic_rules/rules/linux/execution_payload_downloaded_by_interpreter_and_piped_to_interpreter.toml,sha256=Js0c8VedquVy4UGLltEONKIjkXp1YuBky7VbmRJHTRg,10887
nldcsc_elastic_rules/rules/linux/execution_perl_tty_shell.toml,sha256=DBJNXBjAP7grfw767AeMhZcE3XXy4oMiOmEllsvE8wg,9596
nldcsc_elastic_rules/rules/linux/execution_potential_hack_tool_executed.toml,sha256=syJndhAOQYnzVmYxJ32RYPOCigkAmCGrOCjJhAAuSqs,10962
nldcsc_elastic_rules/rules/linux/execution_potentially_overly_permissive_container_creation.toml,sha256=roPYNDk-viDwBC7Rq0WCGQl3RncmN7mP2s02DHTIw6Y,8797
nldcsc_elastic_rules/rules/linux/execution_process_backgrounded_by_unusual_parent.toml,sha256=5ui1cCcTIpnZuMZibMfbwPFWsWOKbXwxDcWa_Ru1Bck,10042
nldcsc_elastic_rules/rules/linux/execution_process_started_from_process_id_file.toml,sha256=xlUWky21cgVB7gGlvSFFEYNoPc96z21ShI82reNtXmk,5915
nldcsc_elastic_rules/rules/linux/execution_process_started_in_shared_memory_directory.toml,sha256=_mAgf5jmzLb6PW27V2EtuOIJcfVfsgQX03mSop_RPUs,8921
nldcsc_elastic_rules/rules/linux/execution_python_tty_shell.toml,sha256=a2sHMBtedrhR8q6oL_1_JmTun2XwtkfFBefmU3wPg50,8598
nldcsc_elastic_rules/rules/linux/execution_python_webserver_spawned.toml,sha256=_lTR-VIdfP6KQlOihsHIxIfrxIF_cBsV2JHYDgrQj7g,8432
nldcsc_elastic_rules/rules/linux/execution_remote_code_execution_via_postgresql.toml,sha256=CdVGo6ItfWUGMmIACgdpmGoCWJ7qsYBsNXcdXh1cHGg,8791
nldcsc_elastic_rules/rules/linux/execution_setsid_nohup_disown_direct_process_execution.toml,sha256=pkBHirBxI3idSg_RxtlUW19zDLoPnF38zz8Mm5n3O0o,9351
nldcsc_elastic_rules/rules/linux/execution_shell_openssl_client_or_server.toml,sha256=psplMhimE2TcaKm9ioEa4IllJp9xlc3dF-maPRKgQHM,9261
nldcsc_elastic_rules/rules/linux/execution_shell_via_background_process.toml,sha256=8A2QMynqOAIFv_W3mDW5konMb2l34brAOAr41f5p0q0,8558
nldcsc_elastic_rules/rules/linux/execution_shell_via_child_tcp_utility_linux.toml,sha256=ngyN-ECrR6wgCcbvjf8QKH137XNksJ6zlW0YthQhTSw,9402
nldcsc_elastic_rules/rules/linux/execution_shell_via_java_revshell_linux.toml,sha256=dMUzla4-Rd3xl7rPRucpOY6tix-k1XJsLnJm_nuLGG8,9757
nldcsc_elastic_rules/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml,sha256=UCK-5-e_bOto802Hu5Hr3URKlzps8pCxQbxQ2JWLTVI,10331
nldcsc_elastic_rules/rules/linux/execution_shell_via_meterpreter_linux.toml,sha256=psgGXkgOz5zT4TPQj_3cmrbumo7AIUg1UN8Kiuat3uA,10841
nldcsc_elastic_rules/rules/linux/execution_shell_via_suspicious_binary.toml,sha256=xBVuX359PaJLkTUE7dz3rq2YIGn-TETKrmRFqQHB6JM,9652
nldcsc_elastic_rules/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml,sha256=nP0IqUOcoOKMDXz1ozfgBEwlZggVgOmBM0IIm7Qza38,9052
nldcsc_elastic_rules/rules/linux/execution_shell_via_udp_cli_utility_linux.toml,sha256=KjhQe0Dy4Dpz5YspLZHFI4avCFeFRpjkVsIgqy_-feU,11347
nldcsc_elastic_rules/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml,sha256=Hkzxu98hZdwPov-Io9EoVzytACbvARUonzpFU8mIcjc,9084
nldcsc_elastic_rules/rules/linux/execution_suspicious_executable_running_system_commands.toml,sha256=BnpMEe8g-qOHmCoRWuK2tZjFRsH4AqhK-daTCepYryA,11090
nldcsc_elastic_rules/rules/linux/execution_suspicious_mining_process_creation_events.toml,sha256=fVl2irQGNLj75fzntVedQUVlQof6x9UweiPlIi79Ni4,8667
nldcsc_elastic_rules/rules/linux/execution_suspicious_mkfifo_execution.toml,sha256=qwXmjDAlDaJdBssCn0bT0-m5Z7R1HlPoWGPDyqz7rhc,8718
nldcsc_elastic_rules/rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml,sha256=JD3m3P7FTLdwQGeya1vjLA6pmgaHKYfEY8KCDL7U8gs,10301
nldcsc_elastic_rules/rules/linux/execution_suspicious_xdg_open_command_execution.toml,sha256=tDASo0k62GzTYbIaC-wTtOCpdzJmzaLjhMu8Ffnwveg,8930
nldcsc_elastic_rules/rules/linux/execution_system_binary_file_permission_change.toml,sha256=dgFfMbYZiF_BsJCRwnmuxddadpyLSYH4QeowAKJ9Gu0,9845
nldcsc_elastic_rules/rules/linux/execution_tc_bpf_filter.toml,sha256=sznUdafePcomeMzuqAdGNfQZu9cI2m-EmhUMWkcEFiw,8865
nldcsc_elastic_rules/rules/linux/execution_unix_socket_communication.toml,sha256=TI-_HRDIjdrY91sb5WiHGbmX1vp5n0YdqYgIro0hzl0,6625
nldcsc_elastic_rules/rules/linux/execution_unknown_rwx_mem_region_binary_executed.toml,sha256=apTYzgsirKSFcndfZC-YavAu9cGgG2ZBQNWmVdSNtf0,8005
nldcsc_elastic_rules/rules/linux/execution_unusual_interactive_process_inside_container.toml,sha256=7Sh7APcjDsDWRE8PHNelM8pmUSynfYpSADVj2lgwVU4,4337
nldcsc_elastic_rules/rules/linux/execution_unusual_kthreadd_execution.toml,sha256=h7TimcuJTAsoz0u1CV1tje4C09d6nothsRa1Y--c6YM,9990
nldcsc_elastic_rules/rules/linux/execution_unusual_path_invocation_from_command_line.toml,sha256=_4KAlmSA666t0tUyAXKGpBzZUegUISOo_kZGFbmRgS4,9527
nldcsc_elastic_rules/rules/linux/execution_unusual_pkexec_execution.toml,sha256=r5uZ6dlgRIoJuR2ZWuneOhqyvuKM0k3HBNYx8IW-zVA,10891
nldcsc_elastic_rules/rules/linux/exfiltration_potential_data_splitting_for_exfiltration.toml,sha256=7YdObYPlNVgb0Yw775sNOYgx9dvJTPcNg4d_7kMbSeo,8533
nldcsc_elastic_rules/rules/linux/exfiltration_potential_database_dumping.toml,sha256=RrhKV5uKIoMIVAWkk3w1bhYg43t12Pw4HIRukEZimEY,8635
nldcsc_elastic_rules/rules/linux/exfiltration_potential_wget_data_exfiltration.toml,sha256=FMzbAYwizIn060ZA6-5qzMJ1t0D4YMoGulgSH6fSaGI,8822
nldcsc_elastic_rules/rules/linux/exfiltration_unusual_file_transfer_utility_launched.toml,sha256=5xaVkIQcL2eoiOx8MzlYNtAzUice_tMa0qQU0LktBHM,10572
nldcsc_elastic_rules/rules/linux/impact_data_encrypted_via_openssl.toml,sha256=H7wwgE-OYlBpvYFKuLvm0vlMK3kjbHqEHHyR7d4-dlE,8673
nldcsc_elastic_rules/rules/linux/impact_esxi_process_kill.toml,sha256=240hLbfVtqam6DH9XVYz_7meWnWjgYvdG0yQTamBgfs,7851
nldcsc_elastic_rules/rules/linux/impact_memory_swap_modification.toml,sha256=X_h5VgUqf57__jEUgHoJj26Q5VeRj0L5og7CwBXsCpc,8894
nldcsc_elastic_rules/rules/linux/impact_potential_bruteforce_malware_infection.toml,sha256=mQh5JbxlzSvVxfUwDZ_4W_2edRgIfsv35GRgCaDUuTQ,11228
nldcsc_elastic_rules/rules/linux/impact_potential_linux_ransomware_note_detected.toml,sha256=CAAURmhcQu_XntZ_EXjcyPJ0BPvLTAgudYdHJCfpQf8,9205
nldcsc_elastic_rules/rules/linux/impact_process_kill_threshold.toml,sha256=fhdyA26NZ_oqv5-NygCk1vFrMU_XpvJQJMTGFJ-Dt8Y,6529
nldcsc_elastic_rules/rules/linux/initial_access_apache_struts_cve_2023_50164_exploitation_to_webshell.toml,sha256=SDXQWPr_P7kwIEvVXVwSe8a6mIM872pUoNJTECshwxQ,10162
nldcsc_elastic_rules/rules/linux/initial_access_first_time_public_key_authentication.toml,sha256=BK_xXR0_vbK1vsI4C0wMgDGPPnAX-WrwECOmQXm4oU4,8293
nldcsc_elastic_rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_ip.toml,sha256=34AMO5Pp-Vc046JJqSWiVy49a5pARr4eozbdkaNSem0,7546
nldcsc_elastic_rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml,sha256=x4E4vGnce0ym5fKc7BzkZALUZ_mUlJvSd5sryshRM2g,5826
nldcsc_elastic_rules/rules/linux/initial_access_telnet_auth_bypass_envar_auditd.toml,sha256=g0160E9BAp5Hb009yF12KA-ClVPRX5iliSdW5XnpD6w,5808
nldcsc_elastic_rules/rules/linux/initial_access_telnet_auth_bypass_via_user_envar.toml,sha256=97C9E1LrZ40EyJ7OmxlcLrTor1eC6x93r_zPW5_LKcA,5868
nldcsc_elastic_rules/rules/linux/lateral_movement_direct_kubelet_access_via_process_args.toml,sha256=ap4qkoNIUNtcq-b062-ZMFGDvO_UX5W3xg1vs9FB6yo,5605
nldcsc_elastic_rules/rules/linux/lateral_movement_kubeconfig_file_activity.toml,sha256=PALu0Jcc9Y7gy_uZdsZQTN0auiBMRpnFl3iFFUWMqIo,9894
nldcsc_elastic_rules/rules/linux/lateral_movement_kubelet_api_connection_attempt_internal_ip.toml,sha256=m5K8adCtwXX-9Na2qd_hjnwiZYh2rguMX5CBotcBTXI,5987
nldcsc_elastic_rules/rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml,sha256=lLgPcLSaVzSqupxp_PDnIASc5CRKRGL8NceDomkkkRA,9953
nldcsc_elastic_rules/rules/linux/lateral_movement_ssh_it_worm_download.toml,sha256=LDTHwqscaq9DFlq855RgXdaHzNwoZn-90HOSkHJmOTY,9252
nldcsc_elastic_rules/rules/linux/lateral_movement_telnet_network_activity_external.toml,sha256=ZPXS2TO8gsABiWUfKKaqN3y5N3vWFDzeYmEi5ce5Zaw,10199
nldcsc_elastic_rules/rules/linux/lateral_movement_telnet_network_activity_internal.toml,sha256=YFZf6ZY96uPRD1VgDn_s_a377Qgm9NCLYj9dH7mStbE,9885
nldcsc_elastic_rules/rules/linux/lateral_movement_unusual_remote_file_creation.toml,sha256=3Z_HBoCTxPuRlTGIgt5WjM1R79X3RK4tkff2s_fgKQw,10358
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_execution.toml,sha256=NiEIX4rlBLCQtPPhcWOMtj_vxOj7kycFwFIRPnmOTSs,11921
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_file_creation.toml,sha256=iBrQBjzmsLdSBm2yYPDWUSKlXp5AA1XkwM8_V4OSE5U,11520
nldcsc_elastic_rules/rules/linux/persistence_apt_package_manager_netcon.toml,sha256=rH30iJTXN6SVKHf_vRYPp4XnhXePL743T-ndajPlbvE,10441
nldcsc_elastic_rules/rules/linux/persistence_at_job_creation.toml,sha256=SPy22-JjrFJwhRwh2kN3kuzP5qQo1IUZlBHpBsMvsp4,10143
nldcsc_elastic_rules/rules/linux/persistence_binfmt_configuration_file_creation.toml,sha256=G2tLtHL6K-zw-kC_bZQS2LqRBkEcpbcewH0-Q0PB7So,7624
nldcsc_elastic_rules/rules/linux/persistence_boot_file_copy.toml,sha256=7I1Sw_x5xhwpTz8ArMTtLmBUjKuUDT2bv_eK1QM997U,10745
nldcsc_elastic_rules/rules/linux/persistence_bpf_probe_write_user.toml,sha256=Vhjlun_tIV-ev3aZbKwyTi9NTnvrJZ_aobAuwhReFQM,7616
nldcsc_elastic_rules/rules/linux/persistence_bpf_program_or_map_load.toml,sha256=sdfkGDljSulVCNMcnbQmhUZ__TJDj1hRnZxLhIvyT1w,7582
nldcsc_elastic_rules/rules/linux/persistence_chkconfig_service_add.toml,sha256=0YNStGWtEvMfmsgJj1D2MNzKDR_55SahVGgc1PHnnNM,12592
nldcsc_elastic_rules/rules/linux/persistence_credential_access_modify_ssh_binaries.toml,sha256=g9-zVdbad8lRy51_KdyszvnPpy5MzgoUFssDIOHMfZk,13062
nldcsc_elastic_rules/rules/linux/persistence_cron_job_creation.toml,sha256=57Q6BpWPE994lZqF8h8KyzSaS4SfV0fvBo15s8hyPoU,14811
nldcsc_elastic_rules/rules/linux/persistence_dbus_service_creation.toml,sha256=06TK4hJf8eEON949Wslo5Qk21r04jvGuvA65YInYid4,10810
nldcsc_elastic_rules/rules/linux/persistence_dbus_unsual_daemon_parent_execution.toml,sha256=Sa_EL4D7zlDYJGiGhXVukjgXy6AU-CqeIrpTut4foO4,9872
nldcsc_elastic_rules/rules/linux/persistence_dnf_package_manager_plugin_file_creation.toml,sha256=yd_2mtGtLrwTMo96siQdv6pwqaoikoCpVnQ4IRRMckM,11087
nldcsc_elastic_rules/rules/linux/persistence_dpkg_package_installation_from_unusual_parent.toml,sha256=pDLUs7--ZMIf67YD7DPlDvc8TXSAw-PILKEj579azI8,9134
nldcsc_elastic_rules/rules/linux/persistence_dpkg_unusual_execution.toml,sha256=wd8Pm7xobili8sJTS0XlLoOig3hJQCUPr6PmenaGNOE,9436
nldcsc_elastic_rules/rules/linux/persistence_dracut_module_creation.toml,sha256=OHNReI-dLUdzAsgLls2q8jLwufAn_ZmeBtKuuqJwxnc,10911
nldcsc_elastic_rules/rules/linux/persistence_dynamic_linker_backup.toml,sha256=xMLmXwVBvdiwnkhlspNKjvwqZdBL6pVnTf1XTc4_WeY,12507
nldcsc_elastic_rules/rules/linux/persistence_extract_initramfs_via_cpio.toml,sha256=rE9d_KoDet-cVr7Sy9c5BzenRYE4Fe2ZWL6hCPfB0VY,8732
nldcsc_elastic_rules/rules/linux/persistence_git_hook_execution.toml,sha256=UF0xZAwxF2LfvPHN_jmt33Dd42CNd-6h_k6e9ktwrvw,9026
nldcsc_elastic_rules/rules/linux/persistence_git_hook_file_creation.toml,sha256=Qf_g4O4YPiqyi0u2wF23gj1hQnQuz3e1oxq3xsYFJJQ,10156
nldcsc_elastic_rules/rules/linux/persistence_git_hook_netcon.toml,sha256=8ITJTxfXglfRDkmXguHlsQWjfGrsowUOtEdGUPG_aks,10231
nldcsc_elastic_rules/rules/linux/persistence_git_hook_process_execution.toml,sha256=Vnf6HXe0Ih9hDNWsWZ7VwJ0_MHdWg4DmkdlyS7J00Q8,9771
nldcsc_elastic_rules/rules/linux/persistence_grub_configuration_creation.toml,sha256=EjViiafudCPq9e5783l2CPtGwNq59-F5KhVtjio9MFg,10478
nldcsc_elastic_rules/rules/linux/persistence_grub_makeconfig.toml,sha256=NbpmeOfvcNFTzU4_xVDXAzTZNu8qHI8utZzrqIbAquE,9250
nldcsc_elastic_rules/rules/linux/persistence_init_d_file_creation.toml,sha256=y4l6Rz4wXqYxLO0ioW3syl4lI1EjQk5d7EtANfzUguo,13572
nldcsc_elastic_rules/rules/linux/persistence_insmod_kernel_module_load.toml,sha256=X62FcQ905SAQa59YR4gx_6X9mOKmc2rD_Fauk-lxjfM,13090
nldcsc_elastic_rules/rules/linux/persistence_kde_autostart_modification.toml,sha256=qcyZNwvsh9B6KyYm-gT-vs-Dedb9kCHCSmnDnKeRPaw,17067
nldcsc_elastic_rules/rules/linux/persistence_kernel_driver_load.toml,sha256=0Q0Pnq0k0tF_GJIAs8mpUBfu51CyY6kChqFAcBj38ac,8323
nldcsc_elastic_rules/rules/linux/persistence_kernel_driver_load_by_non_root.toml,sha256=EMy8VObjXKEL-dqIa2pNf7wUHjRHOKKOsBNp3ePYZ70,8605
nldcsc_elastic_rules/rules/linux/persistence_kernel_module_load_from_unusual_location.toml,sha256=moZTvKN1nz7RltcvCfgitqTS9DkVb6ENmh7VJv5G6Bw,9803
nldcsc_elastic_rules/rules/linux/persistence_kernel_object_file_creation.toml,sha256=p1GR8ZepQnyErAoXmYfVqW_nJ1FwXyepXp9WP65DGes,9201
nldcsc_elastic_rules/rules/linux/persistence_kubernetes_sensitive_file_activity.toml,sha256=AmaU2lpB2kajfA7tvJFwv_BzuypUX6W9zEI5HQ9dkdI,9641
nldcsc_elastic_rules/rules/linux/persistence_kubernetes_static_pod_manifest_path_process_execution.toml,sha256=R8wTA8x1HTbYxS48vgOcks9q2-LLIUomXFj2NhbSRPw,5027
nldcsc_elastic_rules/rules/linux/persistence_kworker_file_creation.toml,sha256=Xv8MiPXwuFA8laW4SoGFCkRBcOW5UwhMbcxVPO-s4n4,11684
nldcsc_elastic_rules/rules/linux/persistence_linux_backdoor_user_creation.toml,sha256=_OsLDV-ICcwjaiIyNXpE99kn2h8v8MOmezcMHHZS5sI,8967
nldcsc_elastic_rules/rules/linux/persistence_linux_group_creation.toml,sha256=6Ibh3QiCz9oojP7YB5YHQaG7GmEq0IAemR4qJprmJmU,7656
nldcsc_elastic_rules/rules/linux/persistence_linux_user_account_creation.toml,sha256=Y62HPZO3rirpLXQmrfIZZQt0Pc670F-bDxw1LPMPrZY,7244
nldcsc_elastic_rules/rules/linux/persistence_linux_user_added_to_privileged_group.toml,sha256=EDI3smA_HIY-1sII8UMuoDi2WcI3CxCLWo2l_Otj3E4,9536
nldcsc_elastic_rules/rules/linux/persistence_lkm_configuration_file_creation.toml,sha256=YbPp6-z-Ks_RtP8KAL64ET4mNn6rDqxWo1fLqZdK7kw,8463
nldcsc_elastic_rules/rules/linux/persistence_manual_dracut_execution.toml,sha256=hVYeksqPfPLsI4SVZQXDEF4tjy0s-7a6wg_3J3-OQRs,8810
nldcsc_elastic_rules/rules/linux/persistence_message_of_the_day_creation.toml,sha256=d9-lWXiFOPc4SpS5TqWRhzsqr-Awynbbs-mNF6VhPN0,11245
nldcsc_elastic_rules/rules/linux/persistence_message_of_the_day_execution.toml,sha256=BBrd432I9DMRIESDaPqRA8aX0fOutkkLjPWdTrpbGR0,12371
nldcsc_elastic_rules/rules/linux/persistence_network_manager_dispatcher_persistence.toml,sha256=DntLOjan-A_ySJTdoRxfWRaCZZrza20sHGVaZCrqpq4,10750
nldcsc_elastic_rules/rules/linux/persistence_openssl_passwd_hash_generation.toml,sha256=Ju7h_WcBS7EvJXW1viVjtXJlVtuuxu7yrtHMzZlflq0,8622
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_creation.toml,sha256=MkaP2kDNYyH5lEynhFyRZPk0EG_rfHu1wPaIzR-6NMc,9576
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_creation_in_unusual_dir.toml,sha256=4H3PZpPwBHBjysnFg6vufT1eil33xfbvhSuuvOIYNTY,7954
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_pam_exec_backdoor_exec.toml,sha256=mb9yepbv1NTzlwqgo_GGXGx2vlnheUqljuoffNpNCL8,8542
nldcsc_elastic_rules/rules/linux/persistence_pluggable_authentication_module_source_download.toml,sha256=QpuGUb_DL5gMFtresU-SI1OiA5xEWVEyL12ta8DDxUo,6833
nldcsc_elastic_rules/rules/linux/persistence_polkit_policy_creation.toml,sha256=MJXaH73AN01YhPRQz3FcSy5HxbEp7dAJIoBNhjjEvPg,8853
nldcsc_elastic_rules/rules/linux/persistence_potential_persistence_script_executable_bit_set.toml,sha256=WiLwJL6R0sXgLYOPYWptAgTjC9KIeRCyivCjTPjQ8tc,10647
nldcsc_elastic_rules/rules/linux/persistence_process_capability_set_via_setcap.toml,sha256=Ls6KLweOB_G3344sbMx4gwfDJsBIatcg6fXCZqjneHs,8599
nldcsc_elastic_rules/rules/linux/persistence_pth_file_creation.toml,sha256=xk_bQbdfmUF1ZVIWH0n81IetgDrAnAk1Sb9tN5QIBqI,10154
nldcsc_elastic_rules/rules/linux/persistence_rc_local_error_via_syslog.toml,sha256=N-kisyvzFLjoyZh9s0cyt3hUMq5SrCiPKI54CVH7Pug,8242
nldcsc_elastic_rules/rules/linux/persistence_rc_local_service_already_running.toml,sha256=IHhtxiBDYdeDRUd97QVnU1j3e1SqWuvL8YMZIUsgyqQ,9025
nldcsc_elastic_rules/rules/linux/persistence_rc_script_creation.toml,sha256=9yqDJapPEJ-my3DjF6Cp4-JIUstCpU6vw4ducoviIf0,12424
nldcsc_elastic_rules/rules/linux/persistence_rpm_package_installation_from_unusual_parent.toml,sha256=6gn28GxlEl04zzEVClUQ_yk1e_N-utETB78uXHjRnis,8543
nldcsc_elastic_rules/rules/linux/persistence_setuid_setgid_capability_set.toml,sha256=XaJROTOUW-DAJfc128V7lmgdt-ndo-bmu7GcEOxdcp0,10727
nldcsc_elastic_rules/rules/linux/persistence_shadow_file_modification.toml,sha256=gPYsNLx1NUyY5lGvcsNRQBlAVWJMRW98E-uQeuCzLy8,8419
nldcsc_elastic_rules/rules/linux/persistence_shared_object_creation.toml,sha256=sdpWymKZZrFVPWc2bpDvl3r1Kr0NZTCFAH5sNj09Ri4,13797
nldcsc_elastic_rules/rules/linux/persistence_shell_configuration_modification.toml,sha256=09Wm7Kbf6zDn7CKgaxGKGJm7XIUrushv39cwa_hufA0,11356
nldcsc_elastic_rules/rules/linux/persistence_simple_web_server_connection_accepted.toml,sha256=Ei6ZK-VMwogq3BsgJShOlUazpzsrXcKCkHy9sIa4z6M,9392
nldcsc_elastic_rules/rules/linux/persistence_simple_web_server_creation.toml,sha256=UFgnHNa_F8dC11iuFJZC559DCZaaxizZnrgGu2csz0k,9655
nldcsc_elastic_rules/rules/linux/persistence_site_and_user_customize_file_creation.toml,sha256=MOeCKmaCcTDy40QJyUeYhwEZelnGcCTVAk2qFLq8GC8,9989
nldcsc_elastic_rules/rules/linux/persistence_ssh_key_generation.toml,sha256=H2B7RecL1GT1ZkLyhGRE2MlVDNnSYbSchgsSbi8wDeg,6776
nldcsc_elastic_rules/rules/linux/persistence_ssh_netcon.toml,sha256=P2lgwe9uo5HV_1e6I1Akz4qziPKF3dIf6dPETuwP3ms,8552
nldcsc_elastic_rules/rules/linux/persistence_ssh_via_backdoored_system_user.toml,sha256=tK_Y2MD_j99WTPARKCm7LVBQd7fFy6q4h3pCubOiPyI,9152
nldcsc_elastic_rules/rules/linux/persistence_suspicious_file_opened_through_editor.toml,sha256=DO5eDahN3MyoshYsZL_9S9PTtXHod_fXdPuKMglNy9k,9191
nldcsc_elastic_rules/rules/linux/persistence_suspicious_ssh_execution_xzbackdoor.toml,sha256=w_tc-MEWoXeff-MnlCp_BJwdZXskbAtqnRLWLOlHBDM,8328
nldcsc_elastic_rules/rules/linux/persistence_systemd_generator_creation.toml,sha256=n7XiOQJYLrGIf5Qt4CFLQIk4_livxebDA3I_nINVB38,10779
nldcsc_elastic_rules/rules/linux/persistence_systemd_netcon.toml,sha256=aDNQyRG3ujkeCooEr1UottNTLHf1Xc79bFdLZnEsNPY,10842
nldcsc_elastic_rules/rules/linux/persistence_systemd_override_conf_creation.toml,sha256=U-QPwoQiYwcpvSbjwdq7xC1AV8A2GiNchc6zHYx2zlQ,10246
nldcsc_elastic_rules/rules/linux/persistence_systemd_scheduled_timer_created.toml,sha256=ewfiPstKWPhFpXvAxQuc7WVFwQ3h2je1lsrMhWJzVdI,13631
nldcsc_elastic_rules/rules/linux/persistence_systemd_service_creation.toml,sha256=oV7czAdXGd2WmWyN3Kf1sXgUxf1lchQgUzmjt-L5IYo,15962
nldcsc_elastic_rules/rules/linux/persistence_systemd_service_started.toml,sha256=PjyVISAKN-vP8o_IitbMiojHibCapESKccjEjll_oJ0,13970
nldcsc_elastic_rules/rules/linux/persistence_systemd_shell_execution.toml,sha256=I8WMjin6nku3f89st9c6qd3eg7qJ5qep1zTyithuLC0,8509
nldcsc_elastic_rules/rules/linux/persistence_tainted_kernel_module_load.toml,sha256=A0-52ahKh_GkDN4dKMLoOKiNOHwrTCs-k9HXvdMljPM,8403
nldcsc_elastic_rules/rules/linux/persistence_tainted_kernel_module_loaded.toml,sha256=kIhN2pw_CilCtPYjDiF55n0QoYidsAfBsDK9e2PnvjY,8703
nldcsc_elastic_rules/rules/linux/persistence_tainted_kernel_module_out_of_tree_load.toml,sha256=7c-wioWweOPkipo91vHcOaurYWlJov5RURm5xswK49I,8365
nldcsc_elastic_rules/rules/linux/persistence_udev_rule_creation.toml,sha256=-CTvcoIbRS09WOgvDeXmEFqqCIwJdULCvTxV_fg2qiI,10245
nldcsc_elastic_rules/rules/linux/persistence_unpack_initramfs_via_unmkinitramfs.toml,sha256=VetHn7NGvqrCCDtmSeR7sPuC3qJcI9oHcrbvCjh5eSU,9105
nldcsc_elastic_rules/rules/linux/persistence_unusual_exim4_child_process.toml,sha256=7QsLYLG50nbXrYTP5wPakCN4E36ckgt7S0j9i2dJ8Xo,6740
nldcsc_elastic_rules/rules/linux/persistence_unusual_pam_grantor.toml,sha256=XPx_FE-cz37y39IgVlnb3WydKvniq-EqBAdcGgZiVZ0,7518
nldcsc_elastic_rules/rules/linux/persistence_unusual_sshd_child_process.toml,sha256=IknX2A0sJl3ThYpcdUkbAbKFozhCbF6g8OlWzP9Et8A,7249
nldcsc_elastic_rules/rules/linux/persistence_user_credential_modification_via_echo.toml,sha256=nsNxKsFLNZ303hm5U9g-BnR_Rrj7A2L9tJwjUJ9OJQw,7795
nldcsc_elastic_rules/rules/linux/persistence_user_or_group_creation_or_modification.toml,sha256=wClRc4Vhy0tSEwy8lkZnc8RzznBXw8xsjkfGv-Kn5S8,8878
nldcsc_elastic_rules/rules/linux/persistence_webserver_file_double_dangerous_extension.toml,sha256=NP0ku8Na3yMcqX2TLGWTiSLRx4fTtZufmjPthceiEwk,9406
nldcsc_elastic_rules/rules/linux/persistence_webserver_file_high_entropy.toml,sha256=lHbrGvVrHXe7YipWoxip53PZ9L5DbcQT75KOW-Fwzbc,9994
nldcsc_elastic_rules/rules/linux/persistence_webserver_file_polyglot_bypass.toml,sha256=W7-cQeqQ2c1VcKn_zIBZdmAXGUhJ9RZMBXV1lQoGaNs,10418
nldcsc_elastic_rules/rules/linux/persistence_webserver_php_file_creation_in_wordpress_plugin_dir.toml,sha256=bXQKInZ6rR0--NtZewmeg5vKJJSlg59IE07zlJnX5Ao,9107
nldcsc_elastic_rules/rules/linux/persistence_webserver_suspicious_child_execution.toml,sha256=tkuUllfmaWXiW_6SxDgTNZ24ypw4jauQeCAJj5d9NHw,14592
nldcsc_elastic_rules/rules/linux/persistence_webserver_suspicious_command_execution.toml,sha256=rnHFnimpd6lMcIs1dQZ0xnyl0xldoWXRiNJ2s0JO5PI,19235
nldcsc_elastic_rules/rules/linux/persistence_webserver_unusual_child_execution.toml,sha256=EuLfFmXL4LWUcB590Ofxr7ci3DA3NIc-I-uxpiLwg2s,10612
nldcsc_elastic_rules/rules/linux/persistence_webserver_unusual_command_execution.toml,sha256=6qJXv4Xnl1p75z9zopbkJQqbLjONRNWJBVCK4Bbr_bk,9683
nldcsc_elastic_rules/rules/linux/persistence_webserver_unusual_file_creation.toml,sha256=rQtMY2mPW95Cr7JpFBirvR-yZj_W8c9nLb1Fh_tGxyI,10497
nldcsc_elastic_rules/rules/linux/persistence_xdg_autostart_netcon.toml,sha256=Rj2WvTxPwWqouZzrCQ8jEPibkE102lqx8_WmuvCw7ig,11638
nldcsc_elastic_rules/rules/linux/persistence_yum_package_manager_plugin_file_creation.toml,sha256=LXgH4__HLTx8YSvBG9dN3ZcZhdAN5sqZJogtoWRZijs,10198
nldcsc_elastic_rules/rules/linux/privilege_escalation_auditd_euid_root_shell_from_non_standard_path.toml,sha256=wS0V_IdMFDBdTcAvuu1-SKjmVz6tskpKHGcTFY_Ai84,4787
nldcsc_elastic_rules/rules/linux/privilege_escalation_auditd_nsenter_target_host_pid.toml,sha256=OOUUzQT5FYoWRmqy5sx6TX9ap0MzTdgpoBr-J7QsyKo,3293
nldcsc_elastic_rules/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml,sha256=qJ5JHqfP5szJl7osULnXaGqMPaD2PsrEg7R-uVNi6rQ,9481
nldcsc_elastic_rules/rules/linux/privilege_escalation_chroot_execution_container_context.toml,sha256=lX9oode7SvYbeVgTEQi-iGI7O7W1tDU1dBXjTOa2kzk,7498
nldcsc_elastic_rules/rules/linux/privilege_escalation_container_escape_via_kernel_core_pattern.toml,sha256=G54ggT7Zijprghqir-3gnaXMz7yvh2GI_G9emVtWY0A,9996
nldcsc_elastic_rules/rules/linux/privilege_escalation_container_runc_init_effective_root_auditd.toml,sha256=iSvo1rOWZdrUNxrla9vvsGWn0wuJ5dOvYRPXyqylF4M,4033
nldcsc_elastic_rules/rules/linux/privilege_escalation_container_util_misconfiguration.toml,sha256=DTNmttZYQ9L3ggB0b4e-iL4lcHLGlUl4sYx-hoVDWJ4,9812
nldcsc_elastic_rules/rules/linux/privilege_escalation_cve_2025_32463_nsswitch_file_creation.toml,sha256=jHi5ICJLfGbDK4rEtCipiHB9bq56jq-peyYIjpjklcs,8836
nldcsc_elastic_rules/rules/linux/privilege_escalation_cve_2025_32463_sudo_chroot_execution.toml,sha256=--_DiVIwvjTK_qbCh9Evv0CEp2FgAtN6BAqNqiBmtuU,9176
nldcsc_elastic_rules/rules/linux/privilege_escalation_dac_permissions.toml,sha256=r39VwQnYoT9UX4OiWAgVEdzHDa49jZkJPpswEn2fS_s,9773
nldcsc_elastic_rules/rules/linux/privilege_escalation_debugfs_launched_inside_container.toml,sha256=ZMwETojC6gtJ8Qan8-OiyNSDkUpIDQqqbx09g_FqEOw,8487
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_escape_via_nsenter.toml,sha256=J1rtd8JkS20lgoayYiKLg2R3ANVkMzsVfFgEKmhwJ6c,6233
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_mount_chroot_container_escape.toml,sha256=C_cjzvG5mw4VQPQevnjc3dCKSNMQD2Nh9kskYfY6VR8,9591
nldcsc_elastic_rules/rules/linux/privilege_escalation_docker_release_file_creation.toml,sha256=6y_O49hbhC980A1ACgvjuR7sx3HrNDoWVzDipKcezJc,6380
nldcsc_elastic_rules/rules/linux/privilege_escalation_enlightenment_window_manager.toml,sha256=MAFATJncDanI15gRQysWcXaA3sDo9FGlva9Qt9KUXxw,8395
nldcsc_elastic_rules/rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml,sha256=j4JieRK7DEif2GDvXMFD2Qmt7wDGrvZqRJ7yR5fZEBs,8503
nldcsc_elastic_rules/rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml,sha256=tP-VhkJTchZ07Xko-GM36pnX_JXE-MX5RgJRRf9WRug,9704
nldcsc_elastic_rules/rules/linux/privilege_escalation_kworker_uid_elevation.toml,sha256=s4W1kgCVnHfMgDDmtM1jnX1TNKnMWHgae_3szaY33ME,8312
nldcsc_elastic_rules/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml,sha256=3L-Td5vCdNOj79UdlxUlSrcBniR3XKZXnJVVaJP5K1Y,10473
nldcsc_elastic_rules/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml,sha256=fZebXRI4oqFOgY2tUL6FuwB1GCuqDD7PB40qd8P4y6c,10318
nldcsc_elastic_rules/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml,sha256=pxcV7R0Z-VXWP4UYSjJzp6qXWJ2t6UkDKTsgaE4gBxk,9712
nldcsc_elastic_rules/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml,sha256=PV3EAOR5zLdjN6JOJeEADxhEGHztKoMNmJRYvVRw8m4,9175
nldcsc_elastic_rules/rules/linux/privilege_escalation_mount_launched_inside_container.toml,sha256=-EPiBJqknWt6ykZQyIQ3kLvOFjvn3wBNf5z1qGiOlGQ,8676
nldcsc_elastic_rules/rules/linux/privilege_escalation_overlayfs_local_privesc.toml,sha256=QaKlSiYE574652YCGT1ejW9TlbR2cJ-DyXFuv6MCyKE,6584
nldcsc_elastic_rules/rules/linux/privilege_escalation_pkexec_envar_hijack.toml,sha256=AgW5NayNT58TyDDnLkkdn_E0dSLZ84qHGk-BCoJQxTI,8877
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_bufferoverflow_attack.toml,sha256=y8ZnoJ2jDRTF_CYpQALQsccbcHnCj9RNw70g4HJubn0,6623
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_copy_fail_cve_2026_31431_exploitation_via_af_alg_socket.toml,sha256=L5yeWPWiSDHkwBgE3_-3SCn1ei7AHa_6e01Kq5UEi3w,10688
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_child.toml,sha256=MJlD2Dk7ZwKmddcnNuAHPH4-vytXWylRImkjrD8hyWg,6776
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_parent.toml,sha256=BICX2Ky-NJIruXOZ7WJlpB4U1q_1NsU3c2D8JVM6PNc,6994
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_privesc_via_general_sequence_parent_child.toml,sha256=evSZT8FvLwDIMLDrHhVpLZdGZ0ahj1yxBYwJ-Wbyc_4,6995
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_privesc_via_python.toml,sha256=RCNK7f3MwGsfpcIwTo4CO6YSRyzoY3VQx2i9fJcg7Kc,7589
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_suid_lpe_via_process_args.toml,sha256=yDUROhrN5SmMGfIU4pXnCO7FgA_9zWDEKx-RirK4mHw,4444
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_suid_sgid_exploitation.toml,sha256=exjLMIqufYTnts9qZnJxZtLN9Y-1WQ7iwKCBIRJ8ERI,12128
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_suid_sgid_proxy_execution.toml,sha256=l8fvt4uo74t2lHkEoJjzeahQUsvyngDhWSOvB3H9rrY,10616
nldcsc_elastic_rules/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml,sha256=v30WKm_ABJUd5lYqgG7cLNHi0ORFjd4H51ffL8tbwzs,9468
nldcsc_elastic_rules/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml,sha256=HwERSwLRUDJ4eif1_YvsR2codz2t6n2aqM582axSnTc,8510
nldcsc_elastic_rules/rules/linux/privilege_escalation_shadow_file_read.toml,sha256=vg-6Y4ity8omMwdNucJHOUd7hwvhZta2TtZOaQUa3oI,9038
nldcsc_elastic_rules/rules/linux/privilege_escalation_snap_confine_lpe_via_cve_2026_3888.toml,sha256=frSOR_ZvvHZnaJtlRsFt3D_7W6vMjoFBdtnTq686oP4,9057
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml,sha256=c7PkiFpcAkLBdpP0svm5LJeYrhHdzRCwvbcAg2HZ3Zw,8736
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_hijacking.toml,sha256=mUMvARsUY8yLk3hKeir5SFqgsm18ZyWxe3aQ8oUf-2Y,10372
nldcsc_elastic_rules/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml,sha256=2xDF_c_Zib29P6OmTzUAv0lwbitfdD7wFaQkkHObUlA,9248
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml,sha256=zgFoVHaaqbPIQ0tGWhHpiN4QHnBUfewT2AUgjZTdB6I,8635
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml,sha256=4Sozlg-z3SptDxu3GPf2s64jVqDNmT9BIYg3O04HgQQ,8806
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_passwd_file_write.toml,sha256=4tQoDjA0RkOEHK7275QBkqn6bXwJ3Y0gNeLiW9hm6lg,10531
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution.toml,sha256=PxJYw_cCTGFTsV_znxyYlqwp1etWF_M7896s0B3-5bs,4243
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_suid_binary_execution_auditd_sequence.toml,sha256=9Gb26Iw91kLwiDlEpWcPlqv9aIiFcbEZsmAIjIuguak,4339
nldcsc_elastic_rules/rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml,sha256=r5r1EeDq90vBX2coxJ3Mg39UsvujZHV-ERQSNh_vezE,10701
nldcsc_elastic_rules/rules/linux/privilege_escalation_uid_change_post_compilation.toml,sha256=yGjB8iVQt0SsaEgcJlQoteHI5WBFmNXax7-NxU1aq5I,8976
nldcsc_elastic_rules/rules/linux/privilege_escalation_uid_elevation_from_unknown_executable.toml,sha256=KwGEM1kQLQnZzvCFknKdJPhlelXm7e_nOwB1OMPfEd8,10040
nldcsc_elastic_rules/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml,sha256=F5uAh0v92lE3OnSCp_S6f1v5OwWXL8MZp16dZh_d1Rk,9609
nldcsc_elastic_rules/rules/linux/privilege_escalation_unshare_to_root_process_auditd_sequence.toml,sha256=D9y5cX5hH6mQxxw2hUwbaOFhLFzd7FhSsMget2xK4lA,5337
nldcsc_elastic_rules/rules/linux/privilege_escalation_writable_docker_socket.toml,sha256=8R_5nbR1h20nS-Yjg8vsRK2g7oyQTR69wpHnY8DrxmM,8631
nldcsc_elastic_rules/rules/macos/collection_discovery_output_written_to_suspicious_file.toml,sha256=WDSdtuhGAQjPqCyya6MdJQBbPSViOJBw6qGa3G_pQs0,6698
nldcsc_elastic_rules/rules/macos/collection_pbpaste_execution_via_unusual_parent.toml,sha256=ZGu92oZLD4xdwNRpqXzkQKTnHjh-GVGsPgCE0zaHaJw,5407
nldcsc_elastic_rules/rules/macos/collection_sensitive_file_access_followed_by_compression.toml,sha256=kDoRmqNuHtay65nOgEWKfmkZ_b5-_SXWmDQT55cguzA,6226
nldcsc_elastic_rules/rules/macos/command_and_control_aws_s3_connection_via_script.toml,sha256=JfrXJMmenCUg6ikZFFLl371lY2rh7CbOEpfhJ1FtsjE,7409
nldcsc_elastic_rules/rules/macos/command_and_control_etherhiding_c2_via_blockchain_rpc_request.toml,sha256=qj8gHiDFNTiqKDztBxvnYnjkJq3TgkO-AIWC_oACYd0,5341
nldcsc_elastic_rules/rules/macos/command_and_control_executable_download_via_wget.toml,sha256=voZiSza-ro0xfWad5PqJiMF3sDKIDsP5O6KcnPIAdSo,5909
nldcsc_elastic_rules/rules/macos/command_and_control_google_calendar_c2_via_script.toml,sha256=fx1gQanE0_xK7vUhoq3MajWB1AlBbOEDhJRYlNEd_wY,6844
nldcsc_elastic_rules/rules/macos/command_and_control_network_connection_to_oast_domain.toml,sha256=FuR4TVWXRR9lPiJ9dm5UJroI3sEiDalm1I5JzrVlbSI,6515
nldcsc_elastic_rules/rules/macos/command_and_control_perl_outbound_network_connection.toml,sha256=SizXem0bfHprGhCa0F2_K3AXpSNgxmTUKSeSVboWN2I,6466
nldcsc_elastic_rules/rules/macos/command_and_control_potential_etherhiding_c2.toml,sha256=KvMmstmnxJXxRvbKuu3hpV2tvU4XnTwrB_uotKZxOko,7422
nldcsc_elastic_rules/rules/macos/command_and_control_script_interpreter_connection_to_non_standard_port.toml,sha256=U5z4OVpZJuPd3qv2eRDt2V9sze9-WyangnRLtLRpOOk,7446
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_curl_from_macos_application.toml,sha256=0mHNWqGWSBwVcNX2uDBZeCPcO9ZbXjHMzIwa-QFnHwc,6751
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_curl_to_google_app_script.toml,sha256=Dgx6z8Y_eDgRhI3spEA2plmY7z3ehNqwJrgDg30s1RI,6010
nldcsc_elastic_rules/rules/macos/command_and_control_suspicious_outbound_network_via_unsigned_binary.toml,sha256=aRB3vDNbSFNT6Zd1s3CY8Mr8KWx6j5vmJ8Pr3S3qFr4,6386
nldcsc_elastic_rules/rules/macos/command_and_control_unusual_connection_to_suspicious_top_level_domain.toml,sha256=ZIqUEHoeEZwD1CoVZ8uAMGsi6_bf8dary5LB98Cw1PU,6122
nldcsc_elastic_rules/rules/macos/command_and_control_unusual_network_connection_to_suspicious_web_service.toml,sha256=mfYukNwXSYrtAdPs285IPh044Co_IltYUctGBnpmBKw,9766
nldcsc_elastic_rules/rules/macos/credential_access_credentials_keychains.toml,sha256=8bR6NRCDSCPsbs63ZqBEwOYHgjI0tbyPbtzQmsSfS_g,8252
nldcsc_elastic_rules/rules/macos/credential_access_dumping_hashes_bi_cmds.toml,sha256=m0RbMVUV4K2ZQaPrzk5LA4lFJ6jQAvLPXyodxG0vQVI,8040
nldcsc_elastic_rules/rules/macos/credential_access_dumping_keychain_security.toml,sha256=gjyx0Hps5HFlwp0vVDhg1cye185ytaHgbQiDRP_3FB0,7720
nldcsc_elastic_rules/rules/macos/credential_access_high_volume_of_pbpaste.toml,sha256=ulzMq40DLM4jjU--sbyUNwYEDJngdw9VUPhrkIzs5VA,6184
nldcsc_elastic_rules/rules/macos/credential_access_kerberosdump_kcc.toml,sha256=KkSXo8YIiMg3V78fZlupSfNKkZi41ZIKx9Pz2WebDy4,7950
nldcsc_elastic_rules/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml,sha256=d8AS1dJRXMGvpLeAK-4j54t5myuVyfWkJw9PKUBhcXE,8816
nldcsc_elastic_rules/rules/macos/credential_access_mitm_localhost_webproxy.toml,sha256=cAkQB2YOdiJ3sehWKp0pPUUfiXjv4__zjpQ2cYVyLlc,8520
nldcsc_elastic_rules/rules/macos/credential_access_potential_macos_ssh_bruteforce.toml,sha256=iyHBsqUsn-bmwZj8FY_V_sWtDk9uMgCv5WlUpfLs4Ho,7014
nldcsc_elastic_rules/rules/macos/credential_access_promt_for_pwd_via_osascript.toml,sha256=k25VQTAVHNZu9ddJM_iHdAQpgasufOxRNdURViDhYdo,9536
nldcsc_elastic_rules/rules/macos/credential_access_python_sensitive_file_access_first_occurrence.toml,sha256=64eA3t_IkEf1LJaJNJSvtwOyVvZi848cxShZUQrGfQU,5542
nldcsc_elastic_rules/rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml,sha256=eY7WtkuZm566keA5qkTML5NhDiIGDI2OGWh0SVkX09A,8568
nldcsc_elastic_rules/rules/macos/credential_access_systemkey_dumping.toml,sha256=Y89LcAFM2yB4eIxAZKTkoYOGh06wKWp43cZbSVE8FPI,8082
nldcsc_elastic_rules/rules/macos/defense_evasion_apple_softupdates_modification.toml,sha256=7HpOWdbbs95T1eRuX-jm9rRueYg4sCa5PpR6WKQnhLg,8046
nldcsc_elastic_rules/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml,sha256=lOrP1uoaAQQ1nWZomALT-xnjHUxLzxb12HRS4N0oWPQ,8798
nldcsc_elastic_rules/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml,sha256=YDZcf-6GwcT2g_pKBnoOAHYuTcQX4udRA3l8eO7JaH8,7844
nldcsc_elastic_rules/rules/macos/defense_evasion_dylib_injection_via_env_vars.toml,sha256=i3l3f5odbyrqYjccSjYEpl5Y-p0oOCQzxr4r-_9F7Q4,7352
nldcsc_elastic_rules/rules/macos/defense_evasion_gatekeeper_override_and_execution.toml,sha256=87M2Y784BpQgmcIGHwlcFJS4lWKnjWnfN0F7vSsTMbg,6023
nldcsc_elastic_rules/rules/macos/defense_evasion_install_root_certificate.toml,sha256=BVixCHD3MW62Xtr8x9FxRA5IT88y9o7NnDOx-i1MBZI,8451
nldcsc_elastic_rules/rules/macos/defense_evasion_modify_environment_launchctl.toml,sha256=6Wb4T3-H50_Vfnx1WBOBLbXh4t7Cf4YnWclDJxK0dUI,8322
nldcsc_elastic_rules/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml,sha256=QwzUQPNkUXB3uW00W5Rad-fOkAIc3h1e8N2j-MbdDn4,8595
nldcsc_elastic_rules/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml,sha256=sDtoRn6NRLCEuTfm_Ot38mJTxiLNPZ2cwSp8wKG7gd4,8523
nldcsc_elastic_rules/rules/macos/defense_evasion_safari_config_change.toml,sha256=D0cy2eyn9Zth69UBeoVLLUAOQTztMdbk2rqtPAbiVPg,8186
nldcsc_elastic_rules/rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file.toml,sha256=Sh1O8vz9FXkDl7VFmP9x1ZCSynZt86De9XAJvRvRUkY,7891
nldcsc_elastic_rules/rules/macos/defense_evasion_suspicious_tcc_access_granted.toml,sha256=wGUElmwAw3wQHE6ePuDUgEiqLkOAzy2YUftvECxcdu0,6587
nldcsc_elastic_rules/rules/macos/defense_evasion_tcc_bypass_mounted_apfs_access.toml,sha256=vu5A7ROC3adlVLNw3DSYn4HvWWj7xoY5w3Y3notsqOE,7792
nldcsc_elastic_rules/rules/macos/defense_evasion_unload_endpointsecurity_kext.toml,sha256=sABoUdYbpzbgcGibB3dm8RubdzPxRsw5_jWcsUNcIEQ,8225
nldcsc_elastic_rules/rules/macos/discovery_dns_request_for_ip_lookup_service.toml,sha256=aTx4Eh2LD_jh9-fG5xq_HACk-2eYqzrr8YE-8lKOmaI,6722
nldcsc_elastic_rules/rules/macos/discovery_external_ip_address_discovery_via_curl.toml,sha256=JHuuyJMUgVOb86wg3-AGAycqD7L3lf_Xf6KHaIN2qUY,6707
nldcsc_elastic_rules/rules/macos/discovery_full_disk_access_check.toml,sha256=S1JtUtdxrfWiVm07GbTqVsH17auw2YVdv40a4Fl0om4,6652
nldcsc_elastic_rules/rules/macos/discovery_suspicious_sip_check.toml,sha256=RYZ3fA9ZKbC41FmMB9Ogz_lovRSD_6Hl5XAnx0A9J4A,6884
nldcsc_elastic_rules/rules/macos/discovery_system_and_network_configuration_check.toml,sha256=hxWLOt5Fy82tauzm25BH6VIjiAdgr87SQ7rH1VGy8ac,6043
nldcsc_elastic_rules/rules/macos/discovery_users_domain_built_in_commands.toml,sha256=FnWL-XCsE24k5OprE2TgBY7vLx5KZ0q8_cCqdeXTz4E,9018
nldcsc_elastic_rules/rules/macos/execution_defense_evasion_electron_app_childproc_node_js.toml,sha256=E1GAmsNKU4dOdG6lofQU0K-lYJkKbK4wuFA9qBOYRuU,8343
nldcsc_elastic_rules/rules/macos/execution_initial_access_suspicious_browser_childproc.toml,sha256=SfKVUk3F5J2PCqOFkJXRmqGobIx6f6vBhQROl6RHReE,9630
nldcsc_elastic_rules/rules/macos/execution_installer_package_spawned_network_event.toml,sha256=57FrfcMvMGUd7v6VyGABwq4sMsPsoRKnR5Vzq7Ey8PA,9952
nldcsc_elastic_rules/rules/macos/execution_python_shell_spawn_first_occurrence.toml,sha256=4uH3XcE-T0zMexc8cZPm1tMlCrQxVqQztq2USbhR1d0,5129
nldcsc_elastic_rules/rules/macos/execution_script_via_automator_workflows.toml,sha256=dXzOjEF_gTxRkULetjvaNOOsXPmQTTuacJFK-E2idVw,7746
nldcsc_elastic_rules/rules/macos/execution_scripting_osascript_exec_followed_by_netcon.toml,sha256=gMCLZcqQ6xCLMgwuh0oqld3pyf4WqFVII8Xl2CQsq4g,8839
nldcsc_elastic_rules/rules/macos/execution_shell_execution_via_apple_scripting.toml,sha256=a6QpNQlIOlfK78S-aADEUQgScf1RxArAHaNYLvBJ57I,8432
nldcsc_elastic_rules/rules/macos/execution_unusual_library_load_via_python.toml,sha256=VsP5cN8Mr1Wk15y-NkbEld3Ou5mVHZ1KWj-_ej2eON8,5730
nldcsc_elastic_rules/rules/macos/initial_access_ssfilecopysender_root_execution.toml,sha256=0JOU3wJc_xft1wC936WM2bv-ogFJz_C396xUFvB2e1E,9476
nldcsc_elastic_rules/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml,sha256=l4gVecDzsdQf3nU4IlcVlEpEHcwq1m_feoneMgCcMJA,10947
nldcsc_elastic_rules/rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml,sha256=sZITQXKRqoNjBe46KksMIwdHg1kEilk8pbP-WHBnnDU,9421
nldcsc_elastic_rules/rules/macos/lateral_movement_mounting_smb_share.toml,sha256=zYKgfItiKdX0h5C8r2GTcYqHlRs7wy-tw1W_rOAQ3MA,8025
nldcsc_elastic_rules/rules/macos/lateral_movement_remote_ssh_login_enabled.toml,sha256=juN9IV7yDBNOASbdHrCzXLAvphucBscILuy0PnA4K8o,8064
nldcsc_elastic_rules/rules/macos/lateral_movement_suspicious_curl_to_jamf_endpoint.toml,sha256=XRSaafYxsOTUJ3AVakZF2JkSG1B0O9HCXYb7q_y8f7w,6217
nldcsc_elastic_rules/rules/macos/lateral_movement_vpn_connection_attempt.toml,sha256=Mcge1pQUihqp_w0Xj22anKRkZ1OKPaUnCYGBdraQ4ig,7885
nldcsc_elastic_rules/rules/macos/persistence_account_creation_hide_at_logon.toml,sha256=PzDsku3ENMV45MRYNvRbheZBAapzqGkJlbDfLrXGVqg,8471
nldcsc_elastic_rules/rules/macos/persistence_apple_mail_rule_modification.toml,sha256=FjD1biFg7OypmQ7LyGB37eq7Hr-gYrMZRhhgUNsztqA,6766
nldcsc_elastic_rules/rules/macos/persistence_creation_change_launch_agents_file.toml,sha256=TgoR4ldOpPPRvhfmgERPtpTbRkgMKakjeg1xexQ_rwI,8867
nldcsc_elastic_rules/rules/macos/persistence_creation_hidden_login_item_osascript.toml,sha256=OICZoFrnC_RY83Zsnp2VZ2lyFYAl2OIRCg1TFVH6qVs,8093
nldcsc_elastic_rules/rules/macos/persistence_credential_access_authorization_plugin_creation.toml,sha256=YdHOEB6-ohxjCdYnh1ET0RLXzYVPVXujuHxFv1rZi2c,8617
nldcsc_elastic_rules/rules/macos/persistence_crontab_creation.toml,sha256=knVedWqkuX54X3WgDZYZXC5q0rLmpk1XpPM20xd1Xx0,8064
nldcsc_elastic_rules/rules/macos/persistence_curl_execution_via_shell_profile.toml,sha256=gIG92VNehbyBtD39tlRfAhRCiBtvrf6cd7jf9M9KdjU,6264
nldcsc_elastic_rules/rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml,sha256=0qho54E4tjc38y-R3BTvY3racv2997L8g8MivJX1zdw,8470
nldcsc_elastic_rules/rules/macos/persistence_directory_services_plugins_modification.toml,sha256=6hE7PqAZSDFC3eXay1STGcCmhnCQM_Fk4U4yyn7eDaU,7974
nldcsc_elastic_rules/rules/macos/persistence_docker_shortcuts_plist_modification.toml,sha256=Tlp3r08zihobdv1YFAfKY5TaLYj7U0D0-OnSliaQxKM,8115
nldcsc_elastic_rules/rules/macos/persistence_emond_rules_file_creation.toml,sha256=G49a6qNqtC8v4esm_EtBeskDSh0BZbUmIZ5QD-G6QJ4,8216
nldcsc_elastic_rules/rules/macos/persistence_emond_rules_process_execution.toml,sha256=_AhsDlQClFt7Eex_O_q-3xdGBS-u6wW__iMGdOAKuRA,9216
nldcsc_elastic_rules/rules/macos/persistence_enable_root_account.toml,sha256=B11TG6XlRxLIHGtAZ29p1hAExSLAhhOzTbb1gTytQ8A,7376
nldcsc_elastic_rules/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml,sha256=AjQ4h8fXQdL5PVhYitO8CvrSelzJwHuPkEKdegfbb2E,8419
nldcsc_elastic_rules/rules/macos/persistence_finder_sync_plugin_pluginkit.toml,sha256=fH7_lIEATK4SRq9qGtwudDoDhsLnpdnvvKto9uA7jtI,7970
nldcsc_elastic_rules/rules/macos/persistence_folder_action_scripts_runtime.toml,sha256=KgtbjIITzybcE67DSLkRMcUjxeMt-gLw4z5f4_i2U9E,8342
nldcsc_elastic_rules/rules/macos/persistence_hidden_plist_filename.toml,sha256=cLDCNsreMKlYJdL1mr7oOx8B3R8rwulDWYTsW754jJk,6460
nldcsc_elastic_rules/rules/macos/persistence_login_logout_hooks_defaults.toml,sha256=26uGRX3YU0G4nzIbcjJcPmrtb_9KZOwBm4X60JjdjV8,7485
nldcsc_elastic_rules/rules/macos/persistence_loginwindow_plist_modification.toml,sha256=EWvNoVBw9OXcLF5H0SHTFsJiUmTkTSBJz6yBy06bMt0,4624
nldcsc_elastic_rules/rules/macos/persistence_manual_chromium_extension_loading.toml,sha256=4DG7V3hngbu1FWbO4mpTUUi-tJUDCnyv3vZU9wqvCWo,6480
nldcsc_elastic_rules/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml,sha256=9D_YcFnEbZs6CWQenNwqJu36jF92woNx6FOvHL6TOkk,8383
nldcsc_elastic_rules/rules/macos/persistence_periodic_tasks_file_modify.toml,sha256=-VPJVF9R9Wqe1inKDSoNFf6tF_FjFGzOB2-_DegSDGE,7969
nldcsc_elastic_rules/rules/macos/persistence_python_launch_agent_or_daemon_creation_first_occurrence.toml,sha256=Rb3bIwMrmdoySCzEw_UA2ovNaO23qKiYikrAa8FwKmc,4835
nldcsc_elastic_rules/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml,sha256=huXI55PQVyGoXS6kYijraTUurVHzFeMy1_54RIa0Z3o,4327
nldcsc_elastic_rules/rules/macos/persistence_screensaver_plist_file_modification.toml,sha256=5TNRkxI0FvH02g6EhLI54ToA_Y9l0Ll17x1EjRa8anU,5014
nldcsc_elastic_rules/rules/macos/persistence_ssfilecopyreceiver_file_writes.toml,sha256=TpzSiAeNPaf_mBvIGDvr1KX24otolLxGfROFrmTtVXQ,10622
nldcsc_elastic_rules/rules/macos/persistence_startup_item_plist_creation.toml,sha256=VdorGjc8GBK1FXtYTTelH0VC2z6O0hd-OglFHYaDpI4,5158
nldcsc_elastic_rules/rules/macos/persistence_suspicious_calendar_modification.toml,sha256=Jt7gZaWgH6mgWT_JSADjQ08gYGtvjf3vE-abtjLUEOs,7705
nldcsc_elastic_rules/rules/macos/persistence_suspicious_file_creation_via_pkg_install_script.toml,sha256=VF67-sCfrTSgXqja6VIE9uakQFMrzLfkhcchkY1Yv4Q,6747
nldcsc_elastic_rules/rules/macos/persistence_suspicious_launch_agent_or_launch_daemon.toml,sha256=uvEocchnkNToz1mizoHEdqaG-g4W8pMIuj_L23CQdos,7261
nldcsc_elastic_rules/rules/macos/persistence_via_atom_init_file_modification.toml,sha256=xtpwBuooeluYVkZZOHLyREmUH24rcuipQ8DJsu6dOUI,7783
nldcsc_elastic_rules/rules/macos/privilege_escalation_applescript_with_admin_privs.toml,sha256=RTk9sNggOFaZKIVc7-8du2Y7ZnUbm-cyCnmUdpViQoU,8125
nldcsc_elastic_rules/rules/macos/privilege_escalation_explicit_creds_via_scripting.toml,sha256=vx8gNqKQkIk88CM3DqRWU9vs_Mq-615F7b7xVkK0IiE,9167
nldcsc_elastic_rules/rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml,sha256=26_QPLUQGHYqEO8C5eHfyyDl9WYkiuc2FCEqfLeHeCY,8903
nldcsc_elastic_rules/rules/macos/privilege_escalation_local_user_added_to_admin.toml,sha256=z6O8fxGcLlXNB6HQOQvbFHpXEgqXgUPqp-Vv9-qpIdM,8454
nldcsc_elastic_rules/rules/macos/privilege_escalation_root_crontab_filemod.toml,sha256=gnCplGfJkhuFsAQ4kOpWhGZUMB6hn56oWTand2ZTgUA,7481
nldcsc_elastic_rules/rules/macos/privilege_escalation_user_added_to_admin_group.toml,sha256=AexiKtD9740_WAkXYcNCMRXSRgCmU9o_jz7GgKpw64o,4255
nldcsc_elastic_rules/rules/ml/command_and_control_ml_dns_tunneling.toml,sha256=alfHvVGwOx_218nF6HhErFRTKT6SCgKCZ80OpNaLCaU,10005
nldcsc_elastic_rules/rules/ml/command_and_control_ml_packetbeat_rare_urls.toml,sha256=s2jFsQrfvnrj3-HRNAfalzZpsqHt9O2qmmqwDbsz04M,10961
nldcsc_elastic_rules/rules/ml/command_and_control_ml_packetbeat_rare_user_agent.toml,sha256=yLIvKSSzTknJTYaE6sT8y2OUeSarKk0rPpRZlr8UTwA,10157
nldcsc_elastic_rules/rules/ml/command_and_control_ml_rare_dns_question.toml,sha256=qe3KbXhG4fqMVFiHu4NC1Ek_MnE4LNZJOinUWyohJsU,10840
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_failed_logon_events.toml,sha256=h7ECODiz3498gR65Q0iynT2TkW6ODjkXj5k7TX4HWX0,9801
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_logon_events.toml,sha256=vSRUeJFb_YNAN6uCmo1BeMsDx3Oq7DuGnP1O9k2z_V0,10991
nldcsc_elastic_rules/rules/ml/credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml,sha256=aabKfaYenJ_I0FJdDc62cF4j7qWCA63jYEc-8qThWAo,9559
nldcsc_elastic_rules/rules/ml/credential_access_ml_linux_anomalous_metadata_process.toml,sha256=xs77dUt5z1-U_v7_Q1iwyh1In7jPvinXVvvZnoJeJR0,10069
nldcsc_elastic_rules/rules/ml/credential_access_ml_linux_anomalous_metadata_user.toml,sha256=3gDucaVmBPm6d9VZaTrIwbOFh3GU-jppkJO0HqLv2j8,10232
nldcsc_elastic_rules/rules/ml/credential_access_ml_suspicious_login_activity.toml,sha256=AEDMRrKJXl9QeBCqUy8uI55GPx9GzWwXK__k-Q8NMAc,10516
nldcsc_elastic_rules/rules/ml/credential_access_ml_windows_anomalous_metadata_process.toml,sha256=hPgBsuZLakXHwscpVR3HorSfQ6t3CFFptSDm0XuV3Gg,9235
nldcsc_elastic_rules/rules/ml/credential_access_ml_windows_anomalous_metadata_user.toml,sha256=JPzCF6Vg8Hoa12SzTdjy3qzwgRM-8D9D-f-gj-88nnc,9133
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_information_discovery.toml,sha256=cYvUXZ7AMLNrY4pYyXJrVmEI97ctHkM2-Of_6zG__nM,10040
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_network_configuration_discovery.toml,sha256=LYOS2GcqfYmdSF4oVRIg6P20AOhcD-Txrt48V2PriVo,10420
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_network_connection_discovery.toml,sha256=AD92hNyxYxLtur024I_fgBA-Dsb1XW0cuO_m9sLAKME,9792
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_process_discovery.toml,sha256=Io85YcosqqIi4kfeHPG9ES3hw3M3z1xYclobDqxIw0I,10186
nldcsc_elastic_rules/rules/ml/discovery_ml_linux_system_user_discovery.toml,sha256=ulvVqjqn2TUrLoAK2C1_L3tfSJkiAiXCDTLLocHR4EA,9805
nldcsc_elastic_rules/rules/ml/execution_ml_windows_anomalous_script.toml,sha256=wtKPBk1iDdTsEXJ473QGpWxIkakDoK-fY30pjcVniEU,7595
nldcsc_elastic_rules/rules/ml/execution_ml_windows_rare_script.toml,sha256=ElFKNXu0A_pSVAf8V3uSrORdpjmw8iolErImprK3VI8,7382
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_hour_for_a_user_to_logon.toml,sha256=coteYC80eHbYGBUX0bWYkDCOlR91TDAypXGtNd7Mfww,6856
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_source_ip_for_a_user.toml,sha256=6guF9WO4PFX_JVMAApBhCTf74cKnFLIotI2YPv9S2Rk,10931
nldcsc_elastic_rules/rules/ml/initial_access_ml_auth_rare_user_logon.toml,sha256=X6pBRJS9Yr1H-8qYmUoDwQDqE-SNKmcJZw6CwDNvzQI,8978
nldcsc_elastic_rules/rules/ml/initial_access_ml_linux_anomalous_user_name.toml,sha256=xS8DpGLKA32AdeX4vEUgd4dGygkEk576uajV0XS4_Pw,7636
nldcsc_elastic_rules/rules/ml/initial_access_ml_windows_anomalous_user_name.toml,sha256=26rZLQYDDTUpuBp4jILQKpYWwSB6NacSYWaP6Il6JG0,7347
nldcsc_elastic_rules/rules/ml/initial_access_ml_windows_rare_user_type10_remote_login.toml,sha256=LLPkRNb7EDc_S4Va7DeYoOMJPyYxzlxmEXqcLApR42s,4245
nldcsc_elastic_rules/rules/ml/ml_high_count_events_for_a_host_name.toml,sha256=hZ0ZAcjlBFXeQrlj9NTaNmhKlP8zgf5_6qfvrhYcGQk,13189
nldcsc_elastic_rules/rules/ml/ml_high_count_network_denies.toml,sha256=r8FAlBIMC_RYRiVdgAhheUofb56XEhjH2Tmejv1hMZY,11218
nldcsc_elastic_rules/rules/ml/ml_high_count_network_events.toml,sha256=wF9z9ycVYb-oY_l6baCLGOsZceNzDnHIF_LrpT_DEFA,10520
nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_activity.toml,sha256=gVLSUO0Wyrp1u1gf_viqvNxhGg2XE4A5S-baPfppsBs,7826
nldcsc_elastic_rules/rules/ml/ml_linux_anomalous_network_port_activity.toml,sha256=9VxYtMySLHsxUWdybJgX-jomDrXnLEVB6528ksyV584,10363
nldcsc_elastic_rules/rules/ml/ml_low_count_events_for_a_host_name.toml,sha256=cuZLxJGIFyoShrqT4Xr4laTEh_vcPoR6k98n5i0wk8c,11643
nldcsc_elastic_rules/rules/ml/ml_packetbeat_rare_server_domain.toml,sha256=jHyAEXzMTW60MPZC9lUa6wGGm1qLyBtTp-wspWeXWlg,11699
nldcsc_elastic_rules/rules/ml/ml_rare_destination_country.toml,sha256=o3BeK7qRfpzmb9T_ChCZSyHm6Q0AVTjxmMUu6q9nssc,12039
nldcsc_elastic_rules/rules/ml/ml_spike_in_traffic_to_a_country.toml,sha256=KeO5qRk5JeuewW5VJiQ2UeNIh9UEdNyMwN_X2CgcLoU,10515
nldcsc_elastic_rules/rules/ml/ml_windows_anomalous_network_activity.toml,sha256=2lKjSC9ftxbkwMeGaYpx-Oj2s0S_zCHhq4O6hxQQCMc,8239
nldcsc_elastic_rules/rules/ml/persistence_ml_linux_anomalous_process_all_hosts.toml,sha256=QjnF65EQmMcb4Iv_yRcuhic9LQXvtQUVVdr1HGpdCoc,10914
nldcsc_elastic_rules/rules/ml/persistence_ml_rare_process_by_host_linux.toml,sha256=w5RKAmDevZhmih_CSyR5niFQeaZZCECCZut1b8WkvLI,9510
nldcsc_elastic_rules/rules/ml/persistence_ml_rare_process_by_host_windows.toml,sha256=qRqY4RinkRketmw6yZTxS-4f7HUnmGzTkf5Qcrhz6Ac,12302
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_path_activity.toml,sha256=uzDe-z7hcwjUzwH-zXoTNZkaskY0TTcEJs0VGLbrtRE,9972
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_process_all_hosts.toml,sha256=E1eYnbG3C9QmC1VRBvr1tmerCbNGwp5dDLf5DhMhdtY,12199
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_process_creation.toml,sha256=zjc2O67VrPVpjzrUTw0OihrUm8CCaX8GqkiAFjSZ4lA,13031
nldcsc_elastic_rules/rules/ml/persistence_ml_windows_anomalous_service.toml,sha256=OfDNe1RcwugXcAisbw0U5DmSUIVrrcsCJoWMMVXnpKA,9668
nldcsc_elastic_rules/rules/ml/privilege_escalation_ml_linux_anomalous_sudo_activity.toml,sha256=mpWxBGfw3xUWO7o4hIeSoSJFvGq1EmDI6pMR0P8_tLM,10075
nldcsc_elastic_rules/rules/ml/privilege_escalation_ml_windows_rare_user_runas_event.toml,sha256=-nYxExX55GcbTL0FFrudB4xskYqpM0mCCZS0UNaB0v0,9346
nldcsc_elastic_rules/rules/ml/resource_development_ml_linux_anomalous_compiler_activity.toml,sha256=b_4OcG_xX6liOmVatrg3-eUjzzgzW2eXT2N0pbnk2bE,12054
nldcsc_elastic_rules/rules/network/collection_fortigate_config_download.toml,sha256=V_5C0UFsyVzx7NKwYZu3CwxRw332GQf1e9wEaDVEuvU,5289
nldcsc_elastic_rules/rules/network/collection_nfs_auth_sys_root_uid_access.toml,sha256=9piEpIyC25EkYMKp6NN00SepQkGHewyJFWdciXshzH0,4483
nldcsc_elastic_rules/rules/network/command_and_control_accepted_default_telnet_port_connection.toml,sha256=Db3T0RxOG9r0029XSt4LZn0L5ktEam7GGe7Cg8RH7cM,8104
nldcsc_elastic_rules/rules/network/command_and_control_cobalt_strike_beacon.toml,sha256=Ztu_D25w0Od73Ved5WbazX47kR9YzHqg7vhzGLMWgoU,7043
nldcsc_elastic_rules/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml,sha256=4zRixAX0EDI8RMyBle-QvalGLMTTmnWURPtix9mc9AY,6879
nldcsc_elastic_rules/rules/network/command_and_control_dns_tunneling_long_labels.toml,sha256=jeTf8sN6TNl3swsQ_2-s0NCSZ_k3fvnqXgAtWtU4oOI,8447
nldcsc_elastic_rules/rules/network/command_and_control_download_rar_powershell_from_internet.toml,sha256=kyijmwAtV6-RYfS04eK3ATRV-am4-P_NYv5I302J-H0,7293
nldcsc_elastic_rules/rules/network/command_and_control_fin7_c2_behavior.toml,sha256=jtgRFeAJohyspFsWm4WnmuzpRBL4MY1p2P73B0oeKF4,3142
nldcsc_elastic_rules/rules/network/command_and_control_halfbaked_beacon.toml,sha256=jitSlQ3qx8giqT2EHLqEGjP_mPbD8iiDRwoc52-zV84,6556
nldcsc_elastic_rules/rules/network/command_and_control_newly_observed_ipsec_nat_traversal_peer.toml,sha256=OrbF68fMsz_YaYwCPM3X9eUx-_4tTVNQsFWRCsGyHCo,8492
nldcsc_elastic_rules/rules/network/command_and_control_potential_icmp_tunneling_to_the_internet.toml,sha256=CzHyINOhSI03tJcmOSy4jnsbrW0Lo01rOAVJIcMI4bg,4766
nldcsc_elastic_rules/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml,sha256=snhhAGkDnimjfM5iv9DH7D2irwokMLlPH9jYyd9oiuo,8251
nldcsc_elastic_rules/rules/network/command_and_control_smtp_to_the_internet_port_26.toml,sha256=2RwE1lwt2iIlJDr346xlh3McUDgFW0KUPwIk435xVcQ,7701
nldcsc_elastic_rules/rules/network/command_and_control_tls_self_signed_recent_external_connection.toml,sha256=PkuJXGoAd5JsT7w2faVmaTcKbo-L4-Bc4MtXK8hkIYc,11237
nldcsc_elastic_rules/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml,sha256=43zR2oqBSnbhf3hkDeBUrXkuY-PzwKNlpS8Ta67kVyk,7420
nldcsc_elastic_rules/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml,sha256=c2FqR2-7Hfr6d7ub0T1k0RcqwwVWm5je35MeQNwxgG8,7358
nldcsc_elastic_rules/rules/network/credential_access_azure_wireserver_http_request_unexpected_user_agent.toml,sha256=3COY_aoprgA9ioyvsoS4h3bUPdhk9m9RMRgqQeD6-xA,6311
nldcsc_elastic_rules/rules/network/credential_access_cloud_imds_credential_http_request.toml,sha256=50utL0jfgZM5UEeLf1ANB9AxxchILkrvG4jMcNznEwY,5289
nldcsc_elastic_rules/rules/network/credential_access_dhcp_multiple_servers_same_transaction.toml,sha256=mlxgyx94_8GifvRxFKH6Jnw9BejjlaOds1MGFoKS-q8,7335
nldcsc_elastic_rules/rules/network/credential_access_icmp_redirect_message_observed.toml,sha256=lf2Rjp0WQfOPOM6KMaJhAYsvw_ibZDoWexzNhybqlxU,3961
nldcsc_elastic_rules/rules/network/credential_access_potential_sip_register_brute_force.toml,sha256=_zA4wWcP161dKCpRUlSedUxqOCD7KBpGjCNZLIWHlNs,6963
nldcsc_elastic_rules/rules/network/credential_access_sonicwall_login_failures_followed_by_success.toml,sha256=u6ERt47MdawkAfK3xH7HmcWAvELMpTw9PV-CtMGtMQU,9104
nldcsc_elastic_rules/rules/network/credential_access_tls_deprecated_or_weak_cipher_negotiation.toml,sha256=Cxy85jX_v9G-mKgCiMbDBJCboo8Emzl4xpUIPp86qOU,5723
nldcsc_elastic_rules/rules/network/defense_evasion_fortigate_overly_permissive_firewall_policy.toml,sha256=AhfGndTe7u5MHP4zzvC_ZHfrMaKM1-sXU8BmBcj_bSk,4780
nldcsc_elastic_rules/rules/network/discovery_icmp_timestamp_or_information_request_from_the_internet.toml,sha256=CKPDJjlOxlIdg_Lr5xwz7NjCmv4lfi-3GuSKP2WMDcw,4689
nldcsc_elastic_rules/rules/network/discovery_potential_network_sweep_detected.toml,sha256=AbZ4YQTg0ULRrfJe9gs3pIPtEhUp_HXMbiyESFoMle8,6897
nldcsc_elastic_rules/rules/network/discovery_potential_port_scan_detected.toml,sha256=JEmseQIjJu63bmLq7ebpNfaSPWH7fHCm4IQTZenV_bI,7831
nldcsc_elastic_rules/rules/network/discovery_potential_sip_extension_enumeration.toml,sha256=eyT1lhOf_cpe3iPnYrUdVAvKzlotrweu2RCkH67_FJI,5418
nldcsc_elastic_rules/rules/network/discovery_potential_syn_port_scan_detected.toml,sha256=Y1o3Dprq_YP5PbWvsZSYfLX-V_TsWse9qLZEe3fXhoU,6836
nldcsc_elastic_rules/rules/network/execution_cassandra_javascript_udf_creation.toml,sha256=pgqu5XML4olGb9_5PmVePoQJz8WQXy7hRoEi9iDBhqc,4530
nldcsc_elastic_rules/rules/network/execution_postgresql_copy_program_command.toml,sha256=VVDi-XgqoQHC5Q-Bp2pmzN1H0t_yEfAFRL7JZ9vrBn8,4309
nldcsc_elastic_rules/rules/network/impact_amqp_multi_queue_purge_burst.toml,sha256=yul_znkseAXxP4fv_P9EJbhwV7omf2XqR9XyWJxUY6s,5758
nldcsc_elastic_rules/rules/network/impact_destructive_mongodb_command.toml,sha256=lPDuzoES3dnVKktslZNq6uZLhAIZcB-8hWK2RwEPvzo,4908
nldcsc_elastic_rules/rules/network/impact_dhcp_starvation_high_client_mac_cardinality.toml,sha256=85_-14WIs7sbNN-KWHH3Fq7gElGtOI1LH-9cMDTlUTc,5400
nldcsc_elastic_rules/rules/network/impact_first_time_seen_memcached_writer.toml,sha256=1zukEyTxbY2ePfQNoWb_DXI6snb0bixak7zGm6sPDqY,6350
nldcsc_elastic_rules/rules/network/impact_potential_nfs_destructive_operation_burst.toml,sha256=OKL8qVvNQnwNOtxDw7kuBd6nZq8rNtnVAC60S0XnAPw,4911
nldcsc_elastic_rules/rules/network/impact_tls_alpn_acme_stalled_handshake.toml,sha256=hwJQX_lRtwA1g_ltD_j1KctEr7NJR-2QqzYxv_d5qHM,9474
nldcsc_elastic_rules/rules/network/initial_access_dns_rebinding_private_ip_answer.toml,sha256=_u_H82gxuwQXoR482bE3tMjim12pvGI-38LIltPvMvg,10135
nldcsc_elastic_rules/rules/network/initial_access_first_seen_sonicwall_remote_access_identity_source.toml,sha256=4qzkqoSD-Ec0wXZvIoqyQBShCjJ6AHeVO4IaQwAVOjA,4887
nldcsc_elastic_rules/rules/network/initial_access_fortigate_admin_login_multi_srcip.toml,sha256=iX8PjgOgjy7MWWnATFQFbD-UGBfmZxCrbMDJyHpM-QQ,5506
nldcsc_elastic_rules/rules/network/initial_access_fortigate_sso_login_from_unusual_source.toml,sha256=ipUuD6pTQ38U7pDoW-TKCsbx2SfTWACgb79MYZ7MB4I,6487
nldcsc_elastic_rules/rules/network/initial_access_newly_observed_fortigate_admin_logon.toml,sha256=KTnaaTadPIoW3HRtYgLyE7ppchlOOHXqoyqWsa81ulo,5050
nldcsc_elastic_rules/rules/network/initial_access_potential_cpanel_whm_crlf_authentication_bypass.toml,sha256=-g-J3a_1iWjPzlNQVkwYJLF4V0jvqqZyhASGsP0a3G0,12655
nldcsc_elastic_rules/rules/network/initial_access_potential_redis_lua_use_after_free_rce_cve_2025_49844.toml,sha256=2RrcwioXKXkq-dlC-0oRI1aPJ3qT-jI0r5QGQOg5jiY,6834
nldcsc_elastic_rules/rules/network/initial_access_react_server_components_rce_attempt.toml,sha256=0AdjqGoUl_8RGAjWaXoEILhJLEJP55Qp1Dr368aZ_YY,5336
nldcsc_elastic_rules/rules/network/initial_access_react_server_rce_network_alerts.toml,sha256=JJc-cigNEQ-mBCG3KwFq4RFE9qWih5MBCwpz9T1oKdE,5222
nldcsc_elastic_rules/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml,sha256=V6QBUZXo-CyILuSYNycY0XYeBy5KybcP3s5kty9MNos,6589
nldcsc_elastic_rules/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml,sha256=xq94X6wJXwHjbn5YAnjf1SfrmOOb5c-k3WbgakQ_9VQ,7277
nldcsc_elastic_rules/rules/network/initial_access_smb_windows_file_sharing_activity_from_the_internet.toml,sha256=smtBPuM2iUu7cngvLanD9v0IiAgiVCsyAjcW32R2-hI,7219
nldcsc_elastic_rules/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml,sha256=Lv6nfcJv5NG11diV0frz-15kF_waNeLpLSIXp23B2Cg,7208
nldcsc_elastic_rules/rules/network/initial_access_splunk_postgres_backup_restore_rce_sequence.toml,sha256=HFjQHhOrZjudn5-4RRrj9Zrw2KpdtU0zZy7uFeOkDHM,8239
nldcsc_elastic_rules/rules/network/initial_access_splunk_postgres_recovery_body_injection.toml,sha256=WoI5EzD2jH0bpy-ECO_vXRg_s-yEXMYTQQmcOqYvVFI,10873
nldcsc_elastic_rules/rules/network/initial_access_thrift_rpc_method_from_external_client.toml,sha256=JRWvnkmJcS4mF4nGxOADjnD9EI7QnjpdlNwLyx11qWU,5096
nldcsc_elastic_rules/rules/network/initial_access_unsecure_elasticsearch_node.toml,sha256=5_g2Tq-tQBnUD31MaDum6DuMu-tvDntwGkNJisVmDXI,6694
nldcsc_elastic_rules/rules/network/lateral_movement_dns_server_overflow.toml,sha256=t0xupWKxZR6hLFJDYcxa9thFxWsLaTicQmdl283vGME,6707
nldcsc_elastic_rules/rules/network/persistence_fortigate_admin_creation_unusual_source.toml,sha256=SxovjFpLe9KsrkJtowRscRW-x8mvsMGkaCrLsudmsnI,4663
nldcsc_elastic_rules/rules/network/persistence_fortigate_sso_login_followed_by_admin_creation.toml,sha256=lCEMHKAULHFffuZLbViuB5c7W4oOHplJXDq2O_YhmRA,5029
nldcsc_elastic_rules/rules/network/persistence_fortigate_super_admin_account_creation.toml,sha256=GUvBLCXTDmEgqjlfrxez4U-lYeFLYAmMHDrbTrJesJU,4344
nldcsc_elastic_rules/rules/network/persistence_mysql_udf_injection.toml,sha256=ooFSDPXvRwoOyFDyhodZHa61dJyuvcsDAygHN8dED84,4253
nldcsc_elastic_rules/rules/network/persistence_potential_redis_config_set_cron_persistence.toml,sha256=TQeK09v52lGAK4bgsA-Q-wXORuVnxU5uNs0NxQsabiM,6595
nldcsc_elastic_rules/rules/network/persistence_potential_redis_config_set_ssh_key_injection.toml,sha256=PqTqueEfwBp_1kBbRD88w1e5WdhLjCxcf7SxkGYvLxk,6378
nldcsc_elastic_rules/rules/promotions/credential_access_endgame_cred_dumping_detected.toml,sha256=OgiWekknH4MBVGJ7VpKNV8540fCuhxT7x7TYFEYFr8g,5583
nldcsc_elastic_rules/rules/promotions/credential_access_endgame_cred_dumping_prevented.toml,sha256=_x8yZCJKIEXT7El7hPDF8hvFDsyA0B3JE2Cl5rWz-b4,5447
nldcsc_elastic_rules/rules/promotions/crowdstrike_external_alerts.toml,sha256=UITFx_IF6OjFoUL8vixwIpHZI-eRDL-uic_EkpxE_qY,4717
nldcsc_elastic_rules/rules/promotions/elastic_security_external_alerts.toml,sha256=5sVZg04LaYkdhfag6xAJTzXetfR7tGZKAZ_asQdrmNI,5509
nldcsc_elastic_rules/rules/promotions/endgame_adversary_behavior_detected.toml,sha256=1MsEv7zZ4--SlzFiaiA8JLVt23et2LSdVS6aVLo0ORI,5046
nldcsc_elastic_rules/rules/promotions/endgame_malware_detected.toml,sha256=ZHC3UE33F3qtv9rn-smliEftvKe6saJeZ3ywkwsBQ4k,5060
nldcsc_elastic_rules/rules/promotions/endgame_malware_prevented.toml,sha256=SuFhyJhtETUypX-Ozyu8O2q5RsL1Gh6Vp0FYOF1sl8M,5351
nldcsc_elastic_rules/rules/promotions/endgame_ransomware_detected.toml,sha256=tEKxp8mpEbMQ4SXMuhKkKHmeVI-Ml5RZa5UC51I8HFY,5141
nldcsc_elastic_rules/rules/promotions/endgame_ransomware_prevented.toml,sha256=nCIM6Dzz9Mw-2DXNKulOmqZyR98fgdQVScTDv2UUKgo,5308
nldcsc_elastic_rules/rules/promotions/execution_endgame_exploit_detected.toml,sha256=3MhexllBLujpRNummSaOQIL1yUrDMeZ88V4wN1eq6lI,5451
nldcsc_elastic_rules/rules/promotions/execution_endgame_exploit_prevented.toml,sha256=-NTfTWqqynUS1k9ZvQl7eGJE3wRV01Ibp9MawmfpTPA,6017
nldcsc_elastic_rules/rules/promotions/external_alerts.toml,sha256=jRhQnOSrF00vFuDgdxgjLsMTZmQ2NWm6pRvVyjQVMzE,5666
nldcsc_elastic_rules/rules/promotions/google_secops_external_alerts.toml,sha256=YjaR3k8Ou1KVQGwT3jWk4Cu7VpbkAI4DAXzdMDnifAU,5550
nldcsc_elastic_rules/rules/promotions/ibm_qradar_external_alerts.toml,sha256=AjduhPA7ZWJ67mflWgFdWeCjtCoe1WWKesdu4W2ko7k,4690
nldcsc_elastic_rules/rules/promotions/m365_defender_alert_external_alerts.toml,sha256=4hB82ZrmUAs4nxv9jSmalZ_pzmKm-FXh5inKwqKg-WA,7300
nldcsc_elastic_rules/rules/promotions/m365_defender_incident_external_alerts.toml,sha256=CJqwz7tvO4nXewQCHxkMcXvcomMNNKv8TgwuGiQe6u4,7620
nldcsc_elastic_rules/rules/promotions/microsoft_sentinel_external_alerts.toml,sha256=H-SGB5zANer6Ce3Aw18GwLoZj7qQbEdwXHsbyQBa1_o,5337
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_detected.toml,sha256=X4baqz9ufZ4nghVmgAExEibOuuKhPCCPEQ1PB_s8TJk,5463
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_prevented.toml,sha256=iFGzI0jUP51Jj3_v9pxVaWKLztZiOKCbyqnoB7vmlu8,5515
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_permission_theft_detected.toml,sha256=Q2ydKItvmO1dacU2x6DW6Wvmi_7UcUDiJwGWLU2_Ixw,5586
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_permission_theft_prevented.toml,sha256=MvzmLhVnE_Ta3AUnl8ckCEU7LOcVGtDwNmuB2OGP2_I,5837
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_process_injection_detected.toml,sha256=V29Dt1fEqOjVCA3fl8FSi26bZlFQEbNnOul_fcsO6pA,6033
nldcsc_elastic_rules/rules/promotions/privilege_escalation_endgame_process_injection_prevented.toml,sha256=2bO0FqDrEbBUeblVR0t98qDh2PP6HNElNK-nUtIwCSg,5558
nldcsc_elastic_rules/rules/promotions/sentinelone_alert_external_alerts.toml,sha256=qawOdyIv1CfZQZZbYv3jicSVQhp0FcCcMxj0BqB2Sec,5512
nldcsc_elastic_rules/rules/promotions/sentinelone_threat_external_alerts.toml,sha256=jr6Y5yxUcP05G3ejLmBJGWStkwGRKLAnz6NXDYOfdNs,5437
nldcsc_elastic_rules/rules/promotions/splunk_external_alerts.toml,sha256=4SCb7-NHiv2d9bhm9YjAUV5K9T0toVF__ROctkTowS0,5352
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_address.toml,sha256=qdBKlI6UENbwfLV1r8pqthgHZlkwubfzT2NqCvpGLx8,9447
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_email.toml,sha256=nppaiP_fGxnZWljPGgTOKBNxindsU0Ut5Qh4AU7H_4k,8145
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_hash.toml,sha256=TblrO69wkDY77Ylkqo3t58NRCLqQsrLczV7I_2XZOfA,10131
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_registry.toml,sha256=Ck1WgvQm6XCxTHczhdYYIZrDbdVnoB3HZoR5_F1jp2w,8449
nldcsc_elastic_rules/rules/threat_intel/threat_intel_indicator_match_url.toml,sha256=IIDDFyjeqOv6A0K6eBnZOsY2COnWuyuDs2zqgHUdXms,9340
nldcsc_elastic_rules/rules/threat_intel/threat_intel_rapid7_threat_command.toml,sha256=TLjbPPCy2o9FdSREmAmZ1ei3Jid56qpG7Kn57zdxK2o,4379
nldcsc_elastic_rules/rules/windows/collection_email_outlook_mailbox_via_com.toml,sha256=_46_Cqq1VLZfoC0n8G83I1v5PpsaIjkcSrnoFkYtbc8,7636
nldcsc_elastic_rules/rules/windows/collection_email_powershell_exchange_mailbox.toml,sha256=g06vUR1w5PNnHOFZWceRnb03FjLsaAkBinf33pyIq4U,7721
nldcsc_elastic_rules/rules/windows/collection_mailbox_export_winlog.toml,sha256=tZxrB3H0_CNGIbAd52gS_4mtIlLUZG4waIEwVoAcJ2U,11276
nldcsc_elastic_rules/rules/windows/collection_posh_audio_capture.toml,sha256=WP3cKGXGZro7JAM1gvpveWFpOpiCcqNhNJs3zOm37Y4,12175
nldcsc_elastic_rules/rules/windows/collection_posh_clipboard_capture.toml,sha256=PLf4wNBrCyj-w45yu755cjr2fTcXUCQGKKWW30otlYI,10827
nldcsc_elastic_rules/rules/windows/collection_posh_keylogger.toml,sha256=aG6qIS3Rt06t1qfmaFndtwArFwqSSRlpRjOR-evUSDA,13203
nldcsc_elastic_rules/rules/windows/collection_posh_mailbox.toml,sha256=kiZvhWl-8BhcDy7E838Eoo4B5UNZxzzztYfoJXSvJQY,10854
nldcsc_elastic_rules/rules/windows/collection_posh_screen_grabber.toml,sha256=9w8lLQJv8jwwZ4i5se77rTknLalQ7XBxEb1qiJ9b83g,12084
nldcsc_elastic_rules/rules/windows/collection_posh_webcam_video_capture.toml,sha256=sLpL-8-2jWJ6RIdPDnq_zGEBBIMc7jY1L4FRlHL3oHA,9475
nldcsc_elastic_rules/rules/windows/collection_winrar_encryption.toml,sha256=0ioX6k0344WSo3MFJ-OBpQhkKVn9_aSsZiz7iHXKVy4,6930
nldcsc_elastic_rules/rules/windows/command_and_control_certreq_postdata.toml,sha256=6gmJ6YGRCGGCuM_uGlgyTk5xnBrFiTsSlJSA1f4M3fk,9229
nldcsc_elastic_rules/rules/windows/command_and_control_common_webservices.toml,sha256=8n0WRBna6owXDnoSAMRVsu84XwK1UIjaZ9eqgOApi7o,18587
nldcsc_elastic_rules/rules/windows/command_and_control_dns_rmm_domains_non_browser.toml,sha256=Q3lyAw9TTH5Gr0LdZAX01x60Jwk6nLvh6VfYV1HPskY,10245
nldcsc_elastic_rules/rules/windows/command_and_control_dns_susp_tld.toml,sha256=KA4aQcvzFJAZPKtbZpezYISMGlJg-OJfunc2-P9rvxI,14215
nldcsc_elastic_rules/rules/windows/command_and_control_dns_tunneling_nslookup.toml,sha256=FR3qv_ogYkcE1Vvwl4GpLL6j_AdKheCH5-s1iZ21-Sg,5862
nldcsc_elastic_rules/rules/windows/command_and_control_encrypted_channel_freesslcert.toml,sha256=i9wJx03BS_SJ2ZL1OXaqDTZnXxbyINnhDBSXChMSpM4,6446
nldcsc_elastic_rules/rules/windows/command_and_control_headless_browser.toml,sha256=k__lLPpyzmNuuFjLOsrN4uzNRqS_Xic5dpQCumv2Uto,12589
nldcsc_elastic_rules/rules/windows/command_and_control_iexplore_via_com.toml,sha256=yEjzp4u_qchOARgsxOZyrqdWezlvntgp2aUO1RHy5ws,8233
nldcsc_elastic_rules/rules/windows/command_and_control_ingress_transfer_bits.toml,sha256=vrIy2_mJYNmIKI7MacavQv4AF2Donxy-i-9hK4uEh7s,9480
nldcsc_elastic_rules/rules/windows/command_and_control_multiple_rmm_vendors_same_host.toml,sha256=CJhFh6sjXipIDfBF5PmbDmdI4QLPdrGMAKtFd_m07wY,14739
nldcsc_elastic_rules/rules/windows/command_and_control_new_terms_commonly_abused_rmm.toml,sha256=TTZ5KGmBpW7nkeNcWgrdEYRPoz8FF4wB5BoOiwvQ9ek,20351
nldcsc_elastic_rules/rules/windows/command_and_control_new_terms_rmm_signer.toml,sha256=MfmmjkU8n8BjipR3vYLuGShSE15BC8NAxl4ypH-9gxA,16603
nldcsc_elastic_rules/rules/windows/command_and_control_newly_observed_screenconnect_host_server.toml,sha256=fG5oBRlNsfTeMqDgxyS_4LGuREEuLnZsQGzMREiU_gA,12435
nldcsc_elastic_rules/rules/windows/command_and_control_openssh_reverse_port_forwarding.toml,sha256=JGc7Pn3CvBKcm7z3KabZjAT9BGM77pdT8_egMi3VDHQ,10482
nldcsc_elastic_rules/rules/windows/command_and_control_outlook_home_page.toml,sha256=yHgLrj9STT5XZkMcqJnQEj_-pRgj_qgm66aLWEPV5co,12675
nldcsc_elastic_rules/rules/windows/command_and_control_port_forwarding_added_registry.toml,sha256=huEeEd9UFrVO8zR1hkp370_uDCsnt6Bb5nXVfcG9K_A,6574
nldcsc_elastic_rules/rules/windows/command_and_control_quick_assist_fullcontrol_sharing.toml,sha256=m7t2NZ7x75IOLtTqumUQtBbROvPWZXoAh5LMNNP5YgQ,5310
nldcsc_elastic_rules/rules/windows/command_and_control_rdp_tunnel_plink.toml,sha256=hWitKd74jp90kdF6dpNnAvadhMXQhyyVdVeDoHFuGU0,12375
nldcsc_elastic_rules/rules/windows/command_and_control_remcos_rat_iocs.toml,sha256=mYITrZ9ZrxGNZKwRQqoQzNkWIH_Bhi3F3rOde5YWcvI,11252
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml,sha256=dgTWeh85XpTUZbKYdRG8wnqmWwHpjCCP7AszdcoUyBw,10001
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml,sha256=_jXXp3XxIA4hAOaTWRcVPq6nTVDEkZxSll7FxhxMT20,9842
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_powershell.toml,sha256=nHdvn9G8fZiymkh4U4zFeNkLl682khPmuWAMONtUTVo,10563
nldcsc_elastic_rules/rules/windows/command_and_control_remote_file_copy_scripts.toml,sha256=55r4hk5mRFAOMjmumE-AV1xksscy939d5KpKs-VEXZA,8212
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_after_msi_install.toml,sha256=z4A3Py76vqIPs40qrjRD9xs3h0giBZ7_Z0UFeieTRic,4600
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_netsupport_susp_path.toml,sha256=-osktokZj5r7w-fR4luc1nxiRpWsrazn2mjAAMXpKX8,12299
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_software_installation_from_commonly_abused_web_service.toml,sha256=c3IjNvcvOBzdq9pKIE07p8lmc0cGkLPRdq7NPn0Gd2Q,22555
nldcsc_elastic_rules/rules/windows/command_and_control_rmm_software_installation_from_internet_originated_msi.toml,sha256=2bCbUgmLeidTS-nfk45F5y8Sx6iX3MYbqPjucYPxkMQ,21931
nldcsc_elastic_rules/rules/windows/command_and_control_screenconnect_childproc.toml,sha256=saUeLmlLZMAsEdOg72vonbo3_DpT2LABLFRrJ3OmehA,10775
nldcsc_elastic_rules/rules/windows/command_and_control_teamviewer_remote_file_copy.toml,sha256=WsKrnlzhsi8PmTa6ZOgMFGKsXWuahBo8ODX89rb8xLo,8170
nldcsc_elastic_rules/rules/windows/command_and_control_tool_transfer_via_curl.toml,sha256=4KFl2oI--MMbC7RCas2ZJGhXbyeBCygXX91yynvhDss,6821
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_cloudflared.toml,sha256=cA4q2cxqTjuiECKxD1MABKLDYieWg2FYPeSoN-FHWJ4,4990
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_vscode.toml,sha256=zhzziJ1GFqrTBKasVVvsf_4P4hV6zZvApyqLhDDYIvw,7459
nldcsc_elastic_rules/rules/windows/command_and_control_tunnel_yuze.toml,sha256=aWNr4AjEPXFjb-iq6J6csKQIbFPLaFHQNW1iupeUork,5235
nldcsc_elastic_rules/rules/windows/command_and_control_velociraptor_shell_execution.toml,sha256=HCWn6H-Mzx9OtGd_W0AEMsDVD-UViBOumHFqkEUH8oY,7160
nldcsc_elastic_rules/rules/windows/credential_access_adcs_certificate_identity_transposition.toml,sha256=ZzshNhem_IpJU6PDXSPmPOp45wQ2WTnFSA8Jck3TJCk,15687
nldcsc_elastic_rules/rules/windows/credential_access_adidns_wildcard.toml,sha256=XnSIK9Q-pLI454ttQ79t3cV7cADoYnBYTjHt8D26Vro,12797
nldcsc_elastic_rules/rules/windows/credential_access_adidns_wpad_record.toml,sha256=yFPAshtFMJnvc_-45oiPyKjYfv_qcQo-ykE-8QzdPIk,5833
nldcsc_elastic_rules/rules/windows/credential_access_browsers_unusual_parent.toml,sha256=gLO2g7CKxgworxihHM_sEoiBlk4MZyUMqw9d3DsN9Ac,16385
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_admin_account.toml,sha256=fjs0OC7wKRcV8LQ-OZmUr3JZCjryq9c_diwj8yIj_lA,8615
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml,sha256=RRuk8f4I6q3SlQZUbENHBz3HPbHmqbjfpAVLp7_6MpU,7879
nldcsc_elastic_rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml,sha256=wq8J9h6Fm0uer5TRnVY-va2Y3JdslfPxRlDoSzGHctg,9309
nldcsc_elastic_rules/rules/windows/credential_access_cmdline_dump_tool.toml,sha256=9ss9lJ_iCmSThm7zaI8LHc1QHPQo3X395oqbKu7UDoc,16437
nldcsc_elastic_rules/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml,sha256=F1Hz9cL58REZ4-58n3xLvaa1zWUR22bS_sjr-tnizeQ,15809
nldcsc_elastic_rules/rules/windows/credential_access_credential_dumping_msbuild.toml,sha256=aieU78lcR0RQ2u-wV0LkxiDcq1n1fL0uI336bOwWsY0,14965
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_newterm_subjectuser.toml,sha256=57dQcj6RKhTylvpo0JqlQdhdRHBq29dAdho3Tz4zJaY,17380
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_replication_rights.toml,sha256=-MLJkm2WKZVj1GDJj6vRyPOqhByZThSATXlfxN7FW5o,8698
nldcsc_elastic_rules/rules/windows/credential_access_dcsync_user_backdoor.toml,sha256=jo3ySJMoQupI593lrfxVEjNoFJK6GS5meASl2MEOaEQ,6967
nldcsc_elastic_rules/rules/windows/credential_access_disable_kerberos_preauth.toml,sha256=v1yFJaPrqPvmCQBetr_X0A0nIadvj2vIT0EXEWo_xl8,6109
nldcsc_elastic_rules/rules/windows/credential_access_dnsnode_creation.toml,sha256=A8CTE0Vz9J_Bt_0qY010sszRItZEnV24Nk2ssGJyg1I,6529
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay.toml,sha256=COVG59_VPpkwy-pV2U3g7wFa6ivmCjxSQh-uyALnhwE,7529
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay_kerberos.toml,sha256=tZHNU_vQ7GiBgom6NPqmRor68zfRJ8rBfOfNiliPBGE,16373
nldcsc_elastic_rules/rules/windows/credential_access_dollar_account_relay_ntlm.toml,sha256=Kyyc_2IlirHlpoWz_hJlnXbIjqecI46aGvotSL3N094,15515
nldcsc_elastic_rules/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml,sha256=LF07WDrc90lFal_6GAbr4SokKzgdFdrXwUbEG0h7KGY,15136
nldcsc_elastic_rules/rules/windows/credential_access_dump_registry_hives.toml,sha256=FubdbPoY_yOGjsN-uvsidQ5gVWvasJmrOe2kJC_LB4o,15437
nldcsc_elastic_rules/rules/windows/credential_access_entraid_prt_via_browsercore.toml,sha256=43PHke4dxn_-dqyQ8_PSRLNTeXIAm4Etb2xMh9DZu4k,6646
nldcsc_elastic_rules/rules/windows/credential_access_generic_localdumps.toml,sha256=YwKPewgDv6lM8IYYUSH18oxdPaXalbpp8UkRu4X-puM,7904
nldcsc_elastic_rules/rules/windows/credential_access_iis_apppoolsa_pwd_appcmd.toml,sha256=Mu2bZLxNrTRDJ4oXc41Wz9J_KNeaDy5X4M7RHPBamxI,6450
nldcsc_elastic_rules/rules/windows/credential_access_iis_connectionstrings_dumping.toml,sha256=WbX8Fb5Q_BSi3fxvmxKqj6KecS6hjWmd8KJNrQXnDbo,16561
nldcsc_elastic_rules/rules/windows/credential_access_imageload_azureadconnectauthsvc.toml,sha256=vI4YQbxI86d3fGK0pi1uiki5HcUFqbYfqiI4YitJvXA,12925
nldcsc_elastic_rules/rules/windows/credential_access_kerberoasting_unusual_process.toml,sha256=CQgk1cxraX6RgkGT9ne6WFVCmf9Ym5tjxLI2xfQq2Z4,11166
nldcsc_elastic_rules/rules/windows/credential_access_kerberos_coerce.toml,sha256=FFL3p5Va2CSh-0DzCe7hunUf-1lRc8PkqmD0ckmJOpU,14113
nldcsc_elastic_rules/rules/windows/credential_access_kerberos_coerce_dns.toml,sha256=WTEhWCXxcBpEWbRrowshlVwtKIuqPa9L-efl-xy_neo,13438
nldcsc_elastic_rules/rules/windows/credential_access_kerberos_service_ticket_rc4.toml,sha256=2FPKCCNTN8YGv8d6eunfzaJx3o0HxcISMlaXToQP2zU,7217
nldcsc_elastic_rules/rules/windows/credential_access_kirbi_file.toml,sha256=dO9caGu-GJx0d-hgnwT9js4409hfhAp3kH5SPXMFsbw,14441
nldcsc_elastic_rules/rules/windows/credential_access_ldap_attributes.toml,sha256=O02dIGrhp_2S4-wjKLmRuiCoDyYeTRnTV5NJrTg0U90,8010
nldcsc_elastic_rules/rules/windows/credential_access_lsass_handle_via_malseclogon.toml,sha256=WStrVjPOe-PfO3LapPKODYly0zbMl9slnDkpbErLzPs,14709
nldcsc_elastic_rules/rules/windows/credential_access_lsass_loaded_susp_dll.toml,sha256=c2soF1XrLDLi2aDRxq7b5Grr93LcTUVj3utUW3dgMfk,10325
nldcsc_elastic_rules/rules/windows/credential_access_lsass_memdump_file_created.toml,sha256=CDNTjCmleq_v1zdFrUGCFlcayULpzEoghWh5xiAWpvA,14226
nldcsc_elastic_rules/rules/windows/credential_access_lsass_memdump_handle_access.toml,sha256=n0ryRiDdyukdo6SnFRF7gMFHEOQmGWdMhJyKm5MSygo,9902
nldcsc_elastic_rules/rules/windows/credential_access_lsass_openprocess_api.toml,sha256=fazKPW_cV941OrNLNLe9yW9uEaCUQU9qt12TVFgtpbQ,10894
nldcsc_elastic_rules/rules/windows/credential_access_machine_account_smb_relay.toml,sha256=L0fRS5l8mSI9mkEsm7AEy46NmZi0QSC-nnq_ROleo9A,12673
nldcsc_elastic_rules/rules/windows/credential_access_mimikatz_memssp_default_logs.toml,sha256=qjN4SoElM8xe7643wksDLNxOedrPFiMM6Flz3RjRwys,13326
nldcsc_elastic_rules/rules/windows/credential_access_mimikatz_powershell_module.toml,sha256=Yt0Rw46Hvgt_8Rn5H2nX4IE84Iv1smJ-zkggCUYHNxk,17623
nldcsc_elastic_rules/rules/windows/credential_access_mod_wdigest_security_provider.toml,sha256=aIRIkkZpuxR-fMBwPISY7JfRxa3XZCictPau19YlxjY,12939
nldcsc_elastic_rules/rules/windows/credential_access_moving_registry_hive_via_smb.toml,sha256=GQjoAH57zp4M1kAx48JX5Ld_kJVHrS0SpICFe0FYmrg,5750
nldcsc_elastic_rules/rules/windows/credential_access_persistence_network_logon_provider_modification.toml,sha256=krA3lBBGJ4I7_HqmezlspR0hK7e3ATn6HBMolA_Tr_M,9793
nldcsc_elastic_rules/rules/windows/credential_access_pkinit_same_principal_u2u.toml,sha256=UYCNaVsq1UlNKG5njsHn505vxrh_YWtT_pTVq6PgoLk,10212
nldcsc_elastic_rules/rules/windows/credential_access_posh_invoke_ninjacopy.toml,sha256=RRgkbY_ZgrsP2KZzlieqK06GCjiUKaPidYuSDhF0l0o,13603
nldcsc_elastic_rules/rules/windows/credential_access_posh_kerb_ticket_dump.toml,sha256=AZiYzEg9ri78ULZYoT8thQHQKj7YbdUhXSXzPVsZPPY,14687
nldcsc_elastic_rules/rules/windows/credential_access_posh_minidump.toml,sha256=3d8H2rq6GvCxdwPLwbmBsJOnwhe6aA9AE7aHcqqxnSA,13526
nldcsc_elastic_rules/rules/windows/credential_access_posh_relay_tools.toml,sha256=uhtvUJsp74G3zk5d7gk7S_v6CYNFnJLwFgkQgNeVJn8,15070
nldcsc_elastic_rules/rules/windows/credential_access_posh_request_ticket.toml,sha256=eKvOMBKW2YYBmK-6ASzQrmRRHIaB4PpKgngy_ZeBfxI,13650
nldcsc_elastic_rules/rules/windows/credential_access_posh_veeam_sql.toml,sha256=4aFK-3eHwNuus1c8yXyptaLyzawZhsznlOc-47D5Fxo,11792
nldcsc_elastic_rules/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml,sha256=F-T6naARoqMhc8sOU15dbRUZPcaAGWsyCSOtjXb06to,5898
nldcsc_elastic_rules/rules/windows/credential_access_protected_storage_service_access.toml,sha256=z1BLJj3mJ6f_LLlf--5X_ur9JbMmOKnz65kHIL9UMw0,4583
nldcsc_elastic_rules/rules/windows/credential_access_rare_webdav_destination.toml,sha256=DhJJC6DW6HE108_79nUSQ-DH4Kl17IYGSzbZA59zVqc,5629
nldcsc_elastic_rules/rules/windows/credential_access_regback_sam_security_hives.toml,sha256=Il9jDs5Qm0CeGz4aDkjLUgAtAFA2_HxLCjLHNvpREjU,13346
nldcsc_elastic_rules/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml,sha256=2eEokWvoQ_1MO9FHh1IknJeIdYKgb0RHJb9eUmBTIXk,15223
nldcsc_elastic_rules/rules/windows/credential_access_remote_sam_secretsdump.toml,sha256=Mb3G0sX4uaxXBlTLRQ6jQy4BumACGmbudr_M6tq4QSY,13110
nldcsc_elastic_rules/rules/windows/credential_access_saved_creds_vault_winlog.toml,sha256=yX2H73ovo2oRxXKaN-1fFOM8-2G27PSWDXjeyzZOcAw,6603
nldcsc_elastic_rules/rules/windows/credential_access_saved_creds_vaultcmd.toml,sha256=zhR0W7lCYm4BAr3y-lbgXNRRMZgVKpVvhchC_x443CY,7367
nldcsc_elastic_rules/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml,sha256=UODPFzgEpIz1KqnxskyVWALEyql5evfCllCSIVwjDHY,16648
nldcsc_elastic_rules/rules/windows/credential_access_shadow_credentials.toml,sha256=_dBzE_br7NC2U6fgNiVFG8NRdaJ9R1JvXxUQhWz61f0,12262
nldcsc_elastic_rules/rules/windows/credential_access_spn_attribute_modified.toml,sha256=WiuarEis4pu-wRE2LBEtg_YSwNoVkR7z3L1BkJjmOfU,6088
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_comsvcs_imageload.toml,sha256=k1pQuNmJZc6bmouT-3dmSvoWhjTmCCImvp5UYE6rtrc,11447
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_generic.toml,sha256=XyD03nXP3MsVERYVg2JUWqdTLO1ad8_TDDw91uKwhHE,7560
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_memdump.toml,sha256=2Sg8Qe7BSxBRHtglT03Ee1DkenQ9HrVHgcTtai4-kCU,14293
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml,sha256=9hMaBL9-OB3iZvQadtVbyq9iCH4Muh39qAKAOY0ulhI,11630
nldcsc_elastic_rules/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml,sha256=rQB4bLJqY5ao5CtMvhOLWHRw2VDQVI8IggcNiDilS1o,5658
nldcsc_elastic_rules/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml,sha256=zoKIcWRUUM5Bh8aTzWNvUggo4IlguN4DWyvUvSKQBLg,7000
nldcsc_elastic_rules/rules/windows/credential_access_veeam_backup_dll_imageload.toml,sha256=s6x3J1I4UIaihEDKTghcPgWWAdvn5zEtlynP3cIAxes,7230
nldcsc_elastic_rules/rules/windows/credential_access_veeam_commands.toml,sha256=g4StHBD22VgNXMdla14I21sF_OtBf9s2ZsCcCZxVHSA,7931
nldcsc_elastic_rules/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml,sha256=3XcHx5EE4ZwIeNKI218SuR8n3xxoF1u1n2yf-l5ycqQ,10605
nldcsc_elastic_rules/rules/windows/credential_access_wbadmin_ntds.toml,sha256=VE-0Ozx8Xl-pw85gk_4Q1yp7TAkeZLrEihA9Ql7j9G8,7253
nldcsc_elastic_rules/rules/windows/credential_access_web_config_file_access.toml,sha256=EgSVVGxtt4-zZr2WoYn0OLepxymjzCO0yscd_xpjqnk,12684
nldcsc_elastic_rules/rules/windows/credential_access_wireless_creds_dumping.toml,sha256=LWSmc_TY9qWB3nhNSIsvjVsIpgbNHEVOl0xoPblW_6M,12347
nldcsc_elastic_rules/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml,sha256=mnlYi4wuUxYnKeB4PrgCzPk9q1ipBcewSVr0JDUllps,8826
nldcsc_elastic_rules/rules/windows/defense_evasion_amsi_bypass_dllhijack.toml,sha256=zDrcjtFJ0GCMi2an046OAmGn8qVd7S9R74BFUr2nj3g,14301
nldcsc_elastic_rules/rules/windows/defense_evasion_amsi_bypass_powershell.toml,sha256=HM93eMiTZyhBDF3KgWV_4AqievMPLiE0iYiPN1mWeqc,12971
nldcsc_elastic_rules/rules/windows/defense_evasion_amsi_bypass_rpc_ndrclientcall.toml,sha256=m7sK43oUIA9rE0wTku_6SJoa2XJmeIxCROYE7xL7Ik4,6282
nldcsc_elastic_rules/rules/windows/defense_evasion_amsienable_key_mod.toml,sha256=E8r2uxU1_xoSdMLnBnMH6j4uRBRAzipv69bzR-tsyJQ,12877
nldcsc_elastic_rules/rules/windows/defense_evasion_audit_policy_disabled_winlog.toml,sha256=9TOTpnJCaD5GNrlcJzQYBx-b1IxgAbHH6ersldd6o-A,5715
nldcsc_elastic_rules/rules/windows/defense_evasion_boot_time_removal_tool.toml,sha256=EPAJXPRYYiqOodWEzJsUbYKSdrI6ZkQkq_gxvys4PTA,8027
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_console_history.toml,sha256=DgTh10LnIsXwSx6b8AOxWcD6mnocnC2cxQO9MkbNu-M,6562
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_event_logs.toml,sha256=0r8tMwCBzoQ7F8-y0QX5oh6MqUdLopZBJiWHda7TOWU,6342
nldcsc_elastic_rules/rules/windows/defense_evasion_clearing_windows_security_logs.toml,sha256=IkLo43CSbs6_gQ2fP4XuVKxYz81jDkVOgoE9gOLqB18,3985
nldcsc_elastic_rules/rules/windows/defense_evasion_code_signing_policy_modification_builtin_tools.toml,sha256=eADAQfhtwuw8_c2XBdXM2VuNsObQLZQF64SL4UnnTCo,7943
nldcsc_elastic_rules/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml,sha256=sGm5h_DyczoU91pOzXvcN6a9tAOtAog71CfLJvbC5Ug,8106
nldcsc_elastic_rules/rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml,sha256=ObQtaXnxLwzAsyCPi4woea6OGiGLOcggJPn3xHfwGKA,12665
nldcsc_elastic_rules/rules/windows/defense_evasion_create_mod_root_certificate.toml,sha256=DTNH18drJNfiFtVAPo8vAY17kSeognBiYT-BBMGgm2I,10388
nldcsc_elastic_rules/rules/windows/defense_evasion_cve_2020_0601.toml,sha256=9H5SSu1dkTEbTrnP8Es1zvBko5I4_UBkOPgmdlr0HWs,5624
nldcsc_elastic_rules/rules/windows/defense_evasion_defender_disabled_via_registry.toml,sha256=mzO2nkiUe7r8E6CQdKFR7aKvbx_R_PbSKzRAY1DAO1U,6224
nldcsc_elastic_rules/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml,sha256=Azu8cNTvb_rO1VEMVjw92s08JozCAGRfAhV0VS3uXXk,7797
nldcsc_elastic_rules/rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml,sha256=og-IEHumlznfTeqNAQXWVuVzXALBNbluUMC8R32alZ4,5711
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_nla.toml,sha256=2fPvU_SH7l8tirdIiotnEe_PPPI7b88f4JXeJd6gKHI,8023
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml,sha256=EH2vthFZLCCzb0fTKJk8AERSZE7g5ZGSc8fd7K3QzeM,10846
nldcsc_elastic_rules/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml,sha256=-lR9jZAgCubwkIOwDj5lVB-eJ4TYGh7Z3vfYPvoHx8w,4987
nldcsc_elastic_rules/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml,sha256=27FJ64H6TJdyrzM22xyS9y5PZVpT040_whTwRM_YooM,9453
nldcsc_elastic_rules/rules/windows/defense_evasion_disabling_windows_logs.toml,sha256=Ex3Ii9YgmYh4UL46xi_SXuDJMeUDXclDzl5M_4zbk2U,6387
nldcsc_elastic_rules/rules/windows/defense_evasion_dns_over_https_enabled.toml,sha256=FFvS1eE35j7Uu5X-MNSOd73zZvLukRGbbgDtapfFnsM,6957
nldcsc_elastic_rules/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml,sha256=O-YQKXHAZVdILthxpNNDu4XbBHF43FmMkuif40UxZ5U,8933
nldcsc_elastic_rules/rules/windows/defense_evasion_edr_freeze_via_werfaultsecure.toml,sha256=f4ExGiqn-r2t80r2KjmpLJrDs3c_-79ND0igjv-RDN8,8114
nldcsc_elastic_rules/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml,sha256=qPUTws4nUTK-l21w-aMj6eSzjahWVRmMXDJKoUuVqRQ,5916
nldcsc_elastic_rules/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml,sha256=Zax4bAdMKeXrCckGC_8uWl-_YRoK-dL7mh9tsp9Ghgc,5476
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml,sha256=YAoEwlXVlQrj5PdG75WmOyGvYyTyCGGg_t7nTk8D4_I,14267
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml,sha256=oOvRdq53pa_cQXpfaKqFW_rrtD7i_jTLnu8aX45piCs,8967
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml,sha256=pI1mhfRqVgtLmm1x74lrCOjQ--cDxvdo7yxA4NAqeDA,13471
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml,sha256=k0wEKD5YmZQbHp7v8l4nT5hzWzyiWG2JWRLaSNW8Aco,8912
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml,sha256=ZwBHa8IsqkHD4jYAOJIM7SL3nUXZX9JOY8hb1t3_sms,7194
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml,sha256=kVrnGFS3AtQDxrEbrt7f5490JBUMB6q_WXu6WXuacAI,8072
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml,sha256=d-uhGtikQMRpjSzGZQtGvwuJLoVu5myrAjjJ5t_nMcc,7598
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml,sha256=aBczVPTZ7_1zmgVtlxoAGgahshZgZvocU3kieVp7QaM,9333
nldcsc_elastic_rules/rules/windows/defense_evasion_execution_windefend_unusual_path.toml,sha256=YFUgBKSW8oALI55ok2S6OSCiT8GSqFJJpNgCLcDZqd8,15385
nldcsc_elastic_rules/rules/windows/defense_evasion_file_creation_mult_extension.toml,sha256=hScMVdROQhoGdgGoZFh3lyr4Aoe9NQazU9vaXqBkrrU,7886
nldcsc_elastic_rules/rules/windows/defense_evasion_from_unusual_directory.toml,sha256=oxQbdvZ6iVoCQjLk1S7E801XvBbRrxkm7NK7G1Xc-Es,11237
nldcsc_elastic_rules/rules/windows/defense_evasion_iis_httplogging_disabled.toml,sha256=kZnRhL9auFNdR3wBwLo0bGZRvqWG6Ly0TWGhoz0pYpA,11303
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_conhost.toml,sha256=Q3tAaa9SS4RWA2u8pq-AsQfVv_XDNLZiZHIrPzoziNo,14409
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_forfiles.toml,sha256=ymH598i0rcdWBU0gJij_eKmJ5j4LFAyULO7FzMPXssc,4693
nldcsc_elastic_rules/rules/windows/defense_evasion_indirect_exec_openssh.toml,sha256=wFbwJjCGT_FXdMSp4Y_kd1OAE31gVjELs5dzCVqw_LQ,15369
nldcsc_elastic_rules/rules/windows/defense_evasion_injection_msbuild.toml,sha256=8z6hbRdPX58LuRn9KwM9k7BXveATElTMjt3Yx7T3qVA,6618
nldcsc_elastic_rules/rules/windows/defense_evasion_installutil_beacon.toml,sha256=g6E-BuiHJ_Z23i8Oj-oVtQmgRBmJqmbN6om_AEqeOg8,6778
nldcsc_elastic_rules/rules/windows/defense_evasion_lolbas_win_cdb_utility.toml,sha256=ugDsW0Z14YeOr6FxRM8kXHw_Ku2OkszwtJTuF8HNUZs,7212
nldcsc_elastic_rules/rules/windows/defense_evasion_lsass_ppl_disabled_registry.toml,sha256=PoNLb6Zpk2qTTIghyrffXiG6NSCIEQo3fqAIBLXYOCQ,13858
nldcsc_elastic_rules/rules/windows/defense_evasion_mark_of_the_web_removal_unusual_process.toml,sha256=8hJhDpxGkhwBAWnNA-XM2l9W1WhZmfCKB5WLLpErrhM,9920
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml,sha256=wUT9Hzt_On_JPtx6uPwRe8g0NFEnVV0k-MHZVoGm9W8,8363
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_as_svchost.toml,sha256=Bz8gZydPcvz_TWeFwCUWCOpsQJf0bjPbP2HrH6THnzQ,11407
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_business_apps_installer.toml,sha256=E676LJJNXAalM08uxdj48Q8RaxoLJOXp1fxN2JBJiuA,12305
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_communication_apps.toml,sha256=Vzb4-szj2NKxGhC8-HAzp-18MHYFmfdYOj4TwoyzO7o,9436
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_renamed_autoit.toml,sha256=iowUZdfydu6N2D5eh2SGIii04p8vEPqiTXoUBvzpwBs,13437
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml,sha256=W_OFsGNYbZu9KVeYD75uQ1cUf_yYTsZxcCqt6FZhsbw,8162
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_trusted_directory.toml,sha256=ffTNF95OqUwGHtue-zc0TatSpHYuZ3uBW_h6PB1eqC0,7926
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_werfault.toml,sha256=APgokVfZBjibo6apJbA-9wo4a11js1cNqoRtd_ACGkk,8373
nldcsc_elastic_rules/rules/windows/defense_evasion_masquerading_windows_dll.toml,sha256=UTWyQjKd5sRqRo4g_3O6Mq6PT2gHDbLasTM8TuSz0Mk,53861
nldcsc_elastic_rules/rules/windows/defense_evasion_microsoft_defender_tampering.toml,sha256=JZxy1khLrxg_wHBQhrEk6oLWM7F_wB-KmMARw7XAJdM,9315
nldcsc_elastic_rules/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml,sha256=4RUWsUb_8AtUqVfwwkh9FBHgntWmUgIejB4NB0ZCEIU,8765
nldcsc_elastic_rules/rules/windows/defense_evasion_modify_ownership_os_files.toml,sha256=rHUr3g_sl6FhBsoXGVfgwq8FP8DbW88UnZIsCSzgEEE,5441
nldcsc_elastic_rules/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml,sha256=P9EHTtQtT_lcBSTrIDiPEaUsSPtmS1MXFsz01w_FSJw,6959
nldcsc_elastic_rules/rules/windows/defense_evasion_msbuild_making_network_connections.toml,sha256=HuvjsWIc4Hr_-3UtIs6ykEHGtjn4mxY5SRLKTJxKQOs,8846
nldcsc_elastic_rules/rules/windows/defense_evasion_mshta_beacon.toml,sha256=r34hs7wqW2gsqbh1gBBV_uT__VzKcWfV0_L-n9yJ7F4,6701
nldcsc_elastic_rules/rules/windows/defense_evasion_mshta_susp_child.toml,sha256=lLhKQo2iJlV6dd2SRLmmkO0BVT88-Lir2ElVjNDAp50,16614
nldcsc_elastic_rules/rules/windows/defense_evasion_msiexec_child_proc_netcon.toml,sha256=2Rp3HxOSTJaPNO9jk_ruQ4trN6pKz_SBCewDAK0teO4,8672
nldcsc_elastic_rules/rules/windows/defense_evasion_msiexec_remote_payload.toml,sha256=aZ8DVjQglXXZHYtH4408We6jpoKsq2evbeOXlpGFrdA,12690
nldcsc_elastic_rules/rules/windows/defense_evasion_msxsl_network.toml,sha256=xGxrx0jUrF-RRM-9OCSPAu14RwHBJ7iMXKLP3RUwQ5c,7124
nldcsc_elastic_rules/rules/windows/defense_evasion_network_connection_from_windows_binary.toml,sha256=N5ljVQXHhPS5lz3ryWayn57VPwwf4thyYiVdxCHV5qU,11470
nldcsc_elastic_rules/rules/windows/defense_evasion_ntlm_downgrade.toml,sha256=QKBbgCxqur6dYq99z0ORaTVbOj1N5QZQkeEZLVtj5OQ,5838
nldcsc_elastic_rules/rules/windows/defense_evasion_obf_args_unicode_modified_letters.toml,sha256=pFRfb5hrTlOfSYWMbVj-Hqpm6dAsw63rdckE-xV7W2E,14929
nldcsc_elastic_rules/rules/windows/defense_evasion_parent_process_pid_spoofing.toml,sha256=IJSpPpjoAFF08BRtnoUm9xSfgkTw7HR_qHT_H7vpPew,14237
nldcsc_elastic_rules/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml,sha256=np1TmLZphdnAnT0bVxu6XArGt3RkbTMzRkzvqnRJ1RQ,8748
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_assembly_load.toml,sha256=dNXE4UnfeTSa0Sgf5HpmR6aIPAWAIruxf6YjwiaAPvE,11975
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_compressed.toml,sha256=KazcuLl9Z90EvSBOsuzoBCpqoDedn95DwGO6Hqc2wkY,14199
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_defender_tampering.toml,sha256=zqqBlbjlI9HGQud73WVQzYM3uMsTM0pag1uTsgS1acY,11188
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_encryption.toml,sha256=q_JPEaJRPWJjvFqKe2sENxEkwMhywLTJlrbbPD_jknE,11555
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_high_entropy.toml,sha256=jVLNjEd1o4Mc6y8DDYZqvBP-M3S2mXvzDR0GutJ_760,12697
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick.toml,sha256=qgzQwzgLFVlwJfOtKmMKASbmf4qmft0mpJaeUeaKzG8,13084
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml,sha256=3plqMLP8HcFAhmnLb802F73x9VpHf1hTCLB0iYvG3Wo,14294
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml,sha256=LTjAPH75oM0zmY1v-3dRyWhAKBGBux7Hkj2jWd3MCWo,15715
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml,sha256=OeccUC-bBEooDYCa_YzMfklGot8QdVWsnNOT4VxjkcA,16522
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml,sha256=rkeznoKSBb-qU_0S1-06RenWF1ubFuG8pxyy4A9WF9c,11100
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml,sha256=lfKi4Nig5xrTcwtkAb4Xg4f6SrSo2XaS-Bl5U2zpDhw,12401
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction.toml,sha256=K_0Y92J3nMVKPuDXrmxtalxYWSTtVV0PAgRooJWabYw,12357
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal.toml,sha256=l5hEP6THwEBtZ9FIsIfoyVgz0nRV72CCCCSPyCeklJM,11227
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword.toml,sha256=P_lkBzqjFCeH05gs7aDaNP3rUTCzpjj_itB4cAyqcac,13008
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_concat.toml,sha256=0JZpmOM3xmLjE4s9IQNGaSx0Y-0F-5Fxs24hSnwBFUw,16452
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_string_format.toml,sha256=Oo3pAAEzPf7vAfE7sPMsDevMMKsAyrjaMGREVVJifIc,13107
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion.toml,sha256=EoPBjMBPYDNQAQUj3jdXH6ffwAq4i0ORCe4ydJQbOaM,12871
nldcsc_elastic_rules/rules/windows/defense_evasion_posh_process_injection.toml,sha256=UDl8BPkv3rk_TFC18JqoLgat794ae7PcFUtRS_H2oYM,16265
nldcsc_elastic_rules/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml,sha256=pZ2Ho4EAA2aL_SA2PuIH7FxtriGnfPR8p40kpqW6Hqo,6759
nldcsc_elastic_rules/rules/windows/defense_evasion_proxy_execution_via_msdt.toml,sha256=Er3C3C8Ytcpdozvjis-AOBfDM9HAa3SlAHo1piRMN_s,15195
nldcsc_elastic_rules/rules/windows/defense_evasion_reg_disable_enableglobalqueryblocklist.toml,sha256=kY_w7RozaLlDwEoJW2fXx9K9EmGA_GxXKIdLvtYxCaI,7813
nldcsc_elastic_rules/rules/windows/defense_evasion_regmod_remotemonologue.toml,sha256=cvBvqw5iBiTlkTGM7G417-6v8tSHcsi2kNkHzVApxgo,6590
nldcsc_elastic_rules/rules/windows/defense_evasion_right_to_left_override.toml,sha256=W-jhOIWkroWju1oopYW6aXVTNlHxNBtDBT66dZfkL_w,7406
nldcsc_elastic_rules/rules/windows/defense_evasion_root_dir_ads_creation.toml,sha256=GkzU9ZzPE-z8mNf8KfyKpIpkozcXrRWGQHjUG8YFhe8,6975
nldcsc_elastic_rules/rules/windows/defense_evasion_run_virt_windowssandbox.toml,sha256=3PGdry727BODDO2JyteSMYDbNqwFyPjHkAgs5YuNoAA,7315
nldcsc_elastic_rules/rules/windows/defense_evasion_rundll32_no_arguments.toml,sha256=paDRueN8eK4zbwvwQ57orYk8bA5a3zqW50LRwF_REpU,11701
nldcsc_elastic_rules/rules/windows/defense_evasion_sc_sdset.toml,sha256=-g2nqUnFtAbe87kv9CwS1mnJunh5m6eeiT0etb2kE6Y,7666
nldcsc_elastic_rules/rules/windows/defense_evasion_sccm_scnotification_dll.toml,sha256=NdJpDFjbbvp9o3sQB3v6rXPccYqnWfDSTxmHSTY-L5Y,5779
nldcsc_elastic_rules/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml,sha256=4Aur9btSdzXcrwiYVYgvuR_GpCJBgse5Gk-uMNLyOUg,7193
nldcsc_elastic_rules/rules/windows/defense_evasion_script_via_html_app.toml,sha256=UZb4fSUZ9nSCOlpYFsW5JrS8DL1GxCbmk67-VWQLxhA,15373
nldcsc_elastic_rules/rules/windows/defense_evasion_sdelete_like_filename_rename.toml,sha256=6t0WpRcpSGogS-sDH7l0QdlpBkWS2oHWf0TzqGJrdaA,5666
nldcsc_elastic_rules/rules/windows/defense_evasion_sip_provider_mod.toml,sha256=iIEZztTL53Nn2JZLc5Pttn2zv4zdyyT0JQUtWLqDssk,7387
nldcsc_elastic_rules/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml,sha256=kpfeuY1oex0AFms2BdgrhOUlScYVQR3y8HELpdbhrR0,8133
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_certutil_commands.toml,sha256=U-IpudY4Eo6uL0dsWU9VKJifVoBMDb4Zg8YyNCPTGsQ,9252
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml,sha256=ZNKwcfuwZGDgRIQh944NZLLF9NRYNeqySuqvSoa8YeM,8541
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml,sha256=3iw0U4vOLChNw1QXCiq-M8uPq7s5-TxMm6UirXaVgvs,15178
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml,sha256=QMcVLS07B1JkF62tzCnTVcnfz7zHddA39668wHSJdK4,14780
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml,sha256=BDLV2kA4O3yryghdjeHV-Ur0kGdsi8nZoo0xKf-uvew,5607
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_scrobj_load.toml,sha256=6fnafxYA94VFl1B9r5veJNC3_w3sEkqKCzyp7wziJy8,7267
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_short_program_name.toml,sha256=gCR3lTQDiZp6YjHjy_oYTitXyStnF1gXU9mOIeWJkfo,7358
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_wmi_script.toml,sha256=XZ4pA9ebEF4sNq4L_yiPsUGzUCwIh8iE6zkvp3gtpaY,7301
nldcsc_elastic_rules/rules/windows/defense_evasion_suspicious_zoom_child_process.toml,sha256=JuGcrboFfCJSLMqvPDOuyG4XFxYtLRTOSelSPIdfLIQ,8743
nldcsc_elastic_rules/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml,sha256=FDsqU2HmPcLmNmjDN-a4z4Wx1zF-AEwxNCylJRnpVzU,14293
nldcsc_elastic_rules/rules/windows/defense_evasion_timestomp_sysmon.toml,sha256=EbTVhJLvpJS6bNA3kkGLtKsv9x1jFzXUqATXD6sQUVQ,8969
nldcsc_elastic_rules/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml,sha256=sw15ao9zLmLZZiYqGD3hbwdS29E3ec3UyoHitlXMItw,10248
nldcsc_elastic_rules/rules/windows/defense_evasion_untrusted_driver_loaded.toml,sha256=flkLgVZ1L5lr27WSisyr-qL8D1pjjvdopux07qt9gQk,12971
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_ads_file_creation.toml,sha256=274rYQnvnlKXcntgEqAHaz2QOzp_Kv5Tr3nzUyMe6bA,12866
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_dir_ads.toml,sha256=JMAKOmdU9HlVzyxUup7CNNmwuj7pxwQiXv5j_PehKEA,6595
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_network_connection_via_dllhost.toml,sha256=Z2q13PaO3UPVkL-S3QqIsog35HQAY3h8nqhAyKBq1kQ,7176
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml,sha256=BdXIeRcgGKV9KxRtEf9IGIBNTM5Hec_nPPdF4ljdDNg,6329
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_process_network_connection.toml,sha256=LLhDD4JBuKmfPpN_j4KDiedwZ_O86GOdcfUdlf0XPZ8,5901
nldcsc_elastic_rules/rules/windows/defense_evasion_unusual_system_vp_child_program.toml,sha256=0m_Vi5ysfDpcNXSMS1KyLWrzy1pN1ka3su6qY1pZTRk,11407
nldcsc_elastic_rules/rules/windows/defense_evasion_via_filter_manager.toml,sha256=Oub9S5wvKx72bwDiIjcvxUr31IsfM8VivedFkk2Dmro,8687
nldcsc_elastic_rules/rules/windows/defense_evasion_wdac_policy_by_unusual_process.toml,sha256=L6GrY0oE4puGb8XFNrEvkiGtercTD2sPu6qORfs--sg,13941
nldcsc_elastic_rules/rules/windows/defense_evasion_windows_filtering_platform.toml,sha256=zBJovsre2kNx3k1yOlu7lt1ltgBAnz81YPd9_1GFIkc,10937
nldcsc_elastic_rules/rules/windows/defense_evasion_workfolders_control_execution.toml,sha256=pHRfmxP94NLsvSSKemV_4iIZlbnX056TNV3eccRz3VY,6215
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_bash_exec.toml,sha256=-FnJ2jJ-oPjQZavwzyaDxALq2qNNPCUlvk0uQsLHEYg,10511
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_child_process.toml,sha256=AXQRgLyM-FuCnRgpsc7PhEgQlyrLlU7o8gWVhgdGZfM,8663
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_enabled_via_dism.toml,sha256=7N1pQfGQQ7YUcPKes3B0FHFmdCwiID7_ep-wkaQ2L-Y,5701
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_filesystem.toml,sha256=5IfkI9hrJ4eY7u6WLfjFGkWMHKC5wCGyaegnnmdOFBw,6939
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_kalilinux.toml,sha256=CJ6nwJXU2_cvwl3cmTI7CfgmyRKxLlLwNvvMPR9ZqU8,14390
nldcsc_elastic_rules/rules/windows/defense_evasion_wsl_registry_modification.toml,sha256=xHY5NnzZpq-YrFRe3MXaECAcuuqtSnk0eyuyEOpZXVk,6234
nldcsc_elastic_rules/rules/windows/discovery_active_directory_webservice.toml,sha256=ZuQbyYSFSA9su-EGmghJ6OTRb1eKPVjMnxZLbzvYcUY,7110
nldcsc_elastic_rules/rules/windows/discovery_ad_explorer_execution.toml,sha256=oi0iTaxp_JLGRfiBPwls1XtqiridQGjAEq3sKyMYBEw,5751
nldcsc_elastic_rules/rules/windows/discovery_adfind_command_activity.toml,sha256=q99C9T3itYftA8622Kh9wYqQHpJbA7pboGylVMbHnQA,7784
nldcsc_elastic_rules/rules/windows/discovery_admin_recon.toml,sha256=Fo-pinh8EVRFgG9WsJCm78shP0JB12h3Ve6uZJHkxAc,6057
nldcsc_elastic_rules/rules/windows/discovery_command_system_account.toml,sha256=GQqfud0NLmojiUkZ1rqaFaie147Hd9QVjfzpkh-VOG4,6622
nldcsc_elastic_rules/rules/windows/discovery_enumerating_domain_trusts_via_dsquery.toml,sha256=SdDtEVdb0fB_yIQ5cIFFnYxXmy-KnstYcxHlZzvcbnw,5606
nldcsc_elastic_rules/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml,sha256=zjEfQgufEkInOtXlg5WF78rFnPIo9ecH59mueLJAXac,5887
nldcsc_elastic_rules/rules/windows/discovery_group_policy_object_discovery.toml,sha256=7-0v4RBkl85eeXb4_4zUepsE3B1jeYYfTU_nExaUC4Q,6042
nldcsc_elastic_rules/rules/windows/discovery_high_number_ad_properties.toml,sha256=2wlD1Jwmp0S8NaqQUrvgzwqx-q60hzDzBvBNw1xTGA4,6298
nldcsc_elastic_rules/rules/windows/discovery_host_public_ip_address_lookup.toml,sha256=wOCkD71JU7bDqqkM0_09SO6kRS2HSsHWA1HEA18uFCo,15569
nldcsc_elastic_rules/rules/windows/discovery_newly_seen_abused_scanners.toml,sha256=A0FCN924JpvbwzKScifq-n-HVvexrD5Ij4k1M-xDYTo,7595
nldcsc_elastic_rules/rules/windows/discovery_peripheral_device.toml,sha256=PIud5rUYkuQUoPKCsqUhs4M7b4A6qqT0zEzpMLUzjqA,5220
nldcsc_elastic_rules/rules/windows/discovery_posh_invoke_sharefinder.toml,sha256=rxzNlsuBggjRu-45UYdsuCn-ZAON7sZaOvz6GWQF0Sw,13795
nldcsc_elastic_rules/rules/windows/discovery_posh_suspicious_api_functions.toml,sha256=TiZKRLWvRfGkOpFbWHkQKkZXV4wBknR0ZfqUQRIcPoU,14729
nldcsc_elastic_rules/rules/windows/discovery_privileged_localgroup_membership.toml,sha256=pRH_DCHA_CHiRgmtoS5TIhedZyrjan77lblhf5_Kj2o,10323
nldcsc_elastic_rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml,sha256=55DbwbIUbwsVYuOdj0XeiWXfb8EJvJxJzaj_SAXI7Dw,5439
nldcsc_elastic_rules/rules/windows/discovery_whoami_command_activity.toml,sha256=svqAhDeovuy6hz1h47sc7P28m4xP112jidkf71hwsDw,6397
nldcsc_elastic_rules/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml,sha256=zfNQRllS7wyhchkwyTMxaRLlnppvS5rif3PhPxBU-9Y,8393
nldcsc_elastic_rules/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml,sha256=r7tUR2SLXql4UH5gwIiMWYNgUVISeNRkzT2-h_d_2ME,7740
nldcsc_elastic_rules/rules/windows/execution_azure_customscript_extension_suspicious_descendant.toml,sha256=cTTR2hINag9EcxBqBPbtYs510dcUn3u0tx4nroQtwJs,7634
nldcsc_elastic_rules/rules/windows/execution_com_object_xwizard.toml,sha256=DMEp2mZVhRyh7EevtER9vsJQ_fClEExgNiqWjbNrGqo,7948
nldcsc_elastic_rules/rules/windows/execution_command_prompt_connecting_to_the_internet.toml,sha256=TiqfYmm5p41woz9RqFdA2B-LE8T_g8SrOI54DcjRsws,10725
nldcsc_elastic_rules/rules/windows/execution_command_shell_started_by_svchost.toml,sha256=9hxxG8NogGaKLCw3uLDQPESChv71VyW2S9-B1QD1QXo,8667
nldcsc_elastic_rules/rules/windows/execution_command_shell_started_by_unusual_process.toml,sha256=OxMmdkmZw1KOh41bJGrS2c6lOfwy5z4byvxGh56XbpY,7407
nldcsc_elastic_rules/rules/windows/execution_command_shell_via_rundll32.toml,sha256=tj6GG1OujzSs0gDf6uPg_gwtqeOp6cfsUD_tMVkqvV8,7424
nldcsc_elastic_rules/rules/windows/execution_delayed_via_ping_lolbas_unsigned.toml,sha256=vam6KZzh54hPNftu0tzuTpBCiLpccWX3r5B2rc62NOA,10082
nldcsc_elastic_rules/rules/windows/execution_downloaded_shortcut_files.toml,sha256=i_dPqFhpTBapmzXpsrOKms5i9DNxwj15jMXwIBmzL8w,6079
nldcsc_elastic_rules/rules/windows/execution_downloaded_url_file.toml,sha256=osHCvVzCYH-NAdm5Z36cw1DEtWhAEq1P3aTOscbHGjA,6130
nldcsc_elastic_rules/rules/windows/execution_enumeration_via_wmiprvse.toml,sha256=Dny_ZrF-tL32_sy7kUqJMEAXa0jbiCJj0e4-iPzeW54,9110
nldcsc_elastic_rules/rules/windows/execution_from_unusual_path_cmdline.toml,sha256=iFMemb8G1bOp21PZbmwcRGsu9WXLTQmT38BVO7ICmmA,14211
nldcsc_elastic_rules/rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml,sha256=UNQxy1nQdj5i9dph9f4H8u1oi9juZUYEYpFmTcAMC38,10020
nldcsc_elastic_rules/rules/windows/execution_initial_access_foxmail_exploit.toml,sha256=hpxpUyegpQcEN21xKpnRvrMZm0-H5KS92dJEN2YvZOY,13956
nldcsc_elastic_rules/rules/windows/execution_initial_access_via_msc_file.toml,sha256=zwdfKz5P9AwFyxwEDz1SCTa5KBfg6c7xwyd2IAVzA0A,14557
nldcsc_elastic_rules/rules/windows/execution_initial_access_wps_dll_exploit.toml,sha256=EBTdG3lEMd6xpsQNS-hbVjUzvXeM52Xnt-iaCglTpnU,12949
nldcsc_elastic_rules/rules/windows/execution_java_dropped_jar_immediate_dns_lookup.toml,sha256=ofzbgOsWuC2SHqrvRvL3uVjmfJ2hbtdVcsLZpoeJuRM,5130
nldcsc_elastic_rules/rules/windows/execution_mofcomp.toml,sha256=B7A3aAvSW638VLO_x439yPiMl5O07TZCinW_A2wo9kg,7292
nldcsc_elastic_rules/rules/windows/execution_ms_office_written_file.toml,sha256=OK_Wymsy8ZeAcbPi7dp7vLte0tzFTyK0aokkOHPYMX8,12548
nldcsc_elastic_rules/rules/windows/execution_nodejs_susp_patterns.toml,sha256=30LvnLQQwSNNJxSa7xg4AgqOc6KaA0RaCREMOZ3sfDE,14085
nldcsc_elastic_rules/rules/windows/execution_notepad_markdown_child_process.toml,sha256=i0qm-5hqvtg_B_X9hCig-drWjA6KzqbvytET8RnTAEo,13923
nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_authors.toml,sha256=qRORN2E84C6jGqYnEUwR95GfmU0OQyoUQeLgBUkoTmE,14805
nldcsc_elastic_rules/rules/windows/execution_posh_hacktool_functions.toml,sha256=SMHu7mRY79CAeoGFsxIVaJS5rutLTGl0FFlWGZ9EXy4,23903
nldcsc_elastic_rules/rules/windows/execution_posh_malicious_script_agg.toml,sha256=7ve4-AasqUatYUd2z3kzSxlMM-gaJNCYzUA-6xQ7Vko,11591
nldcsc_elastic_rules/rules/windows/execution_posh_portable_executable.toml,sha256=8ki_NWIKWayGN-qe8uM2iR18ZIYSg3TMsTp8Vq0sfj0,10400
nldcsc_elastic_rules/rules/windows/execution_posh_psreflect.toml,sha256=-_-SrlwSryQ_uoPcADWuzsxBGg00U0WC1MoFYDk3wUs,14136
nldcsc_elastic_rules/rules/windows/execution_powershell_susp_args_via_winscript.toml,sha256=rOsfE6ofCPgozq0bFqGOhHjUBZ7YnROZwO0cy69bHsc,16404
nldcsc_elastic_rules/rules/windows/execution_psexec_lateral_movement_command.toml,sha256=FGDkjmsbQBqaoTxw_Dk-ygIBOBNQQw9_zUtOORFjaWw,6578
nldcsc_elastic_rules/rules/windows/execution_register_server_program_connecting_to_the_internet.toml,sha256=glAMLgbbwXk2rC78kkXDgevFaxfpPh-7hyQ9ePGDGgU,9336
nldcsc_elastic_rules/rules/windows/execution_revshell_cmd_via_netcat.toml,sha256=lDqGBwleajBaTaAoCq81hyOiRQ8L_wJ0rnWGPuVobLA,11660
nldcsc_elastic_rules/rules/windows/execution_scheduled_task_powershell_source.toml,sha256=YcAhmrWSin9JfnvlxfSdkuC1HgndjD8sQNGaBoZF4YQ,7546
nldcsc_elastic_rules/rules/windows/execution_scripting_remote_webdav.toml,sha256=CdFtMJaNU6fu9vLq6mkiAGun6CEoMC3s6-dja38Ev3o,15353
nldcsc_elastic_rules/rules/windows/execution_scripts_archive_file.toml,sha256=JmNA4zioE1teMOvGzv2QYcYiO_PcvH4_XFqJ_pEVdlE,7908
nldcsc_elastic_rules/rules/windows/execution_shared_modules_local_sxs_dll.toml,sha256=A2W5qp4KNyaltXyTqSPY6p9Ei-G81Hdmei6JWsz1L_s,3486
nldcsc_elastic_rules/rules/windows/execution_susp_javascript_via_deno.toml,sha256=U10zMxxuVbDC0OjItfHQZoD7sbq66PoMjZiZbNDwcEo,14474
nldcsc_elastic_rules/rules/windows/execution_suspicious_cmd_wmi.toml,sha256=xEgWDUrjv7wEb9FD6lRXq1lt3nADR2FTKiO3_B2io5s,13045
nldcsc_elastic_rules/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml,sha256=L0FBvErsALHLLjqaZSRV0lrNwqAEbo69d5LfHSWy-ds,6391
nldcsc_elastic_rules/rules/windows/execution_suspicious_pdf_reader.toml,sha256=USRquRbvyqapxuuFm9nIcrXx3O5APOQyApcdIwwU5VU,9927
nldcsc_elastic_rules/rules/windows/execution_suspicious_powershell_imgload.toml,sha256=AiWzb8JCa1dLV9rn5f8NKKlWC_vfYX2xF__Lv6ZxUtk,7271
nldcsc_elastic_rules/rules/windows/execution_suspicious_psexesvc.toml,sha256=KTU4fYr33x6_ukNOSj2xYasLc_gzlWP577aBjwGW0B8,6111
nldcsc_elastic_rules/rules/windows/execution_via_compiled_html_file.toml,sha256=JYrbTTG6Liw95yzSXMfc8ZYGJupiR8vSEZ4mtkKBUA4,10082
nldcsc_elastic_rules/rules/windows/execution_via_hidden_shell_conhost.toml,sha256=Vw9P28AS-4hz-9cL8Uq32tnA2fBu_zqTMg6CF0d9kek,16374
nldcsc_elastic_rules/rules/windows/execution_via_mmc_console_file_unusual_path.toml,sha256=YBRqIZiIiVDCN6GT2ndskWaqijw3vY9E108NONcLT3M,8314
nldcsc_elastic_rules/rules/windows/execution_windows_cmd_shell_susp_args.toml,sha256=8yHReczalWMatYQNDVZfA_c-p0nLmRVQ-Dn0Do7izX4,19121
nldcsc_elastic_rules/rules/windows/execution_windows_fakecaptcha_cmd_ps.toml,sha256=t2kiPqzE5W1dLCIV9uDh-744ygUtwi8PPdPGQzHnjGc,15474
nldcsc_elastic_rules/rules/windows/execution_windows_phish_clickfix.toml,sha256=9NKG6XR0HCCS9cUaxez9o--CuiPQACj72IjwvgxKfoY,16098
nldcsc_elastic_rules/rules/windows/execution_windows_powershell_susp_args.toml,sha256=O5CkqYHyQViPGP2EWHLmJisnXNVubMfcy-w8_9MXM2U,11293
nldcsc_elastic_rules/rules/windows/execution_windows_script_from_internet.toml,sha256=4gOk43K8uQlnTDaK_4Z8M4ft5FzQf8M8smeRjbh4uN0,8657
nldcsc_elastic_rules/rules/windows/exfiltration_azcopy_storageexplorer.toml,sha256=k9P8nFBzULY0j-1rGsl9eVoH75mGMUbq40nUi6jYMPI,8607
nldcsc_elastic_rules/rules/windows/exfiltration_excessive_dns_queries_by_process.toml,sha256=rp7YrLbQaKi0mh8yg3a9zGeFau44aPJSZlO0-2urL9U,6115
nldcsc_elastic_rules/rules/windows/exfiltration_rclone_cloud_upload.toml,sha256=DDic0t3iujT07X1QPM16Jl7lxRGVJvN6CXaVRnaArkw,5748
nldcsc_elastic_rules/rules/windows/exfiltration_smb_rare_destination.toml,sha256=FVWmtsOsbtUbzS7uayoYYEtrBvm6mSSpvHILyBxuIjE,7575
nldcsc_elastic_rules/rules/windows/impact_backup_file_deletion.toml,sha256=cd6ZVjA0ByXsRlijJSyXg7Q2otlz_VoO7wUNo7B7EJQ,6263
nldcsc_elastic_rules/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml,sha256=8qxPxaw4WO4k2HVpM3sK0YbVyq9YilI-ZzbJ8HfylnA,5744
nldcsc_elastic_rules/rules/windows/impact_high_freq_file_renames_by_kernel.toml,sha256=zNsKNOyEWTSKJjQxF5gENAuawc87bQ4WzVln-IlYf1g,5816
nldcsc_elastic_rules/rules/windows/impact_mod_critical_os_files.toml,sha256=o39vdPWTiR-NvM6q7CA4ZOtucVJ3DwcVGw-IMtanHtM,13905
nldcsc_elastic_rules/rules/windows/impact_modification_of_boot_config.toml,sha256=zvrX8wqVJd8DCsKBGudV-FQEkhNtKbl3xo_asuAGoE4,5542
nldcsc_elastic_rules/rules/windows/impact_ransomware_file_rename_smb.toml,sha256=-2NygIem8d9_gr7AA1rdiXBECjuZkUBANr-aFnZnjLM,10428
nldcsc_elastic_rules/rules/windows/impact_ransomware_note_file_over_smb.toml,sha256=qlwd6FCWX5OaauSqB4UhDqWnhyda_eQcWBfJmYJsvRM,11982
nldcsc_elastic_rules/rules/windows/impact_stop_process_service_threshold.toml,sha256=aS62buRMvCqiLoDNHoAEPjwzb_pvZfNekaSTGew7baU,5405
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml,sha256=HcYGIG_Qci6YXR1bikJ6HpyJgKC5pf-2H5soIo9Ag_o,12181
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml,sha256=xVEdByugpfBynY0mpqgNRyRCtaElWcuNB5WRUY3SKgo,14947
nldcsc_elastic_rules/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml,sha256=Yjj2jHxfBOHwz9SwM0JbZ_z4H0hjBuvr8InyW0m0gTw,10809
nldcsc_elastic_rules/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml,sha256=StD0ZAPimL6inmlLr7-14y_vb7Bnccf8ltkm__sx8sw,8975
nldcsc_elastic_rules/rules/windows/initial_access_execution_from_inetcache.toml,sha256=cKXZ5nJb9vah5KBt0vM1rVSNa0CRy0rrgDWgsQy3QqA,16217
nldcsc_elastic_rules/rules/windows/initial_access_execution_from_removable_media.toml,sha256=ZYS5HCuy2V6FKiIHOr8ID3VTu3BQg8VbYIzHhfD3uW8,6366
nldcsc_elastic_rules/rules/windows/initial_access_execution_remote_via_msiexec.toml,sha256=RkelExvPPfrBvd1_gE7F2oLtAjqQex1i7aZ2QvzUb6c,9218
nldcsc_elastic_rules/rules/windows/initial_access_execution_via_office_addins.toml,sha256=3JDlC2KtJQdvTEzIIigKyfBtyKA6htBV3qDO2hituKI,9752
nldcsc_elastic_rules/rules/windows/initial_access_exfiltration_first_time_seen_usb.toml,sha256=OiNVyPOrLjaxCMRp9km3RkEqKIdbrJzAYaNvHzezcv0,6924
nldcsc_elastic_rules/rules/windows/initial_access_exploit_jetbrains_teamcity.toml,sha256=L80fkCqpxb95gFfBU4H01IjdmjIN_gdZly__8riPdK0,11550
nldcsc_elastic_rules/rules/windows/initial_access_mssql_potential_sql_injection.toml,sha256=Ma3FOgKYo6lIcdFv7hI1chuXqnynq7hnK1n7EsoC-aE,5789
nldcsc_elastic_rules/rules/windows/initial_access_papercut_suspicious_child_process.toml,sha256=UOxkMNh_mihKE1inrH8yMMFhYe5fdpM6fbMrnmtrWOA,8565
nldcsc_elastic_rules/rules/windows/initial_access_potential_webhelpdesk_exploit.toml,sha256=74FuX-Fw_JNQKBLl3KlBVlvOczMJ8fcoEa5z8rWunQc,13811
nldcsc_elastic_rules/rules/windows/initial_access_rdp_file_mail_attachment.toml,sha256=EAgJvn-15jAHX__EjP2KbV5srUdu0cw7Rd2z7HKzRsI,8065
nldcsc_elastic_rules/rules/windows/initial_access_script_executing_powershell.toml,sha256=sJNrZy0bSnO-a8aBHEkgmzwkqTWneWy9gJLkYAW1Jc8,7118
nldcsc_elastic_rules/rules/windows/initial_access_scripts_process_started_via_wmi.toml,sha256=fLDWIGCA149UtMpaO0Fguff_lQ-OvXFtVqjZb3c9DL0,8250
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_execution_from_vscode_extension.toml,sha256=F7bz6fkJnHiS9cesbrg7O7O9W86Uk4xkMya4P-MkqzM,7100
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_files.toml,sha256=XSzcS9lb02VvQ3OxuqSLh6aOabacTT-rCbfnsckrRCs,5270
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_process.toml,sha256=kKNxrf-cR5slMuoUm4b7s2ZZl5_WID5k0Y-hDVXGmIM,9235
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml,sha256=esKSAqlzi1onYnv-_Y0g3o-LjmFnML4pvMkJ-kzM1YQ,14866
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_office_child_process.toml,sha256=dUybkr9y54grLPTpMVCW5OhF5DtYQZUHv0CL5Mq7PfA,11093
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml,sha256=8aYKvDnZlWtPMe1DIMPhvcR0O1fXL-rPmZldtgfuTtw,9188
nldcsc_elastic_rules/rules/windows/initial_access_suspicious_windows_server_update_svc.toml,sha256=HuV5tFeW8qSOijujhCDcPzsWOiQYthvi5sLkdkAHYe4,14516
nldcsc_elastic_rules/rules/windows/initial_access_url_cve_2025_33053.toml,sha256=M3AJ0myUU9iA-lRf-_Vtg_KPWD42jfDwzbFO6Tw8ct4,16259
nldcsc_elastic_rules/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml,sha256=KI6eZI3OaMvSgnw47I_7o_c_KYjYe1o30h2o0ZrNP9Q,9495
nldcsc_elastic_rules/rules/windows/initial_access_webshell_screenconnect_server.toml,sha256=ZuXrUDIEoM5Tc4EprxstxfnL6aLgEgCU-l7SSrNcVyc,15122
nldcsc_elastic_rules/rules/windows/initial_access_xsl_script_execution_via_com.toml,sha256=AKosvVtG0hbCitgsZKj4xa4XE4n4rNJGeNMHWIrGhW4,7830
nldcsc_elastic_rules/rules/windows/lateral_movement_alternate_creds_pth.toml,sha256=RPqR4K4sy46QOlMn0n8igbxM7Ys1k8P1vhUHdhplzd8,6253
nldcsc_elastic_rules/rules/windows/lateral_movement_cmd_service.toml,sha256=R4oka8fcmCtSgqr_6Nwp9nJPP5IJJGVyQZht7kb4ouM,7396
nldcsc_elastic_rules/rules/windows/lateral_movement_credential_access_kerberos_correlation.toml,sha256=3CrkILCViyz5INz1fJr7ukJn_-ImPgRCjzBS-zHkfSg,13598
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_hta.toml,sha256=ZasoOqL6goQaJb3TZyFFsq80rZYAEu9hT7MY2rXT5zk,14414
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_mmc20.toml,sha256=gUjk0Ujg0rXKeCWy4VE4ZKwII76DD4bEkt_ryUPVsxE,13315
nldcsc_elastic_rules/rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml,sha256=tXzNySPiLZhJ3Bfibml44g8vRl38FIP5Rf6PCCkdvzI,7502
nldcsc_elastic_rules/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml,sha256=LewwG5LblXicXf7ZI3q5PaqRNoj6jviqIzr49gYeRwk,7548
nldcsc_elastic_rules/rules/windows/lateral_movement_direct_outbound_smb_connection.toml,sha256=WR9S_SPM4MAFu-OeKCL5P4htgYIdFj-8a4S_fm8BJVk,8914
nldcsc_elastic_rules/rules/windows/lateral_movement_evasion_rdp_shadowing.toml,sha256=vHOsPdGnkbRD7LVxsVSIxgSXMyGNxA2ReRvxZkxjt3I,14482
nldcsc_elastic_rules/rules/windows/lateral_movement_executable_tool_transfer_smb.toml,sha256=4lzR6en1D2A4d4cALaKCJOzm28udAhtr_LRCx5RE7sE,5910
nldcsc_elastic_rules/rules/windows/lateral_movement_execution_from_tsclient_mup.toml,sha256=p-It1pHO4nTSYeO19a2kkOf27N9iDyJGQ5zzjWQakBo,11927
nldcsc_elastic_rules/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml,sha256=u4ALkKwsdOXp0lQGC8SV4tOKcQvC0UiL5QKTGvstl7M,8369
nldcsc_elastic_rules/rules/windows/lateral_movement_incoming_winrm_shell_execution.toml,sha256=4rBG7diciNzhb_zn_LQQGabCSkAuo29oJPfnuQseYlg,6968
nldcsc_elastic_rules/rules/windows/lateral_movement_incoming_wmi.toml,sha256=uiBpOSDI84V7a9cquphH5DHNCGnGWYOauH8BYLAq4x4,7918
nldcsc_elastic_rules/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml,sha256=ax-3GNhR-BrA43As-nf7FLIWznNfz_HwZdjp_nD0xRw,8001
nldcsc_elastic_rules/rules/windows/lateral_movement_powershell_remoting_target.toml,sha256=wdL0IO8J8dF7tVQjNh4UjlsC-_GfjmedNvR2RIXFGlc,7582
nldcsc_elastic_rules/rules/windows/lateral_movement_rdp_enabled_registry.toml,sha256=Lqy1fwpD0_zlBhfUd6eFSzQJKxjXyICYyEellNv_prA,6421
nldcsc_elastic_rules/rules/windows/lateral_movement_rdp_sharprdp_target.toml,sha256=zRF0Dtf_K5Ys-9JOTjjmBdRkTI_jbYPFuCsqhq8keZU,11415
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml,sha256=iaPFMXjtDi5fQexSIlUppBkoIsE76ktmg9gtkdIw7OU,7467
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_service_installed_winlog.toml,sha256=GAc_T7xXeGCZwr_SAYqkuVycYlOEdjl-cKXweI994lc,8630
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_services.toml,sha256=rn3E7FMNqW2DM8dWCjxC3myQf5mq1POgQU3MQChSltc,10809
nldcsc_elastic_rules/rules/windows/lateral_movement_remote_task_creation_winlog.toml,sha256=Na07rh5QrRr94KJDMSXkeyYSAHm5_6-Zm_3PYpQMYIA,4412
nldcsc_elastic_rules/rules/windows/lateral_movement_scheduled_task_target.toml,sha256=bVoUirSfJrEKQlcSF_bNxF7bGjmJdDvhSImfnU7pwFQ,5592
nldcsc_elastic_rules/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml,sha256=ZbmrxHAmvorxKDbtZAEK5tepstzLchdvHUKkyDcOsPQ,6865
nldcsc_elastic_rules/rules/windows/lateral_movement_unusual_dns_service_children.toml,sha256=uBYNfI8CcVj76VIxzbvpP53UZUbTcPFvHGhonK_zT40,14142
nldcsc_elastic_rules/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml,sha256=HzEH-sGf7SQQlZRnIIvcWtaGJNyBjhZJvhQoGz3fl4E,6899
nldcsc_elastic_rules/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml,sha256=i6jEjM8JV9ln6IPtHW82DQTjJ2eU2pHcRHePSskYJls,12756
nldcsc_elastic_rules/rules/windows/lateral_movement_via_wsus_update.toml,sha256=nqxrnufJ-1a28OAsy2Mj5DjtdYKtoIOBHB_UfxgGrYc,7377
nldcsc_elastic_rules/rules/windows/persistence_ad_adminsdholder.toml,sha256=fKEfxw9gaQbfnaX0s3UTveLQgXOwQTU1V2E7KVRuOnk,13854
nldcsc_elastic_rules/rules/windows/persistence_app_compat_shim.toml,sha256=PCJb1i-n1qqxEvfBxNDLLpYe_rcolxpuCz2-98oAWPs,7821
nldcsc_elastic_rules/rules/windows/persistence_appcertdlls_registry.toml,sha256=k1szVZ7izo9pRNKei95CVCwOOhsvvck6YL1V2u-1O2c,7799
nldcsc_elastic_rules/rules/windows/persistence_appinitdlls_registry.toml,sha256=cEZ8ewQJ5ghaBIvTgOfDdVBid7VDfF-NWt9T-0uWOeA,10350
nldcsc_elastic_rules/rules/windows/persistence_browser_extension_install.toml,sha256=A0uRw-1bj_edOoobWw0dHuTMzKzh9LA3H7zTD1xCq_Y,7565
nldcsc_elastic_rules/rules/windows/persistence_dontexpirepasswd_account.toml,sha256=v69Tfa2J8iWFdz0Euv0HaMnZaqV9-2bSWyolZo-qoWU,5529
nldcsc_elastic_rules/rules/windows/persistence_evasion_hidden_local_account_creation.toml,sha256=f1mtO3YChJ2sWBeck4qK0lKWqw29WLTo5A3cDw2utPQ,12998
nldcsc_elastic_rules/rules/windows/persistence_evasion_registry_ifeo_injection.toml,sha256=g5llZPSJSaIgGKB0FOcOvAxRQl5lQARBfClpAq_m_E8,8537
nldcsc_elastic_rules/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml,sha256=KCR2hdLOx0VHwy_omgVh4vh4ro-AkmLECfoiEToyddQ,14432
nldcsc_elastic_rules/rules/windows/persistence_group_modification_by_system.toml,sha256=xw2c6PNRH-ku_bYEwLUSi-lBKaUXq4rJt5CpPAHKC2o,6001
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_job_creation.toml,sha256=dnn1ScXCMx4UOryLSg2KsjwiaXGDSQtupFNigN-jvMs,7563
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_task_creation.toml,sha256=YXSiT4lww0Uim2g1FrzBOp4VoAS7pvyo8hzWfVZufJ8,8698
nldcsc_elastic_rules/rules/windows/persistence_local_scheduled_task_scripting.toml,sha256=UlbKLs2f3dLQFbDgSyVoghcFCgzQfbsHkH3KDya8a0w,3694
nldcsc_elastic_rules/rules/windows/persistence_ms_office_addins_file.toml,sha256=Di5f3ASs1lhzApwrIzOU6dcQIT-qvB2D4k6_QgLk_Sw,13841
nldcsc_elastic_rules/rules/windows/persistence_ms_outlook_vba_template.toml,sha256=VRQ1sdF1NlHGK1aL0SCdclZx7qokBoa18VrEFDL1ITw,7015
nldcsc_elastic_rules/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml,sha256=QmkK-hlmRD2w5hjpLG_WUyAvZ0V_0F12VQkRS-lRKIQ,13706
nldcsc_elastic_rules/rules/windows/persistence_msi_installer_task_startup.toml,sha256=Q9OC5yWoObOtxGXs6Y7_1-77JM-phaPAhtsa90QzR7Y,10080
nldcsc_elastic_rules/rules/windows/persistence_msoffice_startup_registry.toml,sha256=ksPD1A0A8mXPPSDUSsnXMqOb8Va0XFgUaMhozZGynnU,6903
nldcsc_elastic_rules/rules/windows/persistence_netsh_helper_dll.toml,sha256=km2i4S7rE6U3oukgfyPscjSYGl8yuKe_kz9A9JXBSH0,6727
nldcsc_elastic_rules/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml,sha256=LUfo60wHrpd2M_lb9bb2OcCD8mupy4DD3oTWAmdHYfI,8215
nldcsc_elastic_rules/rules/windows/persistence_powershell_profiles.toml,sha256=x3s7JKRB9I5UJCj8tNc5_WhMlf43YmhJ0Sgg9NDpx-4,9923
nldcsc_elastic_rules/rules/windows/persistence_priv_escalation_via_accessibility_features.toml,sha256=UvJQ7ScWtwj8yNVdt68qaQU9Rl54VfdOZv4jIUQ5p_c,12598
nldcsc_elastic_rules/rules/windows/persistence_registry_uncommon.toml,sha256=7kJMuMlfM39c4mTBj_WtUBbgeJVzqoYld1QjL1O9yGg,13395
nldcsc_elastic_rules/rules/windows/persistence_remote_password_reset.toml,sha256=30fPiAACuEtAvxkoGNAonXsLexlRhra-Z2Ge_VRU8gc,7092
nldcsc_elastic_rules/rules/windows/persistence_run_key_and_startup_broad.toml,sha256=KnIt0txKQpHA3YEMrNZXT615dokkYryhoIoDJ4pm6hY,11582
nldcsc_elastic_rules/rules/windows/persistence_runtime_run_key_startup_susp_procs.toml,sha256=ORfSEu3buY0f32kIGeBjlXcmtEXdFV67rEbCNQxZSDk,9197
nldcsc_elastic_rules/rules/windows/persistence_scheduled_task_creation_winlog.toml,sha256=E6KowT9IRM-domAlHNS8DKK-ZS6ejQHVEWGVSiLoqmo,6627
nldcsc_elastic_rules/rules/windows/persistence_scheduled_task_updated.toml,sha256=zCuOMChlm6NA6KThxa3HzF21Q7o7YMkdQ6Efsdj0efw,5775
nldcsc_elastic_rules/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml,sha256=zIVCynL6mpGULUmZq_fzuFjOG7uMXRMktRR5Tbh1krQ,13843
nldcsc_elastic_rules/rules/windows/persistence_service_dll_unsigned.toml,sha256=T5DMK8MBeOPcVhxYhzL4rKVCBCwOqt67ndYiEqf25Jw,10991
nldcsc_elastic_rules/rules/windows/persistence_service_windows_service_winlog.toml,sha256=qQu7X9iwScV8e3qWh5hSLS-_VXzJjp5vTw3G30Pvt9M,15141
nldcsc_elastic_rules/rules/windows/persistence_services_registry.toml,sha256=yZGUnftrKc_xWydxt5C1oruxrng58j6RgZDHj1fiFOw,8932
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml,sha256=F_LU_cPZ5AVdh-XY21Zq00o2Gv2_E9jNOKzxe3fUwsk,8897
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml,sha256=lmyZsz0TJmrVB5h1oOzlb0t1yun_HJeH0WJnY8xQvaI,8529
nldcsc_elastic_rules/rules/windows/persistence_startup_folder_scripts.toml,sha256=eIQ6LQcWvq-p1FhGd_NxuOy9UTAf4kWzbvwN1nuY_50,8871
nldcsc_elastic_rules/rules/windows/persistence_suspicious_com_hijack_registry.toml,sha256=M5ba7LpVKYC5QaWfCoJwTr1-AYOtqOkUJYMdUM2iJ8Y,9974
nldcsc_elastic_rules/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml,sha256=wS0zAtsCb9-8KJCN9Obu_zpf0gbs33jf99-Oef7YMqU,9480
nldcsc_elastic_rules/rules/windows/persistence_suspicious_scheduled_task_runtime.toml,sha256=wJs48VM_t3U-THPtkjAw7u1qK8Dk9WCvSzXmuwu0HEE,8951
nldcsc_elastic_rules/rules/windows/persistence_suspicious_service_created_registry.toml,sha256=bX1qFNJbg9c2fDhkKwVGRHang9OU2xXJvSkNyYHlYQU,13157
nldcsc_elastic_rules/rules/windows/persistence_suspicious_user_mandatory_profile_file.toml,sha256=E7acTD_12arLGjFkXHPqTMAFdYbS0Xa-U2VeQxs7aAk,6317
nldcsc_elastic_rules/rules/windows/persistence_sysmon_wmi_event_subscription.toml,sha256=BnNPezRT7OEIgU8fXGALS8NqPUY0mgVq9LKvSm9dOLc,6884
nldcsc_elastic_rules/rules/windows/persistence_system_shells_via_services.toml,sha256=DED-vWoVFWaNYd52ecsLW-oAhPAISfr5ubOJx1biL_s,8067
nldcsc_elastic_rules/rules/windows/persistence_temp_scheduled_task.toml,sha256=FqjaTz1fmNrKXbwRpdBU59bIsxM0p4RAHhuQR85OqWs,6476
nldcsc_elastic_rules/rules/windows/persistence_time_provider_mod.toml,sha256=6Wo3t4LzemaYfDR7REDqKNOWnbYxC9QG-6PIsKpsNvY,8918
nldcsc_elastic_rules/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml,sha256=EPxxkcqRtuTpeee0mpNLmnrD9KW_ITq91q4TqYWSni8,4772
nldcsc_elastic_rules/rules/windows/persistence_user_account_creation.toml,sha256=P4JWhR1xOE2tPK4luCpEdD39Rw2YrVbUYoMxmSzM4WU,4974
nldcsc_elastic_rules/rules/windows/persistence_via_application_shimming.toml,sha256=lFkunVoFDZBwrdLFUjB5M4k9NIPqZuvSj-empgY1f58,8208
nldcsc_elastic_rules/rules/windows/persistence_via_bits_job_notify_command.toml,sha256=ufVvRIuD1QIyAvfTM5PcBrj9-7qvD7vUYECw5ieyf-I,7101
nldcsc_elastic_rules/rules/windows/persistence_via_hidden_run_key_valuename.toml,sha256=3Yv72kw6ylYuYqIgFpw-eVA1Z8zgeNLfA6EFHO6mHDo,14859
nldcsc_elastic_rules/rules/windows/persistence_via_lsa_security_support_provider_registry.toml,sha256=CPCCCqf4_bn8dsjB7SQ2_pCR_ofVjwTEXLt15I-_i3s,7778
nldcsc_elastic_rules/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml,sha256=EHdHqz3Le8iR5eFOlTenU_5ebxyvVDTZT-BwD7ArgJY,14742
nldcsc_elastic_rules/rules/windows/persistence_via_update_orchestrator_service_hijack.toml,sha256=TdYlDmc5Bgk1o6DTDDLlv0pf2xZCTZ9oGy8I902s_yk,15700
nldcsc_elastic_rules/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml,sha256=UFhMNkvI5_ddSVdvnsOB_jyHixJeHO0VRJbGrlmUcKg,7504
nldcsc_elastic_rules/rules/windows/persistence_via_wmi_stdregprov_run_services.toml,sha256=xinm3VmC3fAFrb9mfqWmkD5KHxgxUmbCE5aQXsxmnLE,17616
nldcsc_elastic_rules/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml,sha256=4VBK3dcvA9scSVOx5iVWiRG9lneoqGShjeRg5hj6E1Q,7980
nldcsc_elastic_rules/rules/windows/persistence_web_shell_aspx_write.toml,sha256=BaUOpmqpHVXf7FL1_kbWLtT2gIh7bYfquFFs5pqWA-A,8198
nldcsc_elastic_rules/rules/windows/persistence_webshell_detection.toml,sha256=xRa-XOUfKGoNMN9U29JPml7EnVM2WpXpqWwKyEzJZBA,18484
nldcsc_elastic_rules/rules/windows/persistence_werfault_reflectdebugger.toml,sha256=9_WHC7Y0VpNaLmuXPhlE8sD8QkTdCTKNcomN_FF_usU,7394
nldcsc_elastic_rules/rules/windows/privilege_escalation_account_takeover_mixed_logon_types.toml,sha256=YWnKtdgVjvNUKE0pfnVdFRvieoBxYX6gEz0NZpl43-Y,4543
nldcsc_elastic_rules/rules/windows/privilege_escalation_badsuccessor_dmsa_abuse.toml,sha256=F6ISNCHBLdORrCtnlFlqLJkwF4XYeAvdqwAJAUNIhz0,13061
nldcsc_elastic_rules/rules/windows/privilege_escalation_create_process_as_different_user.toml,sha256=cyqvQ2H56sjjPgviGkuYbFSqFS03YsEZFOM7GPOR9iI,6359
nldcsc_elastic_rules/rules/windows/privilege_escalation_create_process_with_token_unpriv.toml,sha256=SKlhGQFIABP5vd8IWNilXxQx7UCHf6agdGgrzNfJ6zs,8521
nldcsc_elastic_rules/rules/windows/privilege_escalation_credroaming_ldap.toml,sha256=Yz7E3tqUFYZvJhEcEuoXbNbaS_Y0RETqszxE81BjLgE,6484
nldcsc_elastic_rules/rules/windows/privilege_escalation_disable_uac_registry.toml,sha256=x8x0zhoYtAC7--0sVAJD2mJhAmqpaK92k_J14043xTU,8191
nldcsc_elastic_rules/rules/windows/privilege_escalation_dmsa_creation_by_unusual_user.toml,sha256=W1YOAvHng-5uA5xRMRjDnjKfhYteNFX2MPhomnYpHyw,13373
nldcsc_elastic_rules/rules/windows/privilege_escalation_dns_serverlevelplugindll.toml,sha256=e8y-NzYtXv2oo46o6g03YRxb7V-OHLhwtOyZITx2KcU,7133
nldcsc_elastic_rules/rules/windows/privilege_escalation_driver_newterm_imphash.toml,sha256=eYsIOlFbxCbGVV5fuAyJb3TKqwhggy0aPD-f1p35_28,9188
nldcsc_elastic_rules/rules/windows/privilege_escalation_expired_driver_loaded.toml,sha256=H7xFx9M3mDmQXLqCf1QCEoq_KT3bqpF4b1ShJ52GYe8,6435
nldcsc_elastic_rules/rules/windows/privilege_escalation_exploit_cve_202238028.toml,sha256=C2SKq4pPvCKXi_f46_8BjJR2lLMP90aTwovDXyVGggM,14638
nldcsc_elastic_rules/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml,sha256=QKRiwG_DH5Nsz27nbiDETEL9Wk8YyByhEI5PWfBG39Y,8045
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_iniscript.toml,sha256=HgfUqPYG5mXV7dLTsX1xwxP3okGNI3WjXv6PZ9Jphko,5220
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_privileged_groups.toml,sha256=GQ5ba_D44XjSGG0R6YaSoY03Sv5XfOgIowLE3btl6yI,13375
nldcsc_elastic_rules/rules/windows/privilege_escalation_group_policy_scheduled_task.toml,sha256=3ZnoMe77g2X6oZVCnl8cT5h5FCqquwi2jIF8t6-9epM,5317
nldcsc_elastic_rules/rules/windows/privilege_escalation_installertakeover.toml,sha256=KIRcL-eb_hn2qcs-jIKj3GnpB1dCbpAbyp0_gvDwyco,13760
nldcsc_elastic_rules/rules/windows/privilege_escalation_krbrelayup_service_creation.toml,sha256=mtHPxfi7NvRtVcFOkTZ5v8ZD6FrKpHcbLyTKX37svDI,13978
nldcsc_elastic_rules/rules/windows/privilege_escalation_lsa_auth_package.toml,sha256=cGg3at_nsjxSldtOzFHCT097BOJn-pKeGn1zk1Xo7Ww,6804
nldcsc_elastic_rules/rules/windows/privilege_escalation_make_token_local.toml,sha256=FPeroDpUee_21rewFjt0AeSL9JEY8JPMAFIZq6BzdR8,13401
nldcsc_elastic_rules/rules/windows/privilege_escalation_msi_repair_via_mshelp_link.toml,sha256=6jYSOYI6QlNfkzf4xDrwg0U2GwM5kpOc45qjJSI9-Mg,13425
nldcsc_elastic_rules/rules/windows/privilege_escalation_named_pipe_impersonation.toml,sha256=elqMY5xqeX8MnBwQuEC2IK5szfo6B2FMxfFTsXtHed4,12319
nldcsc_elastic_rules/rules/windows/privilege_escalation_newcreds_logon_rare_process.toml,sha256=ajc29RpzoSm4dKBlHeZeuB0EK-OhNoOegLIPNFRFKTA,6003
nldcsc_elastic_rules/rules/windows/privilege_escalation_persistence_phantom_dll.toml,sha256=NCJu17XLyb_xi59JrrEpWj-0MkDMoVrWpYiTEpn-QhM,10195
nldcsc_elastic_rules/rules/windows/privilege_escalation_port_monitor_print_processor_abuse.toml,sha256=I93vLi05l_xDiAh5MJfEfLZp9PdOu4JBelpcN9P2X5w,7958
nldcsc_elastic_rules/rules/windows/privilege_escalation_posh_token_impersonation.toml,sha256=3nCtJjpBIw_-SRBt1jD_YUHPp3p9hePX09w7Cj4jK1Q,12555
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_registry_copyfiles.toml,sha256=m7K8yjugZVkgeVRrBduxRDZnQi5j1TsQfEn-X4cta4I,11671
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml,sha256=tI-3JhKAGAUSLhm0woha1ul3h9chNzdf7Px1EoWzBzE,7039
nldcsc_elastic_rules/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml,sha256=I8norWg2j6TKfZ0XrbD2eKhUox0AQHNgKk-Qum7XDXs,8717
nldcsc_elastic_rules/rules/windows/privilege_escalation_reg_service_imagepath_mod.toml,sha256=-fvewunCNS0RBWF2yPBmxqKEscsIxRhdC6RHW0T2miM,10280
nldcsc_elastic_rules/rules/windows/privilege_escalation_rogue_windir_environment_var.toml,sha256=q79uE7JetD62m_F1H3IrF-VFOttubvYIC243ckfl3BY,12953
nldcsc_elastic_rules/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml,sha256=SNsu9tYZRCwZeZdV4iM0FWvHq2v-87vDOI-FOD37PF4,13761
nldcsc_elastic_rules/rules/windows/privilege_escalation_service_control_spawned_script_int.toml,sha256=ow-2IQKNa_6DtdJTgqdMQM__9cVdWyg41rfARADClvs,9243
nldcsc_elastic_rules/rules/windows/privilege_escalation_suspicious_dnshostname_update.toml,sha256=vV0qbYnyqmMOQ4RE3-Fa6FcR_NilXX6MCXFcoVxH9PY,11669
nldcsc_elastic_rules/rules/windows/privilege_escalation_takeover_new_source_ip.toml,sha256=HLYYuYqDn3mSRPbY_j3OKjRPRSY9jnt96gdFh5HF8YQ,4450
nldcsc_elastic_rules/rules/windows/privilege_escalation_thread_cpu_priority_hijack.toml,sha256=Q2A_V92kOxx97rl74pMFaVRHE-1wGNrO97PywUEqxAg,13388
nldcsc_elastic_rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml,sha256=rqpkxtYM1e-0GUGuNoTkz8DhkUILCQPlFho6z9Lz5Gg,7272
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml,sha256=MYrfNMhrBWi90UVqQhUlTEJCjtT8PirDnlchCSh0IWM,12767
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml,sha256=YI0slB5EXXCzgKwG5HD7j_rlRTcMOewSRuCN0FHg610,8255
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml,sha256=fDrw8d4s6LA8Gw_1FShSarlu4YRM87RseIBcui-RgQ8,13246
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml,sha256=sZHvWOmXC4z7DczO7T05f_bNVNkv8_jn1mRqkH2rArg,8353
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml,sha256=_K2YfG1OvzWG9VNZQalvoFINzpEDdP4qcbiq10omHUk,7351
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml,sha256=7KiWBmZLMrVlB09znpiVMUDLBKpOWEaMYE7DGkhJNJs,14629
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml,sha256=FmnxFsCwlHAwXAmJ-_VsWWHMwRdZW_aHCbzOUyWhATs,14147
nldcsc_elastic_rules/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml,sha256=OwzpAKD-or1OtgLmgls3gkklZgCx3qcq1TIHFF9xFKY,9115
nldcsc_elastic_rules/rules/windows/privilege_escalation_unquoted_service_path.toml,sha256=japcE8MAh3Rz1bIbpLppfbJCHUm8Ub6JlyzycrJBios,7302
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml,sha256=YMAB0ccBwneGsy1oGQhj-21PC6iG35GfLAjwQMG0bQA,11735
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml,sha256=UpzsIYRrVNdykEuY7RLIoMoJ-7mdvr_Hsyh4aSDomow,9502
nldcsc_elastic_rules/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml,sha256=cdVwqZKGIXVnDaVqinnnuPvkhCcikxHvoEXJBnOO5ms,8609
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_ppid_spoofing.toml,sha256=QzooEy8n3jO8QiJhz-lQQkVFrIhBA1nid1I9nVTcUfo,14106
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_rogue_named_pipe.toml,sha256=Mxp_3C2XSHjPnrCmOz7YfJWWKjTEuw6SussSwiAxVDU,10529
nldcsc_elastic_rules/rules/windows/privilege_escalation_via_token_theft.toml,sha256=C4Opqbk4GANOoHSMw573NII8kIwba5NjqhYWTBag7mc,14508
nldcsc_elastic_rules/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml,sha256=Puds7F0mhtxP3BwxtgrvrK5-lQWyX0FwlNUzeiIQFc0,13510
nldcsc_elastic_rules/rules_building_block/collection_archive_data_zip_imageload.toml,sha256=8b41OUj9fbZqawk21oRoDXaprbhc2TTFJwMYw1Vk-0Y,2143
nldcsc_elastic_rules/rules_building_block/collection_common_compressed_archived_file.toml,sha256=ZgBOzPjXLPxWf2lLW837hWMn5_cnsz4PBP57QG2EhBs,5269
nldcsc_elastic_rules/rules_building_block/collection_files_staged_in_recycle_bin_root.toml,sha256=ZND9dOG4W_SqlSChrIbREchV13LS422GsSmuLzCkmJ4,2153
nldcsc_elastic_rules/rules_building_block/collection_microsoft_purview_dlp_signal.toml,sha256=rVSGM9MUVGL6QNNSSuN1OlSTQ0UahsT1TyXZ3ui6F5U,3201
nldcsc_elastic_rules/rules_building_block/collection_microsoft_purview_insider_risk_signal.toml,sha256=M2VWtJ4NK1vz62Q_qqirEPHiIo2oIO8dHXBFmW3-eKQ,2663
nldcsc_elastic_rules/rules_building_block/collection_outlook_email_archive.toml,sha256=Ro5xj8yJqppmk69-E02T-GBj7PUQxF7gDDtGRdxeUGw,1970
nldcsc_elastic_rules/rules_building_block/collection_posh_compression.toml,sha256=cF6KTwg84qyjYD8aTZWUo9BrsJbXS0sGxole016cdKg,14513
nldcsc_elastic_rules/rules_building_block/command_and_control_bitsadmin_activity.toml,sha256=FaCxqpbs4JXuutPmq6ffj3PbJol8KMOt3zhW2TOGdLc,2536
nldcsc_elastic_rules/rules_building_block/command_and_control_certutil_network_connection.toml,sha256=pUVjpuueuvIsUhu7zP-alHPCpzmmS2ulkz985APXcbc,9039
nldcsc_elastic_rules/rules_building_block/command_and_control_dns_to_commonly_abused_webservices.toml,sha256=5fI8AR39GrG9ALUANDYUJJ-2Qd58TFpyMGXnOvovfYk,8950
nldcsc_elastic_rules/rules_building_block/command_and_control_ollama_model_download_untrusted_source.toml,sha256=T7iaOb5v3sHV_wgkLP-fcJSaxrwFifv9SDYT8p0p-QY,2809
nldcsc_elastic_rules/rules_building_block/credential_access_entra_id_risk_detection_signal.toml,sha256=y5tHWfaBbFrPDz7BHwl15lMzRa4jaj21QeZMDmSJ8oE,2903
nldcsc_elastic_rules/rules_building_block/credential_access_mdmp_file_creation.toml,sha256=By-pqivxymfsRHk-RjlHg5i2fMrXRe4ZWK6JRJfyd3s,3253
nldcsc_elastic_rules/rules_building_block/credential_access_mdmp_file_unusual_extension.toml,sha256=SyscZN0IZi8xi9emnn6KE9Z6hWTgbcPxvfdfV6_alZg,2310
nldcsc_elastic_rules/rules_building_block/credential_access_win_private_key_access.toml,sha256=x2UTdknV5c-7ICGC6qrlZkEiOSE2ZNBd2-ccKoqPUvk,3235
nldcsc_elastic_rules/rules_building_block/defense_evasion_aws_rds_snapshot_created.toml,sha256=0x6TTy4kz3jfDJjbgTIPBOrez_SVTiv3_6h-Y4hO-WM,2153
nldcsc_elastic_rules/rules_building_block/defense_evasion_cmd_copy_binary_contents.toml,sha256=KHCvJbpJQ6trEHELSYWn3SQ7bR0okrm5bwJc3hi9wQk,2229
nldcsc_elastic_rules/rules_building_block/defense_evasion_cmstp_execution.toml,sha256=EutzB37uOQzRQjCaRDPczUYU1rjupW7oZegAbjzjz08,1959
nldcsc_elastic_rules/rules_building_block/defense_evasion_collection_masquerading_unusual_archive_file_extension.toml,sha256=EVhvaDusdx80lrZKGibILcG1LqtE-K1V8eLSYdzaP4k,2367
nldcsc_elastic_rules/rules_building_block/defense_evasion_dll_hijack.toml,sha256=PoqSeLMrYFQYncpSe9sC0dzx7pi6tCcG6YQ_DxLo7ic,4851
nldcsc_elastic_rules/rules_building_block/defense_evasion_dotnet_clickonce_dfsvc_netcon.toml,sha256=SYXy1SdsxI9WXCDK3vZgi8i5DkDDVsXmIGgXlUvZehk,1942
nldcsc_elastic_rules/rules_building_block/defense_evasion_download_susp_extension.toml,sha256=OYPSsyAB0NGBSKPHao-UNjKvTlGBrOhMfMJqj-aSpW8,3220
nldcsc_elastic_rules/rules_building_block/defense_evasion_execution_via_visualstudio_prebuildevent.toml,sha256=6vyf2XtRybzB-Zc7bVU5ELgB1eTYKwWCir_bGbuej3A,3952
nldcsc_elastic_rules/rules_building_block/defense_evasion_file_permission_modification.toml,sha256=F36skR2B3g5SiECjWbdBtXHPx8fz1sF77cXxu5kitHg,2166
nldcsc_elastic_rules/rules_building_block/defense_evasion_first_seen_network_flow_exporter.toml,sha256=QhNRP4JMbKwanIt4lHwrBMbmsFlHPsme3lBBSpHcKks,4771
nldcsc_elastic_rules/rules_building_block/defense_evasion_generic_deletion.toml,sha256=ZQ4GfZu2kTdo2uNiNFwe0PmfePod2T6bD7-k99joscQ,2735
nldcsc_elastic_rules/rules_building_block/defense_evasion_indirect_command_exec_pcalua_forfiles.toml,sha256=8jneTGxA9hZUaZss1onVxnfq9F1NUZmKZD0OSnDcmKQ,1497
nldcsc_elastic_rules/rules_building_block/defense_evasion_injection_from_msoffice.toml,sha256=8wxq3BQX41yZxaySpo0dBzfgyp1FiwxV03plxd2JflY,2722
nldcsc_elastic_rules/rules_building_block/defense_evasion_installutil_command_activity.toml,sha256=OB0BbQWf58Y-nIrvqFgK7jFd_xM6MxHDNsYNHyEimJs,1790
nldcsc_elastic_rules/rules_building_block/defense_evasion_invalid_codesign_imageload.toml,sha256=ZqWgQFwOt-S0qTlLkz0x9KCMT5RZr0NWpqanKJI24JY,1729
nldcsc_elastic_rules/rules_building_block/defense_evasion_masquerading_browsers.toml,sha256=WcFeWERPFKcMz3X8nTfBkGy0TDoCEFtXxX9zk9HdU3E,8218
nldcsc_elastic_rules/rules_building_block/defense_evasion_masquerading_unusual_exe_file_extension.toml,sha256=GRrHg3VVYaiD183bhOsiJq4t4WFluqXvnwLHeG1ar1g,2190
nldcsc_elastic_rules/rules_building_block/defense_evasion_masquerading_vlc_dll.toml,sha256=zro2v96h9WnbifZh9snQAZtPerYKZuHHin2R3DCOQR0,2297
nldcsc_elastic_rules/rules_building_block/defense_evasion_masquerading_windows_system32_exe.toml,sha256=l-764736EjV_gk12K5H8rZwFqPehHwbXUS4286JRE7Q,15812
nldcsc_elastic_rules/rules_building_block/defense_evasion_microsoft_security_compliance_admin_signal.toml,sha256=5RbRBdEfWdLuEzyzqR2-4jHuc-XVYvr-RwMgNqq6_Ec,3240
nldcsc_elastic_rules/rules_building_block/defense_evasion_msdt_suspicious_diagcab.toml,sha256=Qfklfz4aZDRzssX6I5IC10TzgHW2jHrCBbkLyJMk5Cs,2612
nldcsc_elastic_rules/rules_building_block/defense_evasion_msiexec_installsource_archive_file.toml,sha256=kFVpifWK4Ki89ClhaQP4Cswp3xW_6HFZ0K9ukiJ26vY,2229
nldcsc_elastic_rules/rules_building_block/defense_evasion_outlook_suspicious_child.toml,sha256=CfOzltpFHDORu4O9XOf3WvV8sULPhRQ-n26oFJF5Mf4,3819
nldcsc_elastic_rules/rules_building_block/defense_evasion_posh_obfuscation_proportion_special_chars.toml,sha256=bdLtbLL_CYFLIOBz589hWgBq2ct7c4Lp2RQ_e-nUMXs,13358
nldcsc_elastic_rules/rules_building_block/defense_evasion_powershell_clear_logs_script.toml,sha256=uImLIZ79drfK5tN8OlD-ZqxcS0PI64aaH0YiQ3aX5ug,10586
nldcsc_elastic_rules/rules_building_block/defense_evasion_service_disabled_registry.toml,sha256=T8BWWK0s9z0LMAMI7zjbixb_66JBAzsSmat3gvIWfLY,2271
nldcsc_elastic_rules/rules_building_block/defense_evasion_service_path_registry.toml,sha256=-J-77kGkWf1xjr3zTtUcDV82SBU0_fbJShJrWekPj-s,2644
nldcsc_elastic_rules/rules_building_block/defense_evasion_services_exe_path.toml,sha256=WPm2X9bZiBbh_GZ2TgOByGNEUGYogWvBeCszYi2zVfU,2463
nldcsc_elastic_rules/rules_building_block/defense_evasion_suspicious_msiexec_execution.toml,sha256=MfyE4QdP_B1QSFERBNlraitMMi3P6At8GkhOELBV5dk,3390
nldcsc_elastic_rules/rules_building_block/defense_evasion_unsigned_bits_client.toml,sha256=3l8WNZ9xaNJgtlVMDgH66h_i7WcJZflQ35Jo_O-d1x0,1923
nldcsc_elastic_rules/rules_building_block/defense_evasion_unusual_process_extension.toml,sha256=mP-Fj9gLmqhqo_IZBpJS6jIAf88ulOhbo2kJW0nOCWo,3110
nldcsc_elastic_rules/rules_building_block/defense_evasion_unusual_process_path_wbem.toml,sha256=X_f1yMkvXAvo1VxKl3URxAgs0vQyajsWK4NFJ9rBOyQ,1884
nldcsc_elastic_rules/rules_building_block/defense_evasion_write_dac_access.toml,sha256=RTQ6JCCdNGeGpFXQaV83A7GfowG44QKRd_Mbe_lRR5w,2896
nldcsc_elastic_rules/rules_building_block/discovery_capnetraw_capability.toml,sha256=6gafo3IO_Eh0z5fCxrMn2FOpKai6PFQReDly7os6rec,4176
nldcsc_elastic_rules/rules_building_block/discovery_ec2_multi_region_describe_instances.toml,sha256=HcXtYTWAyk1y8yx65B2WqHoRxame2cHt8N88wkyFtdY,9843
nldcsc_elastic_rules/rules_building_block/discovery_files_dir_systeminfo_via_cmd.toml,sha256=Xdr3sdRTjx7lwMq01Zh-KZhSx54fK2bG92yhCS8B54o,4629
nldcsc_elastic_rules/rules_building_block/discovery_generic_account_groups.toml,sha256=JZiv8lq8Or2cTFTKAeAAHiP3aEqcYwVvQ2J7nw1LNIg,3381
nldcsc_elastic_rules/rules_building_block/discovery_generic_process_discovery.toml,sha256=KKKEZNHR_okb_XrxZnP1Rgr-OxiLGo5-tMsCblZUfXg,2510
nldcsc_elastic_rules/rules_building_block/discovery_generic_registry_query.toml,sha256=358WdjEwQeT4ySoygBIaAqj9-WUexZaRnAlYa6t51go,2309
nldcsc_elastic_rules/rules_building_block/discovery_getconf_execution.toml,sha256=DsBkG5z92SsaEJ1JaTsPdMh-VvJCnzUyAd0LnatrQug,2656
nldcsc_elastic_rules/rules_building_block/discovery_hosts_file_access.toml,sha256=_-0jr_1GwItitYTKPhh8gI0S1_y78F7hagOI_smcfMs,1935
nldcsc_elastic_rules/rules_building_block/discovery_internet_capabilities.toml,sha256=FwjiihjtzWWb0AV6PMaV82xa6BDIPT830VHfJYtSkvU,1927
nldcsc_elastic_rules/rules_building_block/discovery_kernel_module_enumeration_via_proc.toml,sha256=mPCl2rYPli1FALGeuXZtyzsaZHTad9Xybu3H1tv3yvk,3677
nldcsc_elastic_rules/rules_building_block/discovery_kubectl_configuration_discovery.toml,sha256=nPpETsDFoEZlvlC-fDd1Ri1cb2wbHcZH6xAByjm1YY8,2391
nldcsc_elastic_rules/rules_building_block/discovery_kubectl_workload_and_cluster_discovery.toml,sha256=KQA-yZpjzreIoljapaZOlJsZTSv-2X28Gn6FjB4X6sk,2752
nldcsc_elastic_rules/rules_building_block/discovery_linux_modprobe_enumeration.toml,sha256=Fjf7OGmqCB_-65V4PzuQBT3C7Z_O4m-sQXxoOFy_Dc8,4202
nldcsc_elastic_rules/rules_building_block/discovery_linux_sysctl_enumeration.toml,sha256=ZsTHKswqD-Gnvd4mipsDu-01V4Z3gBqx-difADRhFZQ,4179
nldcsc_elastic_rules/rules_building_block/discovery_linux_system_information_discovery.toml,sha256=5HxhIZ3hcaslqiwriO4qImfcA04Vmq36f8wzKNPH95w,2234
nldcsc_elastic_rules/rules_building_block/discovery_linux_system_owner_user_discovery.toml,sha256=50mG9x7VAearoUbpIKTPMm8u1L8mOhd2KrIX1uD8PZ0,1827
nldcsc_elastic_rules/rules_building_block/discovery_net_share_discovery_winlog.toml,sha256=6iJkm8KuqDiQ_3T9PciN00y2db97nGfeaGlXSSeV6gU,2604
nldcsc_elastic_rules/rules_building_block/discovery_net_view.toml,sha256=S6byKd8PKg1glWan98FN_u-RO1cP_l_57ozK-Zx1tbk,5471
nldcsc_elastic_rules/rules_building_block/discovery_of_accounts_or_groups_via_builtin_tools.toml,sha256=iANvmZVl-kLEvTSBCvHN2N3oOJzpUOcLHV8yKdw0VCk,2972
nldcsc_elastic_rules/rules_building_block/discovery_of_domain_groups.toml,sha256=4eKFutbELxZg9Ei8keUVnbVe9NBFTmPVksNHlbDlHWI,1852
nldcsc_elastic_rules/rules_building_block/discovery_posh_generic.toml,sha256=aZebJ1RTUwfsqxV0uwJi-fLNnjTfm9d26sTXEE14CQs,10127
nldcsc_elastic_rules/rules_building_block/discovery_posh_password_policy.toml,sha256=19gQn-mjbTXwsi7nSKMtc--SEx1fGM8iglBL4VJD35I,10566
nldcsc_elastic_rules/rules_building_block/discovery_post_exploitation_external_ip_lookup.toml,sha256=4QCeW4h05hp5_fklxWJveEmNJ69E4vWL8TAhM-SSjpM,7503
nldcsc_elastic_rules/rules_building_block/discovery_potential_memory_seeking_activity.toml,sha256=wA4jEzyH_BPJVVevbad6tRO-umgyY4-hoF4zHfK81Ow,3156
nldcsc_elastic_rules/rules_building_block/discovery_process_discovery_via_builtin_tools.toml,sha256=06rAdqkRmQpl20zwbrDXrnyju-m9MHRdnqGIjD8-VqA,2217
nldcsc_elastic_rules/rules_building_block/discovery_remote_system_discovery_commands_windows.toml,sha256=KOOqdUyQztDQI78GPMG0U8U8kEFAIuBN-gtOE5neiRc,5484
nldcsc_elastic_rules/rules_building_block/discovery_security_software_wmic.toml,sha256=sLcOIiEZrckRqMlUgzIAcYK_YI13bkZlirn5OUqb8Ss,4415
nldcsc_elastic_rules/rules_building_block/discovery_signal_unusual_user_host.toml,sha256=bfQpWLqZoRjVSjlK830Y0-ODhU9ZxTFpyFtdQqid4EA,1661
nldcsc_elastic_rules/rules_building_block/discovery_suspicious_proc_enumeration.toml,sha256=P3pRfwDYZppLqiBRaqCab3skNzBpOlI-Si3vtB6X2Qs,3368
nldcsc_elastic_rules/rules_building_block/discovery_system_network_connections.toml,sha256=4gFT6O-Q7TIJ3AkCPAKMivwLLR41l4-CSCm-IRXmwq0,2116
nldcsc_elastic_rules/rules_building_block/discovery_system_service_discovery.toml,sha256=IY3kivOQff7svXbMCN4W4p7vHKxgdvhuz4GQVRb9enA,3744
nldcsc_elastic_rules/rules_building_block/discovery_system_time_discovery.toml,sha256=eRJVqc3MrFGBbk_KVP98ANJK12p4lzRC0MdY0DvJB_M,1932
nldcsc_elastic_rules/rules_building_block/discovery_win_network_connections.toml,sha256=Wqx-itd7dFoAyq-E5YDEiW386GerBEnUXYwu8lC5pHg,2233
nldcsc_elastic_rules/rules_building_block/discovery_windows_system_information_discovery.toml,sha256=4YhipX3n8vNBKJDtoift9U97EJahDwxdlY86pksMVTU,2579
nldcsc_elastic_rules/rules_building_block/entra_id_identity_protection_risk_detections.toml,sha256=6Wcs8IeaR5YdqFESexXLPoSOeDqtw9ap32ZnPEuN1-E,1780
nldcsc_elastic_rules/rules_building_block/execution_aws_lambda_function_updated.toml,sha256=PU7RfKmWeUevvMgzxpyTFyiPAqsWCBEoqq_NVbqYjcw,2342
nldcsc_elastic_rules/rules_building_block/execution_common_debug_or_base_image_pod_creation.toml,sha256=7bulZV5zz-DrFhN_9-CDHpmUR7i8Lf7ADUl3JU2oOxU,2510
nldcsc_elastic_rules/rules_building_block/execution_github_new_event_action_for_pat.toml,sha256=2C_phF80QGub9ZLuo41rCyRYxG12WqiEGSQRN82g96g,2447
nldcsc_elastic_rules/rules_building_block/execution_github_new_repo_interaction_for_pat.toml,sha256=WbI9DxenPd5TswoK3fjwDbZ5Vxu9HvGjMngtzhwDFEQ,2021
nldcsc_elastic_rules/rules_building_block/execution_github_new_repo_interaction_for_user.toml,sha256=ZYDYz5tPJWD4b7R3v2hraOQTWxmbeIHRiTpG62GJWEs,1895
nldcsc_elastic_rules/rules_building_block/execution_github_repo_created.toml,sha256=yHPXdlyvgI6ahuruKqrGqjfBF6jf_nB99_988ueBSK0,1583
nldcsc_elastic_rules/rules_building_block/execution_github_repo_interaction_from_new_ip.toml,sha256=ZYw6pFU1439ZlmQagNaW5xChFo0U6GlnRphAW5g5rYo,2346
nldcsc_elastic_rules/rules_building_block/execution_linux_segfault.toml,sha256=RHQO4ZS797XM6qCBf8OK4iDUC08tN3ZtMRs0ftBKWe0,3365
nldcsc_elastic_rules/rules_building_block/execution_mcp_server_child_process.toml,sha256=Y3fI9NeqGUgsuAgQf8slblkUKLqJXBn6rCADnv03wTA,8290
nldcsc_elastic_rules/rules_building_block/execution_settingcontent_ms_file_creation.toml,sha256=rjFwyMomYyDF3l5mpfXo9PolLh9U6srol7yN4ZX3IOQ,2766
nldcsc_elastic_rules/rules_building_block/execution_unsigned_service_executable.toml,sha256=w97fEkd5OtkVcF-Edd3XSLMSi04mXk8BOjEKdstgpj0,2728
nldcsc_elastic_rules/rules_building_block/execution_wmi_wbemtest.toml,sha256=YJDs6hHwSzlKYuAAJE_3Y4-VkbWwlCmZVuQpmAD6G0c,1500
nldcsc_elastic_rules/rules_building_block/impact_azure_recovery_services_deletion.toml,sha256=JHb-j7gzcFZwVNxOZ6kL8W5d20wBFnG_I5pqWEApmGI,1842
nldcsc_elastic_rules/rules_building_block/impact_github_member_removed_from_organization.toml,sha256=Zg8-5uwvMG9xlaOeIMdTO9eEt7uW7MAbLSr0E2qbt0I,1224
nldcsc_elastic_rules/rules_building_block/impact_github_pat_access_revoked.toml,sha256=GPl-8HtqrtEXGUT5Hbz6EIm6Z1qLriPY6WLTI86EbBA,1211
nldcsc_elastic_rules/rules_building_block/impact_github_user_blocked_from_organization.toml,sha256=BFANcl_jIF21qVBVXMoDZBRddqDXsApsgOa-FqJgT90,1188
nldcsc_elastic_rules/rules_building_block/initial_access_anomalous_rsc_flight_data_patterns.toml,sha256=0jVGt0SF8BxQOvkJt965u_utay8ZdhoqA-TvSJUcPZs,4262
nldcsc_elastic_rules/rules_building_block/initial_access_aws_signin_token_created.toml,sha256=OIKg32OHHgvXY_PFdrG6m0h2Huhc-jrtRoWBE9mUCGE,3242
nldcsc_elastic_rules/rules_building_block/initial_access_github_new_ip_address_for_pat.toml,sha256=-ti9_zQ2xNNOz99qXgfxkxoebuHenlIhRyr30xhcYFY,2156
nldcsc_elastic_rules/rules_building_block/initial_access_github_new_ip_address_for_user.toml,sha256=UF4OiiZ4QG5ZDWdcnaIX78H9y_XNK93qV0eHR5CV83w,1560
nldcsc_elastic_rules/rules_building_block/initial_access_github_new_user_agent_for_pat.toml,sha256=L29ymOXV3XMu3ktwsWL-8KN_ProLRdcM2RFATgPk2qk,2162
nldcsc_elastic_rules/rules_building_block/initial_access_github_new_user_agent_for_user.toml,sha256=Ys3wn_vnXA1ds9xqIeJcX8ViRVMvlANZtE4frvlpj0A,1566
nldcsc_elastic_rules/rules_building_block/initial_access_google_workspace_login_flagged_suspicious_by_google.toml,sha256=o46SfW2j-4TubIZ2VRJTbF9PzviPoAbfgCMUKK3WBe0,6516
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_air_investigation_signal.toml,sha256=iO3Kkrl26aLTG8A3tSyXtrgUoOdvOlRwazxJ1T4EaKc,2517
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_defender_alerts_signal.toml,sha256=cgMrKRi_ng-tStay7fqeNSMUs1W9Tb0nmUddobX0fzw,3377
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_defender_threat_intelligence_signal.toml,sha256=qmItvCxLm8hEchR3iOGFJaRxAy92r80AIRc1vuKa0oI,7675
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_purview_security_compliance_signal.toml,sha256=t8-ud25hc_2hF5ZmJEdJVUY7vMa5ckfmsbZPf5cf76Y,2987
nldcsc_elastic_rules/rules_building_block/initial_access_microsoft_quarantine_hygiene_signal.toml,sha256=YUHq9I9df7Qr5I5OYh5Y5G-dvKmeihZEdPWui2P9rH0,2591
nldcsc_elastic_rules/rules_building_block/initial_access_new_okta_authentication_behavior.toml,sha256=U9YWCoEXLGnqj1suAhIAvu3U0djAMKd_XszJp5UBCkU,4328
nldcsc_elastic_rules/rules_building_block/initial_access_okta_admin_console_login_failure.toml,sha256=WWePUhdeOZQW7iTT3GA8pGRC4brATbemi72kD1j4Cc8,4900
nldcsc_elastic_rules/rules_building_block/initial_access_potential_rce_via_toolshell.toml,sha256=Lbfarv1wrvtnmrqZwV7LzgdlG7tq0WDaBNtDL5KkbXI,2927
nldcsc_elastic_rules/rules_building_block/initial_access_potential_toolshell_exploit_attempt.toml,sha256=l89-9vCYSfY4EaDfnkYsbG4s9slf-XMCGGVcjL0tB-E,2661
nldcsc_elastic_rules/rules_building_block/lateral_movement_at.toml,sha256=xUZPZITTXt4FJjYMIbcn2S94ehJpnSzqDJvSxmDghmY,2098
nldcsc_elastic_rules/rules_building_block/lateral_movement_posh_winrm_activity.toml,sha256=GvJtOPdxQT1QjjacDBsu9dagtpKBrwXOHGAy_GdhD60,3714
nldcsc_elastic_rules/rules_building_block/lateral_movement_rdp_conn_unusual_process.toml,sha256=m7Tpyym_V6YZQi_VMd8Rjwe8HsW4HOzGSk8s1EQdbSk,2383
nldcsc_elastic_rules/rules_building_block/lateral_movement_unusual_process_sql_accounts.toml,sha256=ZBa60GjYv8Zs9WOo8oLi1W4aDsQImu7orjqlifw8Ufk,4018
nldcsc_elastic_rules/rules_building_block/lateral_movement_wmic_remote.toml,sha256=t5CqjMfP7VvOFiP7efHBsCPU8pEVAkJBUbiHgxnd6Rw,2345
nldcsc_elastic_rules/rules_building_block/persistence_aws_iam_login_profile_added_to_user.toml,sha256=39-pqrWUMFFELGzjaFUhxaRQTe27K2gBvpsqbLDoDIk,2252
nldcsc_elastic_rules/rules_building_block/persistence_azure_vm_configuration_modified.toml,sha256=fyGTdSDh40ZD-IgVZ44uWxRa9QFyDwhB_S5tiWIDDdM,2963
nldcsc_elastic_rules/rules_building_block/persistence_github_new_pat_for_user.toml,sha256=bxerR23B3dVmQ1hy6EM_RbW1s-gKfTX-KGvZ3o2st1s,2115
nldcsc_elastic_rules/rules_building_block/persistence_github_new_user_added_to_organization.toml,sha256=MtrewckertZ0Xm3djPg_-5tLAdeEAeS7G9DFH_z52TE,1490
nldcsc_elastic_rules/rules_building_block/persistence_iam_instance_request_to_iam_service.toml,sha256=vez9cdzxWPB-PuxhT11_3-RBlmt4LN9KKJmekCnzHtc,3997
nldcsc_elastic_rules/rules_building_block/persistence_startup_folder_lnk.toml,sha256=IaZOaWEOMKChE2p6bJlU4iQKTuvBxfoEOg5FPsU5jtk,2308
nldcsc_elastic_rules/rules_building_block/persistence_transport_agent_exchange.toml,sha256=GCbSiK8cLlFO7V5SdjLS21563aeSv8TUG9CpRuN3DMc,3522
nldcsc_elastic_rules/rules_building_block/persistence_web_server_sus_file_creation.toml,sha256=ltJnkyg4YTXMxJO4VeYnepNEEG8MevrmLuwsMaPAQPQ,6237
nldcsc_elastic_rules/rules_building_block/privilege_escalation_sts_getsessiontoken_abuse.toml,sha256=TUeG81Vccl8NYzUcyU_MMUqoc9OT44UDnjXYlE2Vo4E,6257
nldcsc_elastic_rules-0.0.181.dist-info/METADATA,sha256=RqbfD9lR4lItjFDRcer7_XIO8TBVsbFa5_vbfPIDLYk,66
nldcsc_elastic_rules-0.0.181.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
nldcsc_elastic_rules-0.0.181.dist-info/top_level.txt,sha256=2ua0gPWflzV4D32kz6ZXXok1H-0wJVI2Scdm_qmNsrM,21
nldcsc_elastic_rules-0.0.181.dist-info/RECORD,,
