src/__init__.py,sha256=Jn5nzFiKh9ih2xl2R1IgZnTw7Q-GAPUFUWyl1n75s24,235
src/logging_config.py,sha256=5zpP2beQLRy5oR9h-Ns96oT5k1wRFIQuANF0DYRo-X0,19010
src/paths.py,sha256=mec5NriaF9bqtJzaWbOSsaNTE3IoPHvEIJ6hWtumlwA,5369
src/py.typed,sha256=ZSegze1ahS5tlaVlEVAF0HG-jTkkScOwTjUnglYQOS8,22
src/risk_config.py,sha256=RHycyWXOrMlscCgO8Jx6bqtHvD-Urgbx5O4EBwgZGZA,2526
src/server.py,sha256=k2WFGHdWTTsU2JhzYjqWCbhxpmJlr9AqZMBKx8dA0rg,13093
src/version.py,sha256=CMH34Gt1AqO7z_TqRj94XwohGoVCf8aes0djkqm45mk,22
src/agent/__init__.py,sha256=YCteGsBM9K8L7Q0_zk591Z68yZi9jM_jngnFpQkXkS4,68
src/agent/auth.py,sha256=mDxeCN3mn75ml9qtgpE9JUFmMtfDSJmNAT1AV0XXKg4,14568
src/agent/config.py,sha256=_Ss5AAKJ3BZXuyfH2FGjQ9W-CXmWzTgbjdci68E9tXI,3793
src/agent/loop.py,sha256=elwcEJgoJwhZ32Z90MNSHlEFOe5jGyPIPbW1a17qnlM,9446
src/agent/mcp_bridge.py,sha256=VSW9dayTISEDtjQaNPZDnaMBlT7pduDu-T0-w6w8KCY,10805
src/agent/prompts.py,sha256=BxtCa2mmJ1H9KN5j4UyE2BQs9hoNOlqL-Pf81BeA7tw,3916
src/agent/providers.py,sha256=jHDl9JrExzTmOUzWIXi75k6NY8eN0m9GDxquoH2IHaQ,19197
src/cli/__init__.py,sha256=5Q0IcO_UV6DhZlRYddWYtzAN5J4gj9tRa0kF8wKGkKs,71
src/cli/main.py,sha256=6Vc8qikk8wY1qygKLqaLLcbnRBRM6ZmHpjcZQR9yTPw,59775
src/clients/__init__.py,sha256=FFMEyb5dJd0kkLYiQvRehTusNU2c_O3C3BCKcZC7hI0,6451
src/clients/base.py,sha256=7cPSrl_FrcUiY2sdFYq-Qq4no-b6rcNbPl1wC8oThtw,8162
src/clients/exceptions.py,sha256=saMI0yJI0tRhJ9t9EQtUd6Jzw0m4S5rWiO6G-_KxDT4,8591
src/clients/common/__init__.py,sha256=6jCK5Ruuai4EkMeMHkus-tTUR7QkGnafuiRrv16p8zo,259
src/clients/common/alias.py,sha256=9Q0DU64A-yTZK1ohAdxW3_t1ctyQ8yJLlKtL9rDvFJM,796
src/clients/common/asset_discovery.py,sha256=OV9EXIXssijytIOCoWM6OaPuwG6CKRvK_xP8QEya43s,10830
src/clients/common/chainsaw_client.py,sha256=gRkoVlK7GRcQLzcVIKwspoyeU-R4hEPztvDgMgTlRFI,22485
src/clients/common/client.py,sha256=KJPC33ayybdCidWcdz-WXe9iZGve42SUFivUuN7pTeM,1422
src/clients/common/cluster.py,sha256=6KccOyQcJfvb8zyCy23RTGF0dU3o0rrpDmZOgdpkoao,424
src/clients/common/cyber_kill_chain.py,sha256=zLDQLyyBph73AarRm2kMj2TeiP-W2PWueacqX34VxRw,27310
src/clients/common/data_stream.py,sha256=3eGDtwaLCHkEG6zoNJiSgo_xUxQSdlnkMZuRyZdf2o0,719
src/clients/common/document.py,sha256=VYGJvmdIBa1No0FtVOs7TU7AOMHxnyh-htk3U6mwc2s,2950
src/clients/common/eql_query.py,sha256=Rq9nS_QNBvc_gOM3j971bdcMC3lqa1T98mYDjZnHbAQ,7354
src/clients/common/esql_client.py,sha256=t4pGxk5HazUbyq0M0eLSGrvYr-LMZ0JqDehI7fDqPn0,29810
src/clients/common/field_mapper.py,sha256=PzPhDja5bg0u1_T-YWCJ2h0pRaXL9Wk7YNDW4RDX-DA,16002
src/clients/common/general.py,sha256=AhXkbIMhOShbRCuQHK2Dku4YZLIznIPWua6n5xq0nV4,473
src/clients/common/hunting_rule_loader.py,sha256=KjcwvHO3JXD9q-P6cl0lQ8LZ9sxSCMPglpwomD-v9n0,8000
src/clients/common/index.py,sha256=RHDEg4BVt6_7PUrFm7YgzLIShSvxC-i__Yn3GX57_Jc,781
src/clients/common/investigation_prompts.py,sha256=rgOK3FWpK75YGckr0SrgMvZhlmvHQ0EfESmCfiKrrkE,21659
src/clients/common/ioc_analysis.py,sha256=X4rCu8_a_cYa2WvhM__4TXAeT655CcVysVMQ9G6O0nA,27639
src/clients/common/rule_loader.py,sha256=jX3LF-uR-QztVowJa95NPnAMKon_sUOQZ_13iSJsvbw,23022
src/clients/common/threat_hunting.py,sha256=LESoQCfTn8iaglCgVjaKuZnGc7klBKJqBbVRwAMZHWU,23845
src/clients/common/schemas/__init__.py,sha256=LpzeITtpD1rqTAJW28nogKsUzNQfd7B-oeLn7hPiRJM,919
src/clients/common/schemas/base.py,sha256=aMkNmrIyjiOORZACy6S4CbHxmTelPQ6MT21R9k9C_WA,10886
src/clients/common/schemas/ecs.py,sha256=dnjaxArJPGMVWSDBcjkAQP6zggTXzeAeRg6w8q6qtOc,8764
src/clients/common/schemas/query_builder.py,sha256=XC72zDwyCgPs5iMauioN8HMx0alCzVKrdhmT-1kxaUE,25251
src/clients/common/schemas/registry.py,sha256=7MKqSTSxQBfHyjCK4BfFyHiCIIwvUx8DhXdrX-netHU,10330
src/clients/common/schemas/sysmon.py,sha256=SRroaRtShY_5K8XtKl8r_lvsnQJdcw5n1nLkoVwVZVQ,19631
src/clients/common/schemas/windows_security.py,sha256=VmUeLO7DQKwgbJ3ai6eOUgxoZTcYAWG56v_OyX8puBk,18380
src/storage/__init__.py,sha256=QJXKXfdgiXWmJP8KvCDx_TVw4zAQUSGHa_p4uq4bEHg,1255
src/storage/auto_capture.py,sha256=2fY51oPik9fY2JiDvXbAFbofJM5TsNYPIGd27tOceL8,7629
src/storage/config.py,sha256=zxCz-Nln_cfRU76UV12l6k0KWkBYMiyWXYpnqGexRes,5539
src/storage/investigation_state.py,sha256=8hXLhDcOWU6qf8JUROcQYJiQMFhXyoJtTDAFQ-gztZw,30491
src/storage/models.py,sha256=Huqsg2KmLFtYgA8xvvREhRfq0nxv0m4baecEhFSmMsI,13194
src/storage/smart_extractor.py,sha256=g61OUV-1iZo9-5qVkFwgK9ibtzM0S2lWf1OfGwAZoVU,24145
src/storage/storage_manager.py,sha256=75ctXeHWIcH1iOdLxGjtPUsbHATHnXGu33p3Hg3QJNE,13746
src/tools/__init__.py,sha256=-0x9pSyA700E71bpQ69pYuLOXwuA00aBBPGkfjI61Yk,438
src/tools/alias.py,sha256=fO_ELK_ZMGOwNhSlet6-g67Qo-CMlWiUnm6zcuyNXP0,1383
src/tools/asset_discovery.py,sha256=i7fFl1ma72HH9OVqs556eQtrShvyDLLi7yqz75WdbNI,2714
src/tools/chainsaw_hunting.py,sha256=L8-kI-MTIaVggIkUVo9zkb2oYhi8CYHqH5LDNS6xFu4,35265
src/tools/cluster.py,sha256=4ZtQj-QHLyu724K-9mohIqjBfANd3IQ4tsoPr0ZvZ_c,615
src/tools/data_stream.py,sha256=Lg27lwZ5bjQIPvngttfRFXAHXK1a_YfORopTsjqfCAg,1802
src/tools/document.py,sha256=DEdE0OWgP0veil28MFSb8mxPYU8VvqkCrqS34PhW0LI,2034
src/tools/eql_query.py,sha256=bGdUCee8nHo8Ho34nOh-eM6OAP6VUnHxFHw7MLvGAmI,2672
src/tools/esql_hunting.py,sha256=9whC8wUv9ZYe5xR3Y3Bl0BoBmBlvb94CJWL8jkfq1HY,56186
src/tools/general.py,sha256=cnA9Syy6r5nRtp2KfINolGf7jwPcIqLQjWipN64I4Cs,828
src/tools/index.py,sha256=IQH4wutx-AeeO3zeNT21oAYG98novHURAg-xKiJhfsY,1354
src/tools/investigation_prompts.py,sha256=GIWoWabdTTvyIn2eqylyh2cx8VlcwrvykyjcX77Nn78,15690
src/tools/investigation_state_tools.py,sha256=Fn6tcGMWf2hNcRPoprqyEliPneDleBMcptQfLEHJ6vs,24842
src/tools/ioc_analysis.py,sha256=aVaDqo6vxTD18plY_Y3WZwGYePUkcmMz8eq40YeDWiY,16323
src/tools/register.py,sha256=3c4UJ81jZs3brdZZp4Z6dxfAuhO_1SgiZ0xHjunuXbs,3291
src/tools/rule_management.py,sha256=PmuJrQmbHpNMglWwDxCH7-4IV_tVLc4DKLqJ_cR6QPk,32891
src/tools/schema_resources.py,sha256=KRsOhwvjcgvbWlvTV-AzsxvQI9XJXflw6QMOc0M0iNk,14661
src/tools/smart_search.py,sha256=zgLRc1M3AFkLwe5GV1vrtnvyiwRQrtb1HjpKXGe0XG8,35617
src/tools/threat_hunting.py,sha256=gNYyP78sfBYMO-c3MVFszbChaUtIu_bda-E_Pa0D1Z4,29609
src/tools/wireshark_tools.py,sha256=-EEia-CGZaA9Cell6Q6kZKnNtijWfAZ6vWd_7eeSCwc,34383
src/tools/workflow_guidance.py,sha256=isuiJZ3jvLw7tkLIMtTquPGkcixmICR0DNSv2ZXykQo,11730
src/utils/__init__.py,sha256=_QUgNiTSsWBzwgouFPjkupT5mKVfOAoeN9f7Jc-k-sU,433
src/utils/response_handler.py,sha256=BlA8eSdrvoVJgqzQjOc7uTMQSY2_k5HOVl4CdANvN3M,12100
src/wireshark/__init__.py,sha256=OmXqvYOtjpAHecNWpY0vO7M9dENfULX-vgayXQy5KOk,93
src/wireshark/config.py,sha256=MrnyuRaYB13gGyARqV4eHztme4jmnLAQ9HtZV59ovB4,2516
src/wireshark/models.py,sha256=7VbrIvwHLsRpCTFmLjlMCVfVBY9fefg3Pl_uA_v-25g,4083
src/wireshark/baseline/__init__.py,sha256=B6Y1cNaLZLbXf44MOktNFSU7aG5b75ilOIKwURx67vo,48
src/wireshark/baseline/baseline_builder.py,sha256=YxcR8GnmPH249doU6sw3eTPv_XXWXYgWRRHFdlAtNcg,7676
src/wireshark/baseline/baseline_store.py,sha256=d4YgK8dYwvohaEsJyZhmwxox0gwrTOu0cXFqUeK3tvQ,3148
src/wireshark/baseline/defaults.py,sha256=QwM7EKBBwrBo7qhv8Xc-qxZ41Y4QZ9MYFtrl6Fu0Ym4,5346
src/wireshark/core/__init__.py,sha256=dhMNDis3AxaiXtLPDuHF5BkZKdnSltVzeM3GHA9l-ds,39
src/wireshark/core/pcap_analyzer.py,sha256=KqDbXAZhrhTeLgCDQpy0t0uC0TcYMB4KbnXFzI8Wpz4,14110
src/wireshark/core/tshark_executor.py,sha256=5TdGArEls1BQQcKN02HwQsPIjLx-61w-AVXg7kPG9eg,8117
src/wireshark/extraction/__init__.py,sha256=1iu-MdaneIPf8SxJRQGsdIZkiwH4VRCNMnrb-gN0Ne8,257
src/wireshark/extraction/hasher.py,sha256=ww4aCHNtJRVJ32XnYXRMwnZew5gt35nqT2WsUcqbi_o,11298
src/wireshark/extraction/object_extractor.py,sha256=z6IkJR0YXk__wAPrnt4le60AY-jCnaXT61cIiRxGYa0,13594
src/wireshark/hunting/__init__.py,sha256=mg3sVJxXm5WY_XaYxv7w9OVPNt88E6MA9rHE_WXfVzY,517
src/wireshark/hunting/anomaly_detector.py,sha256=-Lxv-WOc_n0NRyaGZC-oqxmrDHWYnjwmHBeqdtxzBgw,11415
src/wireshark/hunting/beaconing_detector.py,sha256=xIET22LvFTNp0pyUHK4nyD8SARUG3t7pFGCs23eEPtc,12274
src/wireshark/hunting/ioc_hunter.py,sha256=kwRDk5RhAAeuAs-_X3wOql3AQ8ih0YMItfxvExEXsI8,10691
src/wireshark/hunting/lateral_movement.py,sha256=xNaR5pjW4ziKLoLP6b664Wh5uEFIzDrFJfeAFTR5VeI,14741
src/wireshark/hunting/session_tracker.py,sha256=qReeRfPOVy9LTfJWiSLPV8h1sCe_aDozHjoWlJ0bEU8,11550
src/wireshark/reporting/__init__.py,sha256=TU8C3gHdSLvK5vw4y95MKrlADS5y5RXbox7omWk6r_c,254
src/wireshark/reporting/report_generator.py,sha256=dFpx1g6ieeDPxVtjBRmrcRv2oCmzoz4uiSNvc3snsos,17011
src/wireshark/reporting/timeline_visualizer.py,sha256=-V8_xVggRedCee_3H2Zn5wLWmKJp8OMmhQ13kv9VY2c,9737
src/rules/application__bitbucket__audit__bitbucket_audit_full_data_export_triggered.eql,sha256=kESrZRWjzrNKpfaduVB6EN7Yl91s1pTw-EDPJ5pmQjE,95
src/rules/application__bitbucket__audit__bitbucket_audit_full_data_export_triggered.lucene,sha256=Fk9rDY5FIbyh5opQrn9wra9AjmgoQFlN7TsX-IruG0c,85
src/rules/application__bitbucket__audit__bitbucket_audit_full_data_export_triggered.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_global_permissions_change_detected.eql,sha256=186Eei5m39F3s3QNElIjUw5hKMf_jJqh-TROhLPnvl0,198
src/rules/application__bitbucket__audit__bitbucket_audit_global_permissions_change_detected.lucene,sha256=McEdKFxapkPcb4A1d35TSpDMEQ-yRJxvOxTvBUDr7_Y,187
src/rules/application__bitbucket__audit__bitbucket_audit_global_permissions_change_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_global_secret_scanning_rule_deleted.eql,sha256=bbksvGjBM-FR0pxW5CFR0hZiqb8TtwGEwf76z8w30YM,112
src/rules/application__bitbucket__audit__bitbucket_audit_global_secret_scanning_rule_deleted.lucene,sha256=Hch284IJoSFWRQKAMWGm6d3z5gHIc2brycsX0JjHH1E,103
src/rules/application__bitbucket__audit__bitbucket_audit_global_secret_scanning_rule_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_global_ssh_settings_change_detected.eql,sha256=KEPlCY3mWk0YU3VtYqqpC0C9vNY8OOhxL-lGP01-bec,97
src/rules/application__bitbucket__audit__bitbucket_audit_global_ssh_settings_change_detected.lucene,sha256=ExpVu4co4-Ss2srG5A25lDKI8rlahFVvtWITQeTqjGQ,86
src/rules/application__bitbucket__audit__bitbucket_audit_global_ssh_settings_change_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_log_configuration_update_detected.eql,sha256=DkCQKsbz3xl6z1kIVF-cbkYdA6FP_5rpp8C-5Zbs420,95
src/rules/application__bitbucket__audit__bitbucket_audit_log_configuration_update_detected.lucene,sha256=kUxF0Z28tpEGkdOX1_zcsQDnHwXqIn_rKzl84PCubEI,84
src/rules/application__bitbucket__audit__bitbucket_audit_log_configuration_update_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_project_secret_scanning_allowlist_added.eql,sha256=U59ybF7mZzbrG_QYRxd-7MUYjLpWI518k1Ir6XGrAnY,108
src/rules/application__bitbucket__audit__bitbucket_audit_project_secret_scanning_allowlist_added.lucene,sha256=b9077g_7ZwX5eFYIe6bZdk8BRUxcU7q31qfTRurx8Zc,99
src/rules/application__bitbucket__audit__bitbucket_audit_project_secret_scanning_allowlist_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_exempt_repository_detected.eql,sha256=adKNWz4Ibbrkbl170YiAy4t-qOTPXt5qZ6VUM8Gve3A,107
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_exempt_repository_detected.lucene,sha256=5p9UF0qtXOn9-u523lsBw_pYeAvBTJXWg1asUVsgi8k,97
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_exempt_repository_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_rule_deleted.eql,sha256=sHPFUCdEXbtTSNEUdEkKhKLc8-MC8I2oaP4-mpg01hc,179
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_rule_deleted.lucene,sha256=xqI789FZlPLBaqFOMEy3T42K84Imz-_wovyiDtWqdaA,161
src/rules/application__bitbucket__audit__bitbucket_audit_secret_scanning_rule_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_access_detected.eql,sha256=X140cGQbQ5UVmUIhdVFcptI3XfOZmSDHxPz4dTuVKiQ,97
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_access_detected.lucene,sha256=aSQMhl09bobNJnyOuhxD_F1HGrQGrDo3fRAJmguNb2U,87
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_access_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_full_data_export_triggered.eql,sha256=bwKLfoVjgznazD4_DMJSBBjPcR_3D1pOIcRTqc92_j8,108
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_full_data_export_triggered.lucene,sha256=HNlV67FFdTPSoHzNZmr5KQ5_rf9CpQ5zCMrEzH24jrQ,99
src/rules/application__bitbucket__audit__bitbucket_audit_unauthorized_full_data_export_triggered.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_user_details_export_attempt_detected.eql,sha256=A0LcQkBJS-Pv0k2tP7ueAvTGEmA2Zx1tewZ3s1RmhM0,176
src/rules/application__bitbucket__audit__bitbucket_audit_user_details_export_attempt_detected.lucene,sha256=5fFK1qst2KQttZyJNaL3505xjjdTnlBhzC-MPUu5ABU,166
src/rules/application__bitbucket__audit__bitbucket_audit_user_details_export_attempt_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_detected.eql,sha256=D4LxOV58rR26qGJ23EIY_RnHDH04QNK71NNGF929zIg,87
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_detected.lucene,sha256=RxavI1AyojFgCp4PfABO-aoxmiD3un-VBqeLEZFIQ9I,75
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_via_ssh_detected.eql,sha256=0u4BL9ZYFI46fe_ee0xXKrLf4CLQvJbqDYvG1UkNXG0,92
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_via_ssh_detected.lucene,sha256=A6juFKaeJ-P5x1JQf8dC_KKcEIKZATu2S6auAG9pZ3U,82
src/rules/application__bitbucket__audit__bitbucket_audit_user_login_failure_via_ssh_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__bitbucket__audit__bitbucket_audit_user_permissions_export_attempt_detected.eql,sha256=t5e1_w2pPxhieYQoq08DvpL7fg6NBJxtq2MIvAyuZJc,164
src/rules/application__bitbucket__audit__bitbucket_audit_user_permissions_export_attempt_detected.lucene,sha256=FibonHBTTp96QW7oa7KYZvqv6y5UQz-ZhltH_qFd43g,154
src/rules/application__bitbucket__audit__bitbucket_audit_user_permissions_export_attempt_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__django__appframework_django_exceptions.eql,sha256=R1Cw_4rfmR3YOOYw2bxwtKdW3arJvh6iv88IRR3_AtE,313
src/rules/application__django__appframework_django_exceptions.lucene,sha256=9MZUR2SHX7ShkKK2CNEmg6D2vD4SOgs24j0pQNweyvE,303
src/rules/application__django__appframework_django_exceptions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_delete_action_invoked.eql,sha256=lYGHA-hMpK-E8GeMq5xj-i2ByC3A6L4gKUKkX33Lgfs,101
src/rules/application__github__audit__github_delete_action_invoked.lucene,sha256=bq9wvl0NNeOuIY-lOcTe7kErc5hvrRNgDCts2UiKNwE,83
src/rules/application__github__audit__github_delete_action_invoked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_disable_high_risk_configuration.eql,sha256=ax-ctJIx3ySmreBDXW5QDegvpJ8yBmnbxlRwmDmNPW0,507
src/rules/application__github__audit__github_disable_high_risk_configuration.lucene,sha256=va7_0rONVhX4KijbDkplSLVq3_GwRcwhFKrUslDwV-0,489
src/rules/application__github__audit__github_disable_high_risk_configuration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_disabled_outdated_dependency_or_vulnerability.eql,sha256=aSIpoxVU5ZowQrvbrYYCpoITpkgY7oNJKoQaVR9JXIg,223
src/rules/application__github__audit__github_disabled_outdated_dependency_or_vulnerability.lucene,sha256=o8iIu63stMBbwTFPy5XU1pc4s3MFYtk19v447T6B2tc,205
src/rules/application__github__audit__github_disabled_outdated_dependency_or_vulnerability.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_fork_private_repos_enabled_or_cleared.eql,sha256=s_1OFNYlVvheh1X0o-Ljt4RhsVC428iVfosHMM019Dk,97
src/rules/application__github__audit__github_fork_private_repos_enabled_or_cleared.lucene,sha256=z_vLgn5hi-HGv1MblCEugh_OeplQNO1y3XuzJPgElOU,79
src/rules/application__github__audit__github_fork_private_repos_enabled_or_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_new_org_member.eql,sha256=ogJ7oeQ3z5I2hfXpPlNKLGeyGUNqbf1Flgr69wh7_j0,63
src/rules/application__github__audit__github_new_org_member.lucene,sha256=DP_QDi_SO56WC58JYONHny78IF6kBh4GC4hdKAKPR0Q,45
src/rules/application__github__audit__github_new_org_member.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_new_secret_created.eql,sha256=kemn6Uou15qke603Qr5wOdzHd9Lbv0LWPYcpdst2HcU,155
src/rules/application__github__audit__github_new_secret_created.lucene,sha256=5fQRxm_taz7755Svy_xHw9Cuni8VYGLoivXnOpgmBqE,137
src/rules/application__github__audit__github_new_secret_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_outside_collaborator_detected.eql,sha256=D1d910JHiCGMX9xJimT8v5SMXY1fIpeQ7y5EzQvZJXY,93
src/rules/application__github__audit__github_outside_collaborator_detected.lucene,sha256=dqn_j4RjLHY6CvAuYsi6DxWDVbejqr1k6yZBsGfNsuI,75
src/rules/application__github__audit__github_outside_collaborator_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_pages_site_changed_to_public.eql,sha256=vn5ztOkYrR-LZwvwZnAHxPgz1GecCj-BCcKSm96gOzA,37
src/rules/application__github__audit__github_pages_site_changed_to_public.lucene,sha256=I5iZOiu-1_I8mJ6JzHaEGb3OwQj0dHpe7QmN2u9CdjI,25
src/rules/application__github__audit__github_pages_site_changed_to_public.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_push_protection_bypass_detected.eql,sha256=YG2fXWqBi-01ns_IaKHd_iLjSPn8ZGoGOXau4lMYD0w,60
src/rules/application__github__audit__github_push_protection_bypass_detected.lucene,sha256=J0cQb9Up0X9veyVv2i3qlcY4RUC1LfsRoPUSIW6_Jtw,48
src/rules/application__github__audit__github_push_protection_bypass_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_push_protection_disabled.eql,sha256=zntuocuHnijCqInhKhbnKcyC2jBz3l9OsdhwGvYNjJQ,448
src/rules/application__github__audit__github_push_protection_disabled.lucene,sha256=dJ4GoIxFqT4dZuRCcYnsBP8r89BDlvbG3V1YygSp8l0,430
src/rules/application__github__audit__github_push_protection_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_repo_or_org_transferred.eql,sha256=_PRBKqVnSaLk_ApIGVPsGTRVTexVQ8tLwEQvegrUr3E,111
src/rules/application__github__audit__github_repo_or_org_transferred.lucene,sha256=6vcHIMCZmWqfBiSuH-TxBklMETpecwc0S8mO9KE6pIg,93
src/rules/application__github__audit__github_repo_or_org_transferred.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_repository_archive_status_changed.eql,sha256=xI3mQ8B60wgDQygUJTzEcp6YW6q6z-7LX5Im-d-PXHc,60
src/rules/application__github__audit__github_repository_archive_status_changed.lucene,sha256=ZKvRQE3j-DIHF5ZN4jnyV1PdFir_tPxRpzETAoPIno0,42
src/rules/application__github__audit__github_repository_archive_status_changed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_secret_scanning_feature_disabled.eql,sha256=4HR9hXMOug-ZUoGMJ-iGXUGU5_Opp5II-YufWbGiB4Y,213
src/rules/application__github__audit__github_secret_scanning_feature_disabled.lucene,sha256=PV-_HF_qHFK-6G2psSlpxi4LuY3qAy9FJ96Z7Br7rLc,195
src/rules/application__github__audit__github_secret_scanning_feature_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_self_hosted_runner_changes_detected.eql,sha256=dBgb3RFmu5w5uER2osdJlWW-0g-DU8T5J1SzbRcUlw4,316
src/rules/application__github__audit__github_self_hosted_runner_changes_detected.lucene,sha256=wNOu6CHtKe_x0LjXIyKRjEDAPCB-pPIwU2NSpJd7j4g,298
src/rules/application__github__audit__github_self_hosted_runner_changes_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__github__audit__github_ssh_certificate_config_changed.eql,sha256=tA1Hea6K-Y04t4a-XMoSZ6roYGglsIRkfuu6xoxjjjs,99
src/rules/application__github__audit__github_ssh_certificate_config_changed.lucene,sha256=oLd0AWy4Ljywuufp4ICuhc8BapSvFh95doyJpytQqAw,81
src/rules/application__github__audit__github_ssh_certificate_config_changed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_jndi_injection_exploitation_attempt.eql,sha256=uGUPPt43JYipmNM1j-ENSHWHHzCI7G9_3GSxT0-nnTI,82
src/rules/application__jvm__java_jndi_injection_exploitation_attempt.lucene,sha256=w0vtOzROqky9S_te5_JDhATVpSUFir_xcYWY7zIo5Ls,72
src/rules/application__jvm__java_jndi_injection_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_local_file_read.eql,sha256=1bwIOBILzElFYoZsu9C04AU-0-HZAPX-LEjy5x2GYhc,50
src/rules/application__jvm__java_local_file_read.lucene,sha256=wKEt6pmz6AsgR2AMLXDNnoJn0T8556WNVCYjZPYwNNo,43
src/rules/application__jvm__java_local_file_read.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_ognl_injection_exploitation_attempt.eql,sha256=OtlyQFYCDLtPBti77cCHCWyzyjaZoGhSg3Dj7DlnBc8,81
src/rules/application__jvm__java_ognl_injection_exploitation_attempt.lucene,sha256=viSdItA9Z6I-W0ZyyL0Mw9QCWo7-rz7yxbE5gaRmjK4,71
src/rules/application__jvm__java_ognl_injection_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_rce_exploitation_attempt.eql,sha256=VP1kB01wmmzP-vVoXBW2DS5rL9fgOi2tRRTrJnvNrQw,88
src/rules/application__jvm__java_rce_exploitation_attempt.lucene,sha256=nykrrJQibD4I-CXbHJuOpQOwKQQB7pURoP9R-ZVAeE8,80
src/rules/application__jvm__java_rce_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__jvm__java_xxe_exploitation_attempt.eql,sha256=BqVC9CDCnXLE9hd-iweEXIjMF93G5WV92dSmGZ5jITo,48
src/rules/application__jvm__java_xxe_exploitation_attempt.lucene,sha256=DO7V8wGhETiwez0_E_B3R6rdC3xO0n9NMc5Lf6Rn-AE,38
src/rules/application__jvm__java_xxe_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_change_admission_controller.eql,sha256=Xd8a9sJtMHhwGmWp0YClPfeHu6z5OCjZO1HxcLRqMRQ,228
src/rules/application__kubernetes__audit__kubernetes_audit_change_admission_controller.lucene,sha256=bh1Xcgh8LMEOS9VT9iNoCgp8jQomTMLxql_5RwWBbhI,200
src/rules/application__kubernetes__audit__kubernetes_audit_change_admission_controller.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_cronjob_modification.eql,sha256=x_FId32ulBAmAnKk7nU0kxi_llbepZpVtlSEQncsCZk,157
src/rules/application__kubernetes__audit__kubernetes_audit_cronjob_modification.lucene,sha256=cEFOE5AkW3A2145e_byJuK0RnHNaDqS6jtRwRnNy7Hk,129
src/rules/application__kubernetes__audit__kubernetes_audit_cronjob_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_deployment_deleted.eql,sha256=3Nz-64Q6RaPqAbKdcUFbkTk7pJAbE_sx7br_7Fsdvco,61
src/rules/application__kubernetes__audit__kubernetes_audit_deployment_deleted.lucene,sha256=G0MtNN7MecSdz7oMhY3YetvNAHXb-MmT4GO2LBLVRbs,47
src/rules/application__kubernetes__audit__kubernetes_audit_deployment_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_events_deleted.eql,sha256=u6nGCVX2_oDTSZ_qM87fivf_1ODiSsJKn8mbZ0wTqds,56
src/rules/application__kubernetes__audit__kubernetes_audit_events_deleted.lucene,sha256=blJErSwsCwBmhERJjmYZn_1CW3tijVWH1jXYW8_EpvU,42
src/rules/application__kubernetes__audit__kubernetes_audit_events_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_exec_into_container.eql,sha256=mzanqo-dtGGA2v41KHm57kfumB3CIwMrFGwJqUgOdIo,87
src/rules/application__kubernetes__audit__kubernetes_audit_exec_into_container.lucene,sha256=qnpqdb9xHVom3OHurTeTcosuE8rn-51IW10_IH2EaBc,71
src/rules/application__kubernetes__audit__kubernetes_audit_exec_into_container.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_hostpath_mount.eql,sha256=KKHogm2GUglcRHRYIy_nq0NfQsOkANbFo2Qe9-jQcGQ,71
src/rules/application__kubernetes__audit__kubernetes_audit_hostpath_mount.lucene,sha256=CzGDdV8OHUlCVkQ6s2nEHOmdDU_WMcOo_Ayp1zTe0rU,55
src/rules/application__kubernetes__audit__kubernetes_audit_hostpath_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_pod_in_system_namespace.eql,sha256=HwuZ8s-lL-BN47574XUMBZSp1renxd446BXwMKOY230,92
src/rules/application__kubernetes__audit__kubernetes_audit_pod_in_system_namespace.lucene,sha256=89vMfKJX5Y5NkvhhHvlasFglGjffoIPnhqivQfCAZBI,77
src/rules/application__kubernetes__audit__kubernetes_audit_pod_in_system_namespace.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_privileged_pod_creation.eql,sha256=UPDoLQPQnKtsaTgJamv0Ws48hez_47aeNcYXTc1p-3I,75
src/rules/application__kubernetes__audit__kubernetes_audit_privileged_pod_creation.lucene,sha256=nzIdVWbhhusjpAiFkhysuvZZombsgP5nhGX1KUuV8gk,59
src/rules/application__kubernetes__audit__kubernetes_audit_privileged_pod_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_rbac_permisions_listing.eql,sha256=SN6-lz29OsgJ8eOh5hJwitYY3qFZKwXvb849-qPpClI,109
src/rules/application__kubernetes__audit__kubernetes_audit_rbac_permisions_listing.lucene,sha256=vVnGRyPvDRv0snWDhtSP3rjZ2Sx-4gfTskDVujYdTyQ,93
src/rules/application__kubernetes__audit__kubernetes_audit_rbac_permisions_listing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_rolebinding_modification.eql,sha256=9lXmHLOC7jGYKRYeusljCiU_dydlrKYMW9kWmjAC2GU,196
src/rules/application__kubernetes__audit__kubernetes_audit_rolebinding_modification.lucene,sha256=fRxc_jgFB7RPrpZ8DPC4UNpBrWoITTQkKHCv-dmPfeE,168
src/rules/application__kubernetes__audit__kubernetes_audit_rolebinding_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_enumeration.eql,sha256=YI4EILrFfJA7-MPBUn-GskcY4iTegWEfs5aPS2CaNQs,55
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_enumeration.lucene,sha256=3FsZnNo_RTl7z0G4PhGrUUwbMurKzSEFZ1TjwdBYZpU,41
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_enumeration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_modified_or_deleted.eql,sha256=5-qtGwIKd99PR0xTln6NBdTmGu-dVxYlhJQqdoPRV_U,107
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_modified_or_deleted.lucene,sha256=zntIAl_AncyytIzduLVgChwVRpfV59XYG52cdPddBt4,87
src/rules/application__kubernetes__audit__kubernetes_audit_secrets_modified_or_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_serviceaccount_creation.eql,sha256=7MIXYfBx7b6zxcOLL1OQ9EB_rlZwBZ2EfNzMmb8-oQA,65
src/rules/application__kubernetes__audit__kubernetes_audit_serviceaccount_creation.lucene,sha256=OrYBefU9m5Vg4bgO0qgBN8lKjUkhSpCt35PFxv8cZQw,51
src/rules/application__kubernetes__audit__kubernetes_audit_serviceaccount_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_sidecar_injection.eql,sha256=fg4-Ca80zcgiQBp_7Nc18VPrQkkDekRTrH3pdw9bzPE,80
src/rules/application__kubernetes__audit__kubernetes_audit_sidecar_injection.lucene,sha256=HBQZq15a79pbKHbk-SB06zD3KbgPCHC_rUbnRVb8jZY,64
src/rules/application__kubernetes__audit__kubernetes_audit_sidecar_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__kubernetes__audit__kubernetes_audit_unauthorized_unauthenticated_actions.eql,sha256=HW9_tlU3NJqORvv5qWPyeQT6kvM_JuDU4C0097ATwnk,47
src/rules/application__kubernetes__audit__kubernetes_audit_unauthorized_unauthenticated_actions.lucene,sha256=NRJCTjBM1c53kPoLiT-UkWry9oRtauq_bUv8CprwMOo,33
src/rules/application__kubernetes__audit__kubernetes_audit_unauthorized_unauthenticated_actions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__nodejs__nodejs_rce_exploitation_attempt.eql,sha256=TXIj_EFQmj-4pU6hmk9N8hQnyh1klOED_e7KQmXIn1k,31
src/rules/application__nodejs__nodejs_rce_exploitation_attempt.lucene,sha256=VE3ZmLuqA687zDMuQCWqdX-Ed7n2gF7dYgMT7Jcogmg,22
src/rules/application__nodejs__nodejs_rce_exploitation_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_ftp_login_attempt.eql,sha256=9fI-eXhmsC8xc4nvnM1a-x6OGGqnOkzhXnJ08z11vgs,23
src/rules/application__opencanary__opencanary_ftp_login_attempt.lucene,sha256=DzEwWE8gr900jAyQga_MVliIAG8o1zD2CxW10QDitNw,13
src/rules/application__opencanary__opencanary_ftp_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_git_clone_request.eql,sha256=UTDdLk69SOXCpor733bv0yAhqqFaCcBActlo4RsmJFk,24
src/rules/application__opencanary__opencanary_git_clone_request.lucene,sha256=8YEntSVnkMCTNy3RhBSMFN6TOXuJPggNl6WoeYlxACc,14
src/rules/application__opencanary__opencanary_git_clone_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_http_get.eql,sha256=Ztyns9a4S38qgWIq_eotdz1x4xkQL3SxWx55MM6dMes,23
src/rules/application__opencanary__opencanary_http_get.lucene,sha256=frzT0e4mYnHuNQgsYZt3aUrjGZDDhG0m9ui72Mi4e7U,13
src/rules/application__opencanary__opencanary_http_get.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_http_post_login_attempt.eql,sha256=kTohMSA6WmosqK16TOYlaVwoWzRxJ7I7OugkjnAotiA,23
src/rules/application__opencanary__opencanary_http_post_login_attempt.lucene,sha256=jvMKgXwC82XKWoh5YNQ_b3_hv-XasUkMs86rl0bnnIQ,13
src/rules/application__opencanary__opencanary_http_post_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_httpproxy_login_attempt.eql,sha256=yey4gzBrqACrtybPAWO8GbMJdfmV4QWAH7FxOAYToqg,23
src/rules/application__opencanary__opencanary_httpproxy_login_attempt.lucene,sha256=Vs0m8-YSH4KLj3sZmeAKI56ka24INe3zFzueS7LHrL8,13
src/rules/application__opencanary__opencanary_httpproxy_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_mssql_login_sqlauth.eql,sha256=0X8xNsBLo-E2qwYvqhRXg6s7zMhZ3tCVLVTN3S7Yi5I,23
src/rules/application__opencanary__opencanary_mssql_login_sqlauth.lucene,sha256=gfHQtdANXuMyhjCCYZIB2Yls9wEewYTbfnzNvDiBPiw,13
src/rules/application__opencanary__opencanary_mssql_login_sqlauth.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_mssql_login_winauth.eql,sha256=Qcx_Hiq5vTCuwHZqllFePIznnYNG9c_I--A9DvlkOLw,23
src/rules/application__opencanary__opencanary_mssql_login_winauth.lucene,sha256=bD67b8u6zNR4oQQoT6fvgVqc655qyPWpuU4NAPK1tPs,13
src/rules/application__opencanary__opencanary_mssql_login_winauth.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_mysql_login_attempt.eql,sha256=NssxYCw8BebPJPT2NIcdWJnPliwoUcwUd6fLp7x3HQY,23
src/rules/application__opencanary__opencanary_mysql_login_attempt.lucene,sha256=Cnw1MTE-RfqCUB22oNo98Q48Wh-G7Zx0_jMpgwV9L9g,13
src/rules/application__opencanary__opencanary_mysql_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_ntp_monlist.eql,sha256=WU6vrzrAt898NhPQi50ui7Gp5muVrBOFhOaxf1BmQ44,24
src/rules/application__opencanary__opencanary_ntp_monlist.lucene,sha256=ApN4QuiJpVOJJlAlKsZA81DWSsS1Uw7xg4OBWcKLO_I,14
src/rules/application__opencanary__opencanary_ntp_monlist.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_redis_command.eql,sha256=plVCrCG8qZLZoh0nJ2ZN9z16JRXDXzIV5ObHPN6LMyY,24
src/rules/application__opencanary__opencanary_redis_command.lucene,sha256=yBE9OyFP-7E8VL_ZkO-BmaVEpblKRohYHjPNqhf5y4A,14
src/rules/application__opencanary__opencanary_redis_command.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_sip_request.eql,sha256=MctcUCRX2-Vj2yTRQLBRik7Z7lOtTIkGpK8wZCtk0Po,24
src/rules/application__opencanary__opencanary_sip_request.lucene,sha256=12BwZpQtYd4SUB1fOhdXZa9LcGgKd65i0c17c14E8iQ,14
src/rules/application__opencanary__opencanary_sip_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_smb_file_open.eql,sha256=E7WtMOQwwv8x4Lr5EL8mo4FhpDjZSRW9sRNwOf9yutM,23
src/rules/application__opencanary__opencanary_smb_file_open.lucene,sha256=1bThDLHsHmVwXO0vHrm1zLtROWSq6hiMAUWUQepEHDA,13
src/rules/application__opencanary__opencanary_smb_file_open.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_snmp_cmd.eql,sha256=gUu8E_BP0u0v-mB4nFiIXbHZ2vL_GZ6BXPeiT_Xi_4A,24
src/rules/application__opencanary__opencanary_snmp_cmd.lucene,sha256=ykXRsDzeS7DuuwIk8oVo6S_CuLRMYw1vMRCgpvjBm6s,14
src/rules/application__opencanary__opencanary_snmp_cmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_ssh_login_attempt.eql,sha256=0i_ZxbxFdxEkUcrOQkxnR6GISEkVFCrwIAumcD4jAw8,23
src/rules/application__opencanary__opencanary_ssh_login_attempt.lucene,sha256=t80MfVNDrE_LJ1SlSQAMKPd_Et6Kn-bzWDfwmIHZFzc,13
src/rules/application__opencanary__opencanary_ssh_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_ssh_new_connection.eql,sha256=Qvm30H9jxUZE7UO5WwDnAeagby16ODaf2IkZKE6MBtI,23
src/rules/application__opencanary__opencanary_ssh_new_connection.lucene,sha256=-DbG2-1A_tJ4VIxgzsrhLfbaWEOs6iOGcvXbQRM12N8,13
src/rules/application__opencanary__opencanary_ssh_new_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_telnet_login_attempt.eql,sha256=hPqK3jMqLBFkAp5GTI1bHSGuyiH5__EFFtHCuhdlMME,23
src/rules/application__opencanary__opencanary_telnet_login_attempt.lucene,sha256=zCiuqrRzm28CHvZoFiRiFfFznjyKafQYgAUb1NfIeBU,13
src/rules/application__opencanary__opencanary_telnet_login_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_tftp_request.eql,sha256=OwaF1-1sOXuWhA0LFlCmnEFL-T8P3v0vCe4Pr6u-Ov4,24
src/rules/application__opencanary__opencanary_tftp_request.lucene,sha256=fJGcsOdWHxuKlFTKao6lN-iUFgs-ghlWdWdnaQyNUZw,14
src/rules/application__opencanary__opencanary_tftp_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__opencanary__opencanary_vnc_connection_attempt.eql,sha256=eEgi4IDmQkmsEw_CDTYEnwilpteCmJX2lZYvZ55En8I,24
src/rules/application__opencanary__opencanary_vnc_connection_attempt.lucene,sha256=72toTKpdVfXVkm5i-X27L7jZc6TIyiGDM8fok4LMSzc,14
src/rules/application__opencanary__opencanary_vnc_connection_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__python__app_python_sql_exceptions.eql,sha256=cQ08Wh4o0mgoLbcA87u-z8tWIc0mzEuJIgTPHGaLLuM,86
src/rules/application__python__app_python_sql_exceptions.lucene,sha256=rBzlvc7ASFDM05yvlYr87EDmngmAQ_mqm5-Y1lb-rzA,76
src/rules/application__python__app_python_sql_exceptions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_atsvc_lateral_movement.eql,sha256=gym9Idm2aJ24yrLuSr79R0mM4tiuEqK9Z8Stl4dgGps,123
src/rules/application__rpc_firewall__rpc_firewall_atsvc_lateral_movement.lucene,sha256=Wm_m3wBcp4y-DWR2rktzTjtVxKdHMsF0obwv_4cm_o0,109
src/rules/application__rpc_firewall__rpc_firewall_atsvc_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_atsvc_recon.eql,sha256=w7w7OdcHgODrNpvS4jZhavGLTnfCeqFBYwMkpNWZINw,131
src/rules/application__rpc_firewall__rpc_firewall_atsvc_recon.lucene,sha256=gssMjpPhlwuCGW-x8aQwfg3VtqGtFOB1CB727eE3G4c,117
src/rules/application__rpc_firewall__rpc_firewall_atsvc_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_dcsync_attack.eql,sha256=3n4ddgD5DYNVqZHfYR4jDERf3sv87zK1wU7mvWhfejw,135
src/rules/application__rpc_firewall__rpc_firewall_dcsync_attack.lucene,sha256=dLk_xP-jwn0Lh62V9AOlakJ2ON9Tk6xcpNzFee48qGw,123
src/rules/application__rpc_firewall__rpc_firewall_dcsync_attack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_efs_abuse.eql,sha256=7Bz2cL-MydlG5jYGDaVwOrQPvPvALaaub9Uq-NTaT6U,148
src/rules/application__rpc_firewall__rpc_firewall_efs_abuse.lucene,sha256=ORMzYsULVwihe5W8o710CCW0QxNhefF9CL2ZqbLXh4Q,136
src/rules/application__rpc_firewall__rpc_firewall_efs_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_eventlog_recon.eql,sha256=0MnjigVELbeEK4z3DNAqP7he6T8f1F5Cy3Hop2paYKY,148
src/rules/application__rpc_firewall__rpc_firewall_eventlog_recon.lucene,sha256=GeV4S6lgqj32_m2Bp0a-TdrJXD-OlbOY4jJ0xu0--C0,136
src/rules/application__rpc_firewall__rpc_firewall_eventlog_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_lateral_movement.eql,sha256=jIxNpyFcBtMUDvpwGB5ZKGDMmc68NuAGllpqDoF5D9M,150
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_lateral_movement.lucene,sha256=E1WBBV_EPMZKsO9EyrtwcWnyMU7McCD8kEnXmMIVC2U,150
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_recon.eql,sha256=ElHm8nxBOsyhVl5eJTQvJ_rlEdWX0d0DRQo9xf9hDAo,158
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_recon.lucene,sha256=PW3shLtpIkxnyof3ap-_itPnv-NTnJZiEnxtqRlrmBE,158
src/rules/application__rpc_firewall__rpc_firewall_itaskschedulerservice_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_printing_lateral_movement.eql,sha256=lEUDc9CMcTDM5s_bjJNe9cVk3CrpXxIl6mmb02x2QY0,228
src/rules/application__rpc_firewall__rpc_firewall_printing_lateral_movement.lucene,sha256=bCRa9ekcxMY81SFVQ0WSEnPBZQwrrSSgElbHQejUxt8,224
src/rules/application__rpc_firewall__rpc_firewall_printing_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_dcom_or_wmi.eql,sha256=_r_AnpBzRJJmMH6bLqDGAxRFOO8bH4UO-9VBIGTmRpg,308
src/rules/application__rpc_firewall__rpc_firewall_remote_dcom_or_wmi.lucene,sha256=uo0tUpI3RCf2SHe70J-zg2NNVXyxmgnDX7Xu12sXd14,312
src/rules/application__rpc_firewall__rpc_firewall_remote_dcom_or_wmi.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_lateral_movement.eql,sha256=8GQr23_Ru2cO2TezZfa0U9iIdOg9xA9tXb2c0xdxH1M,154
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_lateral_movement.lucene,sha256=HWuKoKgSAm0wDJ7obTphUWdquSMEefWh-Tcf1UJtjoQ,156
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_recon.eql,sha256=FZuQJNSbVUKywuPa-DpM7qbg6SOz9GvxUPrklBiX3b4,162
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_recon.lucene,sha256=2Tzi4Ui-heArXfzjegv7hDpfRT07Lwc3ID97uoc6x6c,164
src/rules/application__rpc_firewall__rpc_firewall_remote_registry_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_server_service_abuse.eql,sha256=UKNx57ZbGaO4K26Z-WWSpj3pp2zoo2e0uDyhBSRUiiY,98
src/rules/application__rpc_firewall__rpc_firewall_remote_server_service_abuse.lucene,sha256=ue90-k3LNcEzPARmjxXs_tv3-zdcg4UTlbj-E4BQkII,88
src/rules/application__rpc_firewall__rpc_firewall_remote_server_service_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_remote_service_lateral_movement.eql,sha256=NZf1uOg1_4FoauCMVTiF4yOy29iKVVNZwDLKdsmzXiE,98
src/rules/application__rpc_firewall__rpc_firewall_remote_service_lateral_movement.lucene,sha256=950Yh85Fxhgtl6cZ2no1-6wnJzc0Ffqgs9Z6auvuZS0,88
src/rules/application__rpc_firewall__rpc_firewall_remote_service_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_sasec_lateral_movement.eql,sha256=U6gY_XkCAr05GuIEQh-IxbkTMruoVKEcONHEgAp9iNY,123
src/rules/application__rpc_firewall__rpc_firewall_sasec_lateral_movement.lucene,sha256=k9tPY98SbFDgsyGPR_0RHp-WFOhNS6S8y4Bbke8Y89c,109
src/rules/application__rpc_firewall__rpc_firewall_sasec_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_sasec_recon.eql,sha256=puyzRzEWCIRK7leDr2SglJmHVGF04JNCl0NSLSoeXgE,131
src/rules/application__rpc_firewall__rpc_firewall_sasec_recon.lucene,sha256=Vk-LUFzqG7d1j0n8M1j-TGgCqv5I2mD-lzSsy70mt7c,117
src/rules/application__rpc_firewall__rpc_firewall_sasec_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_account.eql,sha256=eugpoyzoGnMhZ5lXFsqRrlcXMTrEdbbGcL0z2brBh5I,110
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_account.lucene,sha256=qdXk6YTHzD18jdn-5x9XA9LAz7_VrInMPE8u5DYrrjM,100
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_sessions.eql,sha256=SekonmxMef5GT9taB9QLFqdsNrW1W47wDPzTxOe2JEY,111
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_sessions.lucene,sha256=xnJQP_QEp2pwHucp0C6SeAqRx2XaPuSGeCcKJMyB98Q,101
src/rules/application__rpc_firewall__rpc_firewall_sharphound_recon_sessions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__ruby__appframework_ruby_on_rails_exceptions.eql,sha256=XgCNEJoQGGOITA52-VDOi6HSyH6s_VdMcA9NSkokcp8,218
src/rules/application__ruby__appframework_ruby_on_rails_exceptions.lucene,sha256=hdHeAjns9j1OHK3fy5aluEJmK14q220H4PeIxB4qkRg,218
src/rules/application__ruby__appframework_ruby_on_rails_exceptions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__spring__spring_application_exceptions.eql,sha256=w0H1iabwk0mZoztIlCwKnAEUF1pJOnskTVeW4x_TIHg,199
src/rules/application__spring__spring_application_exceptions.lucene,sha256=fI6qxQrPK1uYkZ9KgykzlQ9_siQfNbKLSZ7jKASeSAM,189
src/rules/application__spring__spring_application_exceptions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__spring__spring_spel_injection.eql,sha256=DtGDv65LBVX6ntWpM18uODRBeGcMWlr7hwXWEsGNF7A,63
src/rules/application__spring__spring_spel_injection.lucene,sha256=Nk2pmcS0WbS6WtIW3Plsy7wYedEOc8GdYNqEmzpEN_Q,53
src/rules/application__spring__spring_spel_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__sql__app_sqlinjection_errors.eql,sha256=Hw5-779reRhW-EFDsNtCa28sMA9bhPUC3Xi775EZhDg,241
src/rules/application__sql__app_sqlinjection_errors.lucene,sha256=xn-nai8nGu8qPZoS_6dqNIZsydWyyNhhP8PIRMrZDYk,264
src/rules/application__sql__app_sqlinjection_errors.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/application__velocity__velocity_ssti_injection.eql,sha256=xhc3fbgMR8lNXOZW_ZtRFdgBDhMmc3FapUxzaBYtTgs,82
src/rules/application__velocity__velocity_ssti_injection.lucene,sha256=Wdnw83zgBSbpMxoGx9Qn_R3yPeC_EJ_PZkRt9cN5pFg,72
src/rules/application__velocity__velocity_ssti_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_exploiting.eql,sha256=x29U7ABCGPQTxMZCRvPf8thY34uQGly4pf2pxcty6dI,340
src/rules/category__antivirus__av_exploiting.lucene,sha256=qiekJ7-RPeNQ_by9pikg_RqBl_IB2fepbJHXq8eYi3w,322
src/rules/category__antivirus__av_exploiting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_hacktool.eql,sha256=61aF9KGPoAscP9G-VkrCSRvMyOuS2d6-7cuuof6dUHc,662
src/rules/category__antivirus__av_hacktool.lucene,sha256=DwBr7wePFX4iApwvrfSkR7K1PirZfVem865NupAttpg,637
src/rules/category__antivirus__av_hacktool.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_password_dumper.eql,sha256=xZQ9-HRkNFMMATMOSlEGFCBYe7PDKR6XZbkLygfCJSY,480
src/rules/category__antivirus__av_password_dumper.lucene,sha256=WriGpu8pDCh_FNMKlVpLDX2uq8O8PR1bkNUcqfN00zI,461
src/rules/category__antivirus__av_password_dumper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_ransomware.eql,sha256=qJEN6egeGTSlyE1487vOtiywzMqh2qLJoGRqYH8u0Qo,421
src/rules/category__antivirus__av_ransomware.lucene,sha256=o5Jyxj8S1Q_nzQPZqPA1UJ0PdEHexbF9_GNVp43CTno,403
src/rules/category__antivirus__av_ransomware.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_relevant_files.eql,sha256=7Y48CUU8H4FbvVEeh_zJHWtWkuGZrKezsUoQ-mhO6OE,617
src/rules/category__antivirus__av_relevant_files.lucene,sha256=P4uMxBuj2Ho-pROg1JeI7YheCStN1p2icRc1NatKQ7o,598
src/rules/category__antivirus__av_relevant_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__antivirus__av_webshell.eql,sha256=i9KlWVXz-ivtLQcXLUgkfc6FGNwPLSMcuRC8MCc326c,735
src/rules/category__antivirus__av_webshell.lucene,sha256=1DGNn6NiEKNm49Q8vKufGWE9J25ps8hn-cmAvy5iOTo,729
src/rules/category__antivirus__av_webshell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/category__database__db_anomalous_query.eql,sha256=sbaulGVsfGFvDqs-Eh7nbFB_V2AqU5IaKbBDBFEjhFc,56
src/rules/category__database__db_anomalous_query.lucene,sha256=l9SK2bzxe11IrOeR--FjGOcMmO9KA-rNUEndBVD8uus,47
src/rules/category__database__db_anomalous_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_bucket_deleted.eql,sha256=LTiwF2EthSv3vZ-DIfetIbSa7JQw3lteO3dTRUEVuIc,85
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_console_login_failed_authentication.eql,sha256=v8FrmH69_0m_54lvWAnzibUSjGQ2H5R3U1BPOiet948,76
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_console_login_success_without_mfa.eql,sha256=SbqD9lMUFFM_CD-WvglHWPsSMuO65IfvdkbabALJqj0,116
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_disable_logging.eql,sha256=illiIswa9Cvan5_k0XRnu6_13qtQYRDT_5rPaYpfnjc,117
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_guardduty_detector_deleted_or_updated.eql,sha256=iK791FyfY-Vok-7G1wBbm7OJFH0yNsGYUer-ELiBXnI,200
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_imds_malicious_usage.eql,sha256=Dg1Woaqyq4O0YW2chZ4-yDrFJeVLVGycKUyE4UAF3fc,177
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_new_acl_entries.eql,sha256=U8rD_1idk-iYrsLCuCfn0fMTNeHYSnztyHfttzftkC4,80
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_new_route_added.eql,sha256=uxOGQHT4B9lYliBgwblCMD3Kesab5QScKQTWvhBoM2M,70
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_pua_trufflehog.eql,sha256=9eKDy0T-4w689iRIBOTbLLjSxmKAoUayxvDf7pOJ1C0,33
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_region_enabled.eql,sha256=lHY2NxrcJeWfK0E3lMCRSNFU3vaJXP1irVkSYYu6aF0,75
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_security_group_change_ingress_egress.eql,sha256=2StiWLZeogBn8hnEoVkl4hOIHdxfU5-5j2f5YweR8nc,189
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_security_group_change_loadbalancer.eql,sha256=D6gqMz-5pdo997CfZc_ba3NV7QNk6nFD1JBkou_HUus,140
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_security_group_change_rds.eql,sha256=ypF6luzwonlruQZHWTYsmElgx3P6nWdElETNqlLBe1I,182
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_ssm_malicious_usage.eql,sha256=xPN6lvhB4aGKx3gQ4aVRFnVOf8WVcZW7tRWF7q5WvYw,122
src/rules/cloud__aws__cloudtrail__aws_cloudtrail_vpc_flow_logs_deleted.eql,sha256=VBHYjb34JdEg2LHG-cRTLawUJ-6NVGQLdLdiwDTMBSQ,87
src/rules/cloud__aws__cloudtrail__aws_config_disable_recording.eql,sha256=SsQcwdjF4wBkFTQPTa6mEj6qyYxZeeRiqe8Lt4LtJ_g,122
src/rules/cloud__aws__cloudtrail__aws_console_getsignintoken.eql,sha256=SQndD3sykvMqzfNMX_tZz-q9DRcxFmYncXTk4oaPu1o,128
src/rules/cloud__aws__cloudtrail__aws_delete_identity.eql,sha256=SlW7HJ2IHOvcXGUlm_jWof0WJo62oPsoIElU1xh-pGI,73
src/rules/cloud__aws__cloudtrail__aws_delete_saml_provider.eql,sha256=0yk1esEDAmkCw04nbvzZPgb3Yv0Bi7wk6-Oz91qnudc,98
src/rules/cloud__aws__cloudtrail__aws_disable_bucket_versioning.eql,sha256=JdzE8PgPQPcswAHmqAgGSPdAEJilFQ60rViM9pZN6s0,113
src/rules/cloud__aws__cloudtrail__aws_ec2_disable_encryption.eql,sha256=oL5tsk0Fz3S00e4qZTpxhjjbcb1mNWE36kjW-ZYWG7E,88
src/rules/cloud__aws__cloudtrail__aws_ec2_import_key_pair_activity.eql,sha256=sGjPCbtIQfn4qFNhKg3cE6WjWDgBM_cs-Xjp09ZmCPQ,72
src/rules/cloud__aws__cloudtrail__aws_ec2_startup_script_change.eql,sha256=x8nFu3TFRRcbJPOS2JAuZwDeCyDmkS2H-oZOhwlbdhQ,125
src/rules/cloud__aws__cloudtrail__aws_ec2_vm_export_failure.eql,sha256=5KAopDEkadAwmKHk46KqbyOE8sBc6QfZHRs8INCVA4M,163
src/rules/cloud__aws__cloudtrail__aws_ecs_task_definition_cred_endpoint_query.eql,sha256=LtQZR5i4CXLJ-jh4xsXAkUSHZ7n0kXl6lyMlVn4ooXA,223
src/rules/cloud__aws__cloudtrail__aws_efs_fileshare_modified_or_deleted.eql,sha256=wqZFZCoWOE1mCKJ9lxN-tf5OUG1fEl91Mb8Z0jjqOI8,89
src/rules/cloud__aws__cloudtrail__aws_efs_fileshare_mount_modified_or_deleted.eql,sha256=4N7Ui-fW0rtfnPEOGY5VoZip817V9oFkXCblOK9dO6k,90
src/rules/cloud__aws__cloudtrail__aws_eks_cluster_created_or_deleted.eql,sha256=H2kQtbPT2mqtMmCUpIyx1aEMbzlNVuSfsE6IzoGBn5U,99
src/rules/cloud__aws__cloudtrail__aws_elasticache_security_group_created.eql,sha256=8xtyoh9b1NZORFbJYILB6aGksZTCoCx4wVnzn83Mi_c,91
src/rules/cloud__aws__cloudtrail__aws_elasticache_security_group_modified_or_deleted.eql,sha256=Pp47v865Iai40CRqR8DE-YPkP4gMUPXTvcVTCqj92Ec,245
src/rules/cloud__aws__cloudtrail__aws_enum_buckets.eql,sha256=x0AFvSg8ZokdbfOVPkkBq6BKNrAeeFzhlUPR9PeH7Jk,113
src/rules/cloud__aws__cloudtrail__aws_guardduty_disruption.eql,sha256=k38xpPNEUwzlus75Fo5tAc-FO9lEQ3LREObl73a6ehQ,76
src/rules/cloud__aws__cloudtrail__aws_iam_backdoor_users_keys.eql,sha256=Jo59XkYb_56L0eP8BDFqY3wTST2YEVOUs75zL1CcLDE,143
src/rules/cloud__aws__cloudtrail__aws_iam_s3browser_loginprofile_creation.eql,sha256=kitov1-fjROryZStfRlpIuurM_fdCb2koHd588YJ4oY,135
src/rules/cloud__aws__cloudtrail__aws_iam_s3browser_templated_s3_bucket_policy_creation.eql,sha256=5fjojwhe8U88MsLwQfL4yTgVKY00M51vcknEuAKWZzA,246
src/rules/cloud__aws__cloudtrail__aws_iam_s3browser_user_or_accesskey_creation.eql,sha256=5dEtTG81DhllJZe39DJ69gf3_z7ZO9fM0IVbo727JIQ,127
src/rules/cloud__aws__cloudtrail__aws_kms_import_key_material.eql,sha256=MjUKgFTrW3UpHKic7lk5B-0Z5hq5VqtuSGlIdfTcpO0,115
src/rules/cloud__aws__cloudtrail__aws_lambda_function_url.eql,sha256=XNcGQJp_KtU-Ah6NtkqJgU_-CdDWWGg22rThkTPXPnI,85
src/rules/cloud__aws__cloudtrail__aws_new_lambda_layer_attached.eql,sha256=pqhdpZ8i0t6c5OK8iHo6z_lBGGH7CdsLTcmRzrAY54w,123
src/rules/cloud__aws__cloudtrail__aws_passed_role_to_glue_development_endpoint.eql,sha256=HVHQu9pLeEmfTWN_bw2J4lqhSGiJPA5MGTESwu0Qnxk,129
src/rules/cloud__aws__cloudtrail__aws_rds_change_master_password.eql,sha256=sOQF53yDutlsb3XGh-FImNEbRl6IPrx6QBiH6p3zcdk,141
src/rules/cloud__aws__cloudtrail__aws_rds_dbcluster_actions.eql,sha256=D3itjh5Yi42MeAMfZG6h47MYZSaLKmqPiSkyT2waiGE,103
src/rules/cloud__aws__cloudtrail__aws_rds_public_db_restore.eql,sha256=52_L-p0HI2nfXT8XpzZB-JaDmHN7_KrJOWbmlPRuyv8,137
src/rules/cloud__aws__cloudtrail__aws_root_account_usage.eql,sha256=FdvTAhOsaSKApmiApeBj61MSTCZwpTy36fFucv26EXo,73
src/rules/cloud__aws__cloudtrail__aws_route_53_domain_transferred_lock_disabled.eql,sha256=MADjfH3MrFVM7HiiHw6q0S0juTEjn8YtcvSplTiE-JM,88
src/rules/cloud__aws__cloudtrail__aws_route_53_domain_transferred_to_another_account.eql,sha256=jak7tfy8mxdqSe0lxlAn2g0pOAMGawjai6ruveWNQMs,96
src/rules/cloud__aws__cloudtrail__aws_s3_data_management_tampering.eql,sha256=csrIfvFs5leg4fYt0BiV7uMFl5w6pFlgiGFdq3tbWBc,230
src/rules/cloud__aws__cloudtrail__aws_securityhub_finding_evasion.eql,sha256=d6GD6uGKn3Y31y33OPK40PTQ0oE-W_37U8pHeOMSmps,148
src/rules/cloud__aws__cloudtrail__aws_snapshot_backup_exfiltration.eql,sha256=nKwu1NIoS62F2fd_OPV0W2HX5ASl8Uf44wO_Slm9KH0,82
src/rules/cloud__aws__cloudtrail__aws_sso_idp_change.eql,sha256=-klePNQljbC1QsnHyxFwJ_v0olrhUHuukjqjJjJnhZQ,246
src/rules/cloud__aws__cloudtrail__aws_sts_assumerole_misuse.eql,sha256=7E5MhPext2JCrtud-GCG_c0WKmnk2LgjCpXi90ACpog,100
src/rules/cloud__aws__cloudtrail__aws_sts_getcalleridentity_trufflehog.eql,sha256=ZtR3iLJFEOF-kNsyy307hsgmwiTtBwhdEcjMloZEiAU,105
src/rules/cloud__aws__cloudtrail__aws_sts_getsessiontoken_misuse.eql,sha256=BFrSJ6KIuaczhRx_OKNNrTXuKRTJ2ZclES-pq0irrEY,106
src/rules/cloud__aws__cloudtrail__aws_susp_saml_activity.eql,sha256=Yey3OxIEl1LjW9pSV8UVl-ba9RPAqpt2L-naMPj8GaI,151
src/rules/cloud__azure__activity_logs__azure_aadhybridhealth_adfs_new_server.eql,sha256=azGhJliBadeIlLW8Uv3ctZGEA-F4qcvPtKMVLkfvWMo,228
src/rules/cloud__azure__activity_logs__azure_aadhybridhealth_adfs_service_delete.eql,sha256=eCIOE3riwsrs9p0zRS8hanEX3Kh_OR8RhlwWryDT89s,213
src/rules/cloud__azure__activity_logs__azure_ad_user_added_to_admin_role.eql,sha256=27JtAhgyqOkEkGMLOHF1DnC9aE0n-Phku-KRyTeNglw,150
src/rules/cloud__azure__activity_logs__azure_application_deleted.eql,sha256=SNqmc2CSJZB4j0D-B70DiW4RVNrA2u3BppqB4iEOtFA,85
src/rules/cloud__azure__activity_logs__azure_application_gateway_modified_or_deleted.eql,sha256=zoIF2XKjG_VR9AbQcvTiXu23U1OrSS01LVbs1kmN8VE,126
src/rules/cloud__azure__activity_logs__azure_application_security_group_modified_or_deleted.eql,sha256=WZ3ApuxiWm_GSyi7S8lhI4oZ13vtu4neXJFIH-ZzOxY,138
src/rules/cloud__azure__activity_logs__azure_container_registry_created_or_deleted.eql,sha256=gflbBTekLDdH9hxwsEoUtAA6vOYhr7o6iF0AWGgv_gk,128
src/rules/cloud__azure__activity_logs__azure_creating_number_of_resources_detection.eql,sha256=rYE1ymX-wNXMlNa52XoXGKVqjO7oOLBXQg2sRN2tBy0,95
src/rules/cloud__azure__activity_logs__azure_device_no_longer_managed_or_compliant.eql,sha256=ceqjHFSEwWBNZiF2eBCAPYBT_CfU0XaUUbKs6I5nzXU,94
src/rules/cloud__azure__activity_logs__azure_device_or_configuration_modified_or_deleted.eql,sha256=tFNYaRg9IKY3RjkNtvuTpvW_KFG-pqpJoFi3uvPmHfU,132
src/rules/cloud__azure__activity_logs__azure_dns_zone_modified_or_deleted.eql,sha256=i7gtu3K4x4pDslbP-2s8h2m2EcwsMTnuJoYiTms3vyY,104
src/rules/cloud__azure__activity_logs__azure_firewall_modified_or_deleted.eql,sha256=lYuCmAdId-H-nfCNYtV8-UMN2lIW4LDLDqfxM6cYeA4,116
src/rules/cloud__azure__activity_logs__azure_firewall_rule_collection_modified_or_deleted.eql,sha256=SwnaMYN_6eAeEgerWqsu_CkhKTx670uv_LffIV7PS5Y,424
src/rules/cloud__azure__activity_logs__azure_granting_permission_detection.eql,sha256=kK-FYNcZUglkJAvCFONKx6gXsQKmthKFIR6pSXc74NA,58
src/rules/cloud__azure__activity_logs__azure_keyvault_key_modified_or_deleted.eql,sha256=4JjLAP9NLoT5sQhcrasq24W-qFA3qGWR1hYG2j2ZTho,450
src/rules/cloud__azure__activity_logs__azure_keyvault_modified_or_deleted.eql,sha256=LhOvMGI_fIS7QGyChNtBoFqT-dcTflKP_p54W802R5c,195
src/rules/cloud__azure__activity_logs__azure_keyvault_secrets_modified_or_deleted.eql,sha256=wp_kksU1Ya45K8MLMT4LHNnrqX6tCndtrb5Mm4leLr8,428
src/rules/cloud__azure__activity_logs__azure_kubernetes_admission_controller.eql,sha256=yA29yrny-AduqawCSlFHEczCkeorEzxbbDg_GrObJy8,292
src/rules/cloud__azure__activity_logs__azure_kubernetes_cluster_created_or_deleted.eql,sha256=ISaPhXUrmqHINgGUiuRGZ2bz_xtHLGeIfkNFllhDQUI,128
src/rules/cloud__azure__activity_logs__azure_kubernetes_cronjob.eql,sha256=L0Zz9ItPwoQs2fB_s_zA_j8xOOIlfqcJZwH-O_qvqgg,198
src/rules/cloud__azure__activity_logs__azure_kubernetes_events_deleted.eql,sha256=KXSxrvXWblzlWov4OnMYpFKgi7tMQeIsTXiHd9QJK-0,93
src/rules/cloud__azure__activity_logs__azure_kubernetes_network_policy_change.eql,sha256=vMn9f4DCgnjI9SqQsGAJjnOGLocs3HITY-XTzLPD_PI,347
src/rules/cloud__azure__activity_logs__azure_kubernetes_pods_deleted.eql,sha256=H3q9Y1iZgfr0r-I4-V8xkAD9y0pMzToFuIZ5uaVeq9Q,77
src/rules/cloud__azure__activity_logs__azure_kubernetes_role_access.eql,sha256=VlaccxLI2ddHJ93kXiTuo4bPhENh3Ch8srkXnEqhvrg,733
src/rules/cloud__azure__activity_logs__azure_kubernetes_rolebinding_modified_or_deleted.eql,sha256=yH3Zz5PjoDejH8oI3jULHqNUljlHvvPQbqtqxpAKVok,395
src/rules/cloud__azure__activity_logs__azure_kubernetes_secret_or_config_object_access.eql,sha256=A0nZEXu2RMHmkazrAEVNq_00ambtQ5FgTYQG6xXxiCM,263
src/rules/cloud__azure__activity_logs__azure_kubernetes_service_account_modified_or_deleted.eql,sha256=yfIYJOvnj_6SbCFo4cbGCg2cH78Dr1bBU9KcgA88MH0,237
src/rules/cloud__azure__activity_logs__azure_mfa_disabled.eql,sha256=zk4QfugIjhx2I-f906dO9LB4YH8rXf3gmaEdLaUyUjk,113
src/rules/cloud__azure__activity_logs__azure_network_firewall_policy_modified_or_deleted.eql,sha256=-A3bvx9q8rooD1djRUuEyOqi6q3Db1A9dXKcVkozkv0,228
src/rules/cloud__azure__activity_logs__azure_network_firewall_rule_modified_or_deleted.eql,sha256=QOpyU31ZkOd_4M4I0eOMz-0_L4Y3E7PiAol2WM0jstk,273
src/rules/cloud__azure__activity_logs__azure_network_p2s_vpn_modified_or_deleted.eql,sha256=NoOat9TSS7p1OwISCmYUQ4oMJSc29odgSVIRtf394kY,388
src/rules/cloud__azure__activity_logs__azure_network_security_modified_or_deleted.eql,sha256=15Hzorw5oUJmHi2U-fdtp-LZml6X3LhCJfC6svVqnaI,409
src/rules/cloud__azure__activity_logs__azure_network_virtual_device_modified_or_deleted.eql,sha256=0YeOHJE66F2bvx6m5Kpu3pd1QQcVcbP9LhzKHB19dtQ,569
src/rules/cloud__azure__activity_logs__azure_new_cloudshell_created.eql,sha256=SqRQWRYkQuFUTR03HtyyzzibsnXfMhSU9HAD4wsLVOY,58
src/rules/cloud__azure__activity_logs__azure_owner_removed_from_application_or_service_principal.eql,sha256=0SkbmaHisIfAZSwjI4u0X6IvMnqff7jzfINabPlEk2o,108
src/rules/cloud__azure__activity_logs__azure_rare_operations.eql,sha256=1somAK_U43SZYAI6mCXisG-TqKdagxm-Y7dZ_xNRg8U,365
src/rules/cloud__azure__activity_logs__azure_service_principal_created.eql,sha256=b_yJAznrOVs60OJbgQrDdOhY6GoLfH5zFW3h44BBL1E,53
src/rules/cloud__azure__activity_logs__azure_service_principal_removed.eql,sha256=g4C3CEyjGdAbWfYptSY_QN7gfj67xKBOg6L_fD1BJwQ,56
src/rules/cloud__azure__activity_logs__azure_subscription_permissions_elevation_via_activitylogs.eql,sha256=yCU2ndRj3VNzSiHgYdpSsO3fCoB0bZ7rTTCgjQ1ISGQ,71
src/rules/cloud__azure__activity_logs__azure_suppression_rule_created.eql,sha256=36RdderUywQsR52D-LdvxVEWuQP5eGmtYiOpeap6Sds,74
src/rules/cloud__azure__activity_logs__azure_virtual_network_modified_or_deleted.eql,sha256=kyHpCCC_Iu6xsaj4OlAzLIL_pOoo4aPfcrQXzFv_lsQ,168
src/rules/cloud__azure__activity_logs__azure_vpn_connection_modified_or_deleted.eql,sha256=f_G_hT1NCEQb8uB0I5_liKObN_NjBSSWLQxWpdGPP3c,140
src/rules/cloud__azure__audit_logs__azure_aad_secops_ca_policy_removedby_bad_actor.eql,sha256=63vMeEU-SJc1_VQb3ompKXgU_45eiA1lf6cFfVeeWjE,64
src/rules/cloud__azure__audit_logs__azure_aad_secops_ca_policy_updatedby_bad_actor.eql,sha256=2j2yG99ZvNpScfIxtfQAMXSjmtCemHYZOpIrgwQUrFU,64
src/rules/cloud__azure__audit_logs__azure_aad_secops_new_ca_policy_addedby_bad_actor.eql,sha256=iHbonbFM1JgdO7zlyKhIo0rI3j-5Vn8vHaA1wPU_qK0,61
src/rules/cloud__azure__audit_logs__azure_ad_account_created_deleted.eql,sha256=BOK2d5wv46lmrhypNTT37KSM0CVvigKp3nfTAcgVz58,86
src/rules/cloud__azure__audit_logs__azure_ad_bitlocker_key_retrieval.eql,sha256=Q7p35-0FBMjWoX93DDRpdERfRBX01nCYjQxHnSMHXeY,74
src/rules/cloud__azure__audit_logs__azure_ad_certificate_based_authencation_enabled.eql,sha256=9Ymfw4SADb_jdvB5a7-gZwoPBxYWl6kY7Z_PIyAVzv0,134
src/rules/cloud__azure__audit_logs__azure_ad_device_registration_policy_changes.eql,sha256=VILsvhHE60b-Lk6aBRl2-9HfLbwc-u07lykf1UnR07Q,87
src/rules/cloud__azure__audit_logs__azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.eql,sha256=biF8WhTLyoJiSP2nsFKBqij52QSrNJ4KsvKM_mgFAH0,150
src/rules/cloud__azure__audit_logs__azure_ad_new_root_ca_added.eql,sha256=nnHTQbpO_gZOVNAEL9rgo7fR_ShygpAqGqmqBVLDfy8,132
src/rules/cloud__azure__audit_logs__azure_ad_users_added_to_device_admin_roles.eql,sha256=15fXTCMvF_Ns73vVKauDTVvyNBz8zXdvKotoszfZOi0,214
src/rules/cloud__azure__audit_logs__azure_app_appid_uri_changes.eql,sha256=rnmLpNVoMsy_g30L5LfGaj5BCZpV93UtgGaL4Vkq-Os,86
src/rules/cloud__azure__audit_logs__azure_app_credential_added.eql,sha256=flOQbD5h3Mn1kCm_hhiSGEbXsTexLr25KZ-RJE0V7ww,145
src/rules/cloud__azure__audit_logs__azure_app_delegated_permissions_all_users.eql,sha256=-gN1p8OCD7auMtUX7D_Y_R63Mr2aHRoDQQS67diJ5xQ,62
src/rules/cloud__azure__audit_logs__azure_app_end_user_consent.eql,sha256=Cldec9Kqn9PmszsAH30gC9qNGkJdRSsLMTkHSxwJLLI,48
src/rules/cloud__azure__audit_logs__azure_app_end_user_consent_blocked.eql,sha256=egIZjR2qG6bk-Vq-qRa01ct2uY1CcqaG-7a3qVw-1_Q,101
src/rules/cloud__azure__audit_logs__azure_app_owner_added.eql,sha256=4GGM8VTSiIIGjWCw5zJJ1l-k_g_bNLm-VJIcNKqeNfo,56
src/rules/cloud__azure__audit_logs__azure_app_permissions_msft.eql,sha256=kK7py8P1lkWYvqUtutN18f9M6hLsA56-WxskttM8Y-A,118
src/rules/cloud__azure__audit_logs__azure_app_privileged_permissions.eql,sha256=9XDTz5FplU3OrsqKc0MUKq2YXN-1IMeZPPUPZSAScEk,76
src/rules/cloud__azure__audit_logs__azure_app_role_added.eql,sha256=CqRmOLoXUVwxEMlBPTxxLbBBRJiA4WPOFtt7K9dUWww,165
src/rules/cloud__azure__audit_logs__azure_app_uri_modifications.eql,sha256=vqhxBczdBF8qVTjUjvBFjFurgguVHrY3QMYTWJ4EI70,83
src/rules/cloud__azure__audit_logs__azure_auditlogs_laps_credential_dumping.eql,sha256=bYdKxuh8_C1Bvkn7k0yORNmqeSd_ITaKPaaN5FzFrOw,187
src/rules/cloud__azure__audit_logs__azure_change_to_authentication_method.eql,sha256=hSoxhtXGknf9b6hXfBSUgVE5va1EUaPujB0qAAnToDk,131
src/rules/cloud__azure__audit_logs__azure_federation_modified.eql,sha256=dyRlVTLSGXSVvbiw590ShFOQUK_DFLvPZ8NX6yC6UAk,66
src/rules/cloud__azure__audit_logs__azure_group_user_addition_ca_modification.eql,sha256=rvtFSjOyOYLA27pzy3C-uIh-pAWqT4qUOd4hx61n1Ek,53
src/rules/cloud__azure__audit_logs__azure_group_user_removal_ca_modification.eql,sha256=a0u0uIPs_rLR7iiGZ_uTDhsnJb2OfpLF12ERq88FXtw,56
src/rules/cloud__azure__audit_logs__azure_guest_invite_failure.eql,sha256=39pHLP2y6WW__KiePEHOqrsoezcJs9Afub8AS9qqIow,73
src/rules/cloud__azure__audit_logs__azure_guest_to_member.eql,sha256=Pla9atQpyGHSBgijBaUfN6COKXyiG-CtzuyeZmN-or8,189
src/rules/cloud__azure__audit_logs__azure_pim_activation_approve_deny.eql,sha256=X76C8BWAkFSqsUSfDsqqcFhDQ8t3DSy4VBO_KwbjTlM,55
src/rules/cloud__azure__audit_logs__azure_pim_alerts_disabled.eql,sha256=GuNl8d6x0NQ_zpJIFFXa0Uy-IdQQkV6IbiLxb3UUadc,49
src/rules/cloud__azure__audit_logs__azure_pim_change_settings.eql,sha256=0h1ebuSgCwe9Z1r6cnGUE1BsLb_MJdJMSPwmQgG9OpY,58
src/rules/cloud__azure__audit_logs__azure_priviledged_role_assignment_add.eql,sha256=4QLq-Rn1qd42EK2IdIpjRwONirUFHXEIuE7zilaDpJM,105
src/rules/cloud__azure__audit_logs__azure_priviledged_role_assignment_bulk_change.eql,sha256=fudxoPqyI3cpprP0JmZklgGob0EaKYCyVcxx9UkbrQw,111
src/rules/cloud__azure__audit_logs__azure_privileged_account_creation.eql,sha256=DP-2A-Jg6-meUu6chxSFZwUaUhT2UBB-0VCT4vS0uls,111
src/rules/cloud__azure__audit_logs__azure_subscription_permissions_elevation_via_auditlogs.eql,sha256=_00nTXpetgZwUK-CNq2BCD_SFRn7heAK2Cm8vGLoUoM,96
src/rules/cloud__azure__audit_logs__azure_tap_added.eql,sha256=GRdODGpqtEhSiXz2fQMVnKcAoQh86BTYax8nlV_AlyM,130
src/rules/cloud__azure__audit_logs__azure_update_risk_and_mfa_registration_policy.eql,sha256=cFIw9moDBrMR-SFeGKp9Wttoqeux1zAMDh6Tmr-SGuY,133
src/rules/cloud__azure__audit_logs__azure_user_account_mfa_disable.eql,sha256=gVEsqP5EHOebx9-i9wFf8HswMgSuoCAfkYEu4U8Vncs,252
src/rules/cloud__azure__audit_logs__azure_user_password_change.eql,sha256=ktCWSkBpE20hzVcS83qLxDSf_DEKd_bLrlCmm_zTiYo,138
src/rules/cloud__azure__identity_protection__azure_identity_protection_anomalous_token.eql,sha256=ilEQ2-DkElnp3G-D0w7XCfOeHsjGlHlsrSUlc_LawXc,41
src/rules/cloud__azure__identity_protection__azure_identity_protection_anomalous_user.eql,sha256=FYMPqXcXAcaGu8apBHwfZDQAxnDHaJib93NOEtQno7M,48
src/rules/cloud__azure__identity_protection__azure_identity_protection_anonymous_ip_activity.eql,sha256=VOkuc1SB0bnVjtSfAGrnoeDSRtY9Gi5FlOt9LOFEHhE,41
src/rules/cloud__azure__identity_protection__azure_identity_protection_anonymous_ip_address.eql,sha256=MTIbREiSL2T-eX6_RzAGmH8q8b3kClF30N-no5wyZwg,46
src/rules/cloud__azure__identity_protection__azure_identity_protection_atypical_travel.eql,sha256=fhWxUZVhuMxeh1RvifaaIh5RKqCRed4Vl4spshn8O9M,41
src/rules/cloud__azure__identity_protection__azure_identity_protection_impossible_travel.eql,sha256=WUd_f5aTYyOovN8zzci-cpHAjbdx-jGTrboYGAi_3w4,43
src/rules/cloud__azure__identity_protection__azure_identity_protection_inbox_forwarding_rule.eql,sha256=UhrcGDEpcSNCASR5beTiZPzHLIAfTRNTTM0UU-sW4Dw,52
src/rules/cloud__azure__identity_protection__azure_identity_protection_inbox_manipulation.eql,sha256=GFvE-Vx6eG8UdK5dVyj5CTGaoeyGuWqn1Z1jV8rSfIE,63
src/rules/cloud__azure__identity_protection__azure_identity_protection_leaked_credentials.eql,sha256=BixsADQYYsYEA-kprKbECT9_0CSQdqrOEE90jh7Ub9A,44
src/rules/cloud__azure__identity_protection__azure_identity_protection_malicious_ip_address.eql,sha256=5sW2GzwOWYyxjtG4xhThUfKeXtDRf7bCAswZUlM99tc,45
src/rules/cloud__azure__identity_protection__azure_identity_protection_malicious_ip_address_suspicious.eql,sha256=fhU6UE0qO2rW190Qu85q3I67tOlPAC3J3stcFIu6dSA,46
src/rules/cloud__azure__identity_protection__azure_identity_protection_malware_linked_ip.eql,sha256=FT64aN48yJUe89TqTJJujmObAXGIeegon7AWUBOWbec,51
src/rules/cloud__azure__identity_protection__azure_identity_protection_new_coutry_region.eql,sha256=v-zU5F0X3-bvpNTFyFB70DDyXm9OMOancKedHi-Hf6A,37
src/rules/cloud__azure__identity_protection__azure_identity_protection_password_spray.eql,sha256=FTBx9ptTLuTR9Lk3Vhg18zjqLhMzIJSTEFSHmQy5F4E,40
src/rules/cloud__azure__identity_protection__azure_identity_protection_prt_access.eql,sha256=P21b7bD8TLAouREY5t5_M2L3jNRzw7SMAiEQ01PavAU,45
src/rules/cloud__azure__identity_protection__azure_identity_protection_suspicious_browser.eql,sha256=ZW4_EuZLB_pMbDQlzjUDfg5wCCUwR_BkoXpuWQHP6aM,44
src/rules/cloud__azure__identity_protection__azure_identity_protection_threat_intel.eql,sha256=5aL55g2f177s3UyFObCEQWKgX8XCv1A31VLsgFDt658,59
src/rules/cloud__azure__identity_protection__azure_identity_protection_token_issuer_anomaly.eql,sha256=0t4kx-pnjfBPyJ2wwKabf1oHLiIJhv-_a2Anl244KGk,45
src/rules/cloud__azure__identity_protection__azure_identity_protection_unfamilar_sign_in.eql,sha256=8aqdIdxNvyJWfsrmLUL3M0UlbVHcpzEs0ZjSGi22h5E,45
src/rules/cloud__azure__privileged_identity_management__azure_pim_account_stale.eql,sha256=VDlCZCt3GPl-ulkLlzCWt7CBBHMJfGrf647sF-KlVmo,51
src/rules/cloud__azure__privileged_identity_management__azure_pim_invalid_license.eql,sha256=zsBiouwt3l0KfQ6RzWqXYnhxRi6fqvATj7xZg6tQE5s,54
src/rules/cloud__azure__privileged_identity_management__azure_pim_role_assigned_outside_of_pim.eql,sha256=EDvLKGD_dHORoBPHFokS3BrhLFSxA_fwOI5CEF8cxkU,93
src/rules/cloud__azure__privileged_identity_management__azure_pim_role_frequent_activation.eql,sha256=GrdmBdZxvZ7KUXiSM_MSPt8HVcyshfXupMZ0BNDA5rY,68
src/rules/cloud__azure__privileged_identity_management__azure_pim_role_no_mfa_required.eql,sha256=YzAygQzuv9ENvNUTBCGPOntevHaeYBOPMH2-XMAFb_k,61
src/rules/cloud__azure__privileged_identity_management__azure_pim_role_not_used.eql,sha256=p9W2AZTeZ6i9oAcCnmmO5OKdaqzHqI4JnRxqYTu2HDA,59
src/rules/cloud__azure__privileged_identity_management__azure_pim_too_many_global_admins.eql,sha256=8_2KqxiABnPXl7ZOohBRfhDglRXVaGO7askOi_oubak,75
src/rules/cloud__azure__signin_logs__azure_account_lockout.eql,sha256=urQauhkU6uXbeGCjhI8Z0hgHhThmKjUt9GaBHrsRtUw,27
src/rules/cloud__azure__signin_logs__azure_ad_auth_failure_increase.eql,sha256=Y6sHfIR0Ls1dvh1iV7ButjubY7Q4ZjlPUoHKvHznLvE,44
src/rules/cloud__azure__signin_logs__azure_ad_auth_sucess_increase.eql,sha256=9FPsIZi35zuZXHtUiZnRqKpG2NI2_iF6j8IJIacl9do,44
src/rules/cloud__azure__signin_logs__azure_ad_auth_to_important_apps_using_single_factor_auth.eql,sha256=VBoRjtfYBrXWwhYqBujnzNEMtcghrJHz4mNkt50Gzzw,140
src/rules/cloud__azure__signin_logs__azure_ad_authentications_from_countries_you_do_not_operate_out_of.eql,sha256=ZPBxxgiJ1gXV1LVy2JtUZmQPp2ovUKiidu44drwBecI,112
src/rules/cloud__azure__signin_logs__azure_ad_azurehound_discovery.eql,sha256=0_7K1_kQie9TL9jfRJAMJ3KliXCw0n5Bl8APM4OMsmo,52
src/rules/cloud__azure__signin_logs__azure_ad_device_registration_or_join_without_mfa.eql,sha256=G2TIEyOXJ47Wl0kE2JGlaXJ7Y1f8fwJIAno8NcPc8yc,164
src/rules/cloud__azure__signin_logs__azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.eql,sha256=Ok9U-jx2gr2SQ5cNYiIEvkgm0bQ8wXRRB7pX40F-azA,118
src/rules/cloud__azure__signin_logs__azure_ad_only_single_factor_auth_required.eql,sha256=wL8PPs-_-XARzxGhvATohlGfw9JliAoX4TZKOSON9BQ,86
src/rules/cloud__azure__signin_logs__azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.eql,sha256=HjWknMYD4OujyZXkc2h-7x-1_y3H_JBlE5Ve6zSxqQs,181
src/rules/cloud__azure__signin_logs__azure_ad_sign_ins_from_noncompliant_devices.eql,sha256=bzjDpVylpNIS1120UnqT9IFVW8u1xCw8-v0qZpqAx14,43
src/rules/cloud__azure__signin_logs__azure_ad_sign_ins_from_unknown_devices.eql,sha256=UQw_oqXwu35Y7-e0Rr659OBYSLQbSezkQpLZ0tYzChg,144
src/rules/cloud__azure__signin_logs__azure_ad_suspicious_signin_bypassing_mfa.eql,sha256=3IYoVkGlZ-r7k-cMq-FGoJL62_fjMGHbz4e4KDjomwc,93
src/rules/cloud__azure__signin_logs__azure_app_device_code_authentication.eql,sha256=7cj3vn-fOOppR9StZqf9kfc3Lkky3bdUtzOIXbU7Nl8,43
src/rules/cloud__azure__signin_logs__azure_app_ropc_authentication.eql,sha256=YQw9YkV5LU6gqMed_j0FdIP3x_I8Y6lv6D5fRa2yMcY,36
src/rules/cloud__azure__signin_logs__azure_blocked_account_attempt.eql,sha256=x5BEDU1--K84GJ7qjE4Je3VvcybIplPVriA7yo-iryU,59
src/rules/cloud__azure__signin_logs__azure_conditional_access_failure.eql,sha256=kVhtTTd1iltQs6p2fvj0m1mKGzBzmi0blYbZCgviVOU,81
src/rules/cloud__azure__signin_logs__azure_legacy_authentication_protocols.eql,sha256=sawbqcimwz55riCrjEfLOtQF-CmsPYBVT7-vY73OsmY,175
src/rules/cloud__azure__signin_logs__azure_login_to_disabled_account.eql,sha256=rRvr8lSMo1T2UBUr9kCJ9GRI2n0vCky6VeeRGva2Xz8,128
src/rules/cloud__azure__signin_logs__azure_mfa_denies.eql,sha256=0kvM2Lnzuh8PvO_DKkIyn_D69vByfC1-MLtSPepHzEw,90
src/rules/cloud__azure__signin_logs__azure_mfa_interrupted.eql,sha256=V4nXjKQphONs3ybXR7qgzZVsXtLyStJqQk1Jzrbp42s,184
src/rules/cloud__azure__signin_logs__azure_unusual_authentication_interruption.eql,sha256=Hj7PZN7yYkhSj9lrp6LQkSHeIEaVWVtu1SsPyZ0ygXc,280
src/rules/cloud__azure__signin_logs__azure_user_login_blocked_by_conditional_access.eql,sha256=lvpBRWMTOxI4tKiOJcDreuyQBVSStRMaI0TvlnoEa-c,27
src/rules/cloud__azure__signin_logs__azure_users_authenticating_to_other_azure_ad_tenants.eql,sha256=12CldDz_24U59SY1RdSP_k1kBJ3_fB_PiVH2kUV3FDU,105
src/rules/cloud__gcp__audit__gcp_access_policy_deleted.eql,sha256=9sPXPFgLYFVXXDfpBzfbvAfk1_qieZM12aY6IIBubRo,422
src/rules/cloud__gcp__audit__gcp_breakglass_container_workload_deployed.eql,sha256=uaxerHQerQpFAMpcOz9fFQv5QDH8xwiQ_26nUZDBxsk,275
src/rules/cloud__gcp__audit__gcp_bucket_enumeration.eql,sha256=YS0Nwls1-RbpumUD6sZbNsdLUtlYhvGdRvjMw1vyxNA,95
src/rules/cloud__gcp__audit__gcp_bucket_modified_or_deleted.eql,sha256=AW76sbfoiAq0bWIOSqJ6rbBMsQHdyHNU4LwvPAIoacs,142
src/rules/cloud__gcp__audit__gcp_dlp_re_identifies_sensitive_information.eql,sha256=Ay23TU8b7o_2Nt_vcVIbLkHho_yk-i2APO-8-bmvxwk,62
src/rules/cloud__gcp__audit__gcp_dns_zone_modified_or_deleted.eql,sha256=lATPB4G00uGHc7Dx9rTGc3_QNF6c5x5YgtVUoCNRcGE,119
src/rules/cloud__gcp__audit__gcp_firewall_rule_modified_or_deleted.eql,sha256=U6mJx_9YK-hSZ7pZcBS3i8uploPUvYNTz7ueDlvFjpY,162
src/rules/cloud__gcp__audit__gcp_full_network_traffic_packet_capture.eql,sha256=1ERmH-7gF2nHCFcyrTdA4kKaLCcOAMfYn8F6EzNObkg,269
src/rules/cloud__gcp__audit__gcp_kubernetes_admission_controller.eql,sha256=2zSgDdIpoXCX6KSedHM-C5k6wm4bb9Y6TNMtzvmehks,245
src/rules/cloud__gcp__audit__gcp_kubernetes_cronjob.eql,sha256=Dx_LZ8VdWWYiyFmeyCv2N4tEtQ7aaah7Bj2JB0rB49M,97
src/rules/cloud__gcp__audit__gcp_kubernetes_rolebinding.eql,sha256=sNOGLLEcjxU8L0LA73SqkewpsB77af7jUIKY3fUZe18,481
src/rules/cloud__gcp__audit__gcp_kubernetes_secrets_modified_or_deleted.eql,sha256=9Nlx5ttsIS7jWMWD1Sk7BPf-RznjwNju0TMN5P2ciVE,170
src/rules/cloud__gcp__audit__gcp_service_account_disabled_or_deleted.eql,sha256=4fxW1vFdARG8tc_-G4PGqjjuQflbTKy9DwjgoHR-6Is,96
src/rules/cloud__gcp__audit__gcp_service_account_modified.eql,sha256=Q_XjL2Qg7JqWkb-em2VDg4Zr6EBZ9uVk_UxyvrmbKj8,180
src/rules/cloud__gcp__audit__gcp_sql_database_modified_or_deleted.eql,sha256=oj1qIEJMke3UNeBiGO-WFEiayxyER99kQrClvuEMkSA,147
src/rules/cloud__gcp__audit__gcp_vpn_tunnel_modified_or_deleted.eql,sha256=Y2O_f24V_0hNL-cj1L2ha6UWzDYFPK0Ek9lXwRH7vyA,97
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_application_access_levels_modified.eql,sha256=oo5PeOj3iwNQwLGpRUb5Kupj81If8yKCSvyYf0LEN5w,128
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_application_removed.eql,sha256=Y5yUq0PJzSybLEko3sfA-jgkXHNTJ2n45YqRzN8ijoc,128
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_granted_domain_api_access.eql,sha256=WX4fObD_1V4e6mP4wbOv7bwAdh-kqGaXLVQ9DFzGeOc,90
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_mfa_disabled.eql,sha256=MBJHViECCpiHYu2N443WcuxIk8neyp90mJnaEkLl2N8,157
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_role_modified_or_deleted.eql,sha256=9MnNdeWpuU62ugnde68rR0FzWOfHh3FNJXM_SuElO5k,114
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_role_privilege_deleted.eql,sha256=n5xDupZ3PKKpmrFZgxz08z7HAmqyW3julT3jkFOn-mc,79
src/rules/cloud__gcp__gworkspace__gcp_gworkspace_user_granted_admin_privileges.eql,sha256=CZxX4Sgr-zR4137HBVLN97ZMSrtYRwP4jECDpoBCqeY,130
src/rules/cloud__m365__audit__microsoft365_bypass_conditional_access.eql,sha256=yduCyLqA8wvH5UYm-IKD4BV82EosVomQqdrPPHXiLcg,207
src/rules/cloud__m365__audit__microsoft365_disabling_mfa.eql,sha256=MzK-IczswuT3S0w0xIuznkuIU-tTiT2w9OtrtvTu22A,55
src/rules/cloud__m365__audit__microsoft365_new_federated_domain_added_audit.eql,sha256=oIWzUX5d98Uzk8xodxjgoZLLLXA8tR_HlC0RweIDy5s,72
src/rules/cloud__m365__exchange__microsoft365_new_federated_domain_added_exchange.eql,sha256=EpRShu0VIzUzAI3OOQIMDA_Um5QP9T4uEIvoNOkny3k,90
src/rules/cloud__m365__threat_detection__microsoft365_from_susp_ip_addresses.eql,sha256=Qi23X8ajbDC8tO-DpTOdXZ15Xwve1YR8dOqFlM5wtCQ,124
src/rules/cloud__m365__threat_management__microsoft365_activity_by_terminated_user.eql,sha256=L-Knu_BZtVtHObi1fvu01KVPzGaJUxQ_43D-ZE_0Ij4,124
src/rules/cloud__m365__threat_management__microsoft365_activity_from_anonymous_ip_addresses.eql,sha256=bpQHL11y8FPAOm1BJQ3SATV_iXpey6bl17UrqpQaZKY,123
src/rules/cloud__m365__threat_management__microsoft365_activity_from_infrequent_country.eql,sha256=yp0-cTmNvD5GgAgMNUbto86pBcEj1YOl3YW9VUTJ7rc,119
src/rules/cloud__m365__threat_management__microsoft365_data_exfiltration_to_unsanctioned_app.eql,sha256=Qssw7GKaiFmQ5OkA9Ul5zDhUsDZOURQGVU3hA0mr7yA,125
src/rules/cloud__m365__threat_management__microsoft365_impossible_travel_activity.eql,sha256=UIVWgOi5ZtE8RdLXLIVv9UCeta2F-Bmb_kq6vtlUxWE,113
src/rules/cloud__m365__threat_management__microsoft365_logon_from_risky_ip_address.eql,sha256=w0raf_3uvs4gHMR3ZhAHNUMh1fqiXxdlWTiDS8tPMYA,117
src/rules/cloud__m365__threat_management__microsoft365_potential_ransomware_activity.eql,sha256=1O6HALvGpccCbqiKVAFF3xPMsRp3XS04PK4tMuc2NSc,116
src/rules/cloud__m365__threat_management__microsoft365_pst_export_alert.eql,sha256=6ErYh-Yda5-_ZZhjnoBNDthXc8-wUiRL9QPbQWdqJEc,124
src/rules/cloud__m365__threat_management__microsoft365_pst_export_alert_using_new_compliancesearchaction.eql,sha256=3lDwodbmfnrCyZJSFeqlSDVBauqwiBwIHOIDsNLYEzA,137
src/rules/cloud__m365__threat_management__microsoft365_susp_inbox_forwarding.eql,sha256=QCXOFkCYe25hLO1yJrxD0pNyMHRR4YM1Pkx4l86uGQA,114
src/rules/cloud__m365__threat_management__microsoft365_susp_oauth_app_file_download_activities.eql,sha256=scUoQ9Ydblx3aLNaOElXJ3XRveRVEusKrD72kAhPm9s,132
src/rules/cloud__m365__threat_management__microsoft365_unusual_volume_of_file_deletion.eql,sha256=DPdAMgHfcBI7BXXUHFnBL0QpCugRhcmOpBBuyxMdan8,118
src/rules/cloud__m365__threat_management__microsoft365_user_restricted_from_sending_email.eql,sha256=pPDnwWnKEHelu50UGKsfyJmLCjWLtpeVbwL0bS1VhmY,121
src/rules/convert-eql.log,sha256=ZWgoxqi6eu-iaKVZycgCYP1yU7O3SfT5gmxyCX-RA8g,469361
src/rules/identity__cisco_duo__cisco_duo_mfa_bypass_via_bypass_code.eql,sha256=1QXZIiIEfo2qk3X3CX3iUwSyv48EliihyIwrmUWTico,63
src/rules/identity__okta__okta_admin_activity_from_proxy_query.eql,sha256=vdED_Zd2W2UgEda6B5LH9Uu5Y36srvOmf7vjNUPtBaM,89
src/rules/identity__okta__okta_admin_role_assigned_to_user_or_group.eql,sha256=Gnp2q_pwP2-7PAS0rKvKHARPSncx2SKXszgkZ7FfLmc,84
src/rules/identity__okta__okta_admin_role_assignment_created.eql,sha256=nXSGsdWcYFFJOwYg-zPq5CUyOE7PYnl9HRIhuJtadO4,51
src/rules/identity__okta__okta_api_token_created.eql,sha256=8ZzoH47Rf2VhOjXypl_iZQUNahq34gOsJ83vOqroAXU,46
src/rules/identity__okta__okta_api_token_revoked.eql,sha256=XO8osz4SmW5ZKtd7nLk3YRcjg8YnQBHvh_kMoMwBjCc,46
src/rules/identity__okta__okta_application_modified_or_deleted.eql,sha256=a4qUZOAzW8-DdgQHYw7m76b4mIPqzYcuGms6rG9PXKo,91
src/rules/identity__okta__okta_application_sign_on_policy_modified_or_deleted.eql,sha256=TaZoxx57acKfhqW6zUEYUzZvLmqtdk5GMq67XofYVqs,106
src/rules/identity__okta__okta_fastpass_phishing_detection.eql,sha256=AbKta2hXunUpeJGeda296b05JspwZDsVsZQeWgkVssw,140
src/rules/identity__okta__okta_identity_provider_created.eql,sha256=422YQsZ1MqUPWRdxwVwE_um0P_FGibDBmFQL7yMj4xs,50
src/rules/identity__okta__okta_mfa_reset_or_deactivated.eql,sha256=UxJD3DxbUDiIu1UUCh_wJT_941UqZIfWZA_iq1deSSY,86
src/rules/identity__okta__okta_network_zone_deactivated_or_deleted.eql,sha256=o4Ef9JgEU7pjAY9puiMXGTWQDDzxudSa85Guj2x-91I,61
src/rules/identity__okta__okta_new_behaviours_admin_console.eql,sha256=55lloDPjjiz1xNF4KC6EASqTuWWCUvDoCWDhVOV_AXU,203
src/rules/identity__okta__okta_password_in_alternateid_field.eql,sha256=QbUXKLlibVQ2yfWC-91I5s4eGzb0ToD61Y7Ur_p3gHQ,151
src/rules/identity__okta__okta_policy_modified_or_deleted.eql,sha256=0tI512eqelFVCzmCH1nMDNDyoNJCRAJgrkauatBVLuA,81
src/rules/identity__okta__okta_policy_rule_modified_or_deleted.eql,sha256=a77brtoGvbhnf6LA5yZD71BuQKkC28F0LPUbM8bwFmA,71
src/rules/identity__okta__okta_security_threat_detected.eql,sha256=qAZVKXlkN2QCwHbgTzmyjw-5TLLBr0VR5WRfBj75b1I,47
src/rules/identity__okta__okta_suspicious_activity_enduser_report.eql,sha256=Bv1eUXvfjwxCvpip2LsUdVLquNfRBR8I8j0SR7xoaXI,73
src/rules/identity__okta__okta_unauthorized_access_to_app.eql,sha256=Yl_d_VDmAdiK4Cuk0b30zUGOW4Ds5fo9MpDoFKzLj3I,69
src/rules/identity__okta__okta_user_account_locked_out.eql,sha256=2GPNeBFoEIKRZMPsFItpGllkX26XPkhEuyra2YPoYSM,57
src/rules/identity__okta__okta_user_created.eql,sha256=ST1rDm6WgZm1ck_GxyZLbPhdj2jDzER1D8m4WVYb7Ec,44
src/rules/identity__okta__okta_user_session_start_via_anonymised_proxy.eql,sha256=Ay22tgqIU7Ayy7aJmEGtJDYJfKf_X-dBO-zzEY2XEaU,76
src/rules/identity__onelogin__onelogin_assumed_another_user.eql,sha256=UsmaRqulZr8XAGJm6onGKVuMNtmSf6eVdag-inuT4Y4,26
src/rules/identity__onelogin__onelogin_user_account_locked.eql,sha256=y3CoZhLhchPadHEg1D4QuLV5t2eQ3oAEuq4pD2vqmT0,46
src/rules/linux__auditd__execve__lnx_auditd_binary_padding.eql,sha256=WkjPc38RaPdEzNZtIKPfXwl84Q9SLuvjRAvRikjqad4,90
src/rules/linux__auditd__execve__lnx_auditd_binary_padding.lucene,sha256=GQ-mLt-YmxVbPaoRErdnmqOwqoh8P5eJXoqadXxwoQk,81
src/rules/linux__auditd__execve__lnx_auditd_binary_padding.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_bpfdoor_port_redirect.eql,sha256=2dfGSbfWwJaJgRdC1UtW2jp5X6Qr0iy9ailzNTjBeF8,111
src/rules/linux__auditd__execve__lnx_auditd_bpfdoor_port_redirect.lucene,sha256=RmiglCNKkGykheTgFF8DV88R4iBjKE3svxdfD6MMZ0Q,102
src/rules/linux__auditd__execve__lnx_auditd_bpfdoor_port_redirect.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_capabilities_discovery.eql,sha256=OOovl08KXVADoEGS8qsEmwkDNHoquwN0DDRHuOkADWo,63
src/rules/linux__auditd__execve__lnx_auditd_capabilities_discovery.lucene,sha256=BP2Ohpj1297JC61srL1zM2MjZrxbmYQpfJQTndIepe0,47
src/rules/linux__auditd__execve__lnx_auditd_capabilities_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_change_file_time_attr.eql,sha256=dn__2F-JR1O-oyTwWfD3gt5CUMiShrnIXC_mf-DhI3w,74
src/rules/linux__auditd__execve__lnx_auditd_change_file_time_attr.lucene,sha256=B0Jh19-v4D96YlphZWDxnGQ8J5lW8O8o1pmWYG2zYg4,66
src/rules/linux__auditd__execve__lnx_auditd_change_file_time_attr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_chattr_immutable_removal.eql,sha256=0crW8-wtrKpFruwMcjWv8wJdqi5NUQkOsh-u1EMLAZQ,56
src/rules/linux__auditd__execve__lnx_auditd_chattr_immutable_removal.lucene,sha256=PVcUnR6LiSSgYB-WNe4z_x0Jt7c12DaPt9g4QvGtY8g,41
src/rules/linux__auditd__execve__lnx_auditd_chattr_immutable_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_clipboard_collection.eql,sha256=ZmYMgqDI5kuYoYRB-9qJn-gKUI1UBUZbISukNEbpgGQ,126
src/rules/linux__auditd__execve__lnx_auditd_clipboard_collection.lucene,sha256=T-ObBY9LYhbR5tL8MXHWbDOJ2Xr0hplOFTDrwbC5lgk,97
src/rules/linux__auditd__execve__lnx_auditd_clipboard_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_clipboard_image_collection.eql,sha256=Lid-uCz59-lScOvncPcwgMHljsX6fjS5UoIVRZm8bH0,155
src/rules/linux__auditd__execve__lnx_auditd_clipboard_image_collection.lucene,sha256=-NrQuTQkwaigYmpERmtK-aFBBwl0Bh0O82mW6Rglba8,124
src/rules/linux__auditd__execve__lnx_auditd_clipboard_image_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_coinminer.eql,sha256=ZUePEzegEy1vfj0jKoiKVIMuh0RbacVBhIqQCT1T0GA,175
src/rules/linux__auditd__execve__lnx_auditd_coinminer.lucene,sha256=_gC3CFv0hkHN8zt1efMr8q27T5y-nb67E1bXEFEwLfA,172
src/rules/linux__auditd__execve__lnx_auditd_coinminer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_data_compressed.eql,sha256=LmTr_CXQswxPlzZWeGkO66PGt-hJffelISuKRMGsXqg,130
src/rules/linux__auditd__execve__lnx_auditd_data_compressed.lucene,sha256=niXTyk3o3nJlwvfAKbL9jf2qxVCBmgfVnbh8BKYaGq8,106
src/rules/linux__auditd__execve__lnx_auditd_data_compressed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_data_exfil_wget.eql,sha256=fTMI5jP5nxtxs7UO1KmUKD_gSkNAHbKEkopIfvhbtHY,61
src/rules/linux__auditd__execve__lnx_auditd_data_exfil_wget.lucene,sha256=PiwsWOm0CnlA9gJxOFFEx3n_XIYTFz39n6MbBp_yXzE,49
src/rules/linux__auditd__execve__lnx_auditd_data_exfil_wget.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_dd_delete_file.eql,sha256=bj_bwDQFCAPJnjw2gjuvR5WN08jKlsu63hIIMHrgoT0,90
src/rules/linux__auditd__execve__lnx_auditd_dd_delete_file.lucene,sha256=w2jvd_FruzgiSwjvS-6aLi359JpJxdysK-nGQQrIL14,74
src/rules/linux__auditd__execve__lnx_auditd_dd_delete_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_file_or_folder_permissions.eql,sha256=eWSOK1Hcj3vyyGhc5FMEszLdiKLMN62ygLohAzzr26I,62
src/rules/linux__auditd__execve__lnx_auditd_file_or_folder_permissions.lucene,sha256=6Lde80kCb9_136XXMbe1phhNvwwysUWV9eJGA5_uxtU,42
src/rules/linux__auditd__execve__lnx_auditd_file_or_folder_permissions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_find_cred_in_files.eql,sha256=8L_Ogn267aoGo68Avo4eL5juYKwC5XPpj_9uX1uZ4kQ,52
src/rules/linux__auditd__execve__lnx_auditd_find_cred_in_files.lucene,sha256=9YU7QvqBVFP9ARHm4XzfEWFfWUSFJkmLKfMO85Af1JA,40
src/rules/linux__auditd__execve__lnx_auditd_find_cred_in_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_hidden_files_directories.eql,sha256=bv42TulsljDoELAdXl3-GLImzbtqWhRf_g5cvx7Tw1M,148
src/rules/linux__auditd__execve__lnx_auditd_hidden_files_directories.lucene,sha256=kZ1IkeqbwC9j3R-vr7bXS6aKVGcoDS6eMpWwXEi5YY4,114
src/rules/linux__auditd__execve__lnx_auditd_hidden_files_directories.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_hidden_zip_files_steganography.eql,sha256=eXI_tpQay7Muyez8k7H7p0Ev21TUyyHpFDW40SY1uOc,88
src/rules/linux__auditd__execve__lnx_auditd_hidden_zip_files_steganography.lucene,sha256=jZHRaPStAgkADrMMbQOPmaww1ZtURVesmbmjxS-HeNM,64
src/rules/linux__auditd__execve__lnx_auditd_hidden_zip_files_steganography.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_masquerading_crond.eql,sha256=1K6P44Be98jQfVyx3ONcWUQTNtOWu6sI-dw3l60KVR4,70
src/rules/linux__auditd__execve__lnx_auditd_masquerading_crond.lucene,sha256=9qB68cuDO35Hh0mHGYVW25YFww_yHWgc1NB1Sknm0IA,55
src/rules/linux__auditd__execve__lnx_auditd_masquerading_crond.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_modify_system_firewall.eql,sha256=WkK5e4SgKn13iNHN99Z3WiOjURzY91EpeedVe3Za1V8,240
src/rules/linux__auditd__execve__lnx_auditd_modify_system_firewall.lucene,sha256=euCC1cA8DtQosUMkQs1a47L0Y4BAk1YLIPkOdrfpZnM,201
src/rules/linux__auditd__execve__lnx_auditd_modify_system_firewall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_network_sniffing.eql,sha256=5OTus2chSL0FmNSsugpyIhQhgT3QSnK1l6TiKrP1Q5c,128
src/rules/linux__auditd__execve__lnx_auditd_network_sniffing.lucene,sha256=aeS7ZepiOHJb7TPXZ6i74C7hGVr4dDa0Rz6hyl8Ok2Y,106
src/rules/linux__auditd__execve__lnx_auditd_network_sniffing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_screencapture_import.eql,sha256=_DsqR01KMKOfrphSoiZPlEmc35qCg3VyPADVyFsQnbA,164
src/rules/linux__auditd__execve__lnx_auditd_screencapture_import.lucene,sha256=E_AkehpdHfR4Hr6yOKfWZo1_8yKDfsHlYgprGTSDyBQ,131
src/rules/linux__auditd__execve__lnx_auditd_screencapture_import.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_screencaputre_xwd.eql,sha256=jFQZko_Eoxz6B8LJf8hqtMG1AMQ3_swt_xp1WRKTzHc,117
src/rules/linux__auditd__execve__lnx_auditd_screencaputre_xwd.lucene,sha256=ncNouUWPPt8ZuILRj-6i60VT6m_5CjK010NMCc0YvGo,96
src/rules/linux__auditd__execve__lnx_auditd_screencaputre_xwd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_steghide_embed_steganography.eql,sha256=t-Y-XQR2FSG-Uy38OzNUc5aUdvBjrhDsDqZaPUTDqdc,117
src/rules/linux__auditd__execve__lnx_auditd_steghide_embed_steganography.lucene,sha256=cBsKZZLc5_uluwvA5XOsTBbDkinPLpYebwm6bUSHS_s,89
src/rules/linux__auditd__execve__lnx_auditd_steghide_embed_steganography.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_steghide_extract_steganography.eql,sha256=bsn1AVe2PvhTqBHp5EdCHTGRtfMlPR3nv4V0R4vKxxQ,106
src/rules/linux__auditd__execve__lnx_auditd_steghide_extract_steganography.lucene,sha256=jS5Qua_MvrEuUstlR1zb8uMC0LholOXsrxA7Q0f8kyU,81
src/rules/linux__auditd__execve__lnx_auditd_steghide_extract_steganography.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_susp_cmds.eql,sha256=YZ7Q9aKoeSG8ibOiFsKbatP3exryhB9OVsGRnZ-_Npo,196
src/rules/linux__auditd__execve__lnx_auditd_susp_cmds.lucene,sha256=tgFPqludK9uCiGkFyZi_7d49gudC_gMhvvong_t76Ho,169
src/rules/linux__auditd__execve__lnx_auditd_susp_cmds.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_susp_histfile_operations.eql,sha256=1YPL_hI5wdk02ZTz5CLNk1Az6Ul9WwAXkz_t_2CGqRo,128
src/rules/linux__auditd__execve__lnx_auditd_susp_histfile_operations.lucene,sha256=-DsDiV2etv-mm5F7Ij3c_d8bT6ZX3QTWwR9fmaZRDyY,116
src/rules/linux__auditd__execve__lnx_auditd_susp_histfile_operations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_susp_service_reload_or_restart.eql,sha256=IB-EiKCauzoFF3ZA_IuS5_Yn6prlKUGdeKQ-iYDGzmY,107
src/rules/linux__auditd__execve__lnx_auditd_susp_service_reload_or_restart.lucene,sha256=Bcato_Ron_1VaizqVwKiL7tk1T6dWeDaUoH_Rrimgbo,79
src/rules/linux__auditd__execve__lnx_auditd_susp_service_reload_or_restart.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_system_shutdown_reboot.eql,sha256=rxy0GqQstY87nktvnhK5aVcXCmFVrAvX5XSbjPoxt6U,119
src/rules/linux__auditd__execve__lnx_auditd_system_shutdown_reboot.lucene,sha256=wDbWcu6Ja_IZnnhPpVtNy4bp87wTV6TdQFnvCYAQCHE,107
src/rules/linux__auditd__execve__lnx_auditd_system_shutdown_reboot.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_unzip_hidden_zip_files_steganography.eql,sha256=TxkVP0qkCHRlJVIeMATg2yfEyeBSaFmI_qfix-PLVJo,75
src/rules/linux__auditd__execve__lnx_auditd_unzip_hidden_zip_files_steganography.lucene,sha256=6Do5EveRgqOm7W6K1H-G4j7c5NxkmA57khKw6RkajSg,53
src/rules/linux__auditd__execve__lnx_auditd_unzip_hidden_zip_files_steganography.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__execve__lnx_auditd_user_discovery.eql,sha256=f1VvDYEk7y_ulIdn7Av9iTS5fdgvqS3Y124zVupoEdw,106
src/rules/linux__auditd__execve__lnx_auditd_user_discovery.lucene,sha256=NeYLxiAyn7ru40aAjON6MYGk7V-9iD-keZ1zM0J-hBE,86
src/rules/linux__auditd__execve__lnx_auditd_user_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_audio_capture.eql,sha256=3ZQIq761561bJ0dav32km-RUjpwhhXj4FgJtQPl4X54,139
src/rules/linux__auditd__lnx_auditd_audio_capture.lucene,sha256=vUUXi-XzHy0y3XvOSWkJaw-mF28YjkFk_ZV2hP45d7s,118
src/rules/linux__auditd__lnx_auditd_audio_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_disable_aslr_protection.eql,sha256=oYBvbpAZxqQHDwdK-s-KHH3our5tYPQzpQHpHls7d2Y,150
src/rules/linux__auditd__lnx_auditd_disable_aslr_protection.lucene,sha256=vdKew01CtnDcMR-zLXEJA5-Fz_xsFlYJBW7P3a5bG8o,130
src/rules/linux__auditd__lnx_auditd_disable_aslr_protection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_keylogging_with_pam_d.eql,sha256=tjGR2B2hzJp7iAgE4i4Xf3xbnwFM4x-XtMjugmc6fcs,132
src/rules/linux__auditd__lnx_auditd_keylogging_with_pam_d.lucene,sha256=KHjzoeMDpndKVXk2rdnBnCGkjc6J64olbMhLl5HtNqI,112
src/rules/linux__auditd__lnx_auditd_keylogging_with_pam_d.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_password_policy_discovery.eql,sha256=tqo2RmVgrjnTr5lPvppSIgdMhsBXNrt30EliIsHz6dg,358
src/rules/linux__auditd__lnx_auditd_password_policy_discovery.lucene,sha256=s0nehRB9jE2JYOWjXiqkclvTyjxIWBUc5KP1M4DQz0o,344
src/rules/linux__auditd__lnx_auditd_password_policy_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_susp_c2_commands.eql,sha256=I91zgIljLKEX9GRPUBQR1afCAA5AvWx-RJQqH46Xey8,30
src/rules/linux__auditd__lnx_auditd_susp_c2_commands.lucene,sha256=aTGTCzWR-jfORZg0NXeKihSz-RiQEag9CippmbiwIFM,18
src/rules/linux__auditd__lnx_auditd_susp_c2_commands.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__lnx_auditd_system_info_discovery.eql,sha256=AomX99aThIOU-4y8IcAJEN-2GH1bFx17qMcS8nxquoc,324
src/rules/linux__auditd__lnx_auditd_system_info_discovery.lucene,sha256=ZVeObHgLDl-8iD0FQ0EHJ7Jsw2Gcrd8KyGUduObfrHs,284
src/rules/linux__auditd__lnx_auditd_system_info_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_auditing_config_change.eql,sha256=tWVFA1T7hJq_4BCm65S-6hwKjUrZXnBKjHJ65VJOvFQ,95
src/rules/linux__auditd__path__lnx_auditd_auditing_config_change.lucene,sha256=-PNcYWqwjXo_GASoxUK4BRzmAqBYw_jI1jtgqTkcNUM,83
src/rules/linux__auditd__path__lnx_auditd_auditing_config_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_bpfdoor_file_accessed.eql,sha256=gLHTkHjGvdklKJZ_GVgO4l42qwYHJOrxb__oGTwku2w,114
src/rules/linux__auditd__path__lnx_auditd_bpfdoor_file_accessed.lucene,sha256=cJYLbuWkP9hyPFPe4h1idFUxzhflV5xcEY8VUeWGSoM,103
src/rules/linux__auditd__path__lnx_auditd_bpfdoor_file_accessed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_hidden_binary_execution.eql,sha256=k-FlUSZGesswmtst9rp_RbZOZtajv7a4Pt581B_wDnI,132
src/rules/linux__auditd__path__lnx_auditd_hidden_binary_execution.lucene,sha256=f4B5mEywv2BDht4HGvkl4XppldOKbe66UbOO-wGuQXI,119
src/rules/linux__auditd__path__lnx_auditd_hidden_binary_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_ld_so_preload_mod.eql,sha256=8kh7nUaBen9DVBd8dLgygj2OdVbDbHcCQEO79EW4CnA,52
src/rules/linux__auditd__path__lnx_auditd_ld_so_preload_mod.lucene,sha256=-fMJDhBiG8KE_iQpfdFFqY4BSAuCx364v3hFUYME_zA,40
src/rules/linux__auditd__path__lnx_auditd_ld_so_preload_mod.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_logging_config_change.eql,sha256=-m3apkESqw3Ri67Ps5fDXBpV8SFCIfD0xKnvwFrrnPE,114
src/rules/linux__auditd__path__lnx_auditd_logging_config_change.lucene,sha256=9zEY-Sp-w6H7DchjVER22-UarBpeGHhG3p4yOHTGsxw,103
src/rules/linux__auditd__path__lnx_auditd_logging_config_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_magic_system_request_key.eql,sha256=fS5jEE2OcEcI7YlJDFNsYSGZa7CqQyd-Xy7bDDrr9xg,87
src/rules/linux__auditd__path__lnx_auditd_magic_system_request_key.lucene,sha256=SQlmBSvZl0N9c0RdgeBltOo4bb7fji14KdERcsx8zJ4,71
src/rules/linux__auditd__path__lnx_auditd_magic_system_request_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_system_info_discovery2.eql,sha256=ST6VpT1GFR1edSbMLba2uldNqlfMYhByhg4puziuvyc,251
src/rules/linux__auditd__path__lnx_auditd_system_info_discovery2.lucene,sha256=vF1tUcViLsyhkDM-tqNVzDHY20waTFAGWz0rr4GTs1w,261
src/rules/linux__auditd__path__lnx_auditd_system_info_discovery2.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_systemd_service_creation.eql,sha256=CM2oPhyrQgvze7v51iWG9LhQKcQZP_OsdAkqDEjG82I,155
src/rules/linux__auditd__path__lnx_auditd_systemd_service_creation.lucene,sha256=PNIsVwM0bYMqLhB4dlChXPH802j-B404RltCSOuEvaU,144
src/rules/linux__auditd__path__lnx_auditd_systemd_service_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__path__lnx_auditd_unix_shell_configuration_modification.eql,sha256=7uMYf5HGlqG9wmrN8ZBOL6U5lnhzYGUYz53syqtoqJ0,522
src/rules/linux__auditd__path__lnx_auditd_unix_shell_configuration_modification.lucene,sha256=paQx3UitSfWSA8W-PiCkbMa2vOv-yJVMgPAyB5E7Pgo,566
src/rules/linux__auditd__path__lnx_auditd_unix_shell_configuration_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__service_stop__lnx_auditd_disable_system_firewall.eql,sha256=AtUHbIjSyF_j0wSlqBQDcxpPirkxQxI4_nxQt9NMz6U,80
src/rules/linux__auditd__service_stop__lnx_auditd_disable_system_firewall.lucene,sha256=qCXnXUkjvfd3N764ueMzxApj8OtxTwBDHkEkwtYnoSI,60
src/rules/linux__auditd__service_stop__lnx_auditd_disable_system_firewall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_clean_disable_dmesg_logs_via_syslog.eql,sha256=V5qXoe9qDxuuIN3eSzqAghBSetYymZ2gDJzRiUI5iu4,71
src/rules/linux__auditd__syscall__lnx_auditd_clean_disable_dmesg_logs_via_syslog.lucene,sha256=BfEqHqqQ-cWmfQ2oFsvD1ifsVpp_B_mkdbv_GCp3IEA,55
src/rules/linux__auditd__syscall__lnx_auditd_clean_disable_dmesg_logs_via_syslog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_create_account.eql,sha256=cGgtpGmGs2A_fpcpKq4YzRB07lBkZgoZMGQBpvEzt1Y,66
src/rules/linux__auditd__syscall__lnx_auditd_create_account.lucene,sha256=FXKQqz1W2ASBLgASOEqclW-y7UGwIE46CpJ1W5Od9RM,51
src/rules/linux__auditd__syscall__lnx_auditd_create_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_load_module_insmod.eql,sha256=vYHU9-Rwo7WMj0-X8e16xMYIsiXSZ0yd05nMtEHyvtw,67
src/rules/linux__auditd__syscall__lnx_auditd_load_module_insmod.lucene,sha256=2HTHbTlAcF06H5-nspohmvo9OGWL4faXKtkNkN8FtQQ,54
src/rules/linux__auditd__syscall__lnx_auditd_load_module_insmod.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_network_service_scanning.eql,sha256=i1StOoxI-l8R4XsJ3ilmIQqM6S5D77dsoPP9YwcA-dQ,138
src/rules/linux__auditd__syscall__lnx_auditd_network_service_scanning.lucene,sha256=Vvv5lfqQ_XqL6dH8EB5795edIvj4JipTMKMtW01Fgao,122
src/rules/linux__auditd__syscall__lnx_auditd_network_service_scanning.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_split_file_into_pieces.eql,sha256=_kzGIvYYfwSN8BCwNjDAIxfPldHyoIkdXCj3o985GHI,42
src/rules/linux__auditd__syscall__lnx_auditd_split_file_into_pieces.lucene,sha256=vK91avUdDtrdt5Y0rwZi4QYnqvL61XirT3Z2GBlpuyY,28
src/rules/linux__auditd__syscall__lnx_auditd_split_file_into_pieces.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_susp_discovery_sysinfo_syscall.eql,sha256=_WEZ5gLajYFam8SbkuiCLw6z2OTHm5HGKpFvfA2Af2A,79
src/rules/linux__auditd__syscall__lnx_auditd_susp_discovery_sysinfo_syscall.lucene,sha256=y3V0dvIJ4istwQJwJ9AddB5J5T7wBPjcht9pUahpN7k,65
src/rules/linux__auditd__syscall__lnx_auditd_susp_discovery_sysinfo_syscall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_susp_exe_folders.eql,sha256=nck-qinvgyukqEHQKH6YCyUvuvl2jnkhmvt9d5SkDoA,352
src/rules/linux__auditd__syscall__lnx_auditd_susp_exe_folders.lucene,sha256=UI3qOoEyM4LaXt4wLEh0DdEkFOJp3uhfY97BTKjpwyc,390
src/rules/linux__auditd__syscall__lnx_auditd_susp_exe_folders.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_susp_special_file_creation_via_mknod_syscall.eql,sha256=JKIXHeBkJp5jg1bfnqnZvm2Wfs9zC1nFYZ4g0YA-XmM,45
src/rules/linux__auditd__syscall__lnx_auditd_susp_special_file_creation_via_mknod_syscall.lucene,sha256=QjGVI0erlRSbDKry79A9ryUdmxsobIaUb9IE5sWF_YY,31
src/rules/linux__auditd__syscall__lnx_auditd_susp_special_file_creation_via_mknod_syscall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__auditd__syscall__lnx_auditd_web_rce.eql,sha256=lva5eLgK1P-g4rDgCa7B0VrYHCLwSIRKECUXV4K8AUE,80
src/rules/linux__auditd__syscall__lnx_auditd_web_rce.lucene,sha256=RCIkchPq-7YcmNBVDN_l5ovjE2u3Sy-BueygvKkI3g0,60
src/rules/linux__auditd__syscall__lnx_auditd_web_rce.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__clamav__lnx_clamav_relevant_message.eql,sha256=ID0JNsU-UTXnp9uXOIomla2sPtGM-vvNZMm7wri-4RE,100
src/rules/linux__builtin__clamav__lnx_clamav_relevant_message.lucene,sha256=iWCNYp7RhfBhCzrPluy0BDcxAISEN4TnynyL0YZAo8Q,90
src/rules/linux__builtin__clamav__lnx_clamav_relevant_message.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__cron__lnx_cron_crontab_file_modification.eql,sha256=LHL9flxMo-Kt1vorBA4Jw1kB3e3Bqaf8HnjWwJODxjA,20
src/rules/linux__builtin__cron__lnx_cron_crontab_file_modification.lucene,sha256=gZBXxoP4kXHhH0SBBa7UU0Z6NJWgH2BBSj0JF1r42HY,10
src/rules/linux__builtin__cron__lnx_cron_crontab_file_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__guacamole__lnx_guacamole_susp_guacamole.eql,sha256=L0-aslw5R9g3se9OiB-0e_Bs82Ve9gfrbixgRySdwiA,34
src/rules/linux__builtin__guacamole__lnx_guacamole_susp_guacamole.lucene,sha256=pEpOv5KfyVIofOoXYL-lFj3tBM9heDDF2RV5rCFKn40,29
src/rules/linux__builtin__guacamole__lnx_guacamole_susp_guacamole.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_apt_equationgroup_lnx.eql,sha256=5nH7VEXhFZrRPeu_uFPv1ssHZ6fV8N5ncWgH1oEv5aU,1375
src/rules/linux__builtin__lnx_apt_equationgroup_lnx.lucene,sha256=4ygdrfzn8fdAnAdjeTxtHz8ePq2cPVUmvfDaYPagrWg,1657
src/rules/linux__builtin__lnx_apt_equationgroup_lnx.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_buffer_overflows.eql,sha256=C9odX2d89IFFpLr_JYMAcxuTMnK8i1SDzST4K3JrM4A,193
src/rules/linux__builtin__lnx_buffer_overflows.lucene,sha256=dhCdPM6FhtZ9MuPYMyuP2QfpWTtgeZvJPiLeJdKj9Ig,191
src/rules/linux__builtin__lnx_buffer_overflows.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_clear_syslog.eql,sha256=yKIWcNqmkn4YGgZHNwbqc_bYdoecfrYTi258RAKdLdI,207
src/rules/linux__builtin__lnx_clear_syslog.lucene,sha256=bg2p0sVi2U5n_j58Vvyqwe5F6tqrsf013yogBhFBvWE,235
src/rules/linux__builtin__lnx_clear_syslog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_file_copy.eql,sha256=03NMHUzEHHaf6PW4CmkR0Y-iSwqt6nycpw6SUkM-wPc,59
src/rules/linux__builtin__lnx_file_copy.lucene,sha256=_i9Q38jvs5qfvnOjl6D1jGtGydzcGMK9bgGxRsOcQGU,53
src/rules/linux__builtin__lnx_file_copy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_ldso_preload_injection.eql,sha256=8pvodB0Q5gLC0zZMEhUJoaDaBlW3dAnOAMIT522doAk,31
src/rules/linux__builtin__lnx_ldso_preload_injection.lucene,sha256=JFFTUDRv3g-OEX6DyJxuMEDfFSdUwwqfffFyTuKOLEs,23
src/rules/linux__builtin__lnx_ldso_preload_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_potential_susp_ebpf_activity.eql,sha256=v-AMjwBwevC3riDErcTZ7wVr4aJlGpS5XPH4vs2TGQ8,33
src/rules/linux__builtin__lnx_potential_susp_ebpf_activity.lucene,sha256=tgO0lMpQ0U9t4_9YF2kczajdYLBdAkLZ09a7FurI5J0,23
src/rules/linux__builtin__lnx_potential_susp_ebpf_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_privileged_user_creation.eql,sha256=JqEoh_Ireu30Zae14S8jzB8VPQsbPLif96tK621hUgg,74
src/rules/linux__builtin__lnx_privileged_user_creation.lucene,sha256=SAQlqHuey3a-EhZyvwH2XSGtzLvSNmiddRN-_LL05KM,69
src/rules/linux__builtin__lnx_privileged_user_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shell_clear_cmd_history.eql,sha256=2qiwlfiJwFOcTQVZ_-3mRm4nU1OWt7RzJe_u3bbBe8c,395
src/rules/linux__builtin__lnx_shell_clear_cmd_history.lucene,sha256=duuCl10nNzg7vTf76tFDxYU_7cHCl12FnpNAJEh3Qks,429
src/rules/linux__builtin__lnx_shell_clear_cmd_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shell_susp_commands.eql,sha256=6Oj1rjdWfC7QCq4IDb27PnUx-zB-tBszmJ2KSj7dvkY,764
src/rules/linux__builtin__lnx_shell_susp_commands.lucene,sha256=Rdt-53gLeHzy5lQvd-e3jGH07kNjll9VOYOwaJTny1A,891
src/rules/linux__builtin__lnx_shell_susp_commands.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shell_susp_log_entries.eql,sha256=5VQ5TDWwZoFkBNDrnKn0A3fYwCjVXv6ZEAy6HcvT2yk,137
src/rules/linux__builtin__lnx_shell_susp_log_entries.lucene,sha256=RgUPeDX8KWs1UAg3iDB5DbwvKcau9_pHowSe9e3qqnE,137
src/rules/linux__builtin__lnx_shell_susp_log_entries.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shell_susp_rev_shells.eql,sha256=boVyeGSkFt60TAH0ovdqUkyZzuq1UsiZc1fv22VXz-A,1106
src/rules/linux__builtin__lnx_shell_susp_rev_shells.lucene,sha256=WZU2drN1r0g5yvC6Bez1TGVPh2EY55gtvRrxya-i3Mw,1336
src/rules/linux__builtin__lnx_shell_susp_rev_shells.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_shellshock.eql,sha256=hcbcVlQVPm8mGKRjaxKFxw7KpMDwTk2vrKuSSE35W_0,65
src/rules/linux__builtin__lnx_shellshock.lucene,sha256=ZXC8RNqewefKoLJJmbFN2XgXFgiBsyg1mDXl9h4Qc-8,81
src/rules/linux__builtin__lnx_shellshock.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_susp_dev_tcp.eql,sha256=ejLNV7Vej10jI6R30MOhSKyMY2k7pIOedrNb0fY3bCc,281
src/rules/linux__builtin__lnx_susp_dev_tcp.lucene,sha256=nAE-GYm7uvM5O91jda3aPNU_6Y1kXV5x628Ep_5qX5k,352
src/rules/linux__builtin__lnx_susp_dev_tcp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_susp_jexboss.eql,sha256=7_eD_lehrJ0QmutJ2IvU0C9CyoRbHqaIWBVfBYFN5Zo,47
src/rules/linux__builtin__lnx_susp_jexboss.lucene,sha256=2M7CAqOdNxgRIlcift7sKUHAvruJFAsU5JqhSpw0Kic,46
src/rules/linux__builtin__lnx_susp_jexboss.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__lnx_symlink_etc_passwd.eql,sha256=HUfwv_ExAU-aDkrBl2kbC2GHYUEaaAphML625SkFUCM,56
src/rules/linux__builtin__lnx_symlink_etc_passwd.lucene,sha256=28mHyZrJFb2O3PI9FPmcXJQBL3LOQLtWmkMSGQIEfEg,58
src/rules/linux__builtin__lnx_symlink_etc_passwd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__sshd__lnx_sshd_susp_ssh.eql,sha256=l6ndrcyL6-Y3TdNlRsiRJ6vuDSZXTxVfxmeFwRTskbw,379
src/rules/linux__builtin__sshd__lnx_sshd_susp_ssh.lucene,sha256=ngnzRgPsLHMqtC3LEqlzXsLKDeHtCHOB1Dltoy4_E8k,404
src/rules/linux__builtin__sshd__lnx_sshd_susp_ssh.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__syslog__lnx_syslog_security_tools_disabling_syslog.eql,sha256=h4bM50iyaNIzcISyCZi0QJhUL0zndC6Ic5Nq96k4Y3M,129
src/rules/linux__builtin__syslog__lnx_syslog_security_tools_disabling_syslog.lucene,sha256=2tnazxDsRVLPHQQUvmwA7_4YMokMuOMSVkY0V8JUC-U,125
src/rules/linux__builtin__syslog__lnx_syslog_security_tools_disabling_syslog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__syslog__lnx_syslog_susp_named.eql,sha256=InDgTgohF4zsieOkfqu5z0z91xGR60njJKCqVS60Ky4,111
src/rules/linux__builtin__syslog__lnx_syslog_susp_named.lucene,sha256=nK-n7ZmZ0qRP5R8Faf_lwp0ZNftFik3rgNmf-ga4_2M,119
src/rules/linux__builtin__syslog__lnx_syslog_susp_named.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__builtin__vsftpd__lnx_vsftpd_susp_error_messages.eql,sha256=soTRwUwKPoc0Ro-5CqllP-a75EHQKxVzTYhAditcZIw,606
src/rules/linux__builtin__vsftpd__lnx_vsftpd_susp_error_messages.lucene,sha256=sSIQROTnjp7VCnmW9pQK-Jj7S8-5Lp_a9J4BEKiHz34,659
src/rules/linux__builtin__vsftpd__lnx_vsftpd_susp_error_messages.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_doas_conf_creation.eql,sha256=WM1JO36FPFGw9f_t72T3We5jjEfO9QaySkhC9QF5ikU,43
src/rules/linux__file_event__file_event_lnx_doas_conf_creation.lucene,sha256=GnyqF0W_TDCYAdYsCN3IxJd2FB5pyGhhV8pR-PBwTNc,33
src/rules/linux__file_event__file_event_lnx_doas_conf_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_persistence_cron_files.eql,sha256=6AHdXIO0Phf9_R4Q8yGu1rnJB78WWWjL9iZZMAmSgls,255
src/rules/linux__file_event__file_event_lnx_persistence_cron_files.lucene,sha256=Qw0SExs7FJGguwnUPpMGzxJnw_ExPY4L7aVCMIOl_Kc,255
src/rules/linux__file_event__file_event_lnx_persistence_cron_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_persistence_sudoers_files.eql,sha256=kFHmMfp6tb82OV9gGn1CTzj1y5xo19I5WF-UtbYsWSY,44
src/rules/linux__file_event__file_event_lnx_persistence_sudoers_files.lucene,sha256=Sw7N0josEg2soazSRH22drK96A_MaeBa3Qy3PK8datc,35
src/rules/linux__file_event__file_event_lnx_persistence_sudoers_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_susp_filename_with_embedded_base64_command.eql,sha256=meyErXd8mbNQvaStWEpsdHTonW74hzmATHSRWFf1igw,60
src/rules/linux__file_event__file_event_lnx_susp_filename_with_embedded_base64_command.lucene,sha256=qwh_ys8Vw-xFXmLWptSCyfq4Srmig9Ze1nHMNQDCvAY,46
src/rules/linux__file_event__file_event_lnx_susp_filename_with_embedded_base64_command.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_susp_shell_script_under_profile_directory.eql,sha256=ACUSFy_0LE4P4ESUssaRCgL0B0f6nUidljnnhCZg8sU,90
src/rules/linux__file_event__file_event_lnx_susp_shell_script_under_profile_directory.lucene,sha256=LYXH4RSbm0D7VQsorzCQW_6uOYCf0OKwNcEvBQfVHF0,73
src/rules/linux__file_event__file_event_lnx_susp_shell_script_under_profile_directory.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_lock_file.eql,sha256=4JtnkuZXrK0bbnTlwJPDf841cOXzSiYUNDPclNs_AG4,40
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_lock_file.lucene,sha256=2EkE1EJTCC2dYqoMhIh-rzS_zX-Id11VK9GiAnDEkIY,30
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_lock_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_persistence.eql,sha256=kQEm_U2nPv0_KN3rRBqO6JnLDq9MI422epjptGmiA44,41
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_persistence.lucene,sha256=4z1tjYCG3Hr7bX6HJ7aMdY9A2YI-LWM1BXRW8G6Thvk,29
src/rules/linux__file_event__file_event_lnx_triple_cross_rootkit_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__file_event__file_event_lnx_wget_download_file_in_tmp_dir.eql,sha256=OKr13C_7eUIMfCUD_r_CnbaOoonPnxiXsEY3hqkUOIw,77
src/rules/linux__file_event__file_event_lnx_wget_download_file_in_tmp_dir.lucene,sha256=HvKujR3Ld4BRZDqZpnDP3uqTqRXXB-wJXgneUfLOlZs,63
src/rules/linux__file_event__file_event_lnx_wget_download_file_in_tmp_dir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_back_connect_shell_dev.eql,sha256=0NSdPLvDsDTVnOMdXk5W7fxijciARZl89ttO2PKCkwg,86
src/rules/linux__network_connection__net_connection_lnx_back_connect_shell_dev.lucene,sha256=3krx5jQXM0-54Jim8j_mENreLr8rmmsp_M5_FOJ0BNA,68
src/rules/linux__network_connection__net_connection_lnx_back_connect_shell_dev.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_crypto_mining_indicators.eql,sha256=ol6d7JFTnNTyi12ADf6wv_aDG0qYU6vkbDhwIr9Z_4Q,510
src/rules/linux__network_connection__net_connection_lnx_crypto_mining_indicators.lucene,sha256=HMMiGDygb_EL6Q8bzG9htWVorULODL-eJ6pZ6oGJoyw,502
src/rules/linux__network_connection__net_connection_lnx_crypto_mining_indicators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_domain_localtonet_tunnel.eql,sha256=EPZxWquZGBqm-CL7DQ7kupH2CYlO5-28_dZ2AMfD8-g,97
src/rules/linux__network_connection__net_connection_lnx_domain_localtonet_tunnel.lucene,sha256=gtIds_HAK9S4lxNePy8SRAzqlv7CSl-qJmyrW2GoVCs,77
src/rules/linux__network_connection__net_connection_lnx_domain_localtonet_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_ngrok_tunnel.eql,sha256=R_tKHH1vMYoT_gJfqom0zamNjpiUHYap7o55kXq8qXU,212
src/rules/linux__network_connection__net_connection_lnx_ngrok_tunnel.lucene,sha256=qLU_GZCGL4TPZJjeEZJ8plLD_9ik0MvqNmcgimysIrM,194
src/rules/linux__network_connection__net_connection_lnx_ngrok_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__network_connection__net_connection_lnx_susp_malware_callback_port.eql,sha256=x57Qt-4J4FCZzFCciG5X3WUrpKasOxbW7Vl2lWN4PMo,469
src/rules/linux__network_connection__net_connection_lnx_susp_malware_callback_port.lucene,sha256=9U6MqdszoUEwyfPUk99V-zICsBS3iWdIHMmI9kZ-Chc,371
src/rules/linux__network_connection__net_connection_lnx_susp_malware_callback_port.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_apt_shell_execution.eql,sha256=DvxZ7pKnDZ8uFVYGKf4G-KYcZgeVnuuH27wn99tYzUc,94
src/rules/linux__process_creation__proc_creation_lnx_apt_shell_execution.lucene,sha256=tbiHLC5-fD4NgMRabaUtK-MmXUzSeeTPy5L5Ltm9gBE,85
src/rules/linux__process_creation__proc_creation_lnx_apt_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_at_command.eql,sha256=tMGfGRLe4xmc0OuIrpC-3M4L4a5KP6Fa4BfILNi3Obk,40
src/rules/linux__process_creation__proc_creation_lnx_at_command.lucene,sha256=PB0TNtxfWUz8Ufi2CitHSQ32HyU3ykjtXZtdPWsc67s,24
src/rules/linux__process_creation__proc_creation_lnx_at_command.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_auditctl_clear_rules.eql,sha256=_QeBCAd0zAE9xCq6hzOa2oMlp3rbDQQUjmsfYHrGHVk,57
src/rules/linux__process_creation__proc_creation_lnx_auditctl_clear_rules.lucene,sha256=sCVIYpIoDTJKiamje-PHzec8KF-PotLtnaIu7XEojL0,39
src/rules/linux__process_creation__proc_creation_lnx_auditctl_clear_rules.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_av_kaspersky_av_disabled.eql,sha256=Uko31PtRlyUdKQpduUMBKTy-6d3U-yJPFRHhUCyQhaw,110
src/rules/linux__process_creation__proc_creation_lnx_av_kaspersky_av_disabled.lucene,sha256=b6-uYrGq24HS1mRC3zDjP98yE1K6gIoU7OjNeQTBw1U,91
src/rules/linux__process_creation__proc_creation_lnx_av_kaspersky_av_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_awk_shell_spawn.eql,sha256=bFMYkRv8Fk6_8n0uKjkQXnyq0dXGwCXqkVAg-8dl0W4,197
src/rules/linux__process_creation__proc_creation_lnx_awk_shell_spawn.lucene,sha256=W7CBZ30dqTrm6qJqILPNk0E6YYh-zgZcceaDty2iAw8,185
src/rules/linux__process_creation__proc_creation_lnx_awk_shell_spawn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_base64_decode.eql,sha256=DRv0646XrnuVxxC2cst910VNscBC-xFRzuTp33KzeGE,50
src/rules/linux__process_creation__proc_creation_lnx_base64_decode.lucene,sha256=scDbYZmwjKGpcWwRuhfleg7V0tS4vmDtkJiLWYlCm3U,38
src/rules/linux__process_creation__proc_creation_lnx_base64_decode.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_base64_execution.eql,sha256=XSjje9zFkyZx-zecE4ypMEoGOSG_seoWQlMP48JOsH0,170
src/rules/linux__process_creation__proc_creation_lnx_base64_execution.lucene,sha256=_FZSDRo6YLNOLNU8dooakf71jxk6lGqve24y8qTXX3I,160
src/rules/linux__process_creation__proc_creation_lnx_base64_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_base64_shebang_cli.eql,sha256=aKg9nPVEEE-nUV2zvXfgfo7Yq_TOgAcIc6yODla-zOU,126
src/rules/linux__process_creation__proc_creation_lnx_base64_shebang_cli.lucene,sha256=h1FnH4iHyw2DB36FE-_VZxBU-rp8b9yOwgxVYv9nErk,108
src/rules/linux__process_creation__proc_creation_lnx_base64_shebang_cli.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_bash_interactive_shell.eql,sha256=ZYDzDTgrGQFK2AYEjvtV8Bgda8wxENTqiM-WkPiqMMQ,50
src/rules/linux__process_creation__proc_creation_lnx_bash_interactive_shell.lucene,sha256=cuZ8Wubaka-m2d79kdOcBwj6aDemSqk5LTTGUqk7PtI,40
src/rules/linux__process_creation__proc_creation_lnx_bash_interactive_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_bpf_kprob_tracing_enabled.eql,sha256=nF9v3o24zX1JwofeW9zU0GWV6fHe9a-Swr9wTVEDfB4,169
src/rules/linux__process_creation__proc_creation_lnx_bpf_kprob_tracing_enabled.lucene,sha256=t9kKLabfV4JECrrcRm7WbdPbmV4kR5vfY_XtFnHrWcs,161
src/rules/linux__process_creation__proc_creation_lnx_bpf_kprob_tracing_enabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_bpftrace_unsafe_option_usage.eql,sha256=r2ctoW3Rc1lOv4C9vrj8QD8DrSPSCfwMOmzYkGl6tnk,57
src/rules/linux__process_creation__proc_creation_lnx_bpftrace_unsafe_option_usage.lucene,sha256=t38igrDwkesERN90Ilc5uitlfShsnnemAw-Veb_Vxi4,45
src/rules/linux__process_creation__proc_creation_lnx_bpftrace_unsafe_option_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_capa_discovery.eql,sha256=gEg3aeJtINsOauH--R8cFe4tSxzXIlpB5buIDNm46EI,106
src/rules/linux__process_creation__proc_creation_lnx_capa_discovery.lucene,sha256=Z5EurlfPpfPcoHCeV-DTxNKASmAzfbXbo5kF11vFx74,99
src/rules/linux__process_creation__proc_creation_lnx_capa_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_capsh_shell_invocation.eql,sha256=_-yw0XuB-jHFdVhQ5u8eoajUeaaaZuvkSNpsueBAzic,49
src/rules/linux__process_creation__proc_creation_lnx_capsh_shell_invocation.lucene,sha256=cSbq72Bhg6RTRp82xp1Om5rbcaIa6P5XmT2_s-yqF_U,39
src/rules/linux__process_creation__proc_creation_lnx_capsh_shell_invocation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_chattr_immutable_removal.eql,sha256=gHHbjRSOs00YzGVybb0h43WuK8Nsaby3cP7jKikFeio,52
src/rules/linux__process_creation__proc_creation_lnx_chattr_immutable_removal.lucene,sha256=alW0f-v30VRmBkMZNWqpzHhBEMEkExnYbvP-k2HPzxw,42
src/rules/linux__process_creation__proc_creation_lnx_chattr_immutable_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_chroot_execution.eql,sha256=YjCO8dwgL8rN10KyvveI8JLxZLEwKFVG3C_hvReG1cg,80
src/rules/linux__process_creation__proc_creation_lnx_chroot_execution.lucene,sha256=bgS29_2SV8KKTqltIBsxGaWQN0mWVP5JOONvdQixlIY,68
src/rules/linux__process_creation__proc_creation_lnx_chroot_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_clear_logs.eql,sha256=nSoqQyt8PKDlzHd-R0qOdx2aCnVbtITBfPW28VoaLzw,116
src/rules/linux__process_creation__proc_creation_lnx_clear_logs.lucene,sha256=o0htXshmP5jdWbbgi0dbPRsBE1ufwHb8zZXdBFWPeQg,98
src/rules/linux__process_creation__proc_creation_lnx_clear_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_clear_syslog.eql,sha256=cyYMwkzSbKfqoZlHu3B3zo06is2XLPEdib3Fmf_EG08,822
src/rules/linux__process_creation__proc_creation_lnx_clear_syslog.lucene,sha256=KuAhyT-bjqXn7Jx8qK7ffbiLAXz30K29BVToh2Jb6Ck,839
src/rules/linux__process_creation__proc_creation_lnx_clear_syslog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_clipboard_collection.eql,sha256=Ys1B85paPkJaKh_6wgMCqf7bva6_S6Qt7qay_KWjjnI,101
src/rules/linux__process_creation__proc_creation_lnx_clipboard_collection.lucene,sha256=x-8fU2RMqs2eDCZdn7gf7tmHjDnEK3KPQSIoK1Domzs,85
src/rules/linux__process_creation__proc_creation_lnx_clipboard_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_cp_passwd_or_shadow_tmp.eql,sha256=Wdap8uJQMtcmiu4e62KDt0yTFmuB4h6lUb9IRyDIlLk,98
src/rules/linux__process_creation__proc_creation_lnx_cp_passwd_or_shadow_tmp.lucene,sha256=khUNtKGfD1_J0d_D3cgPNgWNSei1zuTG-YUMJ3DGGEc,79
src/rules/linux__process_creation__proc_creation_lnx_cp_passwd_or_shadow_tmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_crontab_enumeration.eql,sha256=LzOshB8mmKIS2FdTg-2AMv3jZbE6up9-BDCUqnhsdhE,52
src/rules/linux__process_creation__proc_creation_lnx_crontab_enumeration.lucene,sha256=4QLiLv-8k5Q5BfalLDrUkCKmZ6x_7Q6GZSsMvqG0G8c,41
src/rules/linux__process_creation__proc_creation_lnx_crontab_enumeration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_crontab_removal.eql,sha256=8f_OfH2ii3qlsr44hvzItSFGaA-LEZL6VG0n7h2rC9g,51
src/rules/linux__process_creation__proc_creation_lnx_crontab_removal.lucene,sha256=8G7jam6YUMnvMNGkn9fxTUl4uvsmc2Dgrmf6NPR-aB4,39
src/rules/linux__process_creation__proc_creation_lnx_crontab_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_crypto_mining.eql,sha256=-HLH1bbagu1BDywREVlgWUW-Fhp7f2GWFGt1KyUYVhM,430
src/rules/linux__process_creation__proc_creation_lnx_crypto_mining.lucene,sha256=Djl5W-eG7Z5To2I4rkybsXg9OMjS2_PlHaK-jy9W4yA,449
src/rules/linux__process_creation__proc_creation_lnx_crypto_mining.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_curl_usage.eql,sha256=J6262jlHT-ePB93oNjQgsJ1RY40r_Fy_JsVmiyjFUkA,25
src/rules/linux__process_creation__proc_creation_lnx_curl_usage.lucene,sha256=i7NA-ROpwkBhDc-pW_bX-Z1v1C_FeOG9km9tgPHa6v8,14
src/rules/linux__process_creation__proc_creation_lnx_curl_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_curl_wget_exec_tmp.eql,sha256=Rx4dwLoAfcYkxa5lGzUGz-1p0oUxQEvULfRtSJhT5nk,130
src/rules/linux__process_creation__proc_creation_lnx_curl_wget_exec_tmp.lucene,sha256=ObqqOB1n_BCR2m5-XTd7oaEpIcSzgg0nabtWqQOTpRA,111
src/rules/linux__process_creation__proc_creation_lnx_curl_wget_exec_tmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_dd_file_overwrite.eql,sha256=hYxbIsED2QDOWq_GPwjIvgNq8l_s_EAH_csD3fjygZM,136
src/rules/linux__process_creation__proc_creation_lnx_dd_file_overwrite.lucene,sha256=56CQWhGl3wr-cYLSKxgVXnSOBV-eEMAIXjUDw4f-OMc,120
src/rules/linux__process_creation__proc_creation_lnx_dd_file_overwrite.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_dd_process_injection.eql,sha256=7LcKJYm2g0nqIomuy7_Ly0RWopgJd8Cz49ULsY4p0Fw,101
src/rules/linux__process_creation__proc_creation_lnx_dd_process_injection.lucene,sha256=4aaTOJdbdD0DTw3Efhqh0tqSrnxbeM1zf5AIbxVLiTo,88
src/rules/linux__process_creation__proc_creation_lnx_dd_process_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_disable_ufw.eql,sha256=Uv32v5BzfQtghspqyAs5dx2K3wVkGscVeOuMDGpTnP0,122
src/rules/linux__process_creation__proc_creation_lnx_disable_ufw.lucene,sha256=xT4B5qfkpIQgPYXnOIRvEna7MT5mL-oInsvFhtMYjI0,107
src/rules/linux__process_creation__proc_creation_lnx_disable_ufw.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_doas_execution.eql,sha256=-eHfxjoE4rfZ4zstubs7pCPuEWSA8xsI3T22RTLN1o0,25
src/rules/linux__process_creation__proc_creation_lnx_doas_execution.lucene,sha256=IYgi4zSH5wrYeowWRifWk5_vyJoP_j7xivujNAic86g,14
src/rules/linux__process_creation__proc_creation_lnx_doas_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_env_shell_invocation.eql,sha256=uXLXqW_QC2DF-IUbU_Tc96PjIwKoJuwS5RDppquz1uE,116
src/rules/linux__process_creation__proc_creation_lnx_env_shell_invocation.lucene,sha256=SIDUJBpc-NdrKCCXYRudXNHs2pPkfPg0yHWOgt--3MA,107
src/rules/linux__process_creation__proc_creation_lnx_env_shell_invocation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_network_discovery.eql,sha256=6tAvr4KvfSTCCFuJZTjVX-DLACXZUHHR89Cyk9ZtH_A,103
src/rules/linux__process_creation__proc_creation_lnx_esxcli_network_discovery.lucene,sha256=JIw64yTR3jw-K5GtjHhGe6gBC0oHCJVNMqBqImSrsZ4,84
src/rules/linux__process_creation__proc_creation_lnx_esxcli_network_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_permission_change_admin.eql,sha256=7SUZRR7frkMpagdShTotAROBMloh3Vf5G6Ln8XEIuIU,140
src/rules/linux__process_creation__proc_creation_lnx_esxcli_permission_change_admin.lucene,sha256=shGXVObPg0p4sP05A2Jz1cMQB8KHi87MYQkp8Pz_KPk,124
src/rules/linux__process_creation__proc_creation_lnx_esxcli_permission_change_admin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_storage_discovery.eql,sha256=Jr3phHiCd1JD9fRznIHzN9RS5heTctxPihsKqSyzwWM,103
src/rules/linux__process_creation__proc_creation_lnx_esxcli_storage_discovery.lucene,sha256=citn1T2GrSolBzdcO7nS8mMAVxiuvXy8vvHrduVDSV0,84
src/rules/linux__process_creation__proc_creation_lnx_esxcli_storage_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_syslog_config_change.eql,sha256=gloZpqtcYWHHWnsdy7Q9RQZ5rCCiHXyeZOh5UtUrrFQ,135
src/rules/linux__process_creation__proc_creation_lnx_esxcli_syslog_config_change.lucene,sha256=9nXDfOD60oa9t0lkNY1LkLAv2NHZNsdyiw-YXc8v-O4,117
src/rules/linux__process_creation__proc_creation_lnx_esxcli_syslog_config_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_system_discovery.eql,sha256=n0AVJkK3sBv8yCj5nvx4YhwqQDXgx7axZjzL85Xqww4,102
src/rules/linux__process_creation__proc_creation_lnx_esxcli_system_discovery.lucene,sha256=zq1azljX5_4oiAd2ruqFHshR6A5Ao5Z3ZrZD8tGC9eM,83
src/rules/linux__process_creation__proc_creation_lnx_esxcli_system_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_user_account_creation.eql,sha256=0MTCjbP2e1htO4RJPKBqQ-bmZhZBhkO5JCyFIdCiI_Y,111
src/rules/linux__process_creation__proc_creation_lnx_esxcli_user_account_creation.lucene,sha256=AZ3Ch3uDEhAXWr2CtZThf9XbmI_RG9DsimYRghT1LCY,97
src/rules/linux__process_creation__proc_creation_lnx_esxcli_user_account_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_discovery.eql,sha256=A8L_C1kVfk6mTWuf8yCx29IFVEqD6RTcVMBbJ1ljiWQ,83
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_discovery.lucene,sha256=Cj6-J10NP6w-zFkwQ9yIhNajxXZpIggOGegez-Qjl9E,70
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_kill.eql,sha256=T9qiJ1oZfz0yjECXZM-foBho90jwPLOO_8MCqzxle-c,85
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_kill.lucene,sha256=thR-w-yB4o6av81PtbiLJpuCP1oDXYVV91Qc625vFlk,71
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vm_kill.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vsan_discovery.eql,sha256=MbWvslEAvZS-58VkRHgFWsznXCF7WjoTrJ40I0gvWm0,100
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vsan_discovery.lucene,sha256=5O8jHKtLxxbkOi9ozNXnZaq-ipdFRy9cNpzHFZ8LCws,81
src/rules/linux__process_creation__proc_creation_lnx_esxcli_vsan_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_file_and_directory_discovery.eql,sha256=dG-pWeQkL3-rhMj3ZLmLT1smgkxIuy3N_Tk3_ptqawU,181
src/rules/linux__process_creation__proc_creation_lnx_file_and_directory_discovery.lucene,sha256=wL7rIm9d7P1CTpASYLpWWeCVPVxagxxHsCTS1S3k5ro,157
src/rules/linux__process_creation__proc_creation_lnx_file_and_directory_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_file_deletion.eql,sha256=wsdG5BUGo6Vk0Z-NtkWF6hq8UlaEwDXzoF5SitqkP3c,54
src/rules/linux__process_creation__proc_creation_lnx_file_deletion.lucene,sha256=261SbP2eNCMF6uDpW5h-tULpLFF5iRUwU2NSJMEClRQ,39
src/rules/linux__process_creation__proc_creation_lnx_file_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_find_shell_execution.eql,sha256=8ei_fyb79iVoMBFW03IuwK41j1QdGa1XNfWUn42s3fU,176
src/rules/linux__process_creation__proc_creation_lnx_find_shell_execution.lucene,sha256=_ovkE1eGRwABdfb_-Dom-GfJZWIABVjrRJmd9S_jyWE,166
src/rules/linux__process_creation__proc_creation_lnx_find_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_flock_shell_execution.eql,sha256=xOj2psvbfKqt0FjiOzM-pmEf0tRUMygArZGTgQv2OoI,150
src/rules/linux__process_creation__proc_creation_lnx_flock_shell_execution.lucene,sha256=SkDUe_gL5L05iSKZ6KZYm9O5GW5noR3oE3SCJpKPVVU,142
src/rules/linux__process_creation__proc_creation_lnx_flock_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_gcc_shell_execution.eql,sha256=rSg0nLdRCAK8LchvMfDl_rB1nm5pLRjkC2NJbCFnOwM,195
src/rules/linux__process_creation__proc_creation_lnx_gcc_shell_execution.lucene,sha256=oLwwdn6HyN7dJy5JUHGHwzDEHUo5uJHJitri0ixBl6g,186
src/rules/linux__process_creation__proc_creation_lnx_gcc_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_git_shell_execution.eql,sha256=-QX-Xz1secCUIxRil2LyVlWLehbBcPpf4k9AjCA6CGI,162
src/rules/linux__process_creation__proc_creation_lnx_git_shell_execution.lucene,sha256=4KWDGrnZf_5MkR0D4OwIPPCtdKHpga4La9-p5ls9HMQ,151
src/rules/linux__process_creation__proc_creation_lnx_git_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_grep_os_arch_discovery.eql,sha256=sItYZmXySv_BmYvJDh6vDBs_tdqCgdpxiC5EcnFrciA,108
src/rules/linux__process_creation__proc_creation_lnx_grep_os_arch_discovery.lucene,sha256=PkRHhFOyj-S9P_72in62z_PD-IixEcZS2dJpb_nhlcs,89
src/rules/linux__process_creation__proc_creation_lnx_grep_os_arch_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_groupdel.eql,sha256=F4Q7x9lkO11zKCuz-3x_4jXUCmlmqyVwcb7zbnKgbOU,29
src/rules/linux__process_creation__proc_creation_lnx_groupdel.lucene,sha256=M6iVg4EBOiczNFa8St7xwRewEpyot5FdfedsDkttdOc,18
src/rules/linux__process_creation__proc_creation_lnx_groupdel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_install_root_certificate.eql,sha256=s9B55uW766fupr2UxbCpgIFPhcB-06xobqGU_3Rw-_8,72
src/rules/linux__process_creation__proc_creation_lnx_install_root_certificate.lucene,sha256=uwQHSJpVZL-V9ucuxXeDXlwkzYAEE5XWCHSNwUioCIc,60
src/rules/linux__process_creation__proc_creation_lnx_install_root_certificate.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_install_suspicioua_packages.eql,sha256=LzUuFh2I1yRroNHPiYzfQn1O0NQt7efMr-WLLpsGBac,381
src/rules/linux__process_creation__proc_creation_lnx_install_suspicioua_packages.lucene,sha256=TJK6Fq1V6r7sG90y4RkRXp5oqkAKlF75RkniMU9hiBY,340
src/rules/linux__process_creation__proc_creation_lnx_install_suspicioua_packages.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_iptables_flush_ufw.eql,sha256=hSc8z15Sf3G_VB5CZAW4uZabSTaymCW35dyls6RRHUQ,301
src/rules/linux__process_creation__proc_creation_lnx_iptables_flush_ufw.lucene,sha256=RRY7ERCc1eIWBcM2i5vP9eo9L4GmN41kUCbGPFqRdNE,289
src/rules/linux__process_creation__proc_creation_lnx_iptables_flush_ufw.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_local_account.eql,sha256=1eN1YFvxkk6pF9fZB_RyYWqkxx7aXWIfqk3f3Q7p22g,390
src/rules/linux__process_creation__proc_creation_lnx_local_account.lucene,sha256=rH62SUqnEX8m6FlGa2ZN56W_C8rr9BBiXhLmN-di2yI,384
src/rules/linux__process_creation__proc_creation_lnx_local_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_local_groups.eql,sha256=yCegWQa1hBBQKL6Yp_-fhElP7-vCw4qUrSA5RjdKaiU,162
src/rules/linux__process_creation__proc_creation_lnx_local_groups.lucene,sha256=Xfg94GGN5P1Yj4flXz79XzwYKW1ZGjd0zeCh7lWRchs,152
src/rules/linux__process_creation__proc_creation_lnx_local_groups.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_malware_gobrat_grep_payload_discovery.eql,sha256=t2SOaFpOHXqgSHrGIEdiXoeXDqBYuMp_V9hl41M2Le0,100
src/rules/linux__process_creation__proc_creation_lnx_malware_gobrat_grep_payload_discovery.lucene,sha256=_1m9cECFvm6PVl14ZVz8Tsa9NwW4cCpImYzfVCx0TmM,81
src/rules/linux__process_creation__proc_creation_lnx_malware_gobrat_grep_payload_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation.eql,sha256=lNsNUl5anwksdCJghiYkdtjPN5D3jdRZjNkcEFwD5qk,27
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation.lucene,sha256=w1uMZx5-Z6uclIRJK2OZXEZ4OBK-RfYTOqH06_YnKv8,16
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.eql,sha256=uXj42zLmGlcswMecrd0yktQAerc4L2BcPEF1zS8qy1c,54
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.lucene,sha256=iW2ossrKQlohDah5b7A2x5p2JmyZEshxhcIYByqNJ9U,44
src/rules/linux__process_creation__proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_mount_hidepid.eql,sha256=03iAG-SvwvlRAd7Ls-4J_iv5ivXaPGTt72Ud6tuKeiQ,83
src/rules/linux__process_creation__proc_creation_lnx_mount_hidepid.lucene,sha256=jTTrIxcwUnwVkRwI5b3UsxxpIEMgTJ42kIBiE2Qryw0,72
src/rules/linux__process_creation__proc_creation_lnx_mount_hidepid.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_netcat_reverse_shell.eql,sha256=V41xNYOo0SAvpUatqEUMVK3opfIfX8X_Qhc5YId8Dnw,445
src/rules/linux__process_creation__proc_creation_lnx_netcat_reverse_shell.lucene,sha256=iWJfh4QDdf5Oklr26v27nUngcfq0WMHvcl_03Fed_3Q,445
src/rules/linux__process_creation__proc_creation_lnx_netcat_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_nice_shell_execution.eql,sha256=6maCoQNlSypxaAr_frZrHdqzg33J_wlKxfLterrHyKk,117
src/rules/linux__process_creation__proc_creation_lnx_nice_shell_execution.lucene,sha256=gG5lMPQOxb5ZU2b1MjerD1plOSOt7ri_-PUGUBayHew,108
src/rules/linux__process_creation__proc_creation_lnx_nice_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_nohup.eql,sha256=P00CqXeSaaGuYHPWIAVdzINdlYpRF4upXgGuSulwweY,26
src/rules/linux__process_creation__proc_creation_lnx_nohup.lucene,sha256=rnF2nwSrKB5FUJXZ44Tvp_xpuvZX0TkqT_qCO-JaLBw,15
src/rules/linux__process_creation__proc_creation_lnx_nohup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_nohup_susp_execution.eql,sha256=55KgaAL5fe5fW8B5dPh0TVdgbval5wt0oFGLWnphcaw,52
src/rules/linux__process_creation__proc_creation_lnx_nohup_susp_execution.lucene,sha256=SnSN9h8bD5TfwZJZMObO2DMUjDznOJQ4ilcGDoYzVhU,41
src/rules/linux__process_creation__proc_creation_lnx_nohup_susp_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executescript.eql,sha256=zWJ9PEN9-A2hyOgiaWo6xEpwriwnA65lyGeF0QljWSU,145
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executescript.lucene,sha256=S0lfAU9EXUukkq9pwrux5-jkHGpE3QnGUngU1lxMpTY,141
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executescript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.eql,sha256=L6pEc6AfZ9kcKUd_mONP0B0wkVtO5UGtRtkobL2Hvlw,114
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.lucene,sha256=F7lvV1oRp-U6On5tlnobKEtLRiTU8T22p2muWkDv5hg,105
src/rules/linux__process_creation__proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_perl_reverse_shell.eql,sha256=Rn909IcRnHzrkrQGOQLThnkevJsVHoMBSWI8g75zSfA,225
src/rules/linux__process_creation__proc_creation_lnx_perl_reverse_shell.lucene,sha256=4qe7PU9K6QR7ukcdhOv9L-O-8EZ176bBM8Gls4OCo40,208
src/rules/linux__process_creation__proc_creation_lnx_perl_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_php_reverse_shell.eql,sha256=Z3pJvdy32tXB8YdQPFn2B6F85j8ggk-NdV9ulbAZk3s,191
src/rules/linux__process_creation__proc_creation_lnx_php_reverse_shell.lucene,sha256=stsB8xZORC4yjBCyKk-54KdfqlRmzBCZkm_VVUPm9q8,171
src/rules/linux__process_creation__proc_creation_lnx_php_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_pnscan_binary_cli_pattern.eql,sha256=LpbbYTk-4CPgw1OaserH7akXcVNLp4m5uiiwrH_85bU,82
src/rules/linux__process_creation__proc_creation_lnx_pnscan_binary_cli_pattern.lucene,sha256=ykaWNEUe8lbxr_d6QLgICtJY4oVqVlrYGCqovl7VJno,65
src/rules/linux__process_creation__proc_creation_lnx_pnscan_binary_cli_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_proxy_connection.eql,sha256=HAvhqr8fPeKxacjoGhAGjYaVO0tbIwQ3-H0Q4DWhegU,64
src/rules/linux__process_creation__proc_creation_lnx_proxy_connection.lucene,sha256=r-tlGDGEqZ8AiSYLPxDyM2VRM2GdryX9xobs3UHJQMc,48
src/rules/linux__process_creation__proc_creation_lnx_proxy_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_pua_trufflehog.eql,sha256=3hfqNyWsqmRdp11-DHsdxZpjRibfMOhoD3eDW9073kM,226
src/rules/linux__process_creation__proc_creation_lnx_pua_trufflehog.lucene,sha256=QSpbgT-HF3tx1uMg11nyiC8ygbaXjQ7LyikStIrX7uQ,230
src/rules/linux__process_creation__proc_creation_lnx_pua_trufflehog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_python_http_server_execution.eql,sha256=EeRfe_Pku4JYjfoBzUxuFpV2q4K9Ijz6hYHQFDNbREo,177
src/rules/linux__process_creation__proc_creation_lnx_python_http_server_execution.lucene,sha256=SxjA0BfOwDSsHTTrdzWxPJjTUFtHuSTH-BHFLTaLxx0,148
src/rules/linux__process_creation__proc_creation_lnx_python_http_server_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_python_pty_spawn.eql,sha256=Mh49JrjpmtP0RlEQuEsHcXCWqpKSNpzyMWyZI-RZZM8,195
src/rules/linux__process_creation__proc_creation_lnx_python_pty_spawn.lucene,sha256=q5-eANucdKuT7SvN8r1e0Nyklk-HexfEs60CXqZuHr4,167
src/rules/linux__process_creation__proc_creation_lnx_python_pty_spawn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_python_reverse_shell.eql,sha256=Fimo7HJo8tnlgms0rv1t3XqUvF5OPtJlsVaGcHLsXwY,187
src/rules/linux__process_creation__proc_creation_lnx_python_reverse_shell.lucene,sha256=xeC7THXaLN4B4BU1KK0sKRmkz70yZctU2cVQfVfupv0,166
src/rules/linux__process_creation__proc_creation_lnx_python_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_python_shell_os_system.eql,sha256=btjqqRE0Ov6GUKA5Q64c_1n-x_KO5pJglQnHpBD-v-4,270
src/rules/linux__process_creation__proc_creation_lnx_python_shell_os_system.lucene,sha256=2DCGqw4ytAk7YDNl8fb6nSxsXo2uc3v-lmpBL6sSLTo,251
src/rules/linux__process_creation__proc_creation_lnx_python_shell_os_system.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.eql,sha256=JuBU7I_DkcIcu4OMdV_SnwMtjLcoevp86zjk7-rCySE,143
src/rules/linux__process_creation__proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.lucene,sha256=CUseXHsjfgej1nTtIPly3VVlIoR7ZKUIh2NjUXUkf2o,138
src/rules/linux__process_creation__proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_remote_system_discovery.eql,sha256=QQlwlJthbEb-dZ-VvS-CwngzsnMwnIyNqTvAKSMblZQ,369
src/rules/linux__process_creation__proc_creation_lnx_remote_system_discovery.lucene,sha256=ykvTJqYwbMihwzt18vikY_vAYCQramSP0nruOosA-dE,368
src/rules/linux__process_creation__proc_creation_lnx_remote_system_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_remove_package.eql,sha256=BlLpEjwzi6EO25VC-_tokRWgaVI3Lht6JEPsOECmh8o,278
src/rules/linux__process_creation__proc_creation_lnx_remove_package.lucene,sha256=PyS44ryHPp4i3lWfOrrONSoD6Ixu20V6Y_4RxP_lD9A,243
src/rules/linux__process_creation__proc_creation_lnx_remove_package.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_execution.eql,sha256=O9EMkQooHLL8HE15e0k9OTymnQaIKM4WLOOo2Bo4aOc,280
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_execution.lucene,sha256=Fvl0unPhd5zN2jO36Q1q48GkZptmaLspJVps_wabkYw,281
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_spawn.eql,sha256=yLBTnU8V8NXX85-DFWYHddzJNOUYVK-EcWQJoEMZJOE,180
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_spawn.lucene,sha256=2ho6r94TLan9EpJV91rdF5TZbj2vYmoOj_msGwYHfBk,165
src/rules/linux__process_creation__proc_creation_lnx_rsync_shell_spawn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_ruby_reverse_shell.eql,sha256=O8P12XNRdcZTIY5kcT3lXFVwW46vMWiayNblRAT7qiU,217
src/rules/linux__process_creation__proc_creation_lnx_ruby_reverse_shell.lucene,sha256=b85y-cygmYhv7AEmiJWpdL_tPWHjA4-Dh2EEo34UEPk,201
src/rules/linux__process_creation__proc_creation_lnx_ruby_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_schedule_task_job_cron.eql,sha256=sOJ-EJikYz3gDEiFh5J12EK76PsGOYPX-Zfo6dYkXJ4,53
src/rules/linux__process_creation__proc_creation_lnx_schedule_task_job_cron.lucene,sha256=wWjYmCS9xMeSTMC-HXYz_qGDopLMKPfg_ewXlfkkNzQ,41
src/rules/linux__process_creation__proc_creation_lnx_schedule_task_job_cron.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_security_software_discovery.eql,sha256=XdOy5AmXzRfF_-9ukbPwTVtwhQv3EypB3APttQTEENo,184
src/rules/linux__process_creation__proc_creation_lnx_security_software_discovery.lucene,sha256=t57E_kwmxok3NK09ela1llZ8xtI0d354qfG7_2DgiOI,161
src/rules/linux__process_creation__proc_creation_lnx_security_software_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_security_tools_disabling.eql,sha256=BxxeDJkUWXTw2g8jdpoiXwAS02Ijl5sMthwZs7eVgOQ,1043
src/rules/linux__process_creation__proc_creation_lnx_security_tools_disabling.lucene,sha256=wBuRNN8ZHVhvRt5rd-n3yDCe9Qi-WLbrLeqfSRPGOIo,972
src/rules/linux__process_creation__proc_creation_lnx_security_tools_disabling.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_services_stop_and_disable.eql,sha256=8gtWo8FgSL9Px115kavxVMSkgMNhCmwUTSsCHQ4s2hc,116
src/rules/linux__process_creation__proc_creation_lnx_services_stop_and_disable.lucene,sha256=UycTm5fErEkYjEmo4Sf-6evdCVDANIflU0QOYGXvc-o,93
src/rules/linux__process_creation__proc_creation_lnx_services_stop_and_disable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_setgid_setuid.eql,sha256=eug-KnUkiXmwW2MWcGa-PqR3gpPB_M5F5171zTLjBCo,94
src/rules/linux__process_creation__proc_creation_lnx_setgid_setuid.lucene,sha256=fMegdqGBtXoPkzi2Th-PG7dTfuwYLKsWK8GY7z-g_yY,81
src/rules/linux__process_creation__proc_creation_lnx_setgid_setuid.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_ssh_shell_execution.eql,sha256=SdDvCCOOn3l0o0lYxLp7x5-PiZyKmBqHX21AhWPAVik,247
src/rules/linux__process_creation__proc_creation_lnx_ssh_shell_execution.lucene,sha256=kMKRmg-ZVPtJX6tzFTZh5WDSeHKTARB9X-Jk9M0NmSc,244
src/rules/linux__process_creation__proc_creation_lnx_ssh_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_ssm_agent_abuse.eql,sha256=MmnE3ZF7s7395WeQFHcqy0CvKQLybTvsb4rU4-ZAjvI,151
src/rules/linux__process_creation__proc_creation_lnx_ssm_agent_abuse.lucene,sha256=k5ICkteOHQxyXGytDnXOZeg--uuNBGYJacRas8hgkNs,142
src/rules/linux__process_creation__proc_creation_lnx_ssm_agent_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_chmod_directories.eql,sha256=x4YtCS6VIpmGL35DHL_eiAIlJKgjr8xTw0vErZpwWUc,100
src/rules/linux__process_creation__proc_creation_lnx_susp_chmod_directories.lucene,sha256=k1HgHBa_6qAsmNdj1oeqtxtsBstlZt4D_540JUO7h78,89
src/rules/linux__process_creation__proc_creation_lnx_susp_chmod_directories.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_container_residence_discovery.eql,sha256=uZyBQT8K2d1g-eeQZQpLJyGCiPtBmlzMnXwKHocITLA,206
src/rules/linux__process_creation__proc_creation_lnx_susp_container_residence_discovery.lucene,sha256=TaMQucvsp8FT0H18VPPKNTSdSIBNnMeVn4xJeXMlb7A,189
src/rules/linux__process_creation__proc_creation_lnx_susp_container_residence_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_fileupload.eql,sha256=EL5AvNlceHU7EyaeI_ArJqjrce5UQYrBqktNOM8jpvs,218
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_fileupload.lucene,sha256=hoYCrYqpRPMP8Mt459xFhx0MoqBVi1KcprGHpHdcFhM,206
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_fileupload.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_useragent.eql,sha256=XPcux3Q3yGhyRWzhxB5oFEItTlm2wXfgURZH86XrcJw,80
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_useragent.lucene,sha256=MCW2q4oveD_ANdx-4vQVEm9T5n3Qvc8xdjYPtrTsP0c,69
src/rules/linux__process_creation__proc_creation_lnx_susp_curl_useragent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_dockerenv_recon.eql,sha256=oxlpVjtNmCieXTWiMd9WYrlNV9z1C-4LHkgC4XiMtv8,120
src/rules/linux__process_creation__proc_creation_lnx_susp_dockerenv_recon.lucene,sha256=mjLmlwyaQ4hkOYOCP_9Ibzy_tI__zxi8zDfjyb1Lhd0,106
src/rules/linux__process_creation__proc_creation_lnx_susp_dockerenv_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_execution_tmp_folder.eql,sha256=f0eGv9qXn0D9WzMS_WRDpsFllf1Q8bQc6iRI0vr_Bks,63
src/rules/linux__process_creation__proc_creation_lnx_susp_execution_tmp_folder.lucene,sha256=D7czEEJhDgxBJ0Jc08XYeurQpjsZsc5h7RFhndn8kuU,54
src/rules/linux__process_creation__proc_creation_lnx_susp_execution_tmp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_find_execution.eql,sha256=6BVn4yTW_hilgY4XzRcoX0MjhPwryfACgzoKW4Aymzk,180
src/rules/linux__process_creation__proc_creation_lnx_susp_find_execution.lucene,sha256=-SLDNN_kkSvcChSwEPtJQLgEIbh9VXH1W3wOHhzB9n4,188
src/rules/linux__process_creation__proc_creation_lnx_susp_find_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_git_clone.eql,sha256=Vla8LCP88diQLbth7fwiRQYU4h5ymSCj-SvjndhTZDY,286
src/rules/linux__process_creation__proc_creation_lnx_susp_git_clone.lucene,sha256=oNoPHv7BtkivtyfQjzZ5BX9Ff2Iqt12Yz0P7u-Y_Lso,272
src/rules/linux__process_creation__proc_creation_lnx_susp_git_clone.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_history_delete.eql,sha256=TGKGVaqp5QM0yaQ0r-_51jJM5Cv3Esw7cLg6czIatXE,185
src/rules/linux__process_creation__proc_creation_lnx_susp_history_delete.lucene,sha256=cABNOg8ig6vUq46ubSVy9yKZRET_LtzMAuhDeiNyoqU,156
src/rules/linux__process_creation__proc_creation_lnx_susp_history_delete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_history_recon.eql,sha256=vo93FzWMg0StQSgd4WF3Sv-sIEDmAhPS_shwNmO-IFk,193
src/rules/linux__process_creation__proc_creation_lnx_susp_history_recon.lucene,sha256=8QpzL0klZjSNKCLlvNSI9Azfw71COqjy4DmzQAqRw_s,165
src/rules/linux__process_creation__proc_creation_lnx_susp_history_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_hktl_execution.eql,sha256=okXWyVenYDMydENwC51095qXYENMXjyfYrFD8oxlah8,900
src/rules/linux__process_creation__proc_creation_lnx_susp_hktl_execution.lucene,sha256=U3T-ciIdSXanqvw7yiXU4lJyXkFGciIJpU6Apxoe_n8,904
src/rules/linux__process_creation__proc_creation_lnx_susp_hktl_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_inod_listing.eql,sha256=oGtiz4bYFNOvlzX2417fUi_EZh8m7wm9m44VBr4mnNo,184
src/rules/linux__process_creation__proc_creation_lnx_susp_inod_listing.lucene,sha256=IEz4W3A9Mt8Lh-Y6oqBF4clBOhsIIpE1bvHEGcrN3jQ,156
src/rules/linux__process_creation__proc_creation_lnx_susp_inod_listing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_interactive_bash.eql,sha256=lQ4wBVUMX6sHBW2-zFku_w_Dkn_5RFMVx6ab05Pr6XI,180
src/rules/linux__process_creation__proc_creation_lnx_susp_interactive_bash.lucene,sha256=zW5bH6gQ2CTe4taQ6uIJaI2668oROwbg8bMipOk4lp0,160
src/rules/linux__process_creation__proc_creation_lnx_susp_interactive_bash.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_java_children.eql,sha256=fU69Vs9IL43cw7Q9MKkHRQf9tbtDRs1djr_p6JJ_k-w,158
src/rules/linux__process_creation__proc_creation_lnx_susp_java_children.lucene,sha256=p0u7NbFv2hmnDllZZylsnClqHLzTtDrxv-a-nKE-w6w,141
src/rules/linux__process_creation__proc_creation_lnx_susp_java_children.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_network_utilities_execution.eql,sha256=HFPJWCtqpVT-1RQKBc34cYhAlvwyUEYe-s_Z4RLBcSI,249
src/rules/linux__process_creation__proc_creation_lnx_susp_network_utilities_execution.lucene,sha256=ifm1y9VG4NGJldTrK7bbZ6JJlpeHhkYtrlIosqCSqHs,235
src/rules/linux__process_creation__proc_creation_lnx_susp_network_utilities_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_pipe_shell.eql,sha256=TqkVu8cGdkHVGWH09g1LTpbIU7pt8xabvVdeqo9eCsU,191
src/rules/linux__process_creation__proc_creation_lnx_susp_pipe_shell.lucene,sha256=GM2rY4W-k2TUKVgbhq9tIeYSqQ1Uwajef8t5NMWZWLk,180
src/rules/linux__process_creation__proc_creation_lnx_susp_pipe_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_process_reading_sudoers.eql,sha256=EjMqWxFCEe5vOIixr4uSNPPtvC6TGo1o1wXLzvthodg,169
src/rules/linux__process_creation__proc_creation_lnx_susp_process_reading_sudoers.lucene,sha256=3NzuL3lteDpDNefvdc_jfCOoct9zzsDKQwjWrQU5urk,163
src/rules/linux__process_creation__proc_creation_lnx_susp_process_reading_sudoers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_recon_indicators.eql,sha256=ZnC78dDSKyZUJebsNFnz28vI6MTgyVtKs9eQ31H5-Y0,70
src/rules/linux__process_creation__proc_creation_lnx_susp_recon_indicators.lucene,sha256=U7Nqyl20BmeamSCpnz4bO7XR2iCQoJN7D3dw7C5rp2U,60
src/rules/linux__process_creation__proc_creation_lnx_susp_recon_indicators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_sensitive_file_access.eql,sha256=7h_dTV5GvKN7r2ThvJjgOLMNeyG4JC-jcAwNEP9bqe8,409
src/rules/linux__process_creation__proc_creation_lnx_susp_sensitive_file_access.lucene,sha256=oICOAxdrLw8uWjeCQKG3NvZZ3nYRUiNqU_8ulWh8DxM,414
src/rules/linux__process_creation__proc_creation_lnx_susp_sensitive_file_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.eql,sha256=zqSOZrlsLHPNM3Ltc4YHpbKczmyATd0xlTyddXTvdf8,115
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.lucene,sha256=YiNVv9SfQXlsPkXFdCpbNCLImtKhaCk98cdr8pPLUDI,104
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_script_exec_from_susp_location.eql,sha256=BNr2lS9CYpORxg8eKydmBYXgQLlFP0Sjinz2LY0wd-s,141
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_script_exec_from_susp_location.lucene,sha256=OpyS0qKS6gsSJIQyliW5nbDRVgLLt78ymkyPTXjgFaY,131
src/rules/linux__process_creation__proc_creation_lnx_susp_shell_script_exec_from_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_system_info_discovery.eql,sha256=McSFa-dx4tSVU92CiW83qzChJAYSwKTZfIlgqC2ZuNY,108
src/rules/linux__process_creation__proc_creation_lnx_system_info_discovery.lucene,sha256=CNgtdNY8NviXR8xzPgdhHG_-z45COkWjBjX5-M0F8TA,97
src/rules/linux__process_creation__proc_creation_lnx_system_info_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_system_network_connections_discovery.eql,sha256=fiZML-xYpVaiwOWhBqMXbATFgEaYdLxzSMZr94MR7w4,153
src/rules/linux__process_creation__proc_creation_lnx_system_network_connections_discovery.lucene,sha256=pV8Ri2EQXAYkWfYqlvoFU_kLW02LXt4TtNl8J-tv_1U,141
src/rules/linux__process_creation__proc_creation_lnx_system_network_connections_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_system_network_discovery.eql,sha256=ZEK0M7jc_wGbyddZCzdd1MqW16uro-CV8eNBV7E1oFc,177
src/rules/linux__process_creation__proc_creation_lnx_system_network_discovery.lucene,sha256=oXlvd7ivznL93-4ipr5X2dJAUi5l3IPkJbiQg9OWHkg,170
src/rules/linux__process_creation__proc_creation_lnx_system_network_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_systemctl_mask_power_settings.eql,sha256=4LUb_6tUfvpVfIFfePfrjbuq70JZ0Mps-NouMpIFo9M,150
src/rules/linux__process_creation__proc_creation_lnx_systemctl_mask_power_settings.lucene,sha256=5CxsV1whQ4pOE5h0ZUAS1NG93AUOUVLYb8wEtBqJzas,131
src/rules/linux__process_creation__proc_creation_lnx_systemctl_mask_power_settings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_touch_susp.eql,sha256=VhiG1m0kvl__aogYnWFR4cv7OO57ww6flSpwHxLbcPk,79
src/rules/linux__process_creation__proc_creation_lnx_touch_susp.lucene,sha256=lSkHpHbGJQ6_uZgxct6wlJkbt39elWBBx8GIwzFGi7w,67
src/rules/linux__process_creation__proc_creation_lnx_touch_susp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_execve_hijack.eql,sha256=BJ6_UODQwRjgjxwRulEVp7-jkKJ--WHz_N9s6fjh-ZY,59
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_execve_hijack.lucene,sha256=UtRoHVKALaambgha_oNlzwCwRv3P4puh2QfTVFgeNgc,46
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_execve_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_install.eql,sha256=YcGWujHkDbCVDU9tUUOP_FqRMVxGNUm3EChB2uJ5HYg,133
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_install.lucene,sha256=xKlTUPJa3rF04-NJ3IGHkjFdGvHVNZU16mbfqtnCtSw,118
src/rules/linux__process_creation__proc_creation_lnx_triple_cross_rootkit_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_userdel.eql,sha256=IaH7ikXgqXYHiVp6i3WkoXc8FtPD8DU463EYfyUMz2I,28
src/rules/linux__process_creation__proc_creation_lnx_userdel.lucene,sha256=7rSy700kWNbAnwh415avp8Df6Dzme5YKl21a8SUrsww,17
src/rules/linux__process_creation__proc_creation_lnx_userdel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_usermod_susp_group.eql,sha256=o-Wo7foPLtXRtaRG8VxTByN87t4CXd27MOjgKxgL-zY,84
src/rules/linux__process_creation__proc_creation_lnx_usermod_susp_group.lucene,sha256=ZlzHs8IVuvfGSNRW4IaDNnUfvjXU7w_1-HMxB1rEkho,69
src/rules/linux__process_creation__proc_creation_lnx_usermod_susp_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_vim_shell_execution.eql,sha256=ssMAXqXd74bYUXLXiDacr5d3z4jcopLVExouJgIFhH4,233
src/rules/linux__process_creation__proc_creation_lnx_vim_shell_execution.lucene,sha256=4vRMgK4GfFMwQJYb6U54iOn3DOk-GF7Buh1SFjwQDpU,225
src/rules/linux__process_creation__proc_creation_lnx_vim_shell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_webshell_detection.eql,sha256=-xBKKGgs5_TOFzHgQVvPTGFDYJYYJqekFOSgH4SAA3U,405
src/rules/linux__process_creation__proc_creation_lnx_webshell_detection.lucene,sha256=q9r9m4WVUmwwS9u3_Q1fn_evvKxpBJglaY3phB_Ip_Y,395
src/rules/linux__process_creation__proc_creation_lnx_webshell_detection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_wget_download_suspicious_directory.eql,sha256=ozOqfC6UUX7Q5ekpTH5-b81tdYMelr1rV6tzrVR6Udo,122
src/rules/linux__process_creation__proc_creation_lnx_wget_download_suspicious_directory.lucene,sha256=0G3XK4PnwofnNqtKqtjpkAnFlYFbcApOBtMi68DL61A,105
src/rules/linux__process_creation__proc_creation_lnx_wget_download_suspicious_directory.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/linux__process_creation__proc_creation_lnx_xterm_reverse_shell.eql,sha256=iEhPnw_WNfl4aMuD5W8ol_QPKuDDxf0lPRVkh_HZD-s,77
src/rules/linux__process_creation__proc_creation_lnx_xterm_reverse_shell.lucene,sha256=cCnbU4HVdMOd2ABWpDPFNbzpdGYROlVxkNZzlJ6b-t0,63
src/rules/linux__process_creation__proc_creation_lnx_xterm_reverse_shell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__file_event__file_event_macos_emond_launch_daemon.eql,sha256=teapb-W8kVoEe46FnMUCelvsYbQh4FfzDdBTSljQ36s,132
src/rules/macos__file_event__file_event_macos_emond_launch_daemon.lucene,sha256=v6sSSZHrxcTrr2gFoXc1TtYWWQuJjqBWz6UFLuj4qUw,125
src/rules/macos__file_event__file_event_macos_emond_launch_daemon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__file_event__file_event_macos_susp_startup_item_created.eql,sha256=IpFqYW5xDphftHQZ73FOQ21SV3uEQBxOBmckI9xrl48,123
src/rules/macos__file_event__file_event_macos_susp_startup_item_created.lucene,sha256=TjdWuwhY0sVP-pHoj_Rf_bE0Aj4iSQWrBeTaOk_AJiE,109
src/rules/macos__file_event__file_event_macos_susp_startup_item_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_applescript.eql,sha256=a5jAYaFPqLXKCkSfhhevB_pq-2Nkd7J0_qDzqwYudOU,85
src/rules/macos__process_creation__proc_creation_macos_applescript.lucene,sha256=u0sAtqfOtqga1YyzyemWozn3kITZTJ989Od0gDvERzA,69
src/rules/macos__process_creation__proc_creation_macos_applescript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_base64_decode.eql,sha256=2LENEiDthMJtbWkbw94zDCN2SIpKPHhDwLaoDhHSfII,57
src/rules/macos__process_creation__proc_creation_macos_base64_decode.lucene,sha256=_j8OH8T5g0ogAPIAWWsCuMrEOkuVYvdpCzCaglanIHg,47
src/rules/macos__process_creation__proc_creation_macos_base64_decode.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_binary_padding.eql,sha256=JofI8GSS-Tgwt3UuR1_9J00qdGgILcQcMajg18S86U0,158
src/rules/macos__process_creation__proc_creation_macos_binary_padding.lucene,sha256=lECmwk1xU0q0KiAkktklrYdmcoSDiPoG4_npoKNvOPA,148
src/rules/macos__process_creation__proc_creation_macos_binary_padding.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_change_file_time_attr.eql,sha256=M29HQz9Rt28csaedj2mhi9FiL_rfeZBZ-gvb3QAoynE,86
src/rules/macos__process_creation__proc_creation_macos_change_file_time_attr.lucene,sha256=oiHPykh2qumF9jIaePZHgIx46U1St8pLM98UlJrHExM,71
src/rules/macos__process_creation__proc_creation_macos_change_file_time_attr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_chflags_hidden_flag.eql,sha256=9DN19nmWLw3dqOb435webSrGPwK7K5Dimh6I5xuUU6c,56
src/rules/macos__process_creation__proc_creation_macos_chflags_hidden_flag.lucene,sha256=CL6QCB5NivX9akJBCq4CQMjcMxeVZETBTW7GAOEk3wQ,44
src/rules/macos__process_creation__proc_creation_macos_chflags_hidden_flag.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_clear_system_logs.eql,sha256=WzK5-iK27AQDPEx5EqnTaeEJJ-TkZIHAjF08nL1H5I8,151
src/rules/macos__process_creation__proc_creation_macos_clear_system_logs.lucene,sha256=r2TN1WLJUwjTAf7mc5Xgwo0TbYry1u_vM5WP9eafsEw,137
src/rules/macos__process_creation__proc_creation_macos_clear_system_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_clipboard_data_via_osascript.eql,sha256=AcvZc8hh82uy2jF_2qg4Csk_R6GaLrZIz8SI5ftZ124,91
src/rules/macos__process_creation__proc_creation_macos_clipboard_data_via_osascript.lucene,sha256=EAKV68kY7lSwvp9OhaA8QtL-hSRhg9twTNMg145liJs,78
src/rules/macos__process_creation__proc_creation_macos_clipboard_data_via_osascript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_create_account.eql,sha256=exlqIMvHljRCuLAAUV3OCUMDDC-qKyy95sTAJRCHa2M,109
src/rules/macos__process_creation__proc_creation_macos_create_account.lucene,sha256=O_HN0w0jogP9jzSr0Xset1duh2ZZe7ybHfXQJKUwFVQ,93
src/rules/macos__process_creation__proc_creation_macos_create_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_create_hidden_account.eql,sha256=nNSkc8GQGaEJ2BR_F4A-w54D8pnq3bLw5I7jPXbP3UE,276
src/rules/macos__process_creation__proc_creation_macos_create_hidden_account.lucene,sha256=r_RHiu7PX6eKcfKYW4XruxXJDOwHwjyQtZQJ7f02kD0,241
src/rules/macos__process_creation__proc_creation_macos_create_hidden_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_creds_from_keychain.eql,sha256=Fg37tkg0Vjh4NNy9OkKIvGZ_Wn4Ipj8HaMIDrva7Xjg,166
src/rules/macos__process_creation__proc_creation_macos_creds_from_keychain.lucene,sha256=Tck1GK24rxWs3NTLeHa2ghCAt2nAV5HeBXXzO8XaOlI,150
src/rules/macos__process_creation__proc_creation_macos_creds_from_keychain.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_csrutil_disable.eql,sha256=iPavGtL2HkMtKQF5RWIku1UhVuybRMqk1TyoTr3Lx7I,56
src/rules/macos__process_creation__proc_creation_macos_csrutil_disable.lucene,sha256=Q-AHpl57WhK85pX3MIt49vPXwNVf2YJIQAUU-eDbTvY,43
src/rules/macos__process_creation__proc_creation_macos_csrutil_disable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_csrutil_status.eql,sha256=O9vgiLtLCILARR9MqSYpipM7IX3rAnnt4w8XJtZ9rZ4,55
src/rules/macos__process_creation__proc_creation_macos_csrutil_status.lucene,sha256=BaAXy6ilWM7yPoqfLTEGacN0CZryUnlHFwuIKs8xfP0,42
src/rules/macos__process_creation__proc_creation_macos_csrutil_status.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_disable_security_tools.eql,sha256=gkdTq4kKU0RO10G2NcRkYIf1951ii_hT0Ig6ywDORH4,601
src/rules/macos__process_creation__proc_creation_macos_disable_security_tools.lucene,sha256=DllW4cyPCxt7qZVZiqKwN5MUJr4tOA-mZ8qvAzQwJxk,583
src/rules/macos__process_creation__proc_creation_macos_disable_security_tools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_dscl_add_user_to_admin_group.eql,sha256=1A-gAf4S6J1j0BusJHf1iBWOKc6tI7GkD0HZfesTg9U,131
src/rules/macos__process_creation__proc_creation_macos_dscl_add_user_to_admin_group.lucene,sha256=Uz6Yj31YQ8i9tzEVqsC8VhnHxzLpoEHUE6lStXo7TQk,123
src/rules/macos__process_creation__proc_creation_macos_dscl_add_user_to_admin_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_dseditgroup_add_to_admin_group.eql,sha256=L-IyWNodO869A7BxCHwubk-EiYHM1_3r-ZiomZ9UGCg,144
src/rules/macos__process_creation__proc_creation_macos_dseditgroup_add_to_admin_group.lucene,sha256=P6FkdNrUp5nvcm2raN_DBnbjPeAOU4VFFJ10fr0qYio,135
src/rules/macos__process_creation__proc_creation_macos_dseditgroup_add_to_admin_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_dsenableroot_enable_root_account.eql,sha256=TKseVr-MQFElbHaTA8fMtgVFSROnNccLUAqeISjVNmk,64
src/rules/macos__process_creation__proc_creation_macos_dsenableroot_enable_root_account.lucene,sha256=Bj_WOeE-1pCPC52qBxA3kzcNiHZv3OtvP3UPwrmP86g,54
src/rules/macos__process_creation__proc_creation_macos_dsenableroot_enable_root_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_file_and_directory_discovery.eql,sha256=iRgyCf1ZSjFG29Dt4onCnXH0oRUhX3GEOP1X-ZowaPY,182
src/rules/macos__process_creation__proc_creation_macos_file_and_directory_discovery.lucene,sha256=l-9UMsRxbMBUyLwo4olAGx3SryVVeJOWeqUYtTRxaz4,166
src/rules/macos__process_creation__proc_creation_macos_file_and_directory_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_find_cred_in_files.eql,sha256=l6v52mJh1N0W-Wr4ioK7lXBr6iLHnRDaI6Bcp1cjhBM,83
src/rules/macos__process_creation__proc_creation_macos_find_cred_in_files.lucene,sha256=jcwFAHzPhO_bwSg40ekjxH2xcn81UNWT6fd8PFwirQo,68
src/rules/macos__process_creation__proc_creation_macos_find_cred_in_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_gui_input_capture.eql,sha256=iSbwrxcVtIu4XTtiFxLUkYsf3Wfe0o3Q6wHXAf-d37M,283
src/rules/macos__process_creation__proc_creation_macos_gui_input_capture.lucene,sha256=FPFU40qwmUC-Bw1fmAQnCyCoXR-gv8p4-cq1edkTkf8,257
src/rules/macos__process_creation__proc_creation_macos_gui_input_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_hdiutil_create.eql,sha256=aHb-Vtnad0M1wlTAOTH2CUa0AWCGxr8-B6Mif10T4fw,55
src/rules/macos__process_creation__proc_creation_macos_hdiutil_create.lucene,sha256=Ngtkylg7OvOfMcYfGOK4AiJgm7MmjB1PFnsK-03JOTA,42
src/rules/macos__process_creation__proc_creation_macos_hdiutil_create.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_hdiutil_mount.eql,sha256=CIqKK5ipsiKYgtbJgoNDL2YHiw77ZEZdnKM9EhqwXG0,78
src/rules/macos__process_creation__proc_creation_macos_hdiutil_mount.lucene,sha256=Ua8Zbnbqhno8494fa1_HFuUPRRmTvgsmP6p9CfaTpLs,61
src/rules/macos__process_creation__proc_creation_macos_hdiutil_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_installer_susp_child_process.eql,sha256=ijiyCwK8R6Iwr3IZyBIYj9AKrfcB7TRYOBrJ8hh4UNE,282
src/rules/macos__process_creation__proc_creation_macos_installer_susp_child_process.lucene,sha256=bQXwlugMy-fE9PL0ZsfErOleV2V-4E5DZNbn83bZPDQ,262
src/rules/macos__process_creation__proc_creation_macos_installer_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_ioreg_discovery.eql,sha256=EfKP42UMIAHwZv_7XIrHd3sHa6SWHCXDPrpzD_bXnf0,248
src/rules/macos__process_creation__proc_creation_macos_ioreg_discovery.lucene,sha256=nt_NbiRZx3gJlrBNawGUvQyu-cSFsPcM3L1mhu3AMKU,223
src/rules/macos__process_creation__proc_creation_macos_ioreg_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_jamf_susp_child.eql,sha256=80tK-1Q3fnyLSfR2VIr4tKA1-qLr41fOO9ISUAhASRs,68
src/rules/macos__process_creation__proc_creation_macos_jamf_susp_child.lucene,sha256=uI-_Eg5nlhDWlk75KzqZ-IYvJAWnaprPd4fOZY5E55g,51
src/rules/macos__process_creation__proc_creation_macos_jamf_susp_child.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_jamf_usage.eql,sha256=UGlkT0RFIBwZfyEwLbyXUhWcjrrg9YpXbGcLCuAGBno,164
src/rules/macos__process_creation__proc_creation_macos_jamf_usage.lucene,sha256=VmRppHwRRIVhuG_v9ndYlRP4eQoCLrMjZGdUmjtyw8Q,145
src/rules/macos__process_creation__proc_creation_macos_jamf_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_jxa_in_memory_execution.eql,sha256=zH9myeXTrdAawAswJqjBBmRSscFFJoC2gZQmB36BLOg,220
src/rules/macos__process_creation__proc_creation_macos_jxa_in_memory_execution.lucene,sha256=McBB9J-25uDqgmpKDkMq7OBQXCTOmVleK3JRtf91CGQ,202
src/rules/macos__process_creation__proc_creation_macos_jxa_in_memory_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_launchctl_execution.eql,sha256=htmoK8OW_L8KoIHiMfUzI1Johuv3sGt6oOMonC6s2HQ,88
src/rules/macos__process_creation__proc_creation_macos_launchctl_execution.lucene,sha256=Y3poP9Vj_JAW9Ssst_kUvp0N1PLDjx2auNKTNXCcQuU,69
src/rules/macos__process_creation__proc_creation_macos_launchctl_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_local_account.eql,sha256=W8cGaVzIVB9o-pMsq3a6NjmATqvusZ-s0sxvX8CXnuA,322
src/rules/macos__process_creation__proc_creation_macos_local_account.lucene,sha256=LBMFiJAzlGH2gEzIUbpT_4r6CPNgHfmrgGdUDLm4E3I,296
src/rules/macos__process_creation__proc_creation_macos_local_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_local_groups.eql,sha256=cSNP4MjEU5kn2osnOB6DypeTMm762ftjsgPkOkta9JE,211
src/rules/macos__process_creation__proc_creation_macos_local_groups.lucene,sha256=t72GdhOrh18LdTnF-26uC-ySASeW1Vk1zrJDDEoNJwI,193
src/rules/macos__process_creation__proc_creation_macos_local_groups.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_network_service_scanning.eql,sha256=G82PkFb5pvy8Y4WdgwdRWEhRLAoiQtEDL0X9Q4k7B2s,115
src/rules/macos__process_creation__proc_creation_macos_network_service_scanning.lucene,sha256=cH-2GFexACL2rQTAe5dit_7jopwq1phpytQQSs2qXvE,91
src/rules/macos__process_creation__proc_creation_macos_network_service_scanning.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_network_sniffing.eql,sha256=LJA3QV75OXCn9sNRcJq2Bo53SufTmtEQXL4ztEPTyu0,48
src/rules/macos__process_creation__proc_creation_macos_network_sniffing.lucene,sha256=ftQRuZ5EdI_wp04bY_OauMjaYeS1_k8bqDTGW35Lxjs,32
src/rules/macos__process_creation__proc_creation_macos_network_sniffing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_nscurl_usage.eql,sha256=RvksmvzeQfAUBhMBDosV5R5HqvY80x8Gc_sSd_RDjN0,150
src/rules/macos__process_creation__proc_creation_macos_nscurl_usage.lucene,sha256=PNknRT_VG8qkf3jfTQtZkohJJfpkcEpzbuSDi4VI-eM,148
src/rules/macos__process_creation__proc_creation_macos_nscurl_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_office_susp_child_processes.eql,sha256=maPqJ-tVCD7zHJIz4TH_pIf_-e2khrS9pIeP1p0NG_A,263
src/rules/macos__process_creation__proc_creation_macos_office_susp_child_processes.lucene,sha256=XROa6mfZLHLSJKbVYi_N5f5F6_jRe97FmSSI-oYHKTQ,252
src/rules/macos__process_creation__proc_creation_macos_office_susp_child_processes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_osacompile_runonly_execution.eql,sha256=hRR-YnmgbAqKpmTTPd9r5xeCaD-YrYJBjRJbtx7RSuE,87
src/rules/macos__process_creation__proc_creation_macos_osacompile_runonly_execution.lucene,sha256=kE19R330idw8zcv4-1cQPdqH8DiHIUVVcEHGMtJhCoc,77
src/rules/macos__process_creation__proc_creation_macos_osacompile_runonly_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_payload_decoded_and_decrypted.eql,sha256=DGAW3D5IrP-1sPOuFfHry7GWZuYk525B443AzGwdEmk,137
src/rules/macos__process_creation__proc_creation_macos_payload_decoded_and_decrypted.lucene,sha256=zeCJPrQ5P2wrqAfBgBLV7NtNpsKeB5yhNmfFVY5jlWM,124
src/rules/macos__process_creation__proc_creation_macos_payload_decoded_and_decrypted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_persistence_via_plistbuddy.eql,sha256=N-rSugCWAjOuyzJK0xTrDRyWQiSU6BPI3Ns6N5_0UTg,150
src/rules/macos__process_creation__proc_creation_macos_persistence_via_plistbuddy.lucene,sha256=Io1_CWWFujx7fhVDKkA6abrJJZuywKVd-iD6IUn1SPc,127
src/rules/macos__process_creation__proc_creation_macos_persistence_via_plistbuddy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_meshagent_arguments.eql,sha256=hskdsGtPlgY1gKyvknAG7oHlDxmbL1-7fYZ_wGfXOwU,44
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_meshagent_arguments.lucene,sha256=8mPmDUEgBZGscarJp80bStDVBfOtcuBtuAXhzU16xxU,34
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_meshagent_arguments.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_renamed_meshagent_execution.eql,sha256=I5Y9_10XJSk2W9eukGMST7AQZfweWtxf3xO5x75D_HU,141
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_renamed_meshagent_execution.lucene,sha256=Ysk2GSYvDC2zlbfuaGljicdBBbwkufjED8d_n2Z9y5A,123
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_renamed_meshagent_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.eql,sha256=JuBU7I_DkcIcu4OMdV_SnwMtjLcoevp86zjk7-rCySE,143
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.lucene,sha256=CUseXHsjfgej1nTtIPly3VVlIoR7ZKUIh2NjUXUkf2o,138
src/rules/macos__process_creation__proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_remote_system_discovery.eql,sha256=QQlwlJthbEb-dZ-VvS-CwngzsnMwnIyNqTvAKSMblZQ,369
src/rules/macos__process_creation__proc_creation_macos_remote_system_discovery.lucene,sha256=ykvTJqYwbMihwzt18vikY_vAYCQramSP0nruOosA-dE,368
src/rules/macos__process_creation__proc_creation_macos_remote_system_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_schedule_task_job_cron.eql,sha256=4E2lzrN7aWQyk1BKJ3eZYI1FIF14mi2zuMAu8pAokxk,54
src/rules/macos__process_creation__proc_creation_macos_schedule_task_job_cron.lucene,sha256=fNEzdVqCniIIbXGBB2PElTCTvFVsqUiUcL3oNQ0vMeY,43
src/rules/macos__process_creation__proc_creation_macos_schedule_task_job_cron.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_screencapture.eql,sha256=CrwstBWOa18STPX-_5VkM7HC-YZIiu0FgzW3XhpqzIs,42
src/rules/macos__process_creation__proc_creation_macos_screencapture.lucene,sha256=ueYYqtl1WTpvj5SIpugygDiYxvL_5XagDm1us8_8Li4,33
src/rules/macos__process_creation__proc_creation_macos_screencapture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_security_software_discovery.eql,sha256=sTkZkyKXEo-sDxbrPWoOjdo-cPIqvCXuIU-eNV8Lloc,266
src/rules/macos__process_creation__proc_creation_macos_security_software_discovery.lucene,sha256=-q9i8OGld7slE9ZzY96YFT2IfZc2iCobpMx2YCU9yv4,246
src/rules/macos__process_creation__proc_creation_macos_security_software_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_space_after_filename.eql,sha256=EfnpqF02B0cWqSVwl_BEJWZlAjymodYfEYx_1R2R97Y,41
src/rules/macos__process_creation__proc_creation_macos_space_after_filename.lucene,sha256=CZfnY4PeYzE3GzO7ruNkkm1dsS9mFsNk4ejV3bW-DDY,29
src/rules/macos__process_creation__proc_creation_macos_space_after_filename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_split_file_into_pieces.eql,sha256=sfauc5d9RRM3iIlHrrO7zF56jVftFcgPh616mhNmCI4,26
src/rules/macos__process_creation__proc_creation_macos_split_file_into_pieces.lucene,sha256=phMFNjsP7QdiX0sqoSo1QVqwpKnve27zSTXKHRq1sEc,15
src/rules/macos__process_creation__proc_creation_macos_split_file_into_pieces.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_browser_child_process.eql,sha256=9CF4MR__tJWaJXCHnI2XFu4RKwgKMJVY51jzuYBkeaY,1311
src/rules/macos__process_creation__proc_creation_macos_susp_browser_child_process.lucene,sha256=LvvWcaoiScrsSlYCOywDuGDnjA8j_HKXr0t24RBUyUE,1324
src/rules/macos__process_creation__proc_creation_macos_susp_browser_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_execution_macos_script_editor.eql,sha256=GlgSRIqBcowVbWvG-1cL4OlgkXmbgMji9YsAXwM_dWc,303
src/rules/macos__process_creation__proc_creation_macos_susp_execution_macos_script_editor.lucene,sha256=QbbMp3PD-5SgQL-vC_QwRrVtDrzAFRaYAi1mQopcRLs,295
src/rules/macos__process_creation__proc_creation_macos_susp_execution_macos_script_editor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_find_execution.eql,sha256=6BVn4yTW_hilgY4XzRcoX0MjhPwryfACgzoKW4Aymzk,180
src/rules/macos__process_creation__proc_creation_macos_susp_find_execution.lucene,sha256=-SLDNN_kkSvcChSwEPtJQLgEIbh9VXH1W3wOHhzB9n4,188
src/rules/macos__process_creation__proc_creation_macos_susp_find_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_histfile_operations.eql,sha256=tKRq0QnD_0ssrsvEo5BZtlxNTMso8FURw4YtJBaZSJk,130
src/rules/macos__process_creation__proc_creation_macos_susp_histfile_operations.lucene,sha256=A9Kjkbq_IuEnMIlDaWR_QIScgrWB7DNgS1gUxyfbYSw,112
src/rules/macos__process_creation__proc_creation_macos_susp_histfile_operations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_in_memory_download_and_compile.eql,sha256=Q-XJwOFUu3s7enH3rpuyIwQpjkYF-7ks_95sRtaUkJ8,62
src/rules/macos__process_creation__proc_creation_macos_susp_in_memory_download_and_compile.lucene,sha256=35N25px4q2GMtWU7bTa00bI9l2MDhLeEFM7HZ-El1pA,48
src/rules/macos__process_creation__proc_creation_macos_susp_in_memory_download_and_compile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_macos_firmware_activity.eql,sha256=AS_d6KELkCbO8FQNgiBNV7z2obvG4xN92s60_M5tObs,116
src/rules/macos__process_creation__proc_creation_macos_susp_macos_firmware_activity.lucene,sha256=qdXXVv_v-pa2rKskQQSoUbnhLgbXpOA_U44AoRbl0fA,99
src/rules/macos__process_creation__proc_creation_macos_susp_macos_firmware_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_susp_system_network_discovery.eql,sha256=I7KTkAowgPBaPn9RyhuTM-Viyp6rXL8eWSM6tY3eDVA,254
src/rules/macos__process_creation__proc_creation_macos_susp_system_network_discovery.lucene,sha256=pJSebzQdS75AKZ0CagD_O1JnmwUJduihO8ArDrhWV_g,240
src/rules/macos__process_creation__proc_creation_macos_susp_system_network_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_suspicious_applet_behaviour.eql,sha256=DK1H87FVOXoG7ofTiEQVOWZ_Hnu-JQ441RwfRjj2ff0,89
src/rules/macos__process_creation__proc_creation_macos_suspicious_applet_behaviour.lucene,sha256=IKDA06Rov5-84jWA_GVVWDildZ1HMs3ECf8kmikMeWI,71
src/rules/macos__process_creation__proc_creation_macos_suspicious_applet_behaviour.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_swvers_discovery.eql,sha256=tAHGDnsnW0nw125GTgXE42eU_tbgKT1Az27c2DRwqOU,111
src/rules/macos__process_creation__proc_creation_macos_swvers_discovery.lucene,sha256=Gg3LZhvAsehG8AA8bIfBMjYsfgnmOCvHpMcsD59ih4A,95
src/rules/macos__process_creation__proc_creation_macos_swvers_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_add_user_to_admin_group.eql,sha256=MZThoHKaCvlY9iF5YV8oJRleBOO4ehZaJUJJy2ZMFiI,94
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_add_user_to_admin_group.lucene,sha256=1eg-yCidU7NOQOrUUS7TdeWx3tRmYJGVFu5B8ojqJng,85
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_add_user_to_admin_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_enable_guest_account.eql,sha256=j0I_JN9vSG0rSPLvcm44sk6yxaioN5ZzlDlRVcb5hJw,93
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_enable_guest_account.lucene,sha256=anvsfujwvOceaFI9nzo60iEzv5jOsePHALkFGlLSCgQ,81
src/rules/macos__process_creation__proc_creation_macos_sysadminctl_enable_guest_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_sysctl_discovery.eql,sha256=Bxs2IFc7Q2FD-xct2omf4-m8LiSsruM0w7z_s5T7T2E,114
src/rules/macos__process_creation__proc_creation_macos_sysctl_discovery.lucene,sha256=ynwQQoT-CukCTH8gQHVaKjMwlOqzTGWB1WGz_CFaL-E,93
src/rules/macos__process_creation__proc_creation_macos_sysctl_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_system_network_connections_discovery.eql,sha256=wE7u1UO5UtgIrQu-c-iielRU-mx4n5aWs5HrjhHsq7o,72
src/rules/macos__process_creation__proc_creation_macos_system_network_connections_discovery.lucene,sha256=nokAwpY7_6EOl1wcURjCcEKdXTil-B0uERQn3oU5w0M,59
src/rules/macos__process_creation__proc_creation_macos_system_network_connections_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_system_profiler_discovery.eql,sha256=JHASMEW-m5SZlhlCi9TKiE4mJdGZfKjJ-48Tz7D6lXE,192
src/rules/macos__process_creation__proc_creation_macos_system_profiler_discovery.lucene,sha256=rBNPI3lW1XoLG1yG9SNaBrTIfukYnp55E3KH3jaI_P4,171
src/rules/macos__process_creation__proc_creation_macos_system_profiler_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_system_shutdown_reboot.eql,sha256=blpXcN_2tnBXyYHSHUF6ul1Rt1Ub3vHpUIkv8dV_17k,59
src/rules/macos__process_creation__proc_creation_macos_system_shutdown_reboot.lucene,sha256=aTS7a6OJ5sI91YEhtc1juma4noP-gOwwzRr8oUzyRJE,44
src/rules/macos__process_creation__proc_creation_macos_system_shutdown_reboot.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_tail_base64_decode_from_image.eql,sha256=PFyGkSJ3VEabFMuNXkvV31aV6ynRtxq7UeQiaS33R24,280
src/rules/macos__process_creation__proc_creation_macos_tail_base64_decode_from_image.lucene,sha256=SGQC55lr1FmID6fi0qZXx-WP_YKCfQLjUopqhdeQr6k,254
src/rules/macos__process_creation__proc_creation_macos_tail_base64_decode_from_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_tmutil_delete_backup.eql,sha256=4qjXHxS-_HOq6v2muqnryN8L-GbMnXTw_Z4UymK2nnU,82
src/rules/macos__process_creation__proc_creation_macos_tmutil_delete_backup.lucene,sha256=TwmgB7JYM6-skJI3OYpIzLzISrbll55dqGjcrvLb6YM,67
src/rules/macos__process_creation__proc_creation_macos_tmutil_delete_backup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_tmutil_disable_backup.eql,sha256=QtBlKBU6FvmHlwSQSrQ8vzR00nzhN4t5xq9uW7YZW4w,83
src/rules/macos__process_creation__proc_creation_macos_tmutil_disable_backup.lucene,sha256=0DT7JudjBL_hJ3eUKG9dpYgpVFTKQ_e811q8V0wUG48,68
src/rules/macos__process_creation__proc_creation_macos_tmutil_disable_backup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_tmutil_exclude_file_from_backup.eql,sha256=wC4IWU3psDImd4w7xIeOSYev-CQiKVcLDe8wdkV6ccY,88
src/rules/macos__process_creation__proc_creation_macos_tmutil_exclude_file_from_backup.lucene,sha256=tzRpQacKDQjRXcNeA2I6lA9vxss4XsvsPDgAJIN9YYE,73
src/rules/macos__process_creation__proc_creation_macos_tmutil_exclude_file_from_backup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_wizardupdate_malware_infection.eql,sha256=EiP7ihy22tSFiFPmJiFk0tPFPf1AkuLf3_sVkafnxY4,142
src/rules/macos__process_creation__proc_creation_macos_wizardupdate_malware_infection.lucene,sha256=ekqbq2Meb4k26CG1Vvcz_B4EfO2dy033SrSS3dguPD0,127
src/rules/macos__process_creation__proc_creation_macos_wizardupdate_malware_infection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_xattr_gatekeeper_bypass.eql,sha256=BIbh8nwAh4RNzFI3joVxMHirgqayHYpCag7o39zMyWY,92
src/rules/macos__process_creation__proc_creation_macos_xattr_gatekeeper_bypass.lucene,sha256=asYL2wpgbVgt9DTWjgZLQ8CKGRdkfP4iYl_qrxPi6rE,78
src/rules/macos__process_creation__proc_creation_macos_xattr_gatekeeper_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/macos__process_creation__proc_creation_macos_xcsset_malware_infection.eql,sha256=og31_oSie2Bv_GiP18EQZnDOhnav-ZbjGgs1W9XLYHA,571
src/rules/macos__process_creation__proc_creation_macos_xcsset_malware_infection.lucene,sha256=n7B64dJ86Gyd6vg2Mw31HRA3AOInI5A8lgLhXoCJE64,557
src/rules/macos__process_creation__proc_creation_macos_xcsset_malware_infection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_clear_logs.eql,sha256=A7_I9HDFK_MlJFsFwxsaVl9322d_KKDckKZSn4Un_aI,45
src/rules/network__cisco__aaa__cisco_cli_clear_logs.lucene,sha256=4GaW2gaA2lcvi8ZoG0hpg5IGGjddcXbBOBKw0dpwJKE,37
src/rules/network__cisco__aaa__cisco_cli_clear_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_collect_data.eql,sha256=LTCqqBRv3cPXaF6iYbbCyUeEVlcTq9SiWMCOBfCVYxo,92
src/rules/network__cisco__aaa__cisco_cli_collect_data.lucene,sha256=OcmuA9NHHpk6FMnZc3WSLKrquPg-8SQuYPJoCXUrYBc,88
src/rules/network__cisco__aaa__cisco_cli_collect_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_crypto_actions.eql,sha256=0XKHQw7Xen_MTmjaE1oa2RgLyta2V27wV93KIpUYGX8,80
src/rules/network__cisco__aaa__cisco_cli_crypto_actions.lucene,sha256=zMQ1qRMqokPwThxQe_3BpQOppsQfptbVZJohirIk9eE,76
src/rules/network__cisco__aaa__cisco_cli_crypto_actions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_disable_logging.eql,sha256=8DQHkcjbEptKuzlch7Th4RVGGfrWjJBC3yxcJJzOxPA,45
src/rules/network__cisco__aaa__cisco_cli_disable_logging.lucene,sha256=5PS3DK3oggQPwxipxugDxGthmah7eKgCFzZMMDKK_e4,39
src/rules/network__cisco__aaa__cisco_cli_disable_logging.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_discovery.eql,sha256=jQkEl8AvMN4GSZskK-Idb0-wi8sJKoe2DVOgu9BXxlE,191
src/rules/network__cisco__aaa__cisco_cli_discovery.lucene,sha256=GDogSkoXIpeMT3OagImNuq-UyWpL6bpSYK3728tM74k,194
src/rules/network__cisco__aaa__cisco_cli_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_dos.eql,sha256=JNgxwgutVFJT_SSvxwQFeslEYOosIuYBq1RnGBxKtpE,77
src/rules/network__cisco__aaa__cisco_cli_dos.lucene,sha256=J_k3LaOCCCRmpjGCoMSzSBO4F8WeIjCzyrNZCq-sa0A,71
src/rules/network__cisco__aaa__cisco_cli_dos.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_file_deletion.eql,sha256=Wg0EADBk4KZa_N3DrnFd80lH6BONxdCORQMDapedhUg,42
src/rules/network__cisco__aaa__cisco_cli_file_deletion.lucene,sha256=GbPwg82WvkKK9hwtowDt-OgpzjVO0KCkCTdeNJHdAi0,32
src/rules/network__cisco__aaa__cisco_cli_file_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_input_capture.eql,sha256=NArJesA5K6vC5uwD9FTh-nuY0H3A4gG2JSyhmWEZ9cI,65
src/rules/network__cisco__aaa__cisco_cli_input_capture.lucene,sha256=GLFNRMWPWhwR8ytq_rnWo9aWny8nK4lt6UdvGgfT-8Y,59
src/rules/network__cisco__aaa__cisco_cli_input_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_local_accounts.eql,sha256=vxyOpFBPDbdb-DuMxJGpHE82oHTuGnPtHZggqQiFodM,30
src/rules/network__cisco__aaa__cisco_cli_local_accounts.lucene,sha256=q1p-9QWbk-pALeiY3Hqh27gh9bQp7nHqTh98EZ_JNGE,20
src/rules/network__cisco__aaa__cisco_cli_local_accounts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_modify_config.eql,sha256=dD_4CBQO0f7Adq-SsXjU2xF6IJDIqTWEaKe9Lew8oRs,183
src/rules/network__cisco__aaa__cisco_cli_modify_config.lucene,sha256=KpOYdfIKptSS1AvBx9AhH2KYJJ-KFMup2INJwc1n-KQ,186
src/rules/network__cisco__aaa__cisco_cli_modify_config.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_moving_data.eql,sha256=x_nz4rm-X-XAzV2XbN9kZFr0dWX3dzC3575c_d7fess,86
src/rules/network__cisco__aaa__cisco_cli_moving_data.lucene,sha256=1-dv83Wu2x1xEVmwoOvG-Aj0tZg_dH8QMOc71EdnsbA,78
src/rules/network__cisco__aaa__cisco_cli_moving_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__aaa__cisco_cli_net_sniff.eql,sha256=nFJRYTdoB-XHlndWtZeAVZTGKUKhy0ihk-Hc8feEix0,63
src/rules/network__cisco__aaa__cisco_cli_net_sniff.lucene,sha256=LWjR-RFqVnQptYVD1DWGnSVU1VACHWocAtOYYMJlCqY,57
src/rules/network__cisco__aaa__cisco_cli_net_sniff.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__bgp__cisco_bgp_md5_auth_failed.eql,sha256=RCpJwKSWanNM9DFz6Rs3O5w-ZK4sAgES_MiiGpD3Q4k,40
src/rules/network__cisco__bgp__cisco_bgp_md5_auth_failed.lucene,sha256=DG3qQHIkGwXNm4bdmTG87VBnv6YAmUGDHNDeLJ4yvNE,34
src/rules/network__cisco__bgp__cisco_bgp_md5_auth_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__cisco__ldp__cisco_ldp_md5_auth_failed.eql,sha256=7bbcjUtXyZpqP5E3IhNcXEQrg9P1zbLvUypeu2qJsGQ,80
src/rules/network__cisco__ldp__cisco_ldp_md5_auth_failed.lucene,sha256=sbHQ_oqfekU83hQVqDBaLekUz1wvr2hZCnD6mhgBxQ4,70
src/rules/network__cisco__ldp__cisco_ldp_md5_auth_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_external_service_interaction_domains.eql,sha256=Di4l9SZxT2xcuOfDU-SmambIfECHyuG61wjre7uAvsc,561
src/rules/network__dns__net_dns_external_service_interaction_domains.lucene,sha256=qPta8dwOrRxPxsiZL52NFNAcidh0ZMU-ffPTvcgMy7U,543
src/rules/network__dns__net_dns_external_service_interaction_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_mal_cobaltstrike.eql,sha256=hcby-3i2mSVLRk0LEpd_505CgZjn5TtsZXVpTYCPYAI,79
src/rules/network__dns__net_dns_mal_cobaltstrike.lucene,sha256=-2x6eXgrYWdoCEFn3Ci3WtaaOeQhQdpzY_CSPIeyaWw,59
src/rules/network__dns__net_dns_mal_cobaltstrike.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_pua_cryptocoin_mining_xmr.eql,sha256=T_JcOiTq9xhrQ9FlBjPPn6OYzBjMhF0B7Scgn22F9Ok,493
src/rules/network__dns__net_dns_pua_cryptocoin_mining_xmr.lucene,sha256=Beoi1autWyL6PjNKiAynxohglc6kZEu8rBQsPtUOGSc,485
src/rules/network__dns__net_dns_pua_cryptocoin_mining_xmr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_susp_b64_queries.eql,sha256=Y-cjA1JCC3A1coqSWmV82FaNc5T5h-bd_q_0HFglek4,24
src/rules/network__dns__net_dns_susp_b64_queries.lucene,sha256=_-E4lGlW2Er4Ox7jHrejL-hSHi38ZQ6KDuNcUQCGajQ,14
src/rules/network__dns__net_dns_susp_b64_queries.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_susp_telegram_api.eql,sha256=SWjKElMSb0XLrmtJWnbW2ZHf0onR3GsazJE5ZseadrI,35
src/rules/network__dns__net_dns_susp_telegram_api.lucene,sha256=DyiaEFF-RSCMYxKpjolD_f5Xu9ieKDodp9lHJNlblXg,23
src/rules/network__dns__net_dns_susp_telegram_api.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_susp_txt_exec_strings.eql,sha256=73I-2b37yfqR764z33ixnKpFdWupyqKHv56b86juvI4,93
src/rules/network__dns__net_dns_susp_txt_exec_strings.lucene,sha256=mm7a178oU4YKgRwk4Y2-IXspOq0V55yZv3aVCm0rioM,74
src/rules/network__dns__net_dns_susp_txt_exec_strings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__dns__net_dns_wannacry_killswitch_domain.eql,sha256=OmvYFwJmxCZ5CMOsXpT6q7wxv_AB_udJTd9XvV_unSM,273
src/rules/network__dns__net_dns_wannacry_killswitch_domain.lucene,sha256=hTUNgASBdex17LrxveSo-GbHNl0Cs5KMx1FlNNiIPik,255
src/rules/network__dns__net_dns_wannacry_killswitch_domain.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__firewall__net_firewall_cleartext_protocols.eql,sha256=SG-_gL1Utz74cv1xYj-LF1kgadUiXHqNDO3Y4Egef_A,187
src/rules/network__firewall__net_firewall_cleartext_protocols.lucene,sha256=F3-tJwrkOxnNNXpH_WnBYh_J7c5bKZ-oxs_Z96dQv1M,193
src/rules/network__firewall__net_firewall_cleartext_protocols.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_admin_account_created.eql,sha256=C32wrV_fIW3nvrpZ7a5tEQ7TN-5k59ohCCqn93bpzbg,50
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_admin_account_created.lucene,sha256=E-jA0Eo-FwB0B6kjEGJ5TKNCwLbAhCwRg28vaakBE4U,36
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_admin_account_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_address_object.eql,sha256=V122IVZR-mHxgDtxwudiryVV9qAWwhnXFC8bo98T7JU,54
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_address_object.lucene,sha256=4dZirELbjClGVHOhUEy6foq1MOwA5uuAFVQh4oF2Se0,40
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_address_object.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_policy_added.eql,sha256=5lXMW13J8cQE5xkZW-TqNcFhZtGOKEF720akIcg8Sxc,53
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_policy_added.lucene,sha256=XoOD6EEQ2BEU57u7aQKFjfqlYAqnU_rI-76QgOfVJ8Y,39
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_firewall_policy_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_local_user_created.eql,sha256=3B2HqE9cXNhdUYDRILLYMfa-Xc190JuhsMSG6AK1wKE,48
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_local_user_created.lucene,sha256=xChIAuJVhUl2tdUu56KnOvvVkb-vmSfSlCkyhbPaONo,34
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_local_user_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_vpn_ssl_web_portal.eql,sha256=vrSSeaeURNjxyaRdyBfwPvGlItvIk3aU45oVgO-6SaU,56
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_vpn_ssl_web_portal.lucene,sha256=0dBwMEgSwsJQyturvi__RXx9KN6_W0VPYVcG3hjydnU,42
src/rules/network__fortinet__fortigate__fortinet_fortigate_new_vpn_ssl_web_portal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_user_group_modified.eql,sha256=VKXksV_ImUMIH33p5RYY9xlY5vewQxGQdcd3cShmTDQ,49
src/rules/network__fortinet__fortigate__fortinet_fortigate_user_group_modified.lucene,sha256=tkRXI-J4_6_mVZsgEP7FKmvp3VaKvmBqWzB3AStBXKM,35
src/rules/network__fortinet__fortigate__fortinet_fortigate_user_group_modified.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__fortinet__fortigate__fortinet_fortigate_vpn_ssl_settings_modified.eql,sha256=utiQfgUo9j-u-b2xbSWmsPn4wUy5pN9CgPHxx1whFzQ,55
src/rules/network__fortinet__fortigate__fortinet_fortigate_vpn_ssl_settings_modified.lucene,sha256=oVGpNJ8GVcAvf2UaUODMsUwkVDNrnB7i7LlWuy418Pg,41
src/rules/network__fortinet__fortigate__fortinet_fortigate_vpn_ssl_settings_modified.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__huawei__bgp__huawei_bgp_auth_failed.eql,sha256=krhpwucPY84V-wi4HNufnAFHVeYxEyufGP4MfHqg_m0,39
src/rules/network__huawei__bgp__huawei_bgp_auth_failed.lucene,sha256=mBLAApEDjgRrvNSQXW6nip6gHqExxwfYuqNy1LDk8Jg,30
src/rules/network__huawei__bgp__huawei_bgp_auth_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__juniper__bgp__juniper_bgp_missing_md5.eql,sha256=Wm4C_4QRGpwFAv3J_nsCzz12ENPQs0VU7cSW4u4OOiI,42
src/rules/network__juniper__bgp__juniper_bgp_missing_md5.lucene,sha256=QQiGT8HWKCSCQmyMrdgEAColjWeLahIgm0v9xdK7Dvw,35
src/rules/network__juniper__bgp__juniper_bgp_missing_md5.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_execution.eql,sha256=PygTHpEF_aB8HSTP1SIEaATxTNg9-iq1GEPAHeonVlU,593
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_execution.lucene,sha256=w1PrjraaKsAgj5XA1JuJu3931SCo0Puq-Z3vWu3Plt4,543
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_persistence.eql,sha256=ZlCeJ5Z-Q514S1c_zwViGpkQU6YFq18MbipHZdeJK3k,405
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_persistence.lucene,sha256=BSKGZM0bnkkNoEcQREuRGanMevvOYTTJJqXFWvdtgGY,371
src/rules/network__zeek__zeek_dce_rpc_mitre_bzar_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dce_rpc_potential_petit_potam_efs_rpc_call.eql,sha256=P_tvRhqOCIwdeoViaWwF7dujM-nj4y7uWXoSNgndD2Q,27
src/rules/network__zeek__zeek_dce_rpc_potential_petit_potam_efs_rpc_call.lucene,sha256=qsee0y8cSa5sSzUkgKeuXTSE2ZzRfU5CBvrDdVVyJ4g,15
src/rules/network__zeek__zeek_dce_rpc_potential_petit_potam_efs_rpc_call.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dce_rpc_smb_spoolss_named_pipe.eql,sha256=OBkselzBcPVBj8N8wbZ8DQM4Oq1LfSBHgeSWfV8IqJw,42
src/rules/network__zeek__zeek_dce_rpc_smb_spoolss_named_pipe.lucene,sha256=azl3Q2PJpFXDw-M1XA6k-rCLBCfxKNq5AmD2IUQxPA0,28
src/rules/network__zeek__zeek_dce_rpc_smb_spoolss_named_pipe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_default_cobalt_strike_certificate.eql,sha256=EGpw0bZ6XL8XP8vQJ-p8bPZAsdFpY1WNp36oVDi0SZ8,39
src/rules/network__zeek__zeek_default_cobalt_strike_certificate.lucene,sha256=NrR1sN7rwQ0ltz25iKTWpVrgzCdEV_EEJJIvuH7F4oY,27
src/rules/network__zeek__zeek_default_cobalt_strike_certificate.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.eql,sha256=pvTC5Pyns3Oq6bnLXsdVn9H6zafMIVfXuYczetFhQno,47
src/rules/network__zeek__zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.lucene,sha256=bfgp1fga_A12Wo8ihZw5noBdTdQApvU9sFjfgR-KlWw,33
src/rules/network__zeek__zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_mining_pools.eql,sha256=fuVmrZI1ydLN_C4GfT_v5BB4p_vgfs2vyZEi6x6JTEY,1365
src/rules/network__zeek__zeek_dns_mining_pools.lucene,sha256=UQ51GWn3FUVDfhswCJnPeph3NUP7-JDzmUwTeGMvmHo,1346
src/rules/network__zeek__zeek_dns_mining_pools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_nkn.eql,sha256=kYg3S526sdTk9DqVS-jxbomzB0I6phQDsXS7RyFW8hY,48
src/rules/network__zeek__zeek_dns_nkn.lucene,sha256=3wkPx6QmCr5qZ_4Zc9gx1heC6y9waMqDMiabeuUhIkI,34
src/rules/network__zeek__zeek_dns_nkn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_susp_zbit_flag.eql,sha256=EdB84dJpyCG0rb3zLsu8-hwuN7q1y-x21KEvE7wuayA,318
src/rules/network__zeek__zeek_dns_susp_zbit_flag.lucene,sha256=9h0Y_qkLP88GPEH-pkovtYTTbrKaFPh-VWsZ4Y8ekZw,291
src/rules/network__zeek__zeek_dns_susp_zbit_flag.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_dns_torproxy.eql,sha256=0IwCW30BZcQAbFwn-D8K2voKh2w9GEd9yKBuelzDPf0,773
src/rules/network__zeek__zeek_dns_torproxy.lucene,sha256=SpRebNuHnkWlTPKeqzpWXY-6A907plRTrLb__aNUR5o,760
src/rules/network__zeek__zeek_dns_torproxy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_http_executable_download_from_webdav.eql,sha256=sPs727tkQThmJmjJuxfeGnwm8iHvQonIuteHaIRRzOk,106
src/rules/network__zeek__zeek_http_executable_download_from_webdav.lucene,sha256=rHf_BOrycDdo0Yd_rUIoT-PU0e6echvRDqCoVnAmIOM,88
src/rules/network__zeek__zeek_http_executable_download_from_webdav.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_http_susp_file_ext_from_susp_tld.eql,sha256=9ys6D6sYPcqifbfo0BapXMdYLpgOB8u73wRd0xp8dso,787
src/rules/network__zeek__zeek_http_susp_file_ext_from_susp_tld.lucene,sha256=ihT5gRcaxjXur9ACxYN5_urvyuO-z1u7J2b8pM9YZZw,780
src/rules/network__zeek__zeek_http_susp_file_ext_from_susp_tld.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_http_webdav_put_request.eql,sha256=iQOu71HDj4Lr9fWyuvWc3yC5qU7bfZwzajmqghofRlg,262
src/rules/network__zeek__zeek_http_webdav_put_request.lucene,sha256=jiklggOKz9q6XrqsPm4nnGeF46BdQlyb0ytZ7Xvuyag,183
src/rules/network__zeek__zeek_http_webdav_put_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_rdp_public_listener.eql,sha256=yEc4jh7rDbNGT9UYGnm3zDr7VSMHPvX_YmEswyM4XHE,368
src/rules/network__zeek__zeek_rdp_public_listener.lucene,sha256=LbRVXDN0-4e3aWK3y8zXAHWuCjjJMpj0Nn7QLVSa4QQ,251
src/rules/network__zeek__zeek_rdp_public_listener.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_atsvc_task.eql,sha256=-zXaw9e-cim60uUgN39JPSurfPVAjNa5gS0B8goofk4,45
src/rules/network__zeek__zeek_smb_converted_win_atsvc_task.lucene,sha256=ynTo_gcTBAIu43fkVfJLYzFR7HftrKPAKQUkCV2pjnE,31
src/rules/network__zeek__zeek_smb_converted_win_atsvc_task.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_impacket_secretdump.eql,sha256=m49Neog7XxZuydWt_pUOYhlMEB_uNyZHNwIjVV6VjtM,85
src/rules/network__zeek__zeek_smb_converted_win_impacket_secretdump.lucene,sha256=sTzx8vUe2HZficekS8PiIQuDgu0nmcLylePPK-KBuj4,67
src/rules/network__zeek__zeek_smb_converted_win_impacket_secretdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_lm_namedpipe.eql,sha256=H1vMFPAYAAgDtMaV1KzWYNz-aOLQaP0K_jX4s7gNlXg,273
src/rules/network__zeek__zeek_smb_converted_win_lm_namedpipe.lucene,sha256=RTJn5WzFsXQurap9RCv4ruHtB-xra0RK2oWiDU-YqDc,261
src/rules/network__zeek__zeek_smb_converted_win_lm_namedpipe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_susp_psexec.eql,sha256=ebYFrW0WUc-KSbseLZk1hcAEHEXeg0gX1ST0FVUMLFY,126
src/rules/network__zeek__zeek_smb_converted_win_susp_psexec.lucene,sha256=Yjm-QqFWwTakwqXZF54Nb_KGP3fGgRh2ZFU9_Gg2L7I,105
src/rules/network__zeek__zeek_smb_converted_win_susp_psexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_susp_raccess_sensitive_fext.eql,sha256=64cPPr-e4o8cLepd83w_SamGc1ABwwMXixw0CsCvCNk,123
src/rules/network__zeek__zeek_smb_converted_win_susp_raccess_sensitive_fext.lucene,sha256=_OHHvqOwOwuhuG7iqVlA2L5JUAvizWFOHoFCXe1W20I,105
src/rules/network__zeek__zeek_smb_converted_win_susp_raccess_sensitive_fext.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_smb_converted_win_transferring_files_with_credential_data.eql,sha256=ilW0CGG8yg9yDbGU4k0DI2rZX-7Qyk1RilnLOe42SVY,135
src/rules/network__zeek__zeek_smb_converted_win_transferring_files_with_credential_data.lucene,sha256=98PAzdyOaz6kN2ujtTi9Os8zpc-gLBQjOTTm5E-FxCM,117
src/rules/network__zeek__zeek_smb_converted_win_transferring_files_with_credential_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/network__zeek__zeek_susp_kerberos_rc4.eql,sha256=6k8JfhetbDrczWbooUTmgAeEz7IxaUuh8da7Amox1u8,76
src/rules/network__zeek__zeek_susp_kerberos_rc4.lucene,sha256=jyrFGTlN17F3Fjgb06GYZM5cYXy4o3f7ILVyVRJk1Z0,61
src/rules/network__zeek__zeek_susp_kerberos_rc4.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/web__product__apache__web_apache_segfault.eql,sha256=9QSmMRd07AAfLs6ndaHFhLAZm_YGs0h1Eau25MAHFq8,43
src/rules/web__product__apache__web_apache_threading_error.eql,sha256=JIkA-w95LTfkzWNahlEy12GyEznHIvCIJbt34xEysXI,129
src/rules/web__product__nginx__web_nginx_core_dump.eql,sha256=_hO2OfvYmqPiJrGK471Ntw4g7t8vSI5Z61JTW3LylZE,45
src/rules/web__proxy_generic__proxy_download_susp_dyndns.eql,sha256=1qKEbMRwWqKNnHB2-jJXxL0VtE7iP8mqEYoOjV5Rp2c,1335
src/rules/web__proxy_generic__proxy_download_susp_tlds_blacklist.eql,sha256=zyqebAxoPK4Pd6NMsVeQpy1cB4535wgy1l8JE_QIbCE,756
src/rules/web__proxy_generic__proxy_download_susp_tlds_whitelist.eql,sha256=sdentS5OIdkhiLrK0rIazjl1CmfKGPYc2uI3SmhDmv4,332
src/rules/web__proxy_generic__proxy_downloadcradle_webdav.eql,sha256=fwcXkKy9qQjUOfwNpnqfZzPtk-j2SuK1QWxIHk4dGE0,73
src/rules/web__proxy_generic__proxy_f5_tm_utility_bash_api_request.eql,sha256=tnw-3T31BjEaVJQx_xG3MVDnZCp-C6GdA37Jltyj1AM,59
src/rules/web__proxy_generic__proxy_hello_world_user_agent.eql,sha256=VU3Vq1ZyG0yUCCDFUCiJNYgajqfTX23_cZzoYRY7TNQ,60
src/rules/web__proxy_generic__proxy_hktl_baby_shark_default_agent_url.eql,sha256=1ZzAZY2YzHnFmU5ucO37XvOUTpjQ0z6135soVnjYTPA,36
src/rules/web__proxy_generic__proxy_hktl_cobalt_strike_malleable_c2_requests.eql,sha256=V_3DPMimYogmtPwyNg2Sf-eAi8EzZK5uEnxFblvM1zA,954
src/rules/web__proxy_generic__proxy_hktl_empire_ua_uri_patterns.eql,sha256=m3cm0nrQ9DGOFJVQjX9YaZqy5fQ21L7C_ggPnJbCnH8,187
src/rules/web__proxy_generic__proxy_pua_advanced_ip_scanner_update_check.eql,sha256=tpfeSx36aOG_t3tq7EbHmInj-6CLDN3TnGvbDnIzWiQ,197
src/rules/web__proxy_generic__proxy_pwndrop.eql,sha256=uBAeH_JzjnDNwltnpbEUTVaTvgTp4x6PG_M_8ROKNuk,30
src/rules/web__proxy_generic__proxy_raw_paste_service_access.eql,sha256=yY6BrqWLuYv2EKM5FFyMYkCAoWTRhdM3T9WmnkPSQdU,173
src/rules/web__proxy_generic__proxy_susp_flash_download_loc.eql,sha256=HSjvuqQrEV7PrnP3epnMMWhbZzEWnFRRCqIfJBgpfxQ,111
src/rules/web__proxy_generic__proxy_susp_ipfs_cred_harvest.eql,sha256=B2LbcVWWAXz9mlu4-Dh-K6A5BDVTgPCAAz1I7SK-qQA,71
src/rules/web__proxy_generic__proxy_telegram_api.eql,sha256=_PX4XHSxEPAsIOfM-KjZYFTcCJC8y0GcLw5bFhL1ds8,91
src/rules/web__proxy_generic__proxy_ua_apt.eql,sha256=A7DQ3EhKcuW1eQcbMo54vyM4ZmdZpg7PZUJXxP86-4A,2923
src/rules/web__proxy_generic__proxy_ua_base64_encoded.eql,sha256=saEdxrAIlESz9lcdPghENbrEN8gPmwJn2DE4oZQlnCE,88
src/rules/web__proxy_generic__proxy_ua_bitsadmin_susp_ip.eql,sha256=atbbxT-HUS8foHG-E_3rFeMbP0n2mV-yCGipsbEenqA,116
src/rules/web__proxy_generic__proxy_ua_bitsadmin_susp_tld.eql,sha256=mge0SFfp2bMCTCmkVxIqMyVA4uOBvIz2F4YXPP7sDxc,120
src/rules/web__proxy_generic__proxy_ua_cryptominer.eql,sha256=irSkE01MoGwADJ2qFdmH_jyGrgwbXuGS6wyqZc7dGME,52
src/rules/web__proxy_generic__proxy_ua_empty.eql,sha256=6eod7C2YiqlSBNuQ6HI1oeb3wXt1kceD3homFsVLUuw,26
src/rules/web__proxy_generic__proxy_ua_frameworks.eql,sha256=HR_-xL3X6VYO0r_RDtDuLURIKL2TPfvPUjL-YlhQgOc,1295
src/rules/web__proxy_generic__proxy_ua_hacktool.eql,sha256=UkS-uRWn3069bZuWjxwHcuJcglCxYYyGh4nOzDsL1so,864
src/rules/web__proxy_generic__proxy_ua_malware.eql,sha256=nWQ9IAf2KoWWWy2kHyVtsBV26oUQ2cCaeFgi2-QF8sk,2930
src/rules/web__proxy_generic__proxy_ua_powershell.eql,sha256=edQseHHGCUY__G8GkOhZXGCFKZR-RCf9ga0qW3dwulk,46
src/rules/web__proxy_generic__proxy_ua_rclone.eql,sha256=i751Cbq25QdH5qYuxVQBFu3pgVwBbwcFt6ksLXcbWms,34
src/rules/web__proxy_generic__proxy_ua_susp.eql,sha256=A1n_MpoAvXm9ViWwjK1dKYjKoipLZWYZfjbXQjbp2Bo,653
src/rules/web__proxy_generic__proxy_ua_susp_base64.eql,sha256=cpXlm6ivnJrteH6HjBH6cYOBomx8zd0wiC6nxJjlcQU,27
src/rules/web__proxy_generic__proxy_webdav_external_execution.eql,sha256=rbv3owDsQKokMI8xVZFIl0kvLmFncK6Bs_VCqpFLHwA,506
src/rules/web__webserver_generic__web_f5_tm_utility_bash_api_request.eql,sha256=R_Ghs1xnL-o4NvezwtZ8pr6VeQT0uMhp6m_IGmvy0hE,66
src/rules/web__webserver_generic__web_iis_tilt_shortname_scan.eql,sha256=Ne1azu_WW8Rqi5VTnJRRnjFsv2Wp15VRwwEQcNGSooE,131
src/rules/web__webserver_generic__web_java_payload_in_access_logs.eql,sha256=_hMqq2G-irWdh5M3E466hljR6KT2QjOlGFgPRD9pMxc,189
src/rules/web__webserver_generic__web_jndi_exploit.eql,sha256=3Xx46TvAfl7os1_0IEnYlxWZ1Qjvdv2y9XhBRjR7r1M,677
src/rules/web__webserver_generic__web_path_traversal_exploitation_attempt.eql,sha256=HZeqq82SjjCWsp9cBUYRk_Z4ldSGKE-66ehnYRzBq2c,211
src/rules/web__webserver_generic__web_source_code_enumeration.eql,sha256=1Io2plLikFHTVQpYN1OP6QR5dV63PWDzPX90kWsqdsU,18
src/rules/web__webserver_generic__web_sql_injection_in_access_logs.eql,sha256=z6rMSGVj92FDZ5NpABNpJRN_WveVt5Zz5b14q87cARc,656
src/rules/web__webserver_generic__web_ssti_in_access_logs.eql,sha256=SDio_q8b5QqowByMhQEHPA4hL9IEp7XdtLy8c1W9m2E,268
src/rules/web__webserver_generic__web_susp_useragents.eql,sha256=Naa-U5gXnRP9yWpC0Vt0BAmxtcpQ0pBCphF5exNfN8I,113
src/rules/web__webserver_generic__web_susp_windows_path_uri.eql,sha256=7deHGIYLGsHZ-AbKzIc-4lVd-hOcNBqR3xb2aAm5jMo,156
src/rules/web__webserver_generic__web_webshell_regeorg.eql,sha256=Rtk-0-9Do9YIa1XOGTkSN6GVEiUxP0cbZNX64D2-T1s,198
src/rules/web__webserver_generic__web_win_webshells_in_access_logs.eql,sha256=IgOx6jR0D3NhbHLMbAL2q4nJfWl1NNYHGWxDcibVtMk,557
src/rules/web__webserver_generic__web_xss_in_access_logs.eql,sha256=EAnxIr81ScYIvJPylkqo7Z3SQpwCbHiXCpYBDdRRXLo,330
src/rules/windows__builtin__application__Other__win_av_relevant_match.eql,sha256=gv3WN3q5dy3_xi26n82mKg-UWSmH6ujGmJ3OXttjmgU,1286
src/rules/windows__builtin__application__Other__win_av_relevant_match.lucene,sha256=IC3RyY68cm7zT9TicAXNdb1oLOEIdsdNl_zY5ldFG_4,1286
src/rules/windows__builtin__application__Other__win_av_relevant_match.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__application_error__win_application_msmpeng_crash_error.eql,sha256=Wo7g1jyPHmL7pEuaSppPck4BTm5IHGwGLRa0F2WHxiA,197
src/rules/windows__builtin__application__application_error__win_application_msmpeng_crash_error.lucene,sha256=sGpwAiiu6BGtHVwVD_J3u92DfO2f9-GgPUw7NT9Yu1Q,178
src/rules/windows__builtin__application__application_error__win_application_msmpeng_crash_error.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__application_error__win_werfault_susp_lsass_credential_dump.eql,sha256=O7eoOAEsCuu5Vd0mHN0VG7oNWxKE8tH1-hJ8kA8bPMA,197
src/rules/windows__builtin__application__application_error__win_werfault_susp_lsass_credential_dump.lucene,sha256=3jTlPzyIOQTdZJnZb-W0nomjTdRkRHpG7Mhq3jTJkgo,178
src/rules/windows__builtin__application__application_error__win_werfault_susp_lsass_credential_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse.eql,sha256=i3UsdOYoP-70sEkLjNs1iboZ-gnEfzgoU6PYhX1mT5Q,166
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse.lucene,sha256=GojWHEjoNLHCtuESJpL_5ta5OeKefxkRVmQdLVO4878,142
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse_susp_location.eql,sha256=bBWy8Lvzmnu9yOF5V5iuKUVVZbz4HK3TS_TzApui668,292
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse_susp_location.lucene,sha256=BF3uZ4f4Wu3F1phpBwC89D6-Ixy_dsqIcc99_g49ug0,267
src/rules/windows__builtin__application__esent__win_esent_ntdsutil_abuse_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__microsoft-windows_audit_cve__win_audit_cve.eql,sha256=AMoJhbqPtlBI7zP5hDx9NCBQUKdPNE_VkzdHVo4sfD0,138
src/rules/windows__builtin__application__microsoft-windows_audit_cve__win_audit_cve.lucene,sha256=CFO-Il6dHywHFD3R88d__Olq0wxUl-tKceL-5mYDfKg,120
src/rules/windows__builtin__application__microsoft-windows_audit_cve__win_audit_cve.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__microsoft_windows_backup__win_susp_backup_delete.eql,sha256=T_e53Y0lLUQgwAu7_F2N5Y7va_JceikELLU5zB9gO78,114
src/rules/windows__builtin__application__microsoft_windows_backup__win_susp_backup_delete.lucene,sha256=4JcWj_Yx0YXHBA-k7R5Gj2xE87Cy479FPL0lpAgEZt4,100
src/rules/windows__builtin__application__microsoft_windows_backup__win_susp_backup_delete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__microsoft_windows_software_restriction_policies__win_software_restriction_policies_block.eql,sha256=64XpQJFnjr2jz54bf51LdrE18eZBpHc-NjYPcS6rz-Y,173
src/rules/windows__builtin__application__microsoft_windows_software_restriction_policies__win_software_restriction_policies_block.lucene,sha256=z-HgsUJe_aHTV6Lzy-GjPRH1rFHiuNNneP971EVNjQs,153
src/rules/windows__builtin__application__microsoft_windows_software_restriction_policies__win_software_restriction_policies_block.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__msiinstaller__win_builtin_remove_application.eql,sha256=y4PJZlhuXptYkqPormqKzU4gwGNKPAufLaztB1BWIPY,122
src/rules/windows__builtin__application__msiinstaller__win_builtin_remove_application.lucene,sha256=2JzgJEF8hxahpQsq-t4em-TFABeMjLr7eSI2_nB1gXw,100
src/rules/windows__builtin__application__msiinstaller__win_builtin_remove_application.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_susp_locations.eql,sha256=TS4ux1ObOwfZTQGLfE_q5cjOOq8YmBlVvzoRE3DUK48,367
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_susp_locations.lucene,sha256=CZ_ruNgDU0Pu_ng6VLgr_nMhm8B7yoBas_QREKvbumg,331
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_web.eql,sha256=kXDAJhK0EQRD-Oho6dFzxL5ArFR5RQmpCDpIpCWZGFI,156
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_web.lucene,sha256=BXMZVDfysYL4d2AYlhuM3qodCk5XwCRbGUOzYKTyfOE,135
src/rules/windows__builtin__application__msiinstaller__win_msi_install_from_web.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__msiinstaller__win_software_atera_rmm_agent_install.eql,sha256=L_0dvct9PWvowNSkrKjvc8RTqVfL9qHwdMiW3gOrWjw,148
src/rules/windows__builtin__application__msiinstaller__win_software_atera_rmm_agent_install.lucene,sha256=uXlAoOPgx22OSey1P_O97-O9vDa5KojKxAkg-e1oJsk,130
src/rules/windows__builtin__application__msiinstaller__win_software_atera_rmm_agent_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_add_sysadmin_account.eql,sha256=NoE57Vf8kqx2XR2YMzGw0CzUOr6Iqjf5CYmLZPGYzDU,235
src/rules/windows__builtin__application__mssqlserver__win_mssql_add_sysadmin_account.lucene,sha256=wTdGJfzhYcdX_0c0kWRzdvhfkRJGJiPRiDnFgS3IOpw,225
src/rules/windows__builtin__application__mssqlserver__win_mssql_add_sysadmin_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_destructive_query.eql,sha256=U8MQgTyOrptOOcgGkvEvwezJwcuB8xh0NcTODGWo5fk,230
src/rules/windows__builtin__application__mssqlserver__win_mssql_destructive_query.lucene,sha256=w636eVJXzog40b40PfM6FYYEHeJwNh5yhDWIUURw9yQ,212
src/rules/windows__builtin__application__mssqlserver__win_mssql_destructive_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_disable_audit_settings.eql,sha256=PDSviwDzGBN3QuSRlL9IE7KHedY8VSgzVTA-nxVpIvM,202
src/rules/windows__builtin__application__mssqlserver__win_mssql_disable_audit_settings.lucene,sha256=GNWjwDedYBbcfI9J-ukGuwgfVCI8TRRgUcSS0Gwj9ho,184
src/rules/windows__builtin__application__mssqlserver__win_mssql_disable_audit_settings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon.eql,sha256=3gMXIGEAZY6Ds6URtoXfMvqMBpPN2y-roiwux6UXCjk,99
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon.lucene,sha256=uwt3y9Sg0HkROCoxg1RrDn2BcEItln7r5LZSPlDANTs,83
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon_from_external_network.eql,sha256=kSrPxu-zla_DdazoQnt6CGFe2utJI6cv9FqxhQDHWHQ,587
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon_from_external_network.lucene,sha256=SN4WsrBks9AdcaJdsIUkXHUCoMrwess_0GYUWiWY3cE,608
src/rules/windows__builtin__application__mssqlserver__win_mssql_failed_logon_from_external_network.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_sp_procoption_set.eql,sha256=pgET3Xbqjz5mgt3uQiItO2-n7Yqw93aOlQ9OgkwE9Xo,204
src/rules/windows__builtin__application__mssqlserver__win_mssql_sp_procoption_set.lucene,sha256=GPBga8CZQBDe2ogOM6BYhKUzrFjfgXIBjWqcwcmMh5o,186
src/rules/windows__builtin__application__mssqlserver__win_mssql_sp_procoption_set.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_audit_log.eql,sha256=L3316CYud-Lq0wm76vb8gpYACQ9jY21YhiIw3vh8Kes,202
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_audit_log.lucene,sha256=mwcDFtrL8v6_6DCipEH81UmtPcm66MFuOFw1EH7YiLM,184
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_audit_log.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_change.eql,sha256=eHqJawnGYP_17WIKIsg3AE9ll481J7Ypd63KEwG-Owg,142
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_change.lucene,sha256=b6Gddef_-9UNCaue6FB6jZrCX6IMlb9HouYJ55PQlN4,124
src/rules/windows__builtin__application__mssqlserver__win_mssql_xp_cmdshell_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_command_exec.eql,sha256=gmMu6pVe7qa0_EcAEF8eyIiE4qcAjbmVdIAV8Cw52NY,161
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_command_exec.lucene,sha256=GzeTTP_qkNJ2oeW-0hN5lXHcjrtIArIM2UJcLyLDBwo,146
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_command_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_file_transfer.eql,sha256=ifSoueQKecWVUhE1YF_fkJ6dTC8OeGeLSjgyM46qmfg,164
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_file_transfer.lucene,sha256=0p4UHpAS_vI5Da1b_0YiOaGxK4qbaHJYdlh3Q5I9tpA,149
src/rules/windows__builtin__application__screenconnect__win_app_remote_access_tools_screenconnect_file_transfer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__application__windows_error_reporting__win_application_msmpeng_crash_wer.eql,sha256=u0bwjfdwZBEueYN7Fy2HDtzRR3_tHl3u6s4sJaJ_IMY,203
src/rules/windows__builtin__application__windows_error_reporting__win_application_msmpeng_crash_wer.lucene,sha256=mkrrGCr91ZqVBUaWhbp3BiFq3eYW3_xPDDp2ZBeKmz0,185
src/rules/windows__builtin__application__windows_error_reporting__win_application_msmpeng_crash_wer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__applocker__win_applocker_file_was_not_allowed_to_run.eql,sha256=5YcywLjURknG-XicJp3O1N4wgmW91Qg-F_zgaFnt80Q,288
src/rules/windows__builtin__applocker__win_applocker_file_was_not_allowed_to_run.lucene,sha256=U5H5jbPH3q-OAXoIWk8BDGYFHS8kOcqXYjPo3wVK5mc,282
src/rules/windows__builtin__applocker__win_applocker_file_was_not_allowed_to_run.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appmodel_runtime__win_appmodel_runtime_sysinternals_tools_appx_execution.eql,sha256=JeS5nDeK2CRmKi-AJAGUp7lA-ZvnuMP26uSU2fyxuuU,211
src/rules/windows__builtin__appmodel_runtime__win_appmodel_runtime_sysinternals_tools_appx_execution.lucene,sha256=z5zw7WoMpP2UDaFTFpxUL3wmHOJgKH1TpYSEc2Geq40,193
src/rules/windows__builtin__appmodel_runtime__win_appmodel_runtime_sysinternals_tools_appx_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_applocker_block.eql,sha256=gxnuKTh1n94QsaFTNK9zJn6k-62lwRNnRXkQvhLz_nQ,99
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_applocker_block.lucene,sha256=5RSKQAgK0AqOgH3Z5aiDCsCNuSjWnWV4_bYBa7FnKb0,88
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_applocker_block.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_mal_appx_names.eql,sha256=6hWBH5D_zA_TzYRCGu3aJHLSUKLTOS6t85nzW62P3Tk,197
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_mal_appx_names.lucene,sha256=ZzeSuNITtAtYcPE8BU5cBBlbh3eFwtfYbrwwJd-MWtk,182
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_mal_appx_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_policy_block.eql,sha256=FN-dlMMbRVmL2MvjtMZXUDQKzFUL7ZZqOLKJzOyA2oQ,130
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_policy_block.lucene,sha256=C8SB3gXI8wkFC00qqxz01bSBQsSxpv_kTYXoUgUavRQ,113
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_policy_block.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_appx_package_installation.eql,sha256=mwLfqkY5_awI4ZMua5K3kUsUVzKUnjpqijt20QZuNDc,146
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_appx_package_installation.lucene,sha256=Bb5jbPe0xxPbgmMF4fuKWr4ttSTarKVqBde7lvT8qK0,133
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_appx_package_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_domains.eql,sha256=mWfZ-fbYvkT0-tUwnKSiDgwrWfzSqr-4HtvpHuooQOg,711
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_domains.lucene,sha256=hEgkrAZQbDMjoco_Q3mM63hMxpKtJEit7kn5IbFkn1o,692
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_package_locations.eql,sha256=iAsB1byCc6AO88cJL9afdaqI7h6dhbTgNu6eRASQRMA,387
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_package_locations.lucene,sha256=UHXz4WFJO6SEU-7kJzTcoA8lYSmWKQkUx9kS5wMHJz4,389
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_susp_package_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_uncommon_package_locations.eql,sha256=UY3RUG2Z2Ey0RL7JEDubN6VQZuU5TAULnSeis-u5rdE,937
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_uncommon_package_locations.lucene,sha256=NeTjsunu2N72vjeMW_4iw8ciZK3ZwXwbtFCs4SDW2oc,957
src/rules/windows__builtin__appxdeployment_server__win_appxdeployment_server_uncommon_package_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__appxpackaging_om__win_appxpackaging_om_sups_appx_signature.eql,sha256=6pNsmMbhf1_eTq2KH7eapaGaOYmCiNUR7WnstDOuQf4,307
src/rules/windows__builtin__appxpackaging_om__win_appxpackaging_om_sups_appx_signature.lucene,sha256=Uh2YU-gaxOk9g0tVVH_pCNYZhc3FdkLj3Nkb6pVxSb0,316
src/rules/windows__builtin__appxpackaging_om__win_appxpackaging_om_sups_appx_signature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_bitsadmin.eql,sha256=arQpWlg9NIBRYPfavMS9vm2LjKp_3czNuqZd2oMKMzg,143
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_bitsadmin.lucene,sha256=eev6glo0CfccdlQyAYTgZirnsViTItETekHzWuYKD_M,131
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_bitsadmin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_powershell.eql,sha256=JZB1vXIzKPAmXMnzrECDBOPPWpQYsDt_LO6-3T5cWAo,169
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_powershell.lucene,sha256=XCqEnaEzhQf4K8gfayqjWMPEIN-aixxJna-wBGdgALw,151
src/rules/windows__builtin__bits_client__win_bits_client_new_job_via_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_saving_susp_extensions.eql,sha256=1r_-go-Db0muJ8ITso_32d4TA43M6wdV4n8aBnF76YQ,315
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_saving_susp_extensions.lucene,sha256=K9HW_Mel3s_wc86319Kk7ul77i3TmDCM6N2mduWwcU0,293
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_saving_susp_extensions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_file_sharing_domains.eql,sha256=pvyia8r4qaTO446ZJkczxU_hgYwR3uA2-EUPybF7ef0,730
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_file_sharing_domains.lucene,sha256=VG7NBT0DTkxYb0LfVXYSIA0hEFoogZ65ZjjO0TN5QCE,712
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_file_sharing_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_ip_address.eql,sha256=OI73BTu66pRyyJZlArbch0pz6mtQWq8YyCtvxOkX42E,836
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_ip_address.lucene,sha256=ZDs3UqcyKE1fltsF1DkW080N-UmD5MdxXbE1blaGD_M,924
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_ip_address.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_uncommon_tld.eql,sha256=qJROncsdohk9APpNgjcBCMK0a7Q3D5rb8rU0NGDpY4A,258
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_uncommon_tld.lucene,sha256=fKChEh5xR4jwirWvUmPD5fSt72bktHJ5wG-x3meEpVc,246
src/rules/windows__builtin__bits_client__win_bits_client_new_transfer_via_uncommon_tld.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__bits_client__win_bits_client_new_trasnfer_susp_local_folder.eql,sha256=t59vIQLl0693EA2lxXdbmEh_If9FaDQezJ15dNljL_0,194
src/rules/windows__builtin__bits_client__win_bits_client_new_trasnfer_susp_local_folder.lucene,sha256=9BJ9Jn9RcKmiPHkbP_wGVwACjzncYH6nq6uqR-DzL2c,178
src/rules/windows__builtin__bits_client__win_bits_client_new_trasnfer_susp_local_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__capi2__win_capi2_acquire_certificate_private_key.eql,sha256=0-QhA4KwZivw_eMNoBgfNhmERBqmmPrJYl-SMbUnJIE,83
src/rules/windows__builtin__capi2__win_capi2_acquire_certificate_private_key.lucene,sha256=QMeeccHkjOIA663zQHCOuu7bMLiHawp3vbLTp8_sQvw,72
src/rules/windows__builtin__capi2__win_capi2_acquire_certificate_private_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__certificate_services_client_lifecycle_system__win_certificateservicesclient_lifecycle_system_cert_exported.eql,sha256=ON3Iti0lsC290FNO9B2h8HUFjCn4H-mnALwQGi96Plw,122
src/rules/windows__builtin__certificate_services_client_lifecycle_system__win_certificateservicesclient_lifecycle_system_cert_exported.lucene,sha256=kMeenfrONoD3iIIH8nJ-5NJUQXcSyYJW6qAhH1Z-Xms,113
src/rules/windows__builtin__certificate_services_client_lifecycle_system__win_certificateservicesclient_lifecycle_system_cert_exported.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_attempted_dll_load.eql,sha256=H4QeXWztZMpgxrHngjC8C1MTKBbQJwhrtk9Ojt7ALZk,3640
src/rules/windows__builtin__code_integrity__win_codeintegrity_attempted_dll_load.lucene,sha256=z9bHQFfE4hPJazZ5L6mw6UjSbfh3rDtOYWo8zI_ECR8,3534
src/rules/windows__builtin__code_integrity__win_codeintegrity_attempted_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_blocked_protected_process_file.eql,sha256=Z9l4zvnFoQMHFM04kU92loUyygm1-C_XNuE-_hJ0_L0,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_blocked_protected_process_file.lucene,sha256=vm3KrNV5EL-owS27PR7uXRmkqlAnC4SdLpdRSVsjVl0,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_blocked_protected_process_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_enforced_policy_block.eql,sha256=cp1fltSx3vphKhMwRY-jmydMdojSeUT_0QP-OSpEDh8,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_enforced_policy_block.lucene,sha256=vHufDRv6WfcP6IWocqIwoVBgdRkC5DDGeKc8dHE89nc,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_enforced_policy_block.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_blocked.eql,sha256=JqWcmoXOt0xUxvDlPpscYn3PZUiPSMmC-K8TaxHXPWg,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_blocked.lucene,sha256=uTjZ57SjdSZkJ2mFGk83vsvAViSKI93ft5GEivagr8w,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_blocked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_loaded.eql,sha256=BYORvPyZWnIkWtmFEpiAbaVtT2dcIYB-tqEjzi2hfj0,111
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_loaded.lucene,sha256=JyHFzDO-B6eF4bk4-gqrGSm5Vi7xgzEw1A8IkqQmoEA,94
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_driver_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_blocked.eql,sha256=npSFWIKJPs6E21rt1AzBN7suFzBK27YPDeTr5mwD6L8,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_blocked.lucene,sha256=-EWqiOx2heb6DqdTxP0o6uLbWdZrHNSsVCJtbuFWpc4,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_blocked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_loaded.eql,sha256=atRJr6CI0TqhZwS3yO9e9zXu8qC7JUint3JUHwHUN3E,111
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_loaded.lucene,sha256=NcJiNUfwKEXf_bKanMrQAUo1ODukicKUZ6jsTjTOcYc,94
src/rules/windows__builtin__code_integrity__win_codeintegrity_revoked_image_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_driver_loaded.eql,sha256=f0ZX9wpTfBjaKl3sdzQzHMuwronOnHUkg-DLsOyDEZ4,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_driver_loaded.lucene,sha256=bfVwhvfcJvqPTbuGhCWTev9c-F1prrYf2AzeoeT_HAA,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_driver_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_image_loaded.eql,sha256=JRTX3qcEnIQnavvol1on_oJQOfClSOM4wZM0fzjScKI,93
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_image_loaded.lucene,sha256=3gW3rrckvuWUW1NC8Ws0cuCwxt0rJw8tmPyOXPwmWpk,82
src/rules/windows__builtin__code_integrity__win_codeintegrity_unsigned_image_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__code_integrity__win_codeintegrity_whql_failure.eql,sha256=f-RJR2AIWxgbvoFPYT8N1W25zt8iWqOReEf0zIDJfVo,228
src/rules/windows__builtin__code_integrity__win_codeintegrity_whql_failure.lucene,sha256=MGbwKjFj0n4qO_kCccXY2CyecBMI4zNkFE-1GUlFT9s,203
src/rules/windows__builtin__code_integrity__win_codeintegrity_whql_failure.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__diagnosis__scripted__win_diagnosis_scripted_load_remote_diagcab.eql,sha256=qmY6uMpgg4OMgGBdTQyyWlKdPSy5_dlMAyNyQI6K7KE,140
src/rules/windows__builtin__diagnosis__scripted__win_diagnosis_scripted_load_remote_diagcab.lucene,sha256=Tw7H1kM8ZBq-E3BbQGNJFilbO3JPsJO-kM4vtjdQR9U,128
src/rules/windows__builtin__diagnosis__scripted__win_diagnosis_scripted_load_remote_diagcab.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_anonymfiles_com.eql,sha256=VGl1ALf315nU0bOFOSoUt4xKHDdXPRj28mCvMPyz4qU,140
src/rules/windows__builtin__dns_client__win_dns_client_anonymfiles_com.lucene,sha256=jbgiPe8dQ8V1Qn-Wc5Zae4AcwNCe68xuvJW1AcqB4C4,129
src/rules/windows__builtin__dns_client__win_dns_client_anonymfiles_com.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_mal_cobaltstrike.eql,sha256=iweAjA9i0IS4v_kOcRiKUzNa1YKMX6z82SOsIHt0J7A,198
src/rules/windows__builtin__dns_client__win_dns_client_mal_cobaltstrike.lucene,sha256=zq5AOaDHGo7pFT-JRQ-Led6cb35q7joa7_Kg6X4hdiU,179
src/rules/windows__builtin__dns_client__win_dns_client_mal_cobaltstrike.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_mega_nz.eql,sha256=KB2EYvzy_uhZWQ8bdR1Pxa-Y4gLw1FoCHnQF0KJ1H9w,148
src/rules/windows__builtin__dns_client__win_dns_client_mega_nz.lucene,sha256=YI8t830xMNCtCVPFubzGaQ1YHlPiNRdhJnrXc-FFUwY,137
src/rules/windows__builtin__dns_client__win_dns_client_mega_nz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_put_io.eql,sha256=SAUfZ7SYvYhJjx1xhbWITZm3NcjQA-JnaNA5tcBEgUg,165
src/rules/windows__builtin__dns_client__win_dns_client_put_io.lucene,sha256=DqcD6slNpFAyts__T1OXxtdL5l1KsrDJG1dji-pjBnU,148
src/rules/windows__builtin__dns_client__win_dns_client_put_io.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_tor_onion.eql,sha256=ts_spnMvoViA1h1VPyavgFCmUOzI0576X9AF3PUncFw,880
src/rules/windows__builtin__dns_client__win_dns_client_tor_onion.lucene,sha256=aaJ-JeRzYB3iq5r-tPvWeNRi-ipOrsgW7lijXoodLiU,868
src/rules/windows__builtin__dns_client__win_dns_client_tor_onion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_client__win_dns_client_ufile_io.eql,sha256=-kFWwiK7g7e_q12YGjwf6Pyg462DAmoybVNEjXaOChM,134
src/rules/windows__builtin__dns_client__win_dns_client_ufile_io.lucene,sha256=-9GSYr69Kp6KlFYtsjtUUexvt3ShsDf-qZSq9YdqrbU,123
src/rules/windows__builtin__dns_client__win_dns_client_ufile_io.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_server__win_dns_server_failed_dns_zone_transfer.eql,sha256=vVtD8Mix5x7BTZSt1LWTJqPwUeVCjtS1e3kKV0VFuyw,60
src/rules/windows__builtin__dns_server__win_dns_server_failed_dns_zone_transfer.lucene,sha256=KsfvsANzWIPYjinO-94aWlzkDZzbWsAhgN_CSlManTI,47
src/rules/windows__builtin__dns_server__win_dns_server_failed_dns_zone_transfer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__dns_server__win_dns_server_susp_server_level_plugin_dll.eql,sha256=1YMMmSoyjk1BjE7vyc3uIoMieV3m9O8HhNvxGIUBnNY,83
src/rules/windows__builtin__dns_server__win_dns_server_susp_server_level_plugin_dll.lucene,sha256=dt3ycc9PqR2l3ny1hsp86rs86G7sPb-MLp6Bui_tTJQ,64
src/rules/windows__builtin__dns_server__win_dns_server_susp_server_level_plugin_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__driverframeworks__win_usb_device_plugged.eql,sha256=Gixfg36ksXkSD1ZGuYo505NY3KTA08CiNVoOblE13H8,131
src/rules/windows__builtin__driverframeworks__win_usb_device_plugged.lucene,sha256=g64gj4i-zd3WSrQY63lNno1PTdhtSkp-PbK_JU1_1YA,115
src/rules/windows__builtin__driverframeworks__win_usb_device_plugged.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule.eql,sha256=Bu6S5p89_NpZcddf_3_XMREdufZvpb7iKLAp3WK2VMg,1503
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule.lucene,sha256=J1vtjFUiF0yYpDpdH4Pe09sEPYv-lCaunjWrSTX07w4,1468
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_susp_folder.eql,sha256=AIyZ48CHSkYuPAg5jCPD6aExPJ7IPWeZjfCySEyiwkM,376
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_susp_folder.lucene,sha256=VOA9iZ0H3kQn5m-yPdIfcy0IVETzje9XV-VxFzyRAYk,359
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_susp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_wmiprvse.eql,sha256=yf6pUmdjGuZsVmISj7Kr-xDFFfREXHegIS6JlMhS7LY,264
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_wmiprvse.lucene,sha256=Ijrcj0EVy1H9TY4nZ6YzkRV8RtaL4C1fkrWnGlwu6Xo,248
src/rules/windows__builtin__firewall_as__win_firewall_as_add_rule_wmiprvse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_all_rules.eql,sha256=XSPLvsEqBluj6epEOfBRYzsfPiWn77viJQr8Uf5Wsmk,393
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_all_rules.lucene,sha256=QFmF7QPevrXsPszQIU0lUzdLVHKKQumXc_T8_nHvk6A,377
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_all_rules.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_rule.eql,sha256=ZetUl64PwmtRsxujr4MG73yaLz3qtfNk6A1Qw0DTtIo,661
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_rule.lucene,sha256=UI_9RxMee53g-tfc6ljZX1jtf__ohlXaZswgcwQro9o,647
src/rules/windows__builtin__firewall_as__win_firewall_as_delete_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_failed_load_gpo.eql,sha256=a9j0f59KmyKlrYxzDSgT-KiHIiOL4qcDvnZACvJr7Qs,116
src/rules/windows__builtin__firewall_as__win_firewall_as_failed_load_gpo.lucene,sha256=k2xZ_InE35NgWjSiFF05dSosEKwwoE_4aSDHBlvUpRk,109
src/rules/windows__builtin__firewall_as__win_firewall_as_failed_load_gpo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_reset_config.eql,sha256=Ke3xjGpEQ_xlQd9l8MI8IDJI5uhowH7rk0Jd9RQYznQ,134
src/rules/windows__builtin__firewall_as__win_firewall_as_reset_config.lucene,sha256=U73kad5PyPg2m8i3IPm7kG8n86uaNBFK6k4o6Z7r_q4,121
src/rules/windows__builtin__firewall_as__win_firewall_as_reset_config.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__firewall_as__win_firewall_as_setting_change.eql,sha256=rxBivfPI270x0YP1MT6EUJ6PjrJhFEEGor4rEsmqJ0I,158
src/rules/windows__builtin__firewall_as__win_firewall_as_setting_change.lucene,sha256=lINUL0ou_TSR8FD9u04dnzP8m9gepy4Z7ev6ygNtLT0,145
src/rules/windows__builtin__firewall_as__win_firewall_as_setting_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__iis-configuration__win_iis_logging_etw_disabled.eql,sha256=_rR1RJ8jRAuonnoVmXAdikinAahLRwNgGH7K-5gw30g,165
src/rules/windows__builtin__iis-configuration__win_iis_logging_etw_disabled.lucene,sha256=XQMfsDoX0ydf-zqZ2P35nFVCyKYHLAQvaGigmmy-wj0,147
src/rules/windows__builtin__iis-configuration__win_iis_logging_etw_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__iis-configuration__win_iis_logging_http_disabled.eql,sha256=RW1g8dfIiY6Mog5nm3flQGeDpZCDqW0HOrBPVoI52WA,141
src/rules/windows__builtin__iis-configuration__win_iis_logging_http_disabled.lucene,sha256=Bn_HPzUnWuahUqXpo_bUhw0BbyCNBma7CLHHzcrkoH4,128
src/rules/windows__builtin__iis-configuration__win_iis_logging_http_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__iis-configuration__win_iis_module_added.eql,sha256=AqeSPqWYKGhj0eiKCvbBTKVSbReTbD8UfEdSl37-H6s,480
src/rules/windows__builtin__iis-configuration__win_iis_module_added.lucene,sha256=0GxVnMKw3v9DgPv6MhexelboAl8E2HH-u95txZUBg-I,460
src/rules/windows__builtin__iis-configuration__win_iis_module_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__iis-configuration__win_iis_module_removed.eql,sha256=gQEF2PKav6wqs9z7RV_Aue0cd8LZHqXsBQpz2LxxeUw,99
src/rules/windows__builtin__iis-configuration__win_iis_module_removed.lucene,sha256=Jx7ngp9X58RsT1jW3nqOpHJOcZ-EMa8sqiBknfMX89s,88
src/rules/windows__builtin__iis-configuration__win_iis_module_removed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__ldap__win_ldap_recon.eql,sha256=vSFpR6db6nSpY7I8lk81YW-vemLKwGGnGSGlT13mE44,2100
src/rules/windows__builtin__ldap__win_ldap_recon.lucene,sha256=5NhYgF8N2-6I0DtqBSMHO8M9FZ_5NbnJ2_OKYL2qz-0,2216
src/rules/windows__builtin__ldap__win_ldap_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__lsa_server__win_lsa_server_normal_user_admin.eql,sha256=GQOrL0wb-H-WPGEcjNFTpAwnD_KtMBMpcsAhKqjzTkI,303
src/rules/windows__builtin__lsa_server__win_lsa_server_normal_user_admin.lucene,sha256=mnsOYlDaoMg_FrfyjN4UD5Xy2uH6KlPZtbk1yaWIXLM,291
src/rules/windows__builtin__lsa_server__win_lsa_server_normal_user_admin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_proxylogon_oabvirtualdir.eql,sha256=R63XECGTx1P2i11sn4fhqQDYEhyyK8SloBUZf9t_LZo,187
src/rules/windows__builtin__msexchange__win_exchange_proxylogon_oabvirtualdir.lucene,sha256=3han6L7f0lUc6VTpUTFEUEndgFiB6eavhLz_rKY8CK4,189
src/rules/windows__builtin__msexchange__win_exchange_proxylogon_oabvirtualdir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_certificate_generation.eql,sha256=NxY--91BnylDwSs6Eoe-QhTNxidu8QpcQtAbR3bcSfc,222
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_certificate_generation.lucene,sha256=h7FaT2ku9wgC3ZUgP6SwL99lix9xLajvmJ8Lyj1c4yE,219
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_certificate_generation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_mailbox_export.eql,sha256=nw4DQIz984a2uCeDMtKPyp7_45y98xuZ4JKv8eO-6po,226
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_mailbox_export.lucene,sha256=3U1__zQfLEGbV-TkZ5558IvJOvn2mMhOUtm7pISBWik,230
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_mailbox_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_remove_mailbox_export.eql,sha256=SCRkAB_wAw2f-xN-T4A150EdcvlGNDlBfJMp4K40sSo,129
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_remove_mailbox_export.lucene,sha256=Qkdmol1Gpy_vzvuIok24_pZgwfhzXIpR9M2-4H-tMOE,125
src/rules/windows__builtin__msexchange__win_exchange_proxyshell_remove_mailbox_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_set_oabvirtualdirectory_externalurl.eql,sha256=NHL_A4Ue_uZ5sfSkvL_YrT4NSNEQ_fT8r4GFX9BnWzY,128
src/rules/windows__builtin__msexchange__win_exchange_set_oabvirtualdirectory_externalurl.lucene,sha256=Q0Myx8hW3W_SN_1mP_j3X-ffxQ6Eti5Zwgkme37oJsQ,118
src/rules/windows__builtin__msexchange__win_exchange_set_oabvirtualdirectory_externalurl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_transportagent.eql,sha256=b9I0gy186sv5sxQBisjjveDhLA53jJ4MWfFvKv230ak,78
src/rules/windows__builtin__msexchange__win_exchange_transportagent.lucene,sha256=bX7Ghrm8bvCldlnlbVnDs35NIzfowDoL_sHuRrKx8Ug,68
src/rules/windows__builtin__msexchange__win_exchange_transportagent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__msexchange__win_exchange_transportagent_failed.eql,sha256=qRW4fnZfkm0ZhOaicgwZXNSmTxtRw1zLf9f1D3RN22Y,124
src/rules/windows__builtin__msexchange__win_exchange_transportagent_failed.lucene,sha256=vBvfIK1oQvoLNxMnj1aQV-PCQa3McWZE8jtM_7xLhYU,110
src/rules/windows__builtin__msexchange__win_exchange_transportagent_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__ntlm__win_susp_ntlm_auth.eql,sha256=mKy3ma6wI9cXwJHNqZAH2TgKD3Cn6lWmK-ywGGnZV1w,84
src/rules/windows__builtin__ntlm__win_susp_ntlm_auth.lucene,sha256=iED-RpSQVYg_nDZTANadgpTRhaSQpcygGrvqT5W4LXI,73
src/rules/windows__builtin__ntlm__win_susp_ntlm_auth.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__ntlm__win_susp_ntlm_brute_force.eql,sha256=451GU217H4cmPK3t25kE7ga6cdbo0QbSlcN6x6CNhEg,216
src/rules/windows__builtin__ntlm__win_susp_ntlm_brute_force.lucene,sha256=xEZDXTfYWwdITqsXISMh60Sy3uaHa7wLyFOlAfZgB9k,197
src/rules/windows__builtin__ntlm__win_susp_ntlm_brute_force.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__ntlm__win_susp_ntlm_rdp.eql,sha256=qAoWtmWvKLmE7VlS6xTTvBMiqPCG7HWHPsxSDSgi3hA,130
src/rules/windows__builtin__ntlm__win_susp_ntlm_rdp.lucene,sha256=qlcZcdeXB0zUnB-mcAwndnovEV2TAn-sLwe1yoruMLY,117
src/rules/windows__builtin__ntlm__win_susp_ntlm_rdp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__openssh__win_sshd_openssh_server_listening_on_socket.eql,sha256=MR9E9W_0IkSojklPCe3B8H3NtbVXo2AzZ4DkElGXzZs,159
src/rules/windows__builtin__openssh__win_sshd_openssh_server_listening_on_socket.lucene,sha256=i1EJu32eurzwFrMiH2Kfg9ZwzkseCY2PB4hnZznD8bw,145
src/rules/windows__builtin__openssh__win_sshd_openssh_server_listening_on_socket.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_access_token_abuse.eql,sha256=s0VK-7LkZyr_vLRpHQ3Q5nSdixyrMiy4hlxiRGOFRpc,254
src/rules/windows__builtin__security__account_management__win_security_access_token_abuse.lucene,sha256=ohsW_CfUDuMQJjMCuFsrqwdf4MSw6FAaYje4MoIMzqM,232
src/rules/windows__builtin__security__account_management__win_security_access_token_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_admin_rdp_login.eql,sha256=OcWOOHDZrMLAtcbHKO2dPwued-N0axJ_SOXNzz8Y0yo,203
src/rules/windows__builtin__security__account_management__win_security_admin_rdp_login.lucene,sha256=iah9evma6zRqVmIU2FC0SuHWzrUE7YsTQqAko6dPfC8,183
src/rules/windows__builtin__security__account_management__win_security_admin_rdp_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_diagtrack_eop_default_login_username.eql,sha256=4kY0FDE6WImEcO_zEfDRRRVpoJu7oxHvSE2HR46q6Fg,162
src/rules/windows__builtin__security__account_management__win_security_diagtrack_eop_default_login_username.lucene,sha256=yW2S92PCamo-oGgurgwwp7xUK0290RZFVlxS2K7fhI4,144
src/rules/windows__builtin__security__account_management__win_security_diagtrack_eop_default_login_username.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_member_added_security_enabled_global_group.eql,sha256=nplVAVW4U2nSiJKRA4LekZRe372ckbRllK00Iemxa30,75
src/rules/windows__builtin__security__account_management__win_security_member_added_security_enabled_global_group.lucene,sha256=GFXgRb7OJSvDoZhffDyFbFLBGVlDxcFaerch6BY0tYE,55
src/rules/windows__builtin__security__account_management__win_security_member_added_security_enabled_global_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_member_removed_security_enabled_global_group.eql,sha256=7vHpB2_yUQkPw8O9w9iMo0wjXqbWvYQa8F7S7LmDXao,75
src/rules/windows__builtin__security__account_management__win_security_member_removed_security_enabled_global_group.lucene,sha256=7XEdiCgEz-ZhPzV0XP27CwPYsNL4HZvmnyN7UumILuc,55
src/rules/windows__builtin__security__account_management__win_security_member_removed_security_enabled_global_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_overpass_the_hash.eql,sha256=o6kzTjZvqspFArLfWx7FNJIHG03rZ59faMK6ySbarX4,205
src/rules/windows__builtin__security__account_management__win_security_overpass_the_hash.lucene,sha256=mN2To-8HFBln_yrEbtZE1WdJ4CFuk9UadH6gUKuICp4,185
src/rules/windows__builtin__security__account_management__win_security_overpass_the_hash.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_pass_the_hash_2.eql,sha256=meOwQrRMe8-WTMEadMSV7C2einMmmevMX5zSRUyUNIQ,376
src/rules/windows__builtin__security__account_management__win_security_pass_the_hash_2.lucene,sha256=CTyn8vHx5pWniQNxmwSOXR3hLdvQXVz8e7-dzpoP6qE,350
src/rules/windows__builtin__security__account_management__win_security_pass_the_hash_2.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_rdp_localhost_login.eql,sha256=L5iVtNVGcQ87-pX4SG3g6KqFYwnhAFe0miCQEJDwKXE,140
src/rules/windows__builtin__security__account_management__win_security_rdp_localhost_login.lucene,sha256=fm8Zp-evjJVRLfFVZUtlc4MqWFzrvhXvG8CwkNMd3y8,118
src/rules/windows__builtin__security__account_management__win_security_rdp_localhost_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_security_enabled_global_group_deleted.eql,sha256=rnqpwbW-pLIoR6PFHlnLT9WtnkAeo6VwqD8zqBdNP7E,75
src/rules/windows__builtin__security__account_management__win_security_security_enabled_global_group_deleted.lucene,sha256=ra-NkaSAybQX1N0UqYgfTsEjuayzJUl4cxgUSiUuUrM,55
src/rules/windows__builtin__security__account_management__win_security_security_enabled_global_group_deleted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_rdp_login.eql,sha256=pzs5EtG01WxqWQKC2oLWwYUn2f3uXRfCPLzJTN3JuHQ,437
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_rdp_login.lucene,sha256=bm98nAQr46TbFFQ0qDhy1GaMzv2kYk0IGxmhBsR8G6I,322
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_rdp_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_smb_login.eql,sha256=8mgG9EsvFDkwj0fcTCR1sjlbYu_DrJDPhP4r1f18r7A,436
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_smb_login.lucene,sha256=l9LsDD_J5GDCKiACbgrWl_4_wIEvN3NWaPfcHMMLY2U,321
src/rules/windows__builtin__security__account_management__win_security_successful_external_remote_smb_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_failed_logon_source.eql,sha256=2Ye8hfNOi2Kg2U2GTrrYU8qAw5bwCtih-tVjtHTqk5Y,400
src/rules/windows__builtin__security__account_management__win_security_susp_failed_logon_source.lucene,sha256=vMUnSjRQmW2SWltTpOAfh0lKbRGpHwbQ6NKAfUGo8hI,287
src/rules/windows__builtin__security__account_management__win_security_susp_failed_logon_source.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_logon_newcredentials.eql,sha256=mNAPyYxzlnzM5udLj48z32gYyqsM9MzvCeYkqXSxpTc,96
src/rules/windows__builtin__security__account_management__win_security_susp_logon_newcredentials.lucene,sha256=L_NyNGInBF_-iEXSPgsNyzZ8o_wXkmpwNfAmUy9czRE,80
src/rules/windows__builtin__security__account_management__win_security_susp_logon_newcredentials.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_privesc_kerberos_relay_over_ldap.eql,sha256=38030Lzspt7-1hrSIaXVISScnrtBlTTM-zSB6T1UU5U,303
src/rules/windows__builtin__security__account_management__win_security_susp_privesc_kerberos_relay_over_ldap.lucene,sha256=fwrimdGWplHUN5WunRtKiUnVcrykcKuQgpvYp9L8vmQ,281
src/rules/windows__builtin__security__account_management__win_security_susp_privesc_kerberos_relay_over_ldap.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_rottenpotato.eql,sha256=WdOOi4mB8_I_q8O8-REpWk7UiOOn4cSVuM-wuiYz4Js,216
src/rules/windows__builtin__security__account_management__win_security_susp_rottenpotato.lucene,sha256=GH-TDkv-Wdrr9OBxQ2sd1zAPprqzPoDVMla1yBHyosU,192
src/rules/windows__builtin__security__account_management__win_security_susp_rottenpotato.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__account_management__win_security_susp_wmi_login.eql,sha256=CUwulWWZyJXhqnqT5rb5tqZ2dqOf3TYHxkhEvZrHxUk,101
src/rules/windows__builtin__security__account_management__win_security_susp_wmi_login.lucene,sha256=vZKWP06gexTEEeqHpA0QJHipcDgHkO9c4_c0pj5Kotc,85
src/rules/windows__builtin__security__account_management__win_security_susp_wmi_login.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__object_access__win_security_wfp_endpoint_agent_blocked.eql,sha256=GaYs09j_0roY-VnZcED5okhAYlYS_KsRO0JXDmSOssg,1624
src/rules/windows__builtin__security__object_access__win_security_wfp_endpoint_agent_blocked.lucene,sha256=BS29RXIPBk7KOLLKnBgctCrQgy9xX4jc9y6GF6XqCpU,1605
src/rules/windows__builtin__security__object_access__win_security_wfp_endpoint_agent_blocked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_aadhealth_mon_agent_regkey_access.eql,sha256=07lkc57J1uYK34QVNRLQs0QnPyS0WegIrYPe2olteAI,575
src/rules/windows__builtin__security__win_security_aadhealth_mon_agent_regkey_access.lucene,sha256=iwlDVl8fCe4l3iEG1PhCISNhHeFq6YpasWhhwxV1Zrs,544
src/rules/windows__builtin__security__win_security_aadhealth_mon_agent_regkey_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_aadhealth_svc_agent_regkey_access.eql,sha256=t9Ia_CkYD24TfCjbB2HCnSVrE0xMmOxNQYLfQ_su5w4,544
src/rules/windows__builtin__security__win_security_aadhealth_svc_agent_regkey_access.lucene,sha256=cJKUW8NAcE8i_fhvvAMIOyjcvd1LGu_DquTojaEoiok,512
src/rules/windows__builtin__security__win_security_aadhealth_svc_agent_regkey_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_account_backdoor_dcsync_rights.eql,sha256=-SdrltA_-YjE69slFdThN4UHi7tmjuDmrrHnI9Ff9JQ,391
src/rules/windows__builtin__security__win_security_account_backdoor_dcsync_rights.lucene,sha256=bwn0qIxjPRpzBnmHUZ02_6BdxBB6QWOWrsLmCOPDYNo,371
src/rules/windows__builtin__security__win_security_account_backdoor_dcsync_rights.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_account_discovery.eql,sha256=56Wc5O3q1g8hSHFyum3teZ7cfrjJqK-7a7a4UTFIh3w,321
src/rules/windows__builtin__security__win_security_account_discovery.lucene,sha256=LjFMhtYqXelvZyZBLuDvpLH11xDZlJephu1jJ8j6Ack,296
src/rules/windows__builtin__security__win_security_account_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_ad_object_writedac_access.eql,sha256=u7GkLl05K57odJhwJcwxlGdbr8mMYGZrWm3SjfyRLfM,238
src/rules/windows__builtin__security__win_security_ad_object_writedac_access.lucene,sha256=d707-SPBQaHMn9SzHvvvULU6H2wwxLv1k7Ol9l_hjEs,216
src/rules/windows__builtin__security__win_security_ad_object_writedac_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_ad_replication_non_machine_account.eql,sha256=KMF8MKVTiznpdrF2UsCnTrooZ__dTWFKTXfCtSqkPZc,316
src/rules/windows__builtin__security__win_security_ad_replication_non_machine_account.lucene,sha256=RQh5TrDKmMkWxjojxUQcdkNCwp2Hq3OiC2HkzMRJyT8,296
src/rules/windows__builtin__security__win_security_ad_replication_non_machine_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_ad_user_enumeration.eql,sha256=OAoOL4SDh7TU3onIFIhsRuG6OdiVUaL6IP4-KMtT_-Q,279
src/rules/windows__builtin__security__win_security_ad_user_enumeration.lucene,sha256=m-9uVMG-rxzMixVMOxT_x24PCBxkui5hpzPdPDuZqsk,251
src/rules/windows__builtin__security__win_security_ad_user_enumeration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability.eql,sha256=LXEH55uHi7E2Rrib2ntnnNkVVjmAEqcovi-8e0rRyB0,240
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability.lucene,sha256=q7AmVkGcm_8Bln8icS8SekXlmHKW28KvgVB9uL4ZbMY,220
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability_eku.eql,sha256=-MjkVwp-r54iqUIJhpHHJN88p4OdzJyxOoVOyQyY6ZE,519
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability_eku.lucene,sha256=CzVsJzfA0jwJELSuLxwUYW-1yTExiWmS3kBZv5zN2ik,483
src/rules/windows__builtin__security__win_security_adcs_certificate_template_configuration_vulnerability_eku.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_add_remove_computer.eql,sha256=Y6gbRO5R_jyUKVvGjvo_DWqUbEYpsgoRGkY7YQfcSVo,76
src/rules/windows__builtin__security__win_security_add_remove_computer.lucene,sha256=NG57v7365dcRFcY_GbSROm0ryfzEQLTEhqdpIY_W4fE,56
src/rules/windows__builtin__security__win_security_add_remove_computer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_admin_share_access.eql,sha256=Lr4s1WyKNBnqWJftUt8ErcVHSiQ9bvmEefHx9A0MhMM,128
src/rules/windows__builtin__security__win_security_admin_share_access.lucene,sha256=Zv9he0K_ksF-_0oXBGGWArqvbAPMfnItS91E6PMesZ0,110
src/rules/windows__builtin__security__win_security_admin_share_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_alert_active_directory_user_control.eql,sha256=JJccERmVjQjm7LN77T1bynbtj71jzteP0Fy-3_4R2dk,128
src/rules/windows__builtin__security__win_security_alert_active_directory_user_control.lucene,sha256=n5Pmgsju0ljCp_LLNyHc2CmNr-sXqNVotkGDYgQF7WU,112
src/rules/windows__builtin__security__win_security_alert_active_directory_user_control.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_alert_ad_user_backdoors.eql,sha256=K-ix_2D9yTa5pKuZbo6he9n0SS5pTQNhZeBMRiF4YKM,568
src/rules/windows__builtin__security__win_security_alert_ad_user_backdoors.lucene,sha256=NZsuZUd3RpSzeAnvcWscfYp09ELwdqflZK7acCf9FBY,540
src/rules/windows__builtin__security__win_security_alert_ad_user_backdoors.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_alert_enable_weak_encryption.eql,sha256=jpEkrRi7VVauFb39jUEGalRyGbufkiYAjGu7XMKZDw8,774
src/rules/windows__builtin__security__win_security_alert_enable_weak_encryption.lucene,sha256=MBcR3thsFu2kv2gBwbGZq6LG-uB9Gb-tOeEmEwfoONw,712
src/rules/windows__builtin__security__win_security_alert_enable_weak_encryption.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_alert_ruler.eql,sha256=5a7ce7pVSlUAyKWuOnQ-LWQjxivK6Oynz7JQQTzjOFw,171
src/rules/windows__builtin__security__win_security_alert_ruler.lucene,sha256=s21W04O4_foyNKhQzc_mDFmVRCVB897K1cJ03hvPJpo,145
src/rules/windows__builtin__security__win_security_alert_ruler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_atsvc_task.eql,sha256=5qPBfv_StGVfnSQPdjYcOuvQCjJeVdB3QKQwgnmC-mY,201
src/rules/windows__builtin__security__win_security_atsvc_task.lucene,sha256=pTCEeqt1XC6ku31k0PsH3WWhV2XCLh0pnGt-pxMhRCs,181
src/rules/windows__builtin__security__win_security_atsvc_task.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_audit_log_cleared.eql,sha256=moFmPjV8YSm_4PcgPV5sRI-91aEGPDTyyzeyioxgtm0,174
src/rules/windows__builtin__security__win_security_audit_log_cleared.lucene,sha256=40_A7Ya6jFWWvHNtnpMCVOXhvQ9wbtiSxzCVcz55Qbs,156
src/rules/windows__builtin__security__win_security_audit_log_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_camera_microphone_access.eql,sha256=tZnbbHaaTsvATubsbcGXG_KfmSC_QG_Q0LD72cAHDac,356
src/rules/windows__builtin__security__win_security_camera_microphone_access.lucene,sha256=Scxcvbt3K_Tuuh1s4FetWM_K6RovbApNG-Sdus1--0g,328
src/rules/windows__builtin__security__win_security_camera_microphone_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_cobaltstrike_service_installs.eql,sha256=cDUUc0MOTLus0qF4nhwfc12LPpBmUe0h8wUhgjWjCO8,713
src/rules/windows__builtin__security__win_security_cobaltstrike_service_installs.lucene,sha256=sYgYX144oeUFWPkHJDvo0ZHla1C5QI1xKUviBc52U9A,686
src/rules/windows__builtin__security__win_security_cobaltstrike_service_installs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_codeintegrity_check_failure.eql,sha256=eAJVplCJtInl8mgPSTB5wtdyPOVd8DbKNmOcn3Yu2ng,335
src/rules/windows__builtin__security__win_security_codeintegrity_check_failure.lucene,sha256=vFZvdrxeVBm5iKA9_S7ChNW6pipMchKajgCZZYWJzYI,307
src/rules/windows__builtin__security__win_security_codeintegrity_check_failure.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dce_rpc_smb_spoolss_named_pipe.eql,sha256=30G8VewzvKPekj1n3ixZ_8cFZwx36ZSxvzuf7n17DSU,156
src/rules/windows__builtin__security__win_security_dce_rpc_smb_spoolss_named_pipe.lucene,sha256=eTFLg41SmFnTOQCf-u4bdJut5mX7mpO3Bgt6gawMYDk,138
src/rules/windows__builtin__security__win_security_dce_rpc_smb_spoolss_named_pipe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dcom_iertutil_dll_hijack.eql,sha256=PRQxskVGOWYOQhbQSbe0eZIhFEHNsjcCdBY16960yYQ,165
src/rules/windows__builtin__security__win_security_dcom_iertutil_dll_hijack.lucene,sha256=roht_gSIQYw7chMtJ7xhmba_t-deGBcTHrCXXvntmDY,148
src/rules/windows__builtin__security__win_security_dcom_iertutil_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dcsync.eql,sha256=isBKQgvourYU1dTyfJAvYZnEl1XPGmDAm65lM-nZfK8,454
src/rules/windows__builtin__security__win_security_dcsync.lucene,sha256=aAFQYd00wtmKMVVSSprV6wTNBvUYb1jaXMlfvNhU_Hs,439
src/rules/windows__builtin__security__win_security_dcsync.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_default_domain_gpo_modification.eql,sha256=1kK1gI-7mLKbVRDKMsMC_9zZzl7nhI4aK4MhGWc5co4,293
src/rules/windows__builtin__security__win_security_default_domain_gpo_modification.lucene,sha256=A622YxiwAYHpzWlWwI9THLm2GLGz4wugHNYNZyQ60fk,287
src/rules/windows__builtin__security__win_security_default_domain_gpo_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_device_installation_blocked.eql,sha256=Aqeos-tt-7pRO4MRgvu7gfGOJX54hvDyeADJw4IdWk0,58
src/rules/windows__builtin__security__win_security_device_installation_blocked.lucene,sha256=MshyPtJYJZRaPvdQGm4M4FqSVd7BVprR658K1XgjpuQ,44
src/rules/windows__builtin__security__win_security_device_installation_blocked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_disable_event_auditing.eql,sha256=NhUn-3ym6o4cN9UtAYKaznG79e1zSwEkCH_RzDgJ-jU,819
src/rules/windows__builtin__security__win_security_disable_event_auditing.lucene,sha256=foR0SIfo-JuLss-zPhMscU0jwYg5x6ptzOHJ_nIZ6cQ,879
src/rules/windows__builtin__security__win_security_disable_event_auditing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_disable_event_auditing_critical.eql,sha256=3XDHGpsTreNsWjD9kFbpTX9C5b1poJgdI-a0VcO4AmA,925
src/rules/windows__builtin__security__win_security_disable_event_auditing_critical.lucene,sha256=xJJGpByNMV51_ixnCwGopoWEeiE_ucLJADW_jzSZe4A,979
src/rules/windows__builtin__security__win_security_disable_event_auditing_critical.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dot_net_etw_tamper.eql,sha256=UaMYbH5QA8NB-xomWlik1N2QEKXBaPPDVGAiz3t0IQ0,419
src/rules/windows__builtin__security__win_security_dot_net_etw_tamper.lucene,sha256=ZI_Cio-D5qmlkpiObNVCHNAW2MCHActM3wPCLYdDtjA,385
src/rules/windows__builtin__security__win_security_dot_net_etw_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dpapi_domain_backupkey_extraction.eql,sha256=c65m5c8kAu2USA_jJNRh2Op0Tad7rvNKgcqO6vDwXSI,193
src/rules/windows__builtin__security__win_security_dpapi_domain_backupkey_extraction.lucene,sha256=8PTBgf2PuLSGacfXABucy1_cdUnGaOptMznYdy6yDVc,173
src/rules/windows__builtin__security__win_security_dpapi_domain_backupkey_extraction.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_dpapi_domain_masterkey_backup_attempt.eql,sha256=_xiDizLQuiB0XFh7x3JjhkyVnYOsjaJtB_FLyVua2qs,58
src/rules/windows__builtin__security__win_security_dpapi_domain_masterkey_backup_attempt.lucene,sha256=3bLWYPQO5g_rttTOkgW_CrL06hOW2pCdBs1q4u8XIAw,44
src/rules/windows__builtin__security__win_security_dpapi_domain_masterkey_backup_attempt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_external_device.eql,sha256=Sa7F0qYAGB-k5omOOR5krJcema2g7MXtSd6H1kY3z5E,171
src/rules/windows__builtin__security__win_security_external_device.lucene,sha256=5dkPai70JFcmQS1Zo_t7lTbk-nh2uTEUhs9tyCTMFlk,156
src/rules/windows__builtin__security__win_security_external_device.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_gpo_scheduledtasks.eql,sha256=IpzcFEiJEC3DkOOEK6r-cjReNIASMcfZqiVgxT4gxBw,500
src/rules/windows__builtin__security__win_security_gpo_scheduledtasks.lucene,sha256=jfvOP0tIO2-PgjQFUakfqBKovJDX6z5oZya3smchY94,464
src/rules/windows__builtin__security__win_security_gpo_scheduledtasks.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_hidden_user_creation.eql,sha256=NtOQPDbUcsenuepsUqUXBXuMf1C0eSkr_XAidjaXOXI,164
src/rules/windows__builtin__security__win_security_hidden_user_creation.lucene,sha256=nws_ssPeQKhIBko9mebliZ8jx-vHyaoX2o8i6-stk6o,146
src/rules/windows__builtin__security__win_security_hidden_user_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_hktl_edr_silencer.eql,sha256=eviks58suXpJbt3MmWDL5-jGJmGUZERBZjct_ULG44c,138
src/rules/windows__builtin__security__win_security_hktl_edr_silencer.lucene,sha256=6RixnDxDuK6V9sPkEcmm0bpquPU1BZkuikqO2t5c15s,118
src/rules/windows__builtin__security__win_security_hktl_edr_silencer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_hktl_nofilter.eql,sha256=pcVL8zaakXanQIx4qthzKH1NlzysdtV1v21VVmh6-wY,188
src/rules/windows__builtin__security__win_security_hktl_nofilter.lucene,sha256=ZkgGydsHYG8V8eENv1qzaQ_URGrsgf0_8nBdlQ0neBk,168
src/rules/windows__builtin__security__win_security_hktl_nofilter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_hybridconnectionmgr_svc_installation.eql,sha256=YduO7TBbvKzy_hDzs3ChTvREB6_IikYejVC_pDNsK1Y,169
src/rules/windows__builtin__security__win_security_hybridconnectionmgr_svc_installation.lucene,sha256=Acf1FeB95rnjGnrtcfE8gUg4rkZucgWnfVj3zQl1S2c,151
src/rules/windows__builtin__security__win_security_hybridconnectionmgr_svc_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_impacket_psexec.eql,sha256=UAZ8qALWbK156TPrlOHLa8JjKIjJJ-p5ZxxBbrxiP04,211
src/rules/windows__builtin__security__win_security_impacket_psexec.lucene,sha256=vBtNBKO3DViO6AjKn7GVoPxcuvkNC23Cy2oiS49qz0Q,187
src/rules/windows__builtin__security__win_security_impacket_psexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_impacket_secretdump.eql,sha256=qdhUgStBYPw3Oy3vKFJGg383DwFT3IjyfS8QvM1lpCc,214
src/rules/windows__builtin__security__win_security_impacket_secretdump.lucene,sha256=EwmT_RTH8tWx580xreklmRPf7F6clayAuas_9nHccLU,194
src/rules/windows__builtin__security__win_security_impacket_secretdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_clip_services_security.eql,sha256=jFwZfhrS3XAEU2Cgwu-DeSCin7rF-CuVbc-GM_slBqI,208
src/rules/windows__builtin__security__win_security_invoke_obfuscation_clip_services_security.lucene,sha256=-9QCBZddO1qJRtIzDmc4dMhNvT1OKChY9wiKgal37G0,193
src/rules/windows__builtin__security__win_security_invoke_obfuscation_clip_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_obfuscated_iex_services_security.eql,sha256=P-91CVpENByyWXb5Lgmr6sDUg3LD8UCQzO8AMl3BXP4,1536
src/rules/windows__builtin__security__win_security_invoke_obfuscation_obfuscated_iex_services_security.lucene,sha256=Uz_MFaD4MZKkPquctqU9dTqoya_7Q2pR__ur7VBoCsE,1730
src/rules/windows__builtin__security__win_security_invoke_obfuscation_obfuscated_iex_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_stdin_services_security.eql,sha256=wUwQOR81vZ3hKnP4hruFEFXl5xrd9bO2hYucPasMoa8,303
src/rules/windows__builtin__security__win_security_invoke_obfuscation_stdin_services_security.lucene,sha256=Ijd4Ur1eyng4sVR4lj8oULjz-6OdhfMIGwRPR8-UFdg,277
src/rules/windows__builtin__security__win_security_invoke_obfuscation_stdin_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_var_services_security.eql,sha256=1IrJioAu1E6v9uqHR3voBzz6qESohb1to6GC3C4Yyn8,264
src/rules/windows__builtin__security__win_security_invoke_obfuscation_var_services_security.lucene,sha256=yRTzDLlbBkklhsLte9sLTCnIQ-bLwj7BZbm3zTcpxAk,239
src/rules/windows__builtin__security__win_security_invoke_obfuscation_var_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_compress_services_security.eql,sha256=TMSkV2EVK3FuEW8M624foZbsxl53JOMFsYo3Wku-tEI,347
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_compress_services_security.lucene,sha256=4wOHcl0jArSERL4eggbO8zL2TbZYpt1z1UJxxaQPJoA,323
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_compress_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_rundll_services_security.eql,sha256=6z9DjB3NAdFzaPssyFjtIIp-yIyC_qYGeIczn-as5nk,283
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_rundll_services_security.lucene,sha256=ofueh6SlskL4Hn2j8ungj_Iwaol0pfgDaN0VfTIz-xo,261
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_rundll_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_stdin_services_security.eql,sha256=0iQsoaW3FqrlQl094DteDDNASwAR17rsxBC8cTttWLQ,243
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_stdin_services_security.lucene,sha256=r7DEIGiJQ6dybkp2A2kAjlBxp4tnGS6IgsbV31Llmr0,221
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_stdin_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_clip_services_security.eql,sha256=46wfpH2H1qWquHdMKbuz3czKnMXx2tC8Qy6x92QTi0M,115
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_clip_services_security.lucene,sha256=KBobU_Fuw3WumpQ_8gYbjG3ziNJ40FeE_fPyj8TZhB8,101
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_clip_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_mshta_services_security.eql,sha256=Kgd9Olmd4ZJfpirHkaA1RJxETxs9FtmyWY78ibexhIo,276
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_mshta_services_security.lucene,sha256=CWPnHo_G07FrNlXrtJ3w0Y0M49e9lrA4M4XEhkM9Z8Q,255
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_mshta_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_rundll32_services_security.eql,sha256=XlC-JFS5pz8rqutd0B-W0iPteBuwL94hCteyDtqM8GU,363
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_rundll32_services_security.lucene,sha256=mF-fPLHZ8euG3LXF9PKonRg2KpZOmww-_vkrEv48lWg,335
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_use_rundll32_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_var_services_security.eql,sha256=2jmCh9nkgjDuyEVqljn4cJLO2yk81nublg-CGxtYNg4,347
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_var_services_security.lucene,sha256=beknlXAVaJsFzuchGp6DKRMq5mJPCi-qiwlXew93sBA,333
src/rules/windows__builtin__security__win_security_invoke_obfuscation_via_var_services_security.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_iso_mount.eql,sha256=GRAAtIk6jBK02DhZC-YL-0vjWumeCycM_1e6NdrvowM,345
src/rules/windows__builtin__security__win_security_iso_mount.lucene,sha256=InVhXa0jakEfCTJbQ5rO68Jig5edlhStjdO-YRoWjYs,317
src/rules/windows__builtin__security__win_security_iso_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_kerberoasting_activity.eql,sha256=kuFDliiJSIyzk-aJ77dIQIun26MU-1zO32WRvgZUJ_U,241
src/rules/windows__builtin__security__win_security_kerberoasting_activity.lucene,sha256=FCrtQoDmBB-j7Rp0EZxwy4xULBCo26ILuOu8vb1PB6c,213
src/rules/windows__builtin__security__win_security_kerberoasting_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_kerberos_asrep_roasting.eql,sha256=uXDhwVlEF5rH1dJqDGy_SEiFXtDoeF6bn3yr2QuMAhI,174
src/rules/windows__builtin__security__win_security_kerberos_asrep_roasting.lucene,sha256=r09WTh3Gg0rm4ITQmIWMwREf9IZICXKLfN_T3JLFzoU,154
src/rules/windows__builtin__security__win_security_kerberos_asrep_roasting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_kerberos_coercion_via_dns_object.eql,sha256=-hEoJuC8VCD2lrQ2eezUwD2P4fSi81X97usnP-6m23Y,437
src/rules/windows__builtin__security__win_security_kerberos_coercion_via_dns_object.lucene,sha256=zzHgR6uEZn9hKLquRjZu3eT3CMH1_hy1JiKceA0jlUE,403
src/rules/windows__builtin__security__win_security_kerberos_coercion_via_dns_object.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_lm_namedpipe.eql,sha256=z13v_JZUcqipDe5YLdiO0U2EM01DIWw2no8BGL840BY,409
src/rules/windows__builtin__security__win_security_lm_namedpipe.lucene,sha256=1RlRPaxf--Rx8lWsqZsRS2sI6OSOv1yp3pbplm-13_0,385
src/rules/windows__builtin__security__win_security_lm_namedpipe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_lsass_access_non_system_account.eql,sha256=59IPWJUrZ_443GY-6XowvIYgcHAKws21em7vznWKihQ,669
src/rules/windows__builtin__security__win_security_lsass_access_non_system_account.lucene,sha256=mor3fOfNdkonWjczXdwtsMK48Ezy_DfctU7sEq6SSXQ,629
src/rules/windows__builtin__security__win_security_lsass_access_non_system_account.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_mal_creddumper.eql,sha256=GVqOAItyjGvAAesv8zUroI0QCp2bKkx9n2LOHWkroK8,198
src/rules/windows__builtin__security__win_security_mal_creddumper.lucene,sha256=KLMFoaY5PQYpB7THZRmCsosbHTAG5mrmPrzxxUcC3LA,176
src/rules/windows__builtin__security__win_security_mal_creddumper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_mal_wceaux_dll.eql,sha256=J7pNPu-xmyRXg7UI-j4oH4CfgblwP7coVdFrSYovQiQ,127
src/rules/windows__builtin__security__win_security_mal_wceaux_dll.lucene,sha256=YGgoJxtUzujDYSZr32TvEVmO12k0KXih98wmeiX3fjE,105
src/rules/windows__builtin__security__win_security_mal_wceaux_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_metasploit_authentication.eql,sha256=6PaJ6jkIDsX9ojhDbRCQ1EXkgJvE7iDn59ETF2pt-xs,408
src/rules/windows__builtin__security__win_security_metasploit_authentication.lucene,sha256=KXrVTnOSqJjIpj3ebh0JN9NsevxN8fzfab8dDVOjcK4,416
src/rules/windows__builtin__security__win_security_metasploit_authentication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_metasploit_or_impacket_smb_psexec_service_install.eql,sha256=bWzyez-8VbfxOeQQkRLWfJvr-Qw9BZCLsR7JWCkYrRU,446
src/rules/windows__builtin__security__win_security_metasploit_or_impacket_smb_psexec_service_install.lucene,sha256=216asDVTx3PZhSAs-HzpS3CYZ3JdLJLV5jH9KgT_caQ,480
src/rules/windows__builtin__security__win_security_metasploit_or_impacket_smb_psexec_service_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_meterpreter_or_cobaltstrike_getsystem_service_install.eql,sha256=nwSBa0a6jMJBmxZo8AUtJP70cFQqOX8Ml9dhntom_tc,487
src/rules/windows__builtin__security__win_security_meterpreter_or_cobaltstrike_getsystem_service_install.lucene,sha256=cFjsMmSxlQUgL0Ckg6YgxfeGyFfPislQU409vl97aCo,454
src/rules/windows__builtin__security__win_security_meterpreter_or_cobaltstrike_getsystem_service_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_net_ntlm_downgrade.eql,sha256=9OsCKgVZbPM241oM_Luz9E-ZWnQ1AthE2TqibQjD4_0,348
src/rules/windows__builtin__security__win_security_net_ntlm_downgrade.lucene,sha256=OdwW0OdYOe2e4Wa8rcJ88Fdccc8ArcJGx25IGatstWI,320
src/rules/windows__builtin__security__win_security_net_ntlm_downgrade.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_net_share_obj_susp_desktop_ini.eql,sha256=Hm4v-9tIA0uJDwBGC4HqEbBqrDshgkPdnGyLY9epgG0,278
src/rules/windows__builtin__security__win_security_net_share_obj_susp_desktop_ini.lucene,sha256=AMQVSHRfEU3c7V6wiqzIAaASQLG99vYSehcPbi7rBzA,252
src/rules/windows__builtin__security__win_security_net_share_obj_susp_desktop_ini.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_new_or_renamed_user_account_with_dollar_sign.eql,sha256=ju4yWspgJ_4uqqf0sMSE988qncetOvl7geUkpllwnDg,260
src/rules/windows__builtin__security__win_security_new_or_renamed_user_account_with_dollar_sign.lucene,sha256=1N2vetGO9lHS6MnVixO8oU_LVimeGLAa4u8YQeD_EV8,236
src/rules/windows__builtin__security__win_security_new_or_renamed_user_account_with_dollar_sign.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_not_allowed_rdp_access.eql,sha256=Xo_zleFZCYreSMXkS8AiMeUjlWZmOLXb4Yosvx2fAtk,58
src/rules/windows__builtin__security__win_security_not_allowed_rdp_access.lucene,sha256=PArVu9QmFWpAPe-C5birN6zqLIP_m_xZ4pHV4TBFN-0,44
src/rules/windows__builtin__security__win_security_not_allowed_rdp_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_password_policy_enumerated.eql,sha256=T9P2XnW5FJrCihMqVAP2FbGdh7LQSxdYJa4mFdpn9iU,166
src/rules/windows__builtin__security__win_security_password_policy_enumerated.lucene,sha256=xGdx9IiaDmLXWWTT2sNHnesJf3gxRuseSmVQ7-_ceOQ,150
src/rules/windows__builtin__security__win_security_password_policy_enumerated.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_pcap_drivers.eql,sha256=sRF54g6z9s1nuQDQaMtK83kWKtYFJNXDPABwYzvRp9c,209
src/rules/windows__builtin__security__win_security_pcap_drivers.lucene,sha256=VIFdjm4IuewnNOLNiEz8OHqtN7HAH8IXj1f3OQJIg6w,187
src/rules/windows__builtin__security__win_security_pcap_drivers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_petitpotam_network_share.eql,sha256=u4FSYMHkZV2vP4qfyruHV5UkIRH1mZ7OMmQ4k46JcU0,222
src/rules/windows__builtin__security__win_security_petitpotam_network_share.lucene,sha256=_Fvxg7F2DyB5PXtQYpHNnkNNG2q6cuKOnt16IJ_GmFc,201
src/rules/windows__builtin__security__win_security_petitpotam_network_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_petitpotam_susp_tgt_request.eql,sha256=oNhogG-2m4_1x3y_8oOWWvQRad8c7Y2WSjZJTL3_VA0,214
src/rules/windows__builtin__security__win_security_petitpotam_susp_tgt_request.lucene,sha256=sbDwgJWafRgITirhJr2BbNBtfz09UBxHrVpuKklyQT8,194
src/rules/windows__builtin__security__win_security_petitpotam_susp_tgt_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_possible_dc_shadow.eql,sha256=0b8twunj5SimMEyEvW8SXbxm3MTL8cu2nTcB-S_erAo,251
src/rules/windows__builtin__security__win_security_possible_dc_shadow.lucene,sha256=5D7HWHVUKS6fEF3v53eOUmnP3FD9dgpfrWjsPtKSOM8,231
src/rules/windows__builtin__security__win_security_possible_dc_shadow.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_powershell_script_installed_as_service.eql,sha256=0l3uYU_y2cdOi9zhifdit9QlTLEjmntM6UXbKboz680,133
src/rules/windows__builtin__security__win_security_powershell_script_installed_as_service.lucene,sha256=l5JEuikrutN5eK82uiURNRuIIzCNZxTDlJEVgEAFoNI,111
src/rules/windows__builtin__security__win_security_powershell_script_installed_as_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_protected_storage_service_access.eql,sha256=dsqWXP8QaI4qOXt3dE6RqG7jPqb9xsYs9OFAEZn3qzI,161
src/rules/windows__builtin__security__win_security_protected_storage_service_access.lucene,sha256=Xuo30eYHZeX9L18AWCabp_yKa7lyYWg7tJJdbfzOO3o,143
src/rules/windows__builtin__security__win_security_protected_storage_service_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_rdp_reverse_tunnel.eql,sha256=QPjfhmPFZnhivSk1HtLfHUnPr42GzMxwImqoqUC6E-A,325
src/rules/windows__builtin__security__win_security_rdp_reverse_tunnel.lucene,sha256=bzonDFNfe3dEF6KZvYyX60P9OA66OW_2ZhUzWt_VFrs,290
src/rules/windows__builtin__security__win_security_rdp_reverse_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_register_new_logon_process_by_rubeus.eql,sha256=MSN6vGWpAX6Un_R6JgDpGbOa3Y14tOUS0MideCiHSuI,121
src/rules/windows__builtin__security__win_security_register_new_logon_process_by_rubeus.lucene,sha256=OakyOjJeDDF9h5s9f-xgUUy3M2cCHVPnYZL_QcPjexs,105
src/rules/windows__builtin__security__win_security_register_new_logon_process_by_rubeus.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_registry_permissions_weakness_check.eql,sha256=DZ49cLq4egGVB9d8uJ8FVQPMg9JS8lMUrDbn44ATHms,212
src/rules/windows__builtin__security__win_security_registry_permissions_weakness_check.lucene,sha256=rgF4Hcu75jNIM9DXC3IrtxahbTWLp9Lgw8imks3RZAk,192
src/rules/windows__builtin__security__win_security_registry_permissions_weakness_check.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_remote_powershell_session.eql,sha256=Hzc-Gqr6cB4q_uokHohHtO1sAHKbBq_dS5cUigjRjns,139
src/rules/windows__builtin__security__win_security_remote_powershell_session.lucene,sha256=0UNabM88SRGOANvOcOOsMVunBeGAKXL4iKpZ1Z0uNEo,119
src/rules/windows__builtin__security__win_security_remote_powershell_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_replay_attack_detected.eql,sha256=puonevdhmcaUNH9bP2eUFxfxxRHw7FWAop_faVAbFfw,58
src/rules/windows__builtin__security__win_security_replay_attack_detected.lucene,sha256=7mgIWA3D5qkmGfMQHep1PzEqyzgxBxsJ0YcF3yr30I8,44
src/rules/windows__builtin__security__win_security_replay_attack_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_sam_registry_hive_handle_request.eql,sha256=zeoeiVSwif_hDLMeOwrfqYGm7B9dBmbpogVDB0uG5gM,141
src/rules/windows__builtin__security__win_security_sam_registry_hive_handle_request.lucene,sha256=MrjpXYp_FUK7LQnL29m-XZKFq_mIEgTMBfO2Bt0JSg8,123
src/rules/windows__builtin__security__win_security_sam_registry_hive_handle_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_scm_database_handle_failure.eql,sha256=Y5GsWAtqtDJB3ubEMRknMtaxrFdychrQtCoOJTgyMsk,242
src/rules/windows__builtin__security__win_security_scm_database_handle_failure.lucene,sha256=vLnxhWPaZTHcNA85fLV9tq9HBP-sV8Q0D5jF350mp-Q,221
src/rules/windows__builtin__security__win_security_scm_database_handle_failure.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_scm_database_privileged_operation.eql,sha256=lYV-_yApvfsnA1cXVtj6Cei4jbHO1sIo6IX-Ubye25w,325
src/rules/windows__builtin__security__win_security_scm_database_privileged_operation.lucene,sha256=Ro6knUPdB5SByw5d1Jfu6S6ylLZ2npvVzUbGbfOOOT4,303
src/rules/windows__builtin__security__win_security_scm_database_privileged_operation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_sdelete_potential_secure_deletion.eql,sha256=ePi0Lpxy3v6vL_ZRFgAlBNRPcGmeu3Z0e9-84846ybk,146
src/rules/windows__builtin__security__win_security_sdelete_potential_secure_deletion.lucene,sha256=49UaD88PxXUGEPgMdwh31XDV1tuChW1oeypEiVC59tg,118
src/rules/windows__builtin__security__win_security_sdelete_potential_secure_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_service_install_remote_access_software.eql,sha256=DJ_KaJb9rhxqrLg5OU0AkSRwH_94kSvspJWwSOs4b70,480
src/rules/windows__builtin__security__win_security_service_install_remote_access_software.lucene,sha256=KTzur-7fnHrNYKqrPxA-0WblUW1ovX9v1K2E6Qx-uD0,458
src/rules/windows__builtin__security__win_security_service_install_remote_access_software.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_service_installation_by_unusal_client.eql,sha256=kesiMz2O41Y1r33B9pKZ1lASXKzxuZ2QaedfCP5Epwo,128
src/rules/windows__builtin__security__win_security_service_installation_by_unusal_client.lucene,sha256=yXzC6Hn9748TAgl3xGcmIyq3_JHyBDZ67ZjBucTr-E0,112
src/rules/windows__builtin__security__win_security_service_installation_by_unusal_client.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_signal_sensitive_config_access.eql,sha256=RBhot-p_5Ws4Pe7hRrTKffWEMgRSB0IUza0LU-D59S4,324
src/rules/windows__builtin__security__win_security_signal_sensitive_config_access.lucene,sha256=PQ9yE-tI9caDPyi86Mib39P3mm4XoyrCCnek32p8qds,291
src/rules/windows__builtin__security__win_security_signal_sensitive_config_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_smb_file_creation_admin_shares.eql,sha256=Af9biM5Drd4bFjH2I42oD_udSrnrQ7Y0MqGkq0CBa2A,191
src/rules/windows__builtin__security__win_security_smb_file_creation_admin_shares.lucene,sha256=Itvs_CKwUEsAc9uRqcbSNInp16iKBszozoeZyj1EmNw,170
src/rules/windows__builtin__security__win_security_smb_file_creation_admin_shares.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_add_domain_trust.eql,sha256=KL6z188ozAq3jG59tkH1nYnT-2rAbbB9Tkfby_IiWUs,58
src/rules/windows__builtin__security__win_security_susp_add_domain_trust.lucene,sha256=8vpOeElqMx8pcs3utUpELOJJPS2cdDem8elozniDOTI,44
src/rules/windows__builtin__security__win_security_susp_add_domain_trust.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_add_sid_history.eql,sha256=hvtsDhjryMVnD_BwnZGvRFKzWYcGADoryxgIkKQO6lI,254
src/rules/windows__builtin__security__win_security_susp_add_sid_history.lucene,sha256=Snz_vrMnCQxRXBT_Vkjd_ra4bNijgXepBICnxUGbSFs,228
src/rules/windows__builtin__security__win_security_susp_add_sid_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_computer_name.eql,sha256=x_v9E8G9uKvOMpnesfIvIqkD9f9MFl1-BG5m9FxZVKs,231
src/rules/windows__builtin__security__win_security_susp_computer_name.lucene,sha256=aeEjpCWuWuZ7vAmNtX7Uq7IlQL_OFxd16aBv7RVXdns,213
src/rules/windows__builtin__security__win_security_susp_computer_name.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_dsrm_password_change.eql,sha256=F5U1b7R6q-FQ3zRtltuRYi8cjlVXIjFdoIljYRE0wvE,58
src/rules/windows__builtin__security__win_security_susp_dsrm_password_change.lucene,sha256=s-oucHX6b0rU-P-SA-pCYqa-EFIbJpn0mkdV6nTznb8,44
src/rules/windows__builtin__security__win_security_susp_dsrm_password_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_failed_logon_reasons.eql,sha256=_EzOZ9MDuWH5ZUML7VC8mZ1EuQfUzXfzhTDXr-t6xEM,356
src/rules/windows__builtin__security__win_security_susp_failed_logon_reasons.lucene,sha256=ggJ5ENoYOl1EL1b9uPA7rXUpH0CUFLJCRAFeRuqdxPk,321
src/rules/windows__builtin__security__win_security_susp_failed_logon_reasons.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_group_policy_abuse_privilege_addition.eql,sha256=xEfswCYYCUHHjYTAyKdFQ6WT_r_sZKD89-2em8y-xQk,264
src/rules/windows__builtin__security__win_security_susp_group_policy_abuse_privilege_addition.lucene,sha256=V6uFsxIo4nFMsdzXKIdJOUTG43YjghafLfoIZpN45oA,248
src/rules/windows__builtin__security__win_security_susp_group_policy_abuse_privilege_addition.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_group_policy_startup_script_added_to_gpo.eql,sha256=UJgUerjk2NsADCNoYE8LGvW7vk1Kjg8WvkA52cR6C1Q,578
src/rules/windows__builtin__security__win_security_susp_group_policy_startup_script_added_to_gpo.lucene,sha256=bZTG1WuLJkThlLeDOKncJyMeAHTpW14hK1FR-geZWuw,540
src/rules/windows__builtin__security__win_security_susp_group_policy_startup_script_added_to_gpo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_kerberos_manipulation.eql,sha256=dXmgetaypCSE6gmdsq6f-30wLb6GHNNZSWf5cn_i6XQ,367
src/rules/windows__builtin__security__win_security_susp_kerberos_manipulation.lucene,sha256=mXhC4NpDYMU9JVdEbldcupXukP0iVA1PimwbGegoWd4,339
src/rules/windows__builtin__security__win_security_susp_kerberos_manipulation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_ldap_dataexchange.eql,sha256=_fHGbHdiW1ujuWAogPtPTfHYDx3X-L9U6iEpD9t0Ag0,246
src/rules/windows__builtin__security__win_security_susp_ldap_dataexchange.lucene,sha256=5aQUhh8aOc2Vq5236zHkSxz-ZJHkF6wM-2PsY--4yrI,222
src/rules/windows__builtin__security__win_security_susp_ldap_dataexchange.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_local_anon_logon_created.eql,sha256=RWRbgZsi88vrmVMGtNuSjdk6PNMh-Q9FEPOI8t0qaqk,160
src/rules/windows__builtin__security__win_security_susp_local_anon_logon_created.lucene,sha256=c7liLM7QRg5pm8kpyyvynxhcLeS4QoMMBsGHPQ5sKuk,142
src/rules/windows__builtin__security__win_security_susp_local_anon_logon_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_logon_explicit_credentials.eql,sha256=wIrEv2sJP9gTXPW-3qKgrVBb7qawNJZ6l3xS6LlMRik,339
src/rules/windows__builtin__security__win_security_susp_logon_explicit_credentials.lucene,sha256=AW-YflWky9N9w6uxuN1zYZ1rbXY3MW4MYVvxRw6o344,311
src/rules/windows__builtin__security__win_security_susp_logon_explicit_credentials.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_lsass_dump.eql,sha256=a8RpbTjAWgiEfmLekfFXSJuYElAsSVtv5et1UJUGwjY,185
src/rules/windows__builtin__security__win_security_susp_lsass_dump.lucene,sha256=CpUFyRwToTN_NwG9kYDyfXJFD8Go-JvKqZos6g62xI0,165
src/rules/windows__builtin__security__win_security_susp_lsass_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_lsass_dump_generic.eql,sha256=c6YgTrp997K1-1i--yY2x2gAnWmbWHRe9E6FpfW-G4A,2351
src/rules/windows__builtin__security__win_security_susp_lsass_dump_generic.lucene,sha256=qEHTPnbZEYSI9NnNm8z5m_IDwUhjllg5ptVoa_QA19E,2271
src/rules/windows__builtin__security__win_security_susp_lsass_dump_generic.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_net_recon_activity.eql,sha256=AM06DVSp0LFC7zcwaSYiUiQmI8BIH_2txPpxgglYSgg,273
src/rules/windows__builtin__security__win_security_susp_net_recon_activity.lucene,sha256=Houyd96MAZXtBf_V6TokjdEq_o5oqDCt5nlCFdBzVlw,245
src/rules/windows__builtin__security__win_security_susp_net_recon_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip.eql,sha256=p0yl-id8WP_iNLOapCmxsLzUJcKOjr8N3UWiu8Zj9WI,229
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip.lucene,sha256=NgXGwjc-8LjIua6V7WP3BUh_QmX0-7MB4TwvTHuldaA,214
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_filename.eql,sha256=nK4RLbz4P5JMt3TZoEhbE0Rc8TAm9wnGFYTfUmc3zz8,291
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_filename.lucene,sha256=EXdfKRpreCbEFY9Al6_jUAbCRnUmvjKAfVBZUklDD_A,269
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_filename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_outlook.eql,sha256=fnKBQaWutoj2XYSas9Re69nkFoEwUVlXy_EEz-3tSG8,223
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_outlook.lucene,sha256=DYKLV1nOiu83sqn7ibgpo1ADxv8Sfv3qCQ6o2OJd0s0,208
src/rules/windows__builtin__security__win_security_susp_opened_encrypted_zip_outlook.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_outbound_kerberos_connection.eql,sha256=2L1gpVJLtvlbLyaxIDA3KRhocAZsTJzwJIv-l0jPnJk,716
src/rules/windows__builtin__security__win_security_susp_outbound_kerberos_connection.lucene,sha256=6hxaibi_tW0raax9raoZi9upKlN5tex748yuZ3feaYk,673
src/rules/windows__builtin__security__win_security_susp_outbound_kerberos_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_possible_shadow_credentials_added.eql,sha256=yg_6S7SwbTO8foSiD51ZObtYls4tPdb2zv0yHa4Af8Q,132
src/rules/windows__builtin__security__win_security_susp_possible_shadow_credentials_added.lucene,sha256=4CfJ9hOYcgKmi1uuwgLART8FvQihXxmHzc8cqqc8vtc,117
src/rules/windows__builtin__security__win_security_susp_possible_shadow_credentials_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_psexec.eql,sha256=vd2-4D7pPZvNfWGlSPrmc6eH6q64a3Ettlm0z303WWI,251
src/rules/windows__builtin__security__win_security_susp_psexec.lucene,sha256=1ob4LH_Nw6cI427ZpsAK1unVPK03LtNhpVQyxCMAKA8,228
src/rules/windows__builtin__security__win_security_susp_psexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_raccess_sensitive_fext.eql,sha256=wYYNSN5mERVV1ku2VNbyOYwDtLN7PRQTMsNLDdFexok,211
src/rules/windows__builtin__security__win_security_susp_raccess_sensitive_fext.lucene,sha256=c3F3cT0LXSHu1hW4oprBVHurLoncfYqIeIpFiI6CbRg,189
src/rules/windows__builtin__security__win_security_susp_raccess_sensitive_fext.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_rc4_kerberos.eql,sha256=5XYaTaxzTOnPfIUwvLWvLLxJjruWesu0pqi01dckBzo,189
src/rules/windows__builtin__security__win_security_susp_rc4_kerberos.lucene,sha256=oa9ixjMtH3Ewtcv5hiaiu6xQT5cd-focFZwpuyzQFsk,169
src/rules/windows__builtin__security__win_security_susp_rc4_kerberos.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_scheduled_task_creation.eql,sha256=DkniOcqdc4jl72AfWmK2Ve0J9ltjJNkx3wqvazDMCcw,689
src/rules/windows__builtin__security__win_security_susp_scheduled_task_creation.lucene,sha256=vFTbmoCvLJBIQZZN2jOuf57ae5EIZtUgWIHOe-YPVSs,683
src/rules/windows__builtin__security__win_security_susp_scheduled_task_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_scheduled_task_delete_or_disable.eql,sha256=kzIO3mpI6eEk0z9VW2rbUxxJuo_LE0EMHo8M2qBKUq0,463
src/rules/windows__builtin__security__win_security_susp_scheduled_task_delete_or_disable.lucene,sha256=__UWxGx5ch78IrN368leukypQcQ5zShLEA_S6iiE7JE,431
src/rules/windows__builtin__security__win_security_susp_scheduled_task_delete_or_disable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_scheduled_task_update.eql,sha256=CbhAxcCrF25NQVp92QCZz14Txj3HUnLUGSEn0oQMr9w,695
src/rules/windows__builtin__security__win_security_susp_scheduled_task_update.lucene,sha256=4neyexb8aiKn2PVInnBj6mD4sx_yvikR3Go6cvsBfLo,689
src/rules/windows__builtin__security__win_security_susp_scheduled_task_update.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_susp_time_modification.eql,sha256=B3GrptfuPXQveo9XpCW2aU9nQM0OpwXfHyWD9tJzeCk,394
src/rules/windows__builtin__security__win_security_susp_time_modification.lucene,sha256=qUtGcZaciPw_ZYf37R_OS97zRQHb6Vc03qJE8WDEP3E,383
src/rules/windows__builtin__security__win_security_susp_time_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_svcctl_remote_service.eql,sha256=RsX7TPtOoW2kDR0LRnwzsC01caBI0YhAgKDlZt8t338,202
src/rules/windows__builtin__security__win_security_svcctl_remote_service.lucene,sha256=7cDxdrwmJvNqbNx40D7nJLFNTLHtaxd8UoF0dU1jkxg,182
src/rules/windows__builtin__security__win_security_svcctl_remote_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_syskey_registry_access.eql,sha256=FdwMrrDpbQqT_sJgOGF-dAY0lH99mc3lVt2X3G76NJ0,213
src/rules/windows__builtin__security__win_security_syskey_registry_access.lucene,sha256=WVG6fVrLrDUYcb1bqCZ-ihyd2gMgY3ycf1QxKEmnXrY,183
src/rules/windows__builtin__security__win_security_syskey_registry_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_sysmon_channel_reference_deletion.eql,sha256=r-PlcuwdoYtF-EPpzREO83-1C4ovoyHRQ1S2nejqMwY,543
src/rules/windows__builtin__security__win_security_sysmon_channel_reference_deletion.lucene,sha256=kTrhs4qFYA438IJQ4QPibZQRJQXXPKgSTA2NMnTrLJw,523
src/rules/windows__builtin__security__win_security_sysmon_channel_reference_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_tap_driver_installation.eql,sha256=FMCXPhgKa66EBF5HdJQ2A9XSzbCcWIFdd7I0PhF9I7g,110
src/rules/windows__builtin__security__win_security_tap_driver_installation.lucene,sha256=2FDNZgsImKSOGdDFyVa55I9tAzsxv0CotrhIRmuGkxs,94
src/rules/windows__builtin__security__win_security_tap_driver_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_teams_suspicious_objectaccess.eql,sha256=O5eF62cWlvw-wnoyaBgvBFpqpXiZNqZHQ1zmIi8quPo,257
src/rules/windows__builtin__security__win_security_teams_suspicious_objectaccess.lucene,sha256=AhYz0KXBK1mzryR_vGQmoI5RHBeVEDZnml2ZiU6iuqM,234
src/rules/windows__builtin__security__win_security_teams_suspicious_objectaccess.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_transf_files_with_cred_data_via_network_shares.eql,sha256=CblS-XwsaW8JggkkI7eKWz8vpfmV6Frv46lg-_KIgzU,383
src/rules/windows__builtin__security__win_security_transf_files_with_cred_data_via_network_shares.lucene,sha256=9gcCfg52oED4jLnbwHfnmqqcmT4sW-vv2j3BheXUNmg,353
src/rules/windows__builtin__security__win_security_transf_files_with_cred_data_via_network_shares.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_added_to_local_administrators.eql,sha256=gTdjmgiyRlGlBY_zUpfOjU0l8kJASC_kjaU8XJKtaZ0,185
src/rules/windows__builtin__security__win_security_user_added_to_local_administrators.lucene,sha256=mqX8pW75uMCYqPmuzuPes_alAOileAoWqHB_fE7i6-c,169
src/rules/windows__builtin__security__win_security_user_added_to_local_administrators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.eql,sha256=94_tgx1bx-Qv5SBW5edIzTOaenC4BjRcTBM7AqNj82s,170
src/rules/windows__builtin__security__win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.lucene,sha256=hkstsWRx110O4rYdgBk0ATJWsnyjcRXg7xp4EIAARhY,154
src/rules/windows__builtin__security__win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_creation.eql,sha256=p1sJbl5d5xBEJvSdSZslu5R8CTUx5K7UcU0Xkmw2lSU,58
src/rules/windows__builtin__security__win_security_user_creation.lucene,sha256=NhSANO081shp3BrBim-S52tnhPN7HQneJeNdTrGW_Ug,44
src/rules/windows__builtin__security__win_security_user_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_driver_loaded.eql,sha256=auyvhig9uM5z9I_gNzuFOa9YPoJdEVpfwsvlVzFJtEA,1000
src/rules/windows__builtin__security__win_security_user_driver_loaded.lucene,sha256=lJyHGijjErKqCgf2P-Uzr_PSH4a3ztmnQo_IKlXSf1g,974
src/rules/windows__builtin__security__win_security_user_driver_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_user_logoff.eql,sha256=uv2a25WT30STdKOyRI1zA5uBWqw4w_bMq4ajR0s_ukA,76
src/rules/windows__builtin__security__win_security_user_logoff.lucene,sha256=vT7DlpHoVgn2V2F8_9iXonTjJsmhRtGExbI-UuIpKAU,56
src/rules/windows__builtin__security__win_security_user_logoff.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_vssaudit_secevent_source_registration.eql,sha256=CJbwi4HzTbrWsJWDQ-UrH7y6lExy842foZxiTkMSaGE,127
src/rules/windows__builtin__security__win_security_vssaudit_secevent_source_registration.lucene,sha256=hu-f81V8ShoBk-31uEe8FwZqJcOkEE5fDSSiXIXWsKY,105
src/rules/windows__builtin__security__win_security_vssaudit_secevent_source_registration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_registry_modified.eql,sha256=CBNi1mDRy9PLVdL5Zn-abKEDtUjXuRqY7EEWfyUJg9c,140
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_registry_modified.lucene,sha256=-EaRmeXLpxtDRbS3MUdCdBpbKLuji45Y1Y7V3bCW0UA,125
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_registry_modified.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_write_access.eql,sha256=PkNL4icg8PXBIixowmQxKEsDIIj6paR8_MqUF96x9kM,224
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_write_access.lucene,sha256=TkUxYDBd3IZ5p2k_719X089Rp25MY8sloz8H-Nk7F40,195
src/rules/windows__builtin__security__win_security_windows_defender_exclusions_write_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_wmi_persistence.eql,sha256=Dv1VhlnjnPotX8jPoSp7YONvezl7IDPmrPOLfULaaBU,159
src/rules/windows__builtin__security__win_security_wmi_persistence.lucene,sha256=OHbWD2F1L0Wy5QVkA4WCoUPJb1B5t-Ph3vJ1hZFwkA8,142
src/rules/windows__builtin__security__win_security_wmi_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_wmiprvse_wbemcomn_dll_hijack.eql,sha256=9jwV59ANaC7xAkKwJIh0PzuYQbOspihTliYRox7cTqc,152
src/rules/windows__builtin__security__win_security_wmiprvse_wbemcomn_dll_hijack.lucene,sha256=zTxD7GiyTv6wr3zoWOI4CHZ6rp0JGXBl29e1n1SgKrk,134
src/rules/windows__builtin__security__win_security_wmiprvse_wbemcomn_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security__win_security_workstation_was_locked.eql,sha256=bi6PSU6oqJDIfg6j_4vts79kP0UT49HXHNJrAxvte3M,58
src/rules/windows__builtin__security__win_security_workstation_was_locked.lucene,sha256=UQE0SuGfjD4gpj0s9C6ZGcdegexA4bz4x1LFFHVzPzk,44
src/rules/windows__builtin__security__win_security_workstation_was_locked.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security_mitigations__win_security_mitigations_defender_load_unsigned_dll.eql,sha256=MEFL-UD9fRST_sO-wqOcVfBnoifSa26Zs6GDyEyd8Xs,257
src/rules/windows__builtin__security_mitigations__win_security_mitigations_defender_load_unsigned_dll.lucene,sha256=Go194nEaaRgbr_2j1i7ApZFqm4C68UaKH1MGn3XGvZM,233
src/rules/windows__builtin__security_mitigations__win_security_mitigations_defender_load_unsigned_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__security_mitigations__win_security_mitigations_unsigned_dll_from_susp_location.eql,sha256=NbrPeg6_b4_ZkudHaCks0ngsUnzAJmIXcHBVdTSiyEs,345
src/rules/windows__builtin__security_mitigations__win_security_mitigations_unsigned_dll_from_susp_location.lucene,sha256=_E907kQvdkS4N2acNBtAYRYDPLPqn_Oxm-zu6YlWksY,322
src/rules/windows__builtin__security_mitigations__win_security_mitigations_unsigned_dll_from_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__servicebus__win_hybridconnectionmgr_svc_running.eql,sha256=ULLEc4GgbR5vNavVDZ9CtgFZ6uyhEBy6_a7_ido7tDk,200
src/rules/windows__builtin__servicebus__win_hybridconnectionmgr_svc_running.lucene,sha256=1nnDBgHr9NgsnzApbUicYVY9zVL4pjv1pf_4OZ3zJ0U,185
src/rules/windows__builtin__servicebus__win_hybridconnectionmgr_svc_running.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__shell_core__win_shell_core_susp_packages_installed.eql,sha256=rfBitC3QmovYpetSd3hPiCaXoOhkHNd6mlwatcjzWY4,306
src/rules/windows__builtin__shell_core__win_shell_core_susp_packages_installed.lucene,sha256=canNwaVsJdokFgVV1wEpMGbbI1nTgUUaxmj-gnf1D_8,279
src/rules/windows__builtin__shell_core__win_shell_core_susp_packages_installed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__smbclient__security__win_smbclient_security_susp_failed_guest_logon.eql,sha256=hNlaaIqwGqbIl1kF4CBHpoR4b5rk0P6lvw0LvgScTNE,164
src/rules/windows__builtin__smbclient__security__win_smbclient_security_susp_failed_guest_logon.lucene,sha256=lUlAle_nZpO0MFsvIJRvv6akbHCvof0o9KgycYm-FCQ,150
src/rules/windows__builtin__smbclient__security__win_smbclient_security_susp_failed_guest_logon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__smbserver__connectivity__win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.eql,sha256=kqNpmcTwA-_dGeakr6NMdKcduPlNf0tpj_nsWzcyuxw,528
src/rules/windows__builtin__smbserver__connectivity__win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.lucene,sha256=uXZMrou8kZ3spnyGyBNmmvGH_gybXMrU9KVvE6Ww-NM,437
src/rules/windows__builtin__smbserver__connectivity__win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__application_popup__win_system_application_sysmon_crash.eql,sha256=vKmfjpjdUvBwStGfDQrhs-zh3dWOLIS34-vsBAPb2h8,210
src/rules/windows__builtin__system__application_popup__win_system_application_sysmon_crash.lucene,sha256=N3VUSSLroJiyAekw01w1O2azPFskr_xkxhXE8bOy4-k,195
src/rules/windows__builtin__system__application_popup__win_system_application_sysmon_crash.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__lsasrv__win_system_lsasrv_ntlmv1.eql,sha256=hJxdPuvWjOH1-xdK7XWDYnfTCs1Fi9FiKxThH3OjJyI,110
src/rules/windows__builtin__system__lsasrv__win_system_lsasrv_ntlmv1.lucene,sha256=IZOgQEqtqUhiC4XO8g-z9Dz4u20-Lxb9Wjd59oh1fgI,88
src/rules/windows__builtin__system__lsasrv__win_system_lsasrv_ntlmv1.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_Iphlpsvc__win_system_isatap_router_address_set.eql,sha256=P6Ju0hQppmtHrc0N06e5dXpAdcXf6kaorkOGMnxIYMQ,276
src/rules/windows__builtin__system__microsoft_windows_Iphlpsvc__win_system_isatap_router_address_set.lucene,sha256=6TC_Gqe9OFFsOZkKgFpJDlB0mUziHLIsGWVhcw46fos,259
src/rules/windows__builtin__system__microsoft_windows_Iphlpsvc__win_system_isatap_router_address_set.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_certification_authority__win_system_adcs_enrollment_request_denied.eql,sha256=-XhysLeU0nelxrERmtdoSGxUyfQhn3v6d_eLWiB-Ymo,124
src/rules/windows__builtin__system__microsoft_windows_certification_authority__win_system_adcs_enrollment_request_denied.lucene,sha256=Jmyfm0JebvYATxUaV8hW9z5wBy0HfVfVjcp1qj-7jTY,110
src/rules/windows__builtin__system__microsoft_windows_certification_authority__win_system_adcs_enrollment_request_denied.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config.eql,sha256=Yzznhul2xP2CCwnEpdGghIrPywLLicnXVZchfPn6qHo,115
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config.lucene,sha256=z8eBMWSdXoCKU945ZRd9RVQL84UmgEsT34DFut1KaKU,102
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config_failed.eql,sha256=S9UnXJQLb6d3WidOVKvvWOE2NT8FX-Mca8vvgBwKKpc,141
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config_failed.lucene,sha256=uLXDzIJZFa32gHxoGfAlaIM-cUf_MsI-YC1uRet39Sg,122
src/rules/windows__builtin__system__microsoft_windows_dhcp_server__win_system_susp_dhcp_config_failed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_distributed_com__win_system_lpe_indicators_tabtip.eql,sha256=RO-wxjCysoUqZDx1pjCRpDXvogjwYK7lR31KXXPvRJA,329
src/rules/windows__builtin__system__microsoft_windows_distributed_com__win_system_lpe_indicators_tabtip.lucene,sha256=tYN0E13xExC5xItCEQd9mmUcrNTcNYrm-O2sivyoIk4,319
src/rules/windows__builtin__system__microsoft_windows_distributed_com__win_system_lpe_indicators_tabtip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_eventlog_cleared.eql,sha256=35e4bhYpko13m8j0pPaibLWF9qCz49PVNEXU6hftH-w,305
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_eventlog_cleared.lucene,sha256=hGkOqg7ZrO194g2yeBjLcsdiH3A9zJ8POth9Wgs8qOY,291
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_eventlog_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_susp_eventlog_cleared.eql,sha256=KoqVSFhCnqt3o6sYwcwBGI-FrxL_xvWzyxYy_MY8hHg,297
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_susp_eventlog_cleared.lucene,sha256=apLGVsLc1Zt2kLZ7wpoT7fqvMKE3KuWrMkTA3OtH39c,283
src/rules/windows__builtin__system__microsoft_windows_eventlog__win_system_susp_eventlog_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_cert_use_no_strong_mapping.eql,sha256=bU8oC1BYgVlZPd1f9GX2G5Ig8OXCln9vxkDzNr_5rEc,196
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_cert_use_no_strong_mapping.lucene,sha256=UeH8Ebi0S25H7kCe5LKVxyyKF_CY84w-AdBg2PjxMX8,176
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_cert_use_no_strong_mapping.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_tgs_no_suitable_encryption_key_found.eql,sha256=5PMPQIa_scSW2mbdgJ9eqzUj4KDIpiYA7BJtzaoq2ek,196
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_tgs_no_suitable_encryption_key_found.lucene,sha256=WCSdltvF10Skf3E3R74i9cLBs1i8Ssv0uM9Tat0WM9M,176
src/rules/windows__builtin__system__microsoft_windows_kerberos_key_distribution_center__win_system_kdcsvc_tgs_no_suitable_encryption_key_found.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_kernel_general__win_system_susp_critical_hive_location_access_bits_cleared.eql,sha256=mccb6QwEVaYyfLBtd2GO8EguzHo2Oyolf1-ZlMti7P8,195
src/rules/windows__builtin__system__microsoft_windows_kernel_general__win_system_susp_critical_hive_location_access_bits_cleared.lucene,sha256=fK--iooxKgpwDZbtKr43_9G8Yqp-2zm859WOK4as1JE,174
src/rules/windows__builtin__system__microsoft_windows_kernel_general__win_system_susp_critical_hive_location_access_bits_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_ntfs__win_system_volume_shadow_copy_mount.eql,sha256=C95rMc4rshdDsKoo6U33ER6NxvpH_doXPt0CA1oTKQU,168
src/rules/windows__builtin__system__microsoft_windows_ntfs__win_system_volume_shadow_copy_mount.lucene,sha256=yy83JkrcKOqyq1HX5GcPJtP9JdiUqe_W1-39YGYPqQI,152
src/rules/windows__builtin__system__microsoft_windows_ntfs__win_system_volume_shadow_copy_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_wer_systemerrorreporting__win_system_crash_dump_created.eql,sha256=gu_JUUu3-32Qs8pk5v7gAjCWCvQKMW3sD2PwrMSPGO0,128
src/rules/windows__builtin__system__microsoft_windows_wer_systemerrorreporting__win_system_crash_dump_created.lucene,sha256=rFHhf8cwV2wrNh9J_HVZgTQoMsYGBUsc-mKOcAehGXg,115
src/rules/windows__builtin__system__microsoft_windows_wer_systemerrorreporting__win_system_crash_dump_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__microsoft_windows_windows_update_client__win_system_susp_system_update_error.eql,sha256=aIp7psRYE-GkQ_GwrFOekGrvIp9qfeTIE4lOPbvQDuI,157
src/rules/windows__builtin__system__microsoft_windows_windows_update_client__win_system_susp_system_update_error.lucene,sha256=oLLuV150eKdxW_wFBvXm-yNmCcsKzW7PYnvLSwA9Yfg,137
src/rules/windows__builtin__system__microsoft_windows_windows_update_client__win_system_susp_system_update_error.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__netlogon__win_system_possible_zerologon_exploitation_using_wellknown_tools.eql,sha256=R5IFgQ1XCHNddBBguXvEdQN6uelShWZUzlZo4GgRU6s,103
src/rules/windows__builtin__system__netlogon__win_system_possible_zerologon_exploitation_using_wellknown_tools.lucene,sha256=sfvGOJRMCiyCqXysibibClYe1287VfKDJCzW69yA-ck,83
src/rules/windows__builtin__system__netlogon__win_system_possible_zerologon_exploitation_using_wellknown_tools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__netlogon__win_system_vul_cve_2020_1472.eql,sha256=ugl8dtUqXAwxL8BHQucugA_L8VmEZX0xa-gnhtlKuSk,94
src/rules/windows__builtin__system__netlogon__win_system_vul_cve_2020_1472.lucene,sha256=wYBus03B0CnDWDAiclrh0Inxy4uZ9cJjmWHwg3YBPcs,78
src/rules/windows__builtin__system__netlogon__win_system_vul_cve_2020_1472.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__ntfs__win_system_ntfs_vuln_exploit.eql,sha256=OLPt__Ab5842Lerb2kCOiSoN11xl66x9XcjCMNr3DMM,280
src/rules/windows__builtin__system__ntfs__win_system_ntfs_vuln_exploit.lucene,sha256=Q_gb0PrhPxa-MuYUGonYOW3sKn9aHj4auPB2HG2m4TI,270
src/rules/windows__builtin__system__ntfs__win_system_ntfs_vuln_exploit.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_cobaltstrike_service_installs.eql,sha256=6A9KzWAHK_x0H2mrrf83jQWDYugas4CPlM8MWewzg90,722
src/rules/windows__builtin__system__service_control_manager__win_system_cobaltstrike_service_installs.lucene,sha256=eaCgV94fI2iLUOmfOcLAXjEKL5_6XCirZMLRpt6axtw,695
src/rules/windows__builtin__system__service_control_manager__win_system_cobaltstrike_service_installs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_defender_disabled.eql,sha256=TA8HStGEytW5S9hQ4qHWJixEu3Q0hOiyBfj5ygq1dO8,286
src/rules/windows__builtin__system__service_control_manager__win_system_defender_disabled.lucene,sha256=LZAyqCswcReybyOcnv7RK9ly2vFZ-f8Ns2uIelsY7rg,262
src/rules/windows__builtin__system__service_control_manager__win_system_defender_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_hack_smbexec.eql,sha256=sG8JRv8WxCpKUc-r-6IpjULOKTWym3IXPg4jImFnJ54,236
src/rules/windows__builtin__system__service_control_manager__win_system_hack_smbexec.lucene,sha256=FXPkIhFHizduOfbN57wzPKCebtlaHVtvn7yBkXAEA2U,223
src/rules/windows__builtin__system__service_control_manager__win_system_hack_smbexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_clip_services.eql,sha256=G0FiNyzLw0-8k2n3bga7GQTkeiWzISYnG_m_Y6uSRu4,239
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_clip_services.lucene,sha256=53G9rabFVtILZKcEevVq2ScFJ4iFTizk95VDPz5d_5c,224
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_clip_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_obfuscated_iex_services.eql,sha256=6n-ArngAQvFJPLdJJSJIdYPsOsNQto0IM02fK7ESZZo,1528
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_obfuscated_iex_services.lucene,sha256=vWtqbNqhk-fQ0nAb-uC3u7kAkVcMpuZYAFGwmy5rlxU,1722
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_obfuscated_iex_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_stdin_services.eql,sha256=0Gxf0JLtdhZrZMudBuniauQmg9Up29PH5l1LAMdT0Ck,383
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_stdin_services.lucene,sha256=stZTwD8XB8X9pBLDDui5SNVM_gBZrcBLU7ZpMBV8sWU,353
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_stdin_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_var_services.eql,sha256=fTcvB1HkzIlAGClSkhAl06viGJ549xVvwy2Y4LRN9fk,289
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_var_services.lucene,sha256=wfSwAIZ_ovUjh9g3-apc2ieXxVJUXkM6UPmONx-RM38,264
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_var_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_compress_services.eql,sha256=A9Y8OHtAYvn_FPTvzHwBOwCUFYHYrSnpADsBfwAwCbo,373
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_compress_services.lucene,sha256=1-wSzY773CX5oYewTDRKQNcti1UQ1b8j6gG_OygDK8Q,350
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_compress_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_rundll_services.eql,sha256=6ibr4b80nOr21tmWojSG7TjPxuCfXnK9q-SNhaT0iO8,308
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_rundll_services.lucene,sha256=foemRUYRBPe5wjlG52p01apmcNFSrMTXKRxo85RvfoI,286
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_rundll_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_stdin_services.eql,sha256=9YZLpAOWeouojtpSpL2ijKl4fNPwKyaQ6fIlIw15T4Y,271
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_stdin_services.lucene,sha256=IBQMMM3I4R9FQA0bDDfcY5ysU7gPrufGvfcXEoooZxs,247
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_stdin_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_clip_services.eql,sha256=Or9cDG1pK5ZwpCi0HYJq1Nx94xVI-wWmu4kcIDhh-3w,158
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_clip_services.lucene,sha256=eBBbWL3Uykl5BWpfQuMXPayPy61JxgTd95E_UVgR9fc,144
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_clip_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_mshta_services.eql,sha256=a0MN961V4QRgto5xKUQArmfwCcE_zhQcd6bezzZxgRA,211
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_mshta_services.lucene,sha256=rDZA1AwTyNPefQpswd3us8SjcWI5wDe3Mzib8DXaANk,194
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_mshta_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_rundll32_services.eql,sha256=LRjAJd03Rie_FoizfMUJdqB-yFmV6ApVYc7DiQyLTqU,382
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_rundll32_services.lucene,sha256=ALJNhQw__jRgggUyholujGlHFaHMYUQeqx1c0abENPo,354
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_use_rundll32_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_var_services.eql,sha256=3UC_mYmFDnkB3W0qm04Ha5mxKGjYG1X_BnlpgZ0vWvY,366
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_var_services.lucene,sha256=5aLZd9-tGG_LaBS24eOsvgV65jE1J7IIIFQruUye6DU,352
src/rules/windows__builtin__system__service_control_manager__win_system_invoke_obfuscation_via_var_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_krbrelayup_service_installation.eql,sha256=SWBMdDpkgjOpBK8PzCfXf6ysgCvUuJ3yWazzrGCAAdI,101
src/rules/windows__builtin__system__service_control_manager__win_system_krbrelayup_service_installation.lucene,sha256=aMXpCCu-uHLNPWiivAYACNWMvrS5ulkD6OVTSy2ic28,85
src/rules/windows__builtin__system__service_control_manager__win_system_krbrelayup_service_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_mal_creddumper.eql,sha256=u75w44Sqdf4J6EIwaeOt6ACi9OzpDFbqnfYsSMNcj4Y,241
src/rules/windows__builtin__system__service_control_manager__win_system_mal_creddumper.lucene,sha256=hPuAEsvCe_aCqskXrOcPG0qOQ0rO2dKaMN41Qx-n2DY,219
src/rules/windows__builtin__system__service_control_manager__win_system_mal_creddumper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.eql,sha256=-l1uiW8SJ6wdfNzS1EfxseJk51QhMQyyB0lAoECSEyg,490
src/rules/windows__builtin__system__service_control_manager__win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.lucene,sha256=I3QGS3lhmhaltYrxMTr7mG_IAYBo2ItyeJ_E89WPlB0,457
src/rules/windows__builtin__system__service_control_manager__win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_moriya_rootkit.eql,sha256=Bn9Oul9Ax50ypyV4Tj5C_gIzytA7Cytf2kCYCS_Vrok,154
src/rules/windows__builtin__system__service_control_manager__win_system_moriya_rootkit.lucene,sha256=0jJtrSJAEDp0SE8AUDymq0Q6_LZN_wAX1p0-hGZzCus,138
src/rules/windows__builtin__system__service_control_manager__win_system_moriya_rootkit.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_powershell_script_installed_as_service.eql,sha256=t1uOml9qJ0L6hD7t1JF3C9h74R2hIzTlWR0oW6AHIHw,176
src/rules/windows__builtin__system__service_control_manager__win_system_powershell_script_installed_as_service.lucene,sha256=blDWXsv8secIoW3HFukoBuW2fpzdvGmuvZfilef4Pr0,154
src/rules/windows__builtin__system__service_control_manager__win_system_powershell_script_installed_as_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_anydesk.eql,sha256=yQwM0OM9tSV8vnUzVRo9p0ZAvx-C6Ig2iTdASiPfzao,250
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_anydesk.lucene,sha256=NkEGli9lxQT6ypniToywhT4CqxmV0Bp9AXfxqJukh5U,230
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_anydesk.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_csexecsvc.eql,sha256=FF21j9isI96sL0pIVM2lr4TwCX-QInTbvoYlK2GsFy8,209
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_csexecsvc.lucene,sha256=Lxb6L85LM5fd1dyjhPrGF2qzhGtR3Ml_qqeUD11z5K4,191
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_csexecsvc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_hacktools.eql,sha256=FG85NcdPJAlvGHwa6UeS9q5NYYifU82NW3S6625YMCY,342
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_hacktools.lucene,sha256=eBQpQq2xVLhxVmWflH4W5g5C17p30eeYge3Ws7fQR80,313
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_hacktools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_mesh_agent.eql,sha256=drC1ZcXc1DKgVACpOBFQ22InlpTlk4vXzmWghnYYYsA,211
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_mesh_agent.lucene,sha256=4lhMLnaFwHJ9AcuakwGUQGgBH5rwOOtSidrFzHNRies,194
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_mesh_agent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_netsupport_manager.eql,sha256=Y44kUJ85eRMf-m47Uim_KK6L5gxpSKRMyZT67Yw1qZ0,228
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_netsupport_manager.lucene,sha256=P0GGu-mzeiW-1dv1krYnW6sAi36XXxkluXkm3NUb2us,211
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_netsupport_manager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_paexec.eql,sha256=FsakYG7H2RUEkBDIeW6JdNccadt77eyGYloUUUSkb0I,213
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_paexec.lucene,sha256=8TIOU6_Nq4mtWifqpjpNMQvPQB9C1du73iQlIYEipQM,198
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_paexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy.eql,sha256=4GvqHuszEgLA_aMWwz2n3KADqwQPRxfMKaf6xaVkk6I,239
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy.lucene,sha256=IFYZ5J4tLIn5o2EGQCAfy2GnA3aXIUPI7ecuNSxrew8,216
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy_runner.eql,sha256=SPV4rqNLR65UZ8v2QjL084T6L_aRpFrvxsyc0o5iWEI,219
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy_runner.lucene,sha256=NSou0XMNm9X5K8i7JfUhK_WwRsJX9IAxfXd25Z_8kCM,203
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pdqdeploy_runner.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pua_proceshacker.eql,sha256=4wmTZAysogSjQeUvHZhxqporCORELO0AnvIAfOJDIo4,188
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pua_proceshacker.lucene,sha256=AgSL-xKVP6xOuuoLFvv5J6MqCV95tiqu4rMHpUNfQno,170
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_pua_proceshacker.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remcom.eql,sha256=tKGeWq3f9HTZiE75SjgQqrxCDfL_XnPzD09R3OV43nc,209
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remcom.lucene,sha256=02z6RUpC1WhSPaEifqbm53vwKV-Ks5cvWN8gK0SLp_s,191
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remcom.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_access_software.eql,sha256=r4YVk5CpuNWafO-iQcDlMriHuzotawENxy8vzjb5yJI,551
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_access_software.lucene,sha256=D8e_si1H6oLrXTosV9qBg__L6eppoXH4SHFpgObRQAw,523
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_access_software.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_utilities.eql,sha256=tlxqDxWEu8HvtjbSP5rfL7K9OjQHtWHQ11cuLgeeKGY,269
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_utilities.lucene,sha256=sNJrAmrZYHTT4xwYwqe-dbvWK5z3B-oJa-2SlwjHHb4,254
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_remote_utilities.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sliver.eql,sha256=dlETTGMqQ2Cjt0VO2bvDhB4w27CEVRTd3GNccOiRvEw,333
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sliver.lucene,sha256=GEFEYPhlqn_5sZbqKK3pNrBE6qxXqXo39UbS3di8iw4,334
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sliver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sups_unusal_client.eql,sha256=b1YwHcwdlezwP-6yLQmRgchPPEHKRlOloOUmxwAbS3I,127
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sups_unusal_client.lucene,sha256=vZZF1vBufKtVyFmYrLsAc2VgbvIROIjO50Oz9GASE7A,113
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sups_unusal_client.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_susp.eql,sha256=OfQaaA5tm9jzdYr4lpKZNxdC7oMDZ0mCVMvFXC2uv44,287
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_susp.lucene,sha256=zjDiFwk72RzdwHpdzWxY3KBkNgsBJnpPyJgDEFxnWdE,280
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_susp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sysinternals_psexec.eql,sha256=Ncqm3POgKPWKwnCg9OK0zf3MUUOkKSr_I4lRFCeMp1o,207
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sysinternals_psexec.lucene,sha256=EZ_AcNL7nNMLDbhQRjQ-rAAbvOTj27YnVdP3kNfmMSM,189
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_sysinternals_psexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tacticalrmm.eql,sha256=8DmjK9iF5-d_NRovaQZsn4N6aEdNUwjTwISQP3d4bWA,228
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tacticalrmm.lucene,sha256=ZSJFkWQPs65qzv-WPnzNc2QvaE1YX427a92M6WlxnJQ,212
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tacticalrmm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tap_driver.eql,sha256=icuYZ2K1_TJuTHr8Bj3M9-HKkV_K1SFDtNIrJD-Aa1g,153
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tap_driver.lucene,sha256=TZ4n92tqJG6mf-sfLJwqP8Z9NbRCM9ycMObzk8yHBkQ,137
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_tap_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_uncommon.eql,sha256=cE0xVFqnqIxNylDrixSEvmNj1uZwwv5vQcYnhTRZLy4,572
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_uncommon.lucene,sha256=HtIFSON7AR2kum4LatZn4mWym4mNj6r8HDsvLGFhGkw,550
src/rules/windows__builtin__system__service_control_manager__win_system_service_install_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_generic.eql,sha256=fJwUw0gZ2bfp4L2gyvfKgENjepb8KFIfnLrAJaHCAFc,109
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_generic.lucene,sha256=6INOs-cGbK_xgP_1bq6D3pn8YIoEmTaNrImaDUSPH_4,95
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_generic.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_important.eql,sha256=wBVQ20INGE8oxbRg5UKQCB5xe0syF6f-PhW1hGl2pPk,564
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_important.lucene,sha256=D9cd70oX6taPcHkk-bDqc1TbGRA_Yb29YLVvwT7ENxw,546
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_error_important.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_unexpectedly.eql,sha256=uC33tRBiGr1Cx-EioyngkR1HIoeEzkHfYkgR29YlUb0,243
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_unexpectedly.lucene,sha256=zEm-l4OCSQwoF54lkTTY5ZaDusDu8-FC0snEbclAGT0,220
src/rules/windows__builtin__system__service_control_manager__win_system_service_terminated_unexpectedly.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_susp_rtcore64_service_install.eql,sha256=mTFAG9KV7cdFPGa-nba22uh_7ObpuDwwbgTS-A4WkCw,154
src/rules/windows__builtin__system__service_control_manager__win_system_susp_rtcore64_service_install.lucene,sha256=IW2hHn8ArkscZJzLDSgp9C_Z9y_ACv6lwHdkBJVYjaA,138
src/rules/windows__builtin__system__service_control_manager__win_system_susp_rtcore64_service_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder.eql,sha256=5aAwznU-b97pS2pNXYUZnhvfUXat7B5vm9u-Gk5KBuQ,365
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder.lucene,sha256=DnssAG_D_l2O3aSu2rXfz9muo1kL9eYZ7iMlCyZEl10,344
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder_pattern.eql,sha256=Bm2pS5NB2hn99kTv83zaU_VQNSRWk6EGNxhtaGWnUf8,347
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder_pattern.lucene,sha256=2TKgdPELM5XXRQiUY1TiIrZY_ZXmC7b8wzptNHF5Zks,363
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_folder_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_script.eql,sha256=0kouBygooFXDss3y652BIywNHZOwzR3tcdOwQBAD-1Y,528
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_script.lucene,sha256=67YLGYrN2gz3fjDEzUi_JWV4MKVtys4nZKjbctmjZR4,518
src/rules/windows__builtin__system__service_control_manager__win_system_susp_service_installation_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__taskscheduler__win_taskscheduler_execution_from_susp_locations.eql,sha256=XB0GlP9vP-fMc-GjclWiQj7SPivkcZMM5-wLlYFLhas,254
src/rules/windows__builtin__taskscheduler__win_taskscheduler_execution_from_susp_locations.lucene,sha256=fp6VFQ4QVQE4Z0XvNE69rtWhXXCabKU01KIlMX0jgPQ,237
src/rules/windows__builtin__taskscheduler__win_taskscheduler_execution_from_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__taskscheduler__win_taskscheduler_lolbin_execution_via_task_scheduler.eql,sha256=Cuzv0kl5NXgO7AtOcGVqkcH2sEvS48D0yL5b5XFI8XQ,252
src/rules/windows__builtin__taskscheduler__win_taskscheduler_lolbin_execution_via_task_scheduler.lucene,sha256=50aX103n7dndMxnjO1eomfCfoIUkKe0AmeiV51F-NDw,233
src/rules/windows__builtin__taskscheduler__win_taskscheduler_lolbin_execution_via_task_scheduler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__taskscheduler__win_taskscheduler_susp_schtasks_delete.eql,sha256=pCS1j6tNyJ9SCRU4UbOinASBhHRuTqteNKCGPWIgl7E,428
src/rules/windows__builtin__taskscheduler__win_taskscheduler_susp_schtasks_delete.lucene,sha256=k1n-q9cqmGqOpiur986ggYuCe0RbwwXAXusUwb7sun8,402
src/rules/windows__builtin__taskscheduler__win_taskscheduler_susp_schtasks_delete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__terminalservices__win_terminalservices_rdp_ngrok.eql,sha256=7snTk-bWYSwV5JGXnEL99tohIOEh7Enlmzn9dKp8ddk,159
src/rules/windows__builtin__terminalservices__win_terminalservices_rdp_ngrok.lucene,sha256=92K7Yo2yTCQsBLaemOej1F4dPQ1p2mbPU1yW6EQBGxg,147
src/rules/windows__builtin__terminalservices__win_terminalservices_rdp_ngrok.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__win_alert_mimikatz_keywords.eql,sha256=RPed9oRIFsCQZPCIJVEClT55YkLE1rne4Ho7-VjmE00,436
src/rules/windows__builtin__win_alert_mimikatz_keywords.lucene,sha256=bKnTxI_JwMpGs0HTze1AiOjxU8NF20bIfzEp7pCS5Tg,456
src/rules/windows__builtin__win_alert_mimikatz_keywords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_antimalware_platform_expired.eql,sha256=fIfeOgTLjSn_EPOZZjLtS_lCbFXPsCL1MM-Tev0yE8c,96
src/rules/windows__builtin__windefend__win_defender_antimalware_platform_expired.lucene,sha256=Cs1micS2jF7nkp9sAikCtpD6PZAqgXoRFxmJqPQnHjo,86
src/rules/windows__builtin__windefend__win_defender_antimalware_platform_expired.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_asr_lsass_access.eql,sha256=BdmbHmHKkXG3XZQGpctosMG_CV_bXy8eS4X6nqOYGoY,778
src/rules/windows__builtin__windefend__win_defender_asr_lsass_access.lucene,sha256=--B3rll1VgDjnAsY_BmZJiY7xkaRlc9M2HH49eEkQVU,759
src/rules/windows__builtin__windefend__win_defender_asr_lsass_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_asr_psexec_wmi.eql,sha256=wo6bnUMLLlJXPgaxKBlHRYluFkE4WdRdkaCfvxCIqVY,168
src/rules/windows__builtin__windefend__win_defender_asr_psexec_wmi.lucene,sha256=eXIzeYjrRQq6jwMmnLSnTSXcIpnyYugJ-4iNslw-Lww,150
src/rules/windows__builtin__windefend__win_defender_asr_psexec_wmi.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_config_change_exclusion_added.eql,sha256=W8wBP95tpgMKyrFhgIozf5UTyP-0aFVt9kXTT1eqUU0,175
src/rules/windows__builtin__windefend__win_defender_config_change_exclusion_added.lucene,sha256=_qJ-dP3T5IzfSMVLLAR_dJ3W0DZbX9Et0upLUb3NJQc,164
src/rules/windows__builtin__windefend__win_defender_config_change_exclusion_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_config_change_exploit_guard_tamper.eql,sha256=fY-8p6WmUktMYSRyQCYT4wvsq8UkFVv1rW56ni80axU,536
src/rules/windows__builtin__windefend__win_defender_config_change_exploit_guard_tamper.lucene,sha256=CbzbZjNwY5ms_GpWjbD_gyGVSE_arXdmoOc8d4NO5Bo,524
src/rules/windows__builtin__windefend__win_defender_config_change_exploit_guard_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_config_change_sample_submission_consent.eql,sha256=RSYxVcb-_R2T6HTwAdKmmUVIFf6PM5awYs0mTVgf8y8,184
src/rules/windows__builtin__windefend__win_defender_config_change_sample_submission_consent.lucene,sha256=5FYn1-oDsA4eKnp77Mv3bHkaCtPc1XBkquNCJB1GDYk,177
src/rules/windows__builtin__windefend__win_defender_config_change_sample_submission_consent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_history_delete.eql,sha256=fQWzWZgE7lAgJt3PtewRepFCXn0AZwTyNDBqfmnqS1c,96
src/rules/windows__builtin__windefend__win_defender_history_delete.lucene,sha256=UJBrtW1AZWxd7gBSzkw9blsWc1RPWuEvhw-qm4zo-HU,86
src/rules/windows__builtin__windefend__win_defender_history_delete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_malware_and_pua_scan_disabled.eql,sha256=uKBSNeVmvBo4vLsba2JGz8y0PlSkvabyuj9zBTt7-VA,96
src/rules/windows__builtin__windefend__win_defender_malware_and_pua_scan_disabled.lucene,sha256=lE6A6dfcAWd7xMn4cSI35GXfIzlCyPmjBaBbdRAHcS8,86
src/rules/windows__builtin__windefend__win_defender_malware_and_pua_scan_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_malware_detected_amsi_source.eql,sha256=35IP_1cTt1wGD61ubSXlD40H_MBXNNG0lIQSYpwGb9I,138
src/rules/windows__builtin__windefend__win_defender_malware_detected_amsi_source.lucene,sha256=97ADfdv3DQNq2gw_W2v4Cdq-nOmQgZNxWKgivK0ApJw,126
src/rules/windows__builtin__windefend__win_defender_malware_detected_amsi_source.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_real_time_protection_disabled.eql,sha256=7zNAJc4iJZ_A-PAjn9eEIKR5AVv-8UIMbGoxLelxsRY,96
src/rules/windows__builtin__windefend__win_defender_real_time_protection_disabled.lucene,sha256=pfhBTTb6Ays5hhHB5JTWBUn-ixjuJw10yrSHbCEvalM,86
src/rules/windows__builtin__windefend__win_defender_real_time_protection_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_real_time_protection_errors.eql,sha256=0WhebMl1FwW4QKHKw9Ua6cbi66rvyM758p9nLjwP3yY,223
src/rules/windows__builtin__windefend__win_defender_real_time_protection_errors.lucene,sha256=HhGmpfpccbw-ey-PYxSuy5Xmg2pLvN6klTLydADZtUI,197
src/rules/windows__builtin__windefend__win_defender_real_time_protection_errors.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_restored_quarantine_file.eql,sha256=cA13f_0qV6FSLtQ8-RRizeO8HiIMjfNka0Vsc9c8uLk,96
src/rules/windows__builtin__windefend__win_defender_restored_quarantine_file.lucene,sha256=7tFPiwW8xmYuyZaLtFqt5_G5MJU241WEcU4RBu4lLzI,86
src/rules/windows__builtin__windefend__win_defender_restored_quarantine_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_suspicious_features_tampering.eql,sha256=h9wBV0NZrTQBXKX0_4YxYfR6vHjI8EC7aifbHR09Y-E,427
src/rules/windows__builtin__windefend__win_defender_suspicious_features_tampering.lucene,sha256=Q3cY4vLgxEEXjvKn4OiLcURjJWPz0dkvrqnWvhcLOoo,420
src/rules/windows__builtin__windefend__win_defender_suspicious_features_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_tamper_protection_trigger.eql,sha256=1cuuJA5ggW3N_QihiGbuyQ-jGba7tc7RvVcjEgI8U14,538
src/rules/windows__builtin__windefend__win_defender_tamper_protection_trigger.lucene,sha256=XQjeZdyFRC1sTS9fWJh0DSE3dlWMWaOQcNQfT5-16ms,532
src/rules/windows__builtin__windefend__win_defender_tamper_protection_trigger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_threat.eql,sha256=IVbimNly8j6DC9Gep8ZQEyjrgoPFdrPAtV4xKQqrixg,130
src/rules/windows__builtin__windefend__win_defender_threat.lucene,sha256=65yx3IbDf8SMzL3vfchLQvw2EACMJbSxefZ37V6bCoo,114
src/rules/windows__builtin__windefend__win_defender_threat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__windefend__win_defender_virus_scan_disabled.eql,sha256=ztO0f_Mf0hofrotoQaA4IB_hM6CTcSun5crk4tNrb2g,96
src/rules/windows__builtin__windefend__win_defender_virus_scan_disabled.lucene,sha256=FYUsXZbqlfbd3qrMi8uOKepvzwK7H_xqIM-a3aSDwUU,86
src/rules/windows__builtin__windefend__win_defender_virus_scan_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__builtin__wmi__win_wmi_persistence.eql,sha256=Jaj6J5PGxlHb_XO09WOUY47VDGaptyWsPy3EQfdOAL8,411
src/rules/windows__builtin__wmi__win_wmi_persistence.lucene,sha256=TKlO3-Vk_Cz4-Q-pJQhvHzOzQAcviKja_8H620wmYpc,400
src/rules/windows__builtin__wmi__win_wmi_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cactustorch.eql,sha256=oMzMq1qOPmI_C1mEYE159DLL0vFDb7E9RV1vnNErlBQ,289
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cactustorch.lucene,sha256=1kcLPG1lGQ0fyanO0xpQvAWmjaRH3ye4BQ0lrW4eT3M,272
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cactustorch.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cobaltstrike.eql,sha256=IouUAY2B6Jv_BnMu1937NaKOMm6Z0XgIeml_A1G4NAI,75
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cobaltstrike.lucene,sha256=GhMEo28T-MyA7SFpMBxJbN1psSI46nEdYIyHbaRpIMY,57
src/rules/windows__create_remote_thread__create_remote_thread_win_hktl_cobaltstrike.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_keepass.eql,sha256=DvpReYxrq10Z242p5PXjgs4GJtNSO2y_Y7si_Cbmj34,57
src/rules/windows__create_remote_thread__create_remote_thread_win_keepass.lucene,sha256=j5wSevqMey0Udjnm_vD4IAM7VkRhyUTMIN6uim0K1Ps,45
src/rules/windows__create_remote_thread__create_remote_thread_win_keepass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_mstsc_susp_location.eql,sha256=tZ1Sh1OzAQWKLifposZwcis6TkLhrSDFPd7ekTrTM3M,227
src/rules/windows__create_remote_thread__create_remote_thread_win_mstsc_susp_location.lucene,sha256=Lbt-oajTpn1VuWIsTeVY5bz1NHX_RgeTPI6maReTMxU,212
src/rules/windows__create_remote_thread__create_remote_thread_win_mstsc_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_lsass.eql,sha256=15XrChrX-8VWzy8sgTHCBEfmWfHfFQRtjP7uSSVl-dg,123
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_lsass.lucene,sha256=D8jCvscTBaIDfujYF7O5HGj_YEQH_ihJGpIIZ-i86IU,103
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_susp_targets.eql,sha256=BXadfRhQDUi3pjtpORspL8sOWL6ZBJPZQKcVQ8oT8sg,155
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_susp_targets.lucene,sha256=eT5kiWCc0VMYq48WoTzIb9jg0yZ0aO8trCQwRTx7u1Q,129
src/rules/windows__create_remote_thread__create_remote_thread_win_powershell_susp_targets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_password_dumper_lsass.eql,sha256=0l2muV-Iw-Tb2f3WLObTlOlvx8-t-uTV_9RxLMjosbc,93
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_password_dumper_lsass.lucene,sha256=vAYSD3kdsGJXQMiNw1HwJJ7T5iPXO7Nblp1NmDKjJH8,80
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_password_dumper_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_relevant_source_image.eql,sha256=uIYXc_HOIf5EnlRdznpcu4efbxumzq_v_Czc5CWARxg,1838
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_relevant_source_image.lucene,sha256=V7BkHWYZf0WGgIF6BhMBExOfRBs3SMo9igO4VnFIj_A,1801
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_relevant_source_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_source_image.eql,sha256=W2kkjxUopOxaqiApXf-NHLP4GgaaDbQm9MC09nrWSS8,3194
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_source_image.lucene,sha256=78BK7rrx_3L_NJS1Yax_dfdtRmSdegWGFVPntmbKZL0,3139
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_source_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_target_image.eql,sha256=qcq6-2d1iYah9SSmzcwkmbD-wD6OHc8v1bPbqx5QhIk,1193
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_target_image.lucene,sha256=p6KgKZgYpuzSdBp6joPD9lurhhxxO0gv11j41l2jsEo,1152
src/rules/windows__create_remote_thread__create_remote_thread_win_susp_uncommon_target_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_remote_thread__create_remote_thread_win_ttdinjec.eql,sha256=4klH7uTCnMCLveDGRk7FFnkPU8X0ztc2PHyOdL5HKVc,48
src/rules/windows__create_remote_thread__create_remote_thread_win_ttdinjec.lucene,sha256=e4EPUxBeQ533gZ90Vn1voW1Ii4_dvW3diev2y704BC4,36
src/rules/windows__create_remote_thread__create_remote_thread_win_ttdinjec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_ads_executable.eql,sha256=HL4OS7ELJLYvTFefP0AQEFJkJuyoR0tF6jV7vvsUNzM,124
src/rules/windows__create_stream_hash__create_stream_hash_ads_executable.lucene,sha256=iJdMtYZbUlgKa1YJJCKlmjLaBLaKA-G0qALzP9sWA-8,112
src/rules/windows__create_stream_hash__create_stream_hash_ads_executable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_creation_internet_file.eql,sha256=sC8gZ73MN6kXavRLTgyZVomoh_dbI6CJyGg4-O3VebQ,1841
src/rules/windows__create_stream_hash__create_stream_hash_creation_internet_file.lucene,sha256=uGiwMUohRLrdFl5dlQSMmmoQY3bxaeL_hmJnO7OuILY,1796
src/rules/windows__create_stream_hash__create_stream_hash_creation_internet_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_susp_extension.eql,sha256=JFaR97b01mtnGcTa0mZq5bDWBOwLosLJdtKMSpIliGU,798
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_susp_extension.lucene,sha256=yUpnKB5RNf5tBJzHU4OQ-L156vUB8rran0JVYMDFAUo,781
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_susp_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_unusual_extension.eql,sha256=n3oKSteCFXtPWpTdif3yMWXY_wobRb4YK1mfkTVQSbg,708
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_unusual_extension.lucene,sha256=LyHl-7ZwyGlqDtFnS_aIpES90z-yqEKQfIHj1cdhGQc,685
src/rules/windows__create_stream_hash__create_stream_hash_file_sharing_domains_download_unusual_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_hktl_generic_download.eql,sha256=SvC_v2TTbTC04l41faXD9-v8hPyL2ePwwWRWbpxuV98,4732
src/rules/windows__create_stream_hash__create_stream_hash_hktl_generic_download.lucene,sha256=NaKP5Z7OMzCh2qOvFJdz6aH-MnD193dX1bgxxItGH5M,4816
src/rules/windows__create_stream_hash__create_stream_hash_hktl_generic_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_regedit_export_to_ads.eql,sha256=dGUkHicA1hJGP6Ur0JmQTEtBJIFIi3ZF9ac4tUkmGOs,46
src/rules/windows__create_stream_hash__create_stream_hash_regedit_export_to_ads.lucene,sha256=HjWSgkBumqv2doWsgVJOhavAlM4uJPQ3mXtuQjMRxfE,34
src/rules/windows__create_stream_hash__create_stream_hash_regedit_export_to_ads.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_susp_ip_domains.eql,sha256=DDRkwbBysuNcIQabBCVr9DRjYPsn3k6F2PROI1_DAtI,387
src/rules/windows__create_stream_hash__create_stream_hash_susp_ip_domains.lucene,sha256=YMtccc9T7Nv6vMxMhkTjnrVjKM24Dg9uW3yOKH0SkO8,420
src/rules/windows__create_stream_hash__create_stream_hash_susp_ip_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_winget_susp_package_source.eql,sha256=3FD9kmD0qd1fUXiwDjWDQvIvFv_7VQfQ__AbPn4QgKE,279
src/rules/windows__create_stream_hash__create_stream_hash_winget_susp_package_source.lucene,sha256=dBUYpKXvP5yx1E2AGipiBdady4AlQqQdARfBx8GPSdM,288
src/rules/windows__create_stream_hash__create_stream_hash_winget_susp_package_source.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__create_stream_hash__create_stream_hash_zip_tld_download.eql,sha256=vtl2E5F979zkfnIIKWgDh52KgH2TM6j9_tQ2iTFvlyA,372
src/rules/windows__create_stream_hash__create_stream_hash_zip_tld_download.lucene,sha256=m0oDEQ7EFop4cmqPHBLahWQiob2WXTmbWvwC8RusYwk,373
src/rules/windows__create_stream_hash__create_stream_hash_zip_tld_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_anonymfiles_com.eql,sha256=0fGMd0-siVsl94N-HmfddKikELRxoRsQ4VFFHLrWzIU,47
src/rules/windows__dns_query__dns_query_win_anonymfiles_com.lucene,sha256=BlkrsHqCbVHXQQCwNvbXtCCBCapAcpwBPzQsSrkLunM,35
src/rules/windows__dns_query__dns_query_win_anonymfiles_com.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_appinstaller.eql,sha256=_j1bgcIGK9Jc-rhkVyDSMRj32HcXnw5H9Ayn_m6VnHY,140
src/rules/windows__dns_query__dns_query_win_appinstaller.lucene,sha256=Dcw5tFMjWhmwr_w5mnxVbRTw_BT76nJga9nDvscHpPY,128
src/rules/windows__dns_query__dns_query_win_appinstaller.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_cloudflared_communication.eql,sha256=jx_ca1dfrU9DRcHj8RuezY8ZrqjchRP11_zosG_buvg,137
src/rules/windows__dns_query__dns_query_win_cloudflared_communication.lucene,sha256=syDmzTCQ5N_skoOxZfyyWioz7dOR0Ui3SMZm25z0LwU,120
src/rules/windows__dns_query__dns_query_win_cloudflared_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_common_malware_hosting_services.eql,sha256=aDQh1YzkHH_WTc_0lCyTixWs2IDQTG-No5nr90HvOyg,166
src/rules/windows__dns_query__dns_query_win_common_malware_hosting_services.lucene,sha256=dmUpdkR_4MMDhgV892Vx8hrZtLPoy8fUIFD2mxvUaks,148
src/rules/windows__dns_query__dns_query_win_common_malware_hosting_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_devtunnels_communication.eql,sha256=yNt8-n2g_Ln6Ab-Kz-n_0qCkJH-utF51MOF5t6XVegM,46
src/rules/windows__dns_query__dns_query_win_devtunnels_communication.lucene,sha256=rWFfCT0-avY3cBceTm_EGx2bSrtgt08ixBTwprX5Ep4,34
src/rules/windows__dns_query__dns_query_win_devtunnels_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_dns_server_discovery_via_ldap_query.eql,sha256=SNfDwmbO5axfFfiHLrrCZ30PgxlBNqGjbpcen_916ns,530
src/rules/windows__dns_query__dns_query_win_dns_server_discovery_via_ldap_query.lucene,sha256=TzxHfEXKeu0DPH-pyotFiVYpvuGyydbi8ia4rJIJj1k,511
src/rules/windows__dns_query__dns_query_win_dns_server_discovery_via_ldap_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_domain_azurewebsites.eql,sha256=hczflomMlrHJu1FVh0rYaXqzg4rQHP2-iJXoAk1eeLI,2762
src/rules/windows__dns_query__dns_query_win_domain_azurewebsites.lucene,sha256=zh7iVxZRhMJc5fmzrHvKHgLIqaLhgrZ7SBxMBTN1NYE,2694
src/rules/windows__dns_query__dns_query_win_domain_azurewebsites.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_finger.eql,sha256=U3g8JDPAEUMCke0zLeloPIqSMvIbAT9se42rLTKUltA,45
src/rules/windows__dns_query__dns_query_win_finger.lucene,sha256=5OHpJFh3CLuV744hoCCW-evw4rWLg5oLPGfbRLqUmN0,33
src/rules/windows__dns_query__dns_query_win_finger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_hybridconnectionmgr_servicebus.eql,sha256=8Hwt1G5p68DU6EO5-2mml38TWortewLFMjUYHlzG9HA,106
src/rules/windows__dns_query__dns_query_win_hybridconnectionmgr_servicebus.lucene,sha256=x3zalk0AVcOoY4AXEAl_04WXeXL9qFTPM62BqnbP83U,92
src/rules/windows__dns_query__dns_query_win_hybridconnectionmgr_servicebus.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_kerberos_coercion_via_dns_object_spoofing.eql,sha256=SBDcuPm0OHd82xYLnOn80wmbangL_A-fB9mBIX0EQtw,71
src/rules/windows__dns_query__dns_query_win_kerberos_coercion_via_dns_object_spoofing.lucene,sha256=7GWTNIj6wCh8Px576aVTroA375uREON0NzjL9Jfcnuo,57
src/rules/windows__dns_query__dns_query_win_kerberos_coercion_via_dns_object_spoofing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_mal_cobaltstrike.eql,sha256=hQYfNVxsBCQADZhJFpaX2eax0yUmIflCh8WCuPGU_n8,103
src/rules/windows__dns_query__dns_query_win_mal_cobaltstrike.lucene,sha256=5_-m4KouA9LPo8RSuSk3osGb6OhCWDzzLtbUOdLDLbY,83
src/rules/windows__dns_query__dns_query_win_mal_cobaltstrike.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_mega_nz.eql,sha256=o9ay_HTPkq6a9m1CXoCuqFVH3_vDoPbdrUkXgml3P48,55
src/rules/windows__dns_query__dns_query_win_mega_nz.lucene,sha256=5y3HyhIfroj3miXyzBP0-8phS14THAY0VPh_I5RGHNg,43
src/rules/windows__dns_query__dns_query_win_mega_nz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_onelaunch_update_service.eql,sha256=0XkywsT698l54BBu5F0Jx-kw7gtWDFKIn20aPR_JH4k,93
src/rules/windows__dns_query__dns_query_win_onelaunch_update_service.lucene,sha256=tEurrmAR1aeF88Wp86lt9A5MqYxY4Jrb_lOuUshLFsg,79
src/rules/windows__dns_query__dns_query_win_onelaunch_update_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_quickassist.eql,sha256=Q0vOPzRjqKGwznEn06WrkABGWjMQ9k8rn39rJD4I7Q8,123
src/rules/windows__dns_query__dns_query_win_quickassist.lucene,sha256=u-67lV_0AoRkWzoDr13miSCzKYdlWqThsMnDCJjCCUg,109
src/rules/windows__dns_query__dns_query_win_quickassist.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_regsvr32_dns_query.eql,sha256=kL568i-CmTVofRSs3xWBC-JGmU_QomNZco6KJPE1tTw,47
src/rules/windows__dns_query__dns_query_win_regsvr32_dns_query.lucene,sha256=-VuikHHJhTJjRzaJrz2tsqtUWKy0_LBOp6Huyakz1Fc,35
src/rules/windows__dns_query__dns_query_win_regsvr32_dns_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_remote_access_software_domains_non_browsers.eql,sha256=j0ks2-fAw7vuJ0WB3m_DuKGWV8iQSXQMDOzDoBd8Eds,3938
src/rules/windows__dns_query__dns_query_win_remote_access_software_domains_non_browsers.lucene,sha256=OS9pkTwjk2Kg9879jaAjgWmo-0pJm-gT9VJ4ulaWBF8,3866
src/rules/windows__dns_query__dns_query_win_remote_access_software_domains_non_browsers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_susp_external_ip_lookup.eql,sha256=-6ryf1krkKx6UI5KIEbg41HfwaKGcvctzSYlh0FLIiU,2104
src/rules/windows__dns_query__dns_query_win_susp_external_ip_lookup.lucene,sha256=YPCTq2fJvgm933eujdasgzfi3RCKQXpEqg29y_S-n10,2060
src/rules/windows__dns_query__dns_query_win_susp_external_ip_lookup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_teamviewer_domain_query_by_uncommon_app.eql,sha256=m6kliG4TUT_cxPT8DVtAEAX3Irt1-jeOxgKpvusH7B8,130
src/rules/windows__dns_query__dns_query_win_teamviewer_domain_query_by_uncommon_app.lucene,sha256=jciGj_wlQJEl-rWiAzwzZ8NmTXhMpu9tgrINq7E26j0,110
src/rules/windows__dns_query__dns_query_win_teamviewer_domain_query_by_uncommon_app.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_tor_onion_domain_query.eql,sha256=MPaswXUEZgF8zVfLcN1n-y8H2TA4pu0IR96S6k2sid4,647
src/rules/windows__dns_query__dns_query_win_tor_onion_domain_query.lucene,sha256=4STdh4DwwMYqcXltJpjD0jIoi2z6nbldseyFhyfulmM,634
src/rules/windows__dns_query__dns_query_win_tor_onion_domain_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_ufile_io_query.eql,sha256=s_IcPWl7T2QPagJdYO8_N5sqpbnC5T4yKDNNJ7aQIi8,41
src/rules/windows__dns_query__dns_query_win_ufile_io_query.lucene,sha256=WA4nexTQg0O_lHeh9glk01H5FVv9JxzLYUN1_FWEaEE,29
src/rules/windows__dns_query__dns_query_win_ufile_io_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__dns_query__dns_query_win_vscode_tunnel_communication.eql,sha256=jk4UoQ00I4qjyyLm81f0Ish1HlRF50KablzLUmoYAAE,61
src/rules/windows__dns_query__dns_query_win_vscode_tunnel_communication.lucene,sha256=_SQoTNt28peq5u0qg75CaXXg7JwcSISZ7d-3Kn-pFxQ,49
src/rules/windows__dns_query__dns_query_win_vscode_tunnel_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_mal_drivers.eql,sha256=CgNp1t0bvE_F7YP5TvgYKoCoyRfd7FxfxYTN6ffvYv8,44120
src/rules/windows__driver_load__driver_load_win_mal_drivers.lucene,sha256=YlwXAww0YnaW--2RP8Kbbb6GRlg_XdjvsNimPyYwaXU,44891
src/rules/windows__driver_load__driver_load_win_mal_drivers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_mal_drivers_names.eql,sha256=7jppG2VsBBvVSOae9_-RQW8srt2LXg9HxpJK9Kgq8RU,1641
src/rules/windows__driver_load__driver_load_win_mal_drivers_names.lucene,sha256=-fnaeOwJ1dSoopUBQDQyEQcUlm4-FTAMR-QiGLIT--U,1623
src/rules/windows__driver_load__driver_load_win_mal_drivers_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_pua_process_hacker.eql,sha256=foM5tiNwhHHV0-UWOe8s1O_XJ1uDhGLKWbqTbApz3po,265
src/rules/windows__driver_load__driver_load_win_pua_process_hacker.lucene,sha256=8CHLaHYeUsKjg4dKWDHDQwf1gfX-v0TZPNvMTmk2mXs,249
src/rules/windows__driver_load__driver_load_win_pua_process_hacker.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_pua_system_informer.eql,sha256=nFnzBSI_jMslSCCHwef8XmkmqMaiQVCF6paNWUrrjuA,1082
src/rules/windows__driver_load__driver_load_win_pua_system_informer.lucene,sha256=y67SMxmfUuaFdZtN0QXqX4MTP2okqbe0154hTyei5io,1075
src/rules/windows__driver_load__driver_load_win_pua_system_informer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_susp_temp_use.eql,sha256=j7xmNXfI9PJTF5BuWX0PlPwNJ_N-3L2Bbc9Pq-sNy5M,32
src/rules/windows__driver_load__driver_load_win_susp_temp_use.lucene,sha256=NdAhTghqLE9elFdoGcWqRNdIEzwxLvfxdi5777EqZMc,20
src/rules/windows__driver_load__driver_load_win_susp_temp_use.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_vuln_drivers.eql,sha256=Rlce1MTijpLqBe1cP9-uQq0i5y-S-HVgI4s0Ndn4g_Q,245799
src/rules/windows__driver_load__driver_load_win_vuln_drivers.lucene,sha256=GTxJqmGhfqbTPI0iEqI-PnLzOuY61ei_cPqJFWy_F7s,250213
src/rules/windows__driver_load__driver_load_win_vuln_drivers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_vuln_drivers_names.eql,sha256=UNV08uzUS8wrf_ZA2IXqpm-aDQaqzlR11wdrXedXGwg,5228
src/rules/windows__driver_load__driver_load_win_vuln_drivers_names.lucene,sha256=ezaJBE1Pbh6O9CwW6tJBRJEXeUl8LMNVBzLfdAoZZws,5221
src/rules/windows__driver_load__driver_load_win_vuln_drivers_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_vuln_hevd_driver.eql,sha256=tbu0FvHjwB8Dt2Q7n4is6uwEo2TfBrhvsCfEJsCvunI,163
src/rules/windows__driver_load__driver_load_win_vuln_hevd_driver.lucene,sha256=LqkqZEmWVd3kW3P5JgDx2aDGBOtWYaGdNe5xg9WYVaE,145
src/rules/windows__driver_load__driver_load_win_vuln_hevd_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_vuln_winring0_driver.eql,sha256=A6SiikYqaiLaqvbvwM4xmM6HhTaBKZc0Y-NXyyirflM,207
src/rules/windows__driver_load__driver_load_win_vuln_winring0_driver.lucene,sha256=-jgdgSuWbkZEBD5qMjK2IBowHyuWc-9D0E_D2EfoGlc,188
src/rules/windows__driver_load__driver_load_win_vuln_winring0_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__driver_load__driver_load_win_windivert.eql,sha256=oGCCQnboamfa24LFfoLU6GnYIPIPHM2Fup573Y9GHr0,998
src/rules/windows__driver_load__driver_load_win_windivert.lucene,sha256=l9ThqdDH1BW1o6OZwGMgSWo4frVKVxsylfNesk3EQ2U,990
src/rules/windows__driver_load__driver_load_win_windivert.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__etw__custom_rpc_etw_suspicious_activity.lucene,sha256=KnKzZPparkLMYKNbkljZmYVU63_lmg9MAcgd1ybyGgQ,112
src/rules/windows__file__file_access__file_access_win_susp_credential_manager_access.eql,sha256=kewR23oTiuAv4i3BIQt3jJ4Uw_nBSUr2_8nGe_VVetc,348
src/rules/windows__file__file_access__file_access_win_susp_credential_manager_access.lucene,sha256=I36BswojYF62QqgWkG4f1SgEJEBe1C0AyUhU6SEtIa4,331
src/rules/windows__file__file_access__file_access_win_susp_credential_manager_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_credhist.eql,sha256=iz4o6Vs-9tG7TaaztNU6pMF0Uttu5eAKcGH5UslnZG0,250
src/rules/windows__file__file_access__file_access_win_susp_credhist.lucene,sha256=SvjJQ0H1Qw3HXyFEXjSgbY5Pz-XE9Y03fePTxmL5hSQ,238
src/rules/windows__file__file_access__file_access_win_susp_credhist.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_crypto_currency_wallets.eql,sha256=MMlyOvnUMHUbvEAP0FJBrakZt_cyFkwG7K-jtUqA1r0,884
src/rules/windows__file__file_access__file_access_win_susp_crypto_currency_wallets.lucene,sha256=Clgki6CSJ7zb2FqcIiaa0wAwXgfMMAYg4soVJ7B47yM,849
src/rules/windows__file__file_access__file_access_win_susp_crypto_currency_wallets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_dpapi_master_key_access.eql,sha256=QXPNTVkYNsSLeooYsEfgvDagXo4gSRfjvvc4ZoEfF0A,247
src/rules/windows__file__file_access__file_access_win_susp_dpapi_master_key_access.lucene,sha256=Cqj8ZJh59bd6j-bWz1SdCXV_seuf90YqmLotx1ycBZ4,237
src/rules/windows__file__file_access__file_access_win_susp_dpapi_master_key_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_gpo_files.eql,sha256=znGOFw2PSvcB63CFxQ6oC9kAn5cqlZum_XI95fVBXLA,455
src/rules/windows__file__file_access__file_access_win_susp_gpo_files.lucene,sha256=imTnoPs_UZbGGJzqUrHfi2hB88NrOYcOrUEcrg-r744,431
src/rules/windows__file__file_access__file_access_win_susp_gpo_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_susp_process_access_browser_cred_files.eql,sha256=q2_sZcH6H5rhsbczjWyD02_KtcMO_LYfeSPtsMoTPvg,3455
src/rules/windows__file__file_access__file_access_win_susp_process_access_browser_cred_files.lucene,sha256=31lgsFILwd1GbxkEr5GKIYyMfR_UcRYeCYHRzI_SoPA,3394
src/rules/windows__file__file_access__file_access_win_susp_process_access_browser_cred_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_access__file_access_win_teams_sensitive_files.eql,sha256=OizZtUsg_Jl2dipmwgowId4bjp50XnIMhcsnMvbt0OI,181
src/rules/windows__file__file_access__file_access_win_teams_sensitive_files.lucene,sha256=RsMEOuuxjiGE8m9nn1ucZ0ylY4eytUkxigB3n4oOg_s,162
src/rules/windows__file__file_access__file_access_win_teams_sensitive_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_change__file_change_win_2022_timestomping.eql,sha256=_-kz449Ydtjqy8Rmj8ipaa_BS6d6NmWabQRMKBZLhNw,606
src/rules/windows__file__file_change__file_change_win_2022_timestomping.lucene,sha256=e8OqA2wqu7sGQoDDu9ZWddd0Vauw3vl9wdQQrHzx37Y,569
src/rules/windows__file__file_change__file_change_win_2022_timestomping.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_change__file_change_win_unusual_modification_by_dns_exe.eql,sha256=SApLBNZ_aIKl-oLNaBYXA3DYOZAr3pQcsRAn6fDkT7k,75
src/rules/windows__file__file_change__file_change_win_unusual_modification_by_dns_exe.lucene,sha256=f-BbCrDM2mF63pvB3nxTXujwCEYlNB7HJQnz4IVQPi0,61
src/rules/windows__file__file_change__file_change_win_unusual_modification_by_dns_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_backup_file.eql,sha256=GIQTvipW3tk2Iielk_4Z3aGpDm_8jl9kTKgkXtxCfh4,236
src/rules/windows__file__file_delete__file_delete_win_delete_backup_file.lucene,sha256=GCRAv6VKhONbliYZkr3qr1iUmXT2csg_uJGaJow-2Kw,210
src/rules/windows__file__file_delete__file_delete_win_delete_backup_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_event_log_files.eql,sha256=hPaz-NCQ9Xqx_uV5MSj8ua6N0_AGSRzSWQkA-RyOGOo,83
src/rules/windows__file__file_delete__file_delete_win_delete_event_log_files.lucene,sha256=JxoHqsOKVaM7WblkO-AWq0-Hg9qSuwzXVx_8YKw6uSo,70
src/rules/windows__file__file_delete__file_delete_win_delete_event_log_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_exchange_powershell_logs.eql,sha256=6vH5khSlnBXE1rrlKSmAqrTtO8Vq6-SH9l1nLVwubCw,99
src/rules/windows__file__file_delete__file_delete_win_delete_exchange_powershell_logs.lucene,sha256=khuagy2HwQeGfu5_Ddy_jDVa27ccNNo9nGWrZsoiN0s,85
src/rules/windows__file__file_delete__file_delete_win_delete_exchange_powershell_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_iis_access_logs.eql,sha256=7OkldH8rE2fbARo2Ebw2QL5BI91In-OKsObYPp0hmZw,73
src/rules/windows__file__file_delete__file_delete_win_delete_iis_access_logs.lucene,sha256=Ohk3IyE39uK1aftphx8kkHonJ2S9AFaSHRpWO29e4So,59
src/rules/windows__file__file_delete__file_delete_win_delete_iis_access_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_own_image.eql,sha256=cFIkYtg_tQ18Wp6RF7xWnw854gAsJvZeI5tPSqN5Znw,106
src/rules/windows__file__file_delete__file_delete_win_delete_own_image.lucene,sha256=2ejejP57rjCOMKfbDta7emiYDoQDJYvp9QwQWKQOJeY,101
src/rules/windows__file__file_delete__file_delete_win_delete_own_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_powershell_command_history.eql,sha256=DAudgtoSmI3wcnZQN-GbvyHy6OoCdYtI0fe_AfEb66c,61
src/rules/windows__file__file_delete__file_delete_win_delete_powershell_command_history.lucene,sha256=yuGVbpt1r4YueXayMf-mhbXANTjjQgdSqbaxayuwtoA,49
src/rules/windows__file__file_delete__file_delete_win_delete_powershell_command_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_prefetch.eql,sha256=tJHN8fQeYp6WfqgPMBlPvyz3FGTjr0m9iRuCrQWhkbM,185
src/rules/windows__file__file_delete__file_delete_win_delete_prefetch.lucene,sha256=Bu0RSEOVFw5A6X__R-4dk1wDsSA2JnLiP-cXngTnWqw,163
src/rules/windows__file__file_delete__file_delete_win_delete_prefetch.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_teamviewer_logs.eql,sha256=qUOdv5uMjnQ-8aZwsOL775TfCkcZwPfLA8395yUdXwk,128
src/rules/windows__file__file_delete__file_delete_win_delete_teamviewer_logs.lucene,sha256=OfekFATMlonruf57MBPHrXuIcCkx7ppzqaOsHdCVh8w,113
src/rules/windows__file__file_delete__file_delete_win_delete_teamviewer_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_delete_tomcat_logs.eql,sha256=UF7kfrq8A1TLhQ_fMo-aiuzjcnYmkbBkX4J6VumeUY4,133
src/rules/windows__file__file_delete__file_delete_win_delete_tomcat_logs.lucene,sha256=eFd4iX5T-l2TpjDZUx9Z_QX5bFjqW4cUpQjSfyYPjKg,111
src/rules/windows__file__file_delete__file_delete_win_delete_tomcat_logs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_sysinternals_sdelete_file_deletion.eql,sha256=i9QMX1pSUZ9KDnOngGu7tuCbxyXkzsQ1sq5YlWj183A,121
src/rules/windows__file__file_delete__file_delete_win_sysinternals_sdelete_file_deletion.lucene,sha256=7IEfMxoPYOQNoj69-gwdWJjYajOGfA4X-4EUi7ufr3I,102
src/rules/windows__file__file_delete__file_delete_win_sysinternals_sdelete_file_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_unusual_deletion_by_dns_exe.eql,sha256=SApLBNZ_aIKl-oLNaBYXA3DYOZAr3pQcsRAn6fDkT7k,75
src/rules/windows__file__file_delete__file_delete_win_unusual_deletion_by_dns_exe.lucene,sha256=f-BbCrDM2mF63pvB3nxTXujwCEYlNB7HJQnz4IVQPi0,61
src/rules/windows__file__file_delete__file_delete_win_unusual_deletion_by_dns_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_delete__file_delete_win_zone_identifier_ads_uncommon.eql,sha256=RDmLSYuWZ_Svc34aDK2DxG27K0q7BkFZl1L5hX8-jq4,850
src/rules/windows__file__file_delete__file_delete_win_zone_identifier_ads_uncommon.lucene,sha256=fFTYwkYbAdcS20aLb_IlA9pcxdA_J5xslTcPiHIxAjs,839
src/rules/windows__file__file_delete__file_delete_win_zone_identifier_ads_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_adsi_cache_creation_by_uncommon_tool.eql,sha256=9szg1eAi18LWfygqZYwmzRgx5APCkVh2bJKalKB5nd0,991
src/rules/windows__file__file_event__file_event_win_adsi_cache_creation_by_uncommon_tool.lucene,sha256=COPUu1Uxh7GoOMyQTOnUsc8zfybCS49wcEwutOmaiKI,967
src/rules/windows__file__file_event__file_event_win_adsi_cache_creation_by_uncommon_tool.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_advanced_ip_scanner.eql,sha256=peOpVRIub6BRWHOhKu38tVA9JMMZmB05nw_0U5W7q_U,70
src/rules/windows__file__file_event__file_event_win_advanced_ip_scanner.lucene,sha256=1QEj1li0zWWTDDNWRLDT_D3Eg3PIKOxxZ0CMl18AAdM,61
src/rules/windows__file__file_event__file_event_win_advanced_ip_scanner.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_anydesk_artefact.eql,sha256=0qWiVVplVm82g8IaJcD9SVHJ9p2V8Fm9wSRVYg9zZpU,117
src/rules/windows__file__file_event__file_event_win_anydesk_artefact.lucene,sha256=3N4oNYAyJllxdAoaC744UYOai0uy0xWokC5C1i6kHnw,99
src/rules/windows__file__file_event__file_event_win_anydesk_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_anydesk_writing_susp_binaries.eql,sha256=qeststwZYfIyEW8tBW4FH92GZHgI6cqin-A-J9Q3o6M,155
src/rules/windows__file__file_event__file_event_win_anydesk_writing_susp_binaries.lucene,sha256=C6pH1hOvztHI2OpFWFbOxLIGiKWTGg3o2LgUCj0XS2A,127
src/rules/windows__file__file_event__file_event_win_anydesk_writing_susp_binaries.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_aspnet_temp_files.eql,sha256=74fD9yR84AdVNBbkHtxqhzYV3NoKxUvOu6fdc4UPrTk,159
src/rules/windows__file__file_event__file_event_win_aspnet_temp_files.lucene,sha256=qf6x81JnZLZW_df4TI9nsNe54yKaPI5mGTINJT7YJ2Y,143
src/rules/windows__file__file_event__file_event_win_aspnet_temp_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_bloodhound_collection.eql,sha256=AkrC-_Ckfh1_v_PpDCVU4MbDS3YowzwIAG0L6NZTij0,319
src/rules/windows__file__file_event__file_event_win_bloodhound_collection.lucene,sha256=RrmXPXcvR04uJFsmPHSCBAemzFQJreA0_00RFxi6ol4,297
src/rules/windows__file__file_event__file_event_win_bloodhound_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_create_evtx_non_common_locations.eql,sha256=rE72tkwp4LIXCvcGIAQ22lRaIwj9g85154l5sLNKBS4,223
src/rules/windows__file__file_event__file_event_win_create_evtx_non_common_locations.lucene,sha256=qQ_NnpcJ0DX7hwGUMT64rzLuoZO5Ib8z8zU7dsBRVTc,207
src/rules/windows__file__file_event__file_event_win_create_evtx_non_common_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_create_non_existent_dlls.eql,sha256=hH3Bn-nxseMSNeZYOjUs-KhirXuhUPFLEyNwzsI-ZBU,293
src/rules/windows__file__file_event__file_event_win_create_non_existent_dlls.lucene,sha256=lufW8BhJxOEPfDj-AxrM0KQgCE56z4KWKwXiI0sxnnA,281
src/rules/windows__file__file_event__file_event_win_create_non_existent_dlls.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_deno.eql,sha256=n3ZiAkr1yV9kg7fZc_WdS-EBH407tnMMSgYeJwma9pE,134
src/rules/windows__file__file_event__file_event_win_creation_deno.lucene,sha256=oyRHgTgNgEY17SX4zDE1Vj1ec5UN2L3elNLFgnDL5L0,113
src/rules/windows__file__file_event__file_event_win_creation_deno.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_new_shim_database.eql,sha256=gMPa6mHFkvF07LBs0D3EFF_x7eV4aLBTV8FyZr6gCLk,100
src/rules/windows__file__file_event__file_event_win_creation_new_shim_database.lucene,sha256=nq77uGAvnfPhs3lnmilcosZo9ymkNTawHvUnt2LNbDM,84
src/rules/windows__file__file_event__file_event_win_creation_new_shim_database.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_scr_binary_file.eql,sha256=4jkEw1Gjl8RmZHS1YIYzfnowIve3Ej_nKLTEPwH9L6k,190
src/rules/windows__file__file_event__file_event_win_creation_scr_binary_file.lucene,sha256=yQbBmDoM83pRPphkF2Zeg9-Q_H0vNpIwTo3MPJAgD0g,166
src/rules/windows__file__file_event__file_event_win_creation_scr_binary_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_system_dll_files.eql,sha256=zZqlN2bd2v2tzCkOx4z3QznGt1DT5KQhbfSGcnTJrn8,280
src/rules/windows__file__file_event__file_event_win_creation_system_dll_files.lucene,sha256=H4e2oVjmdrbjlCnq5oITTd1a_KoYNrC7jkZ4QIM_dt4,262
src/rules/windows__file__file_event__file_event_win_creation_system_dll_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_system_file.eql,sha256=njctVMge7BO-bcsVbnZumk3fbRL3Tn2DN7FPtbl-B3A,2689
src/rules/windows__file__file_event__file_event_win_creation_system_file.lucene,sha256=LKshCvLoA-qHqmZgk1WZAhlaa9j8CR4HdlebuS-QAkY,2637
src/rules/windows__file__file_event__file_event_win_creation_system_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_creation_unquoted_service_path.eql,sha256=i8fcR7czhuNCklgdLYPd00xAIDYLKlu1qRPOsippYXU,38
src/rules/windows__file__file_event__file_event_win_creation_unquoted_service_path.lucene,sha256=Tk6fk6LrVM9PI9Hjpb2wweQnJEbOYl-FU81wfQq5vaA,27
src/rules/windows__file__file_event__file_event_win_creation_unquoted_service_path.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_cred_dump_tools_dropped_files.eql,sha256=dcSutX7IFDdLGkUjF84wf_kF83n2APPz5l8t60I1crg,531
src/rules/windows__file__file_event__file_event_win_cred_dump_tools_dropped_files.lucene,sha256=AduBpqjoxDW8LixTZNIO-FM3nvaYKI0wKmaTtxKcjZo,506
src/rules/windows__file__file_event__file_event_win_cred_dump_tools_dropped_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_cscript_wscript_dropper.eql,sha256=xrdycCnvI8QL_n-qGXBidtRyA3KBvhvYhBmQUasr5r8,199
src/rules/windows__file__file_event__file_event_win_cscript_wscript_dropper.lucene,sha256=rjPZ-yFVo8nxTp3thfea1DKggCOll1eQp5XWQynVNK4,167
src/rules/windows__file__file_event__file_event_win_cscript_wscript_dropper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_csexec_service.eql,sha256=vnc7mGAW1Y2Cu0r0PSnNF63AiUUSM9whk_-9K5pAzA8,39
src/rules/windows__file__file_event__file_event_win_csexec_service.lucene,sha256=CMzGGoND8Or11NnkwWWUO7mMY537tFEh5R--dgpXscU,27
src/rules/windows__file__file_event__file_event_win_csexec_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_csharp_compile_artefact.eql,sha256=BWQ11cUNoWX0BENuloBInjFzr6aYbRIpwhzRzFsSBXM,32
src/rules/windows__file__file_event__file_event_win_csharp_compile_artefact.lucene,sha256=RQF7sZdYmAr5_MOi_SUtV9Kamxxz4IuuE9DcJL_pc0A,20
src/rules/windows__file__file_event__file_event_win_csharp_compile_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_dcom_iertutil_dll_hijack.eql,sha256=z3vZMEN7Vmp92iB40EKMhXjW5pw1oCdPkd6oQResfqk,89
src/rules/windows__file__file_event__file_event_win_dcom_iertutil_dll_hijack.lucene,sha256=lndmBQxLt9uMc7ryk_1XOG1XxwrkvPY7ukB_XjpRItY,76
src/rules/windows__file__file_event__file_event_win_dcom_iertutil_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_desktop_ini_created_by_uncommon_process.eql,sha256=c6qd4BRETIwBAX7dM_pxvJZ1_X1O9s1DNNgkPmuJzVw,451
src/rules/windows__file__file_event__file_event_win_desktop_ini_created_by_uncommon_process.lucene,sha256=86r574BGqI5_qIjH-iuFrys30YuDo1Wrx8E8I7oXotw,431
src/rules/windows__file__file_event__file_event_win_desktop_ini_created_by_uncommon_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_dll_sideloading_space_path.eql,sha256=C09A98SqQrEQHQecumrtNIXKx-ppBbKGHIB4mSuTW5E,123
src/rules/windows__file__file_event__file_event_win_dll_sideloading_space_path.lucene,sha256=lN_lWybPATiAE5wJKdAeqQSEoavze19rBY4EQGCfIG8,114
src/rules/windows__file__file_event__file_event_win_dll_sideloading_space_path.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_dump_file_susp_creation.eql,sha256=TeMIP1hD61xRru_hp-rnLRI0JLC-k-ihEOFiGexx4Zc,192
src/rules/windows__file__file_event__file_event_win_dump_file_susp_creation.lucene,sha256=mW0bwooeJ2T3SSSUfgDbUOmjOn_7uYrZlwyzKhNSbvk,166
src/rules/windows__file__file_event__file_event_win_dump_file_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_errorhandler_persistence.eql,sha256=Fs74Sw9OvjMuqT7AqEW5Db4atJRZ1zbbrCMpdtzR1OE,67
src/rules/windows__file__file_event__file_event_win_errorhandler_persistence.lucene,sha256=DE6OxZyYeRR0rOROGTlCXBQvR1LSJqfpbnPs0LyJt0Y,55
src/rules/windows__file__file_event__file_event_win_errorhandler_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop.eql,sha256=fa-Dsn0u1CWfz0WqsyU92ARiiqrspTZ38H5hOCD-_7U,235
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop.lucene,sha256=qoUSfOwUUGM9OdNyLe7CQt7lYUv_gn4hD_vhJwgJljo,205
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop_suspicious.eql,sha256=SCqA-J-t_z7F5wrDwRB-rBZOTuCDieD0K_byn_ktz3Q,191
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop_suspicious.lucene,sha256=4_b4n08FLQ4a3ideAnN7uUsKYrcVfzNZN6vDkHvGPcs,169
src/rules/windows__file__file_event__file_event_win_exchange_webshell_drop_suspicious.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_gotoopener_artefact.eql,sha256=c1ziegLG4Lbrj3naIDjt0sR3mjMs0YoBkCrzEYo9uWs,94
src/rules/windows__file__file_event__file_event_win_gotoopener_artefact.lucene,sha256=-Lz_yh1P0QCz79Yxp_oei3IX9XfAJ7xQFcSppNAcfZg,85
src/rules/windows__file__file_event__file_event_win_gotoopener_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_crackmapexec_indicators.eql,sha256=NzXua__8_gnREVeAc4Ga2tkPjDz4ZvN-wEW-qf_Nox4,342
src/rules/windows__file__file_event__file_event_win_hktl_crackmapexec_indicators.lucene,sha256=36LeJZ8VI2RfjfbuCkLM8o9nNXEAlfE84dGlal_Nw9A,377
src/rules/windows__file__file_event__file_event_win_hktl_crackmapexec_indicators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_dumpert.eql,sha256=EEIEfSBlItSQZ-7UjUiEl1Sr0sjDxDhRY-Njr-tfm28,35
src/rules/windows__file__file_event__file_event_win_hktl_dumpert.lucene,sha256=pot7RGZtWsV-G0zcnqva2dZ2WDwH5288fP-6u6CrJTo,23
src/rules/windows__file__file_event__file_event_win_hktl_dumpert.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_hivenightmare_file_exports.eql,sha256=PMTVIcgrCJAEqk7DzJU4vgFw5OpM8i9wjN3U0FC3XBY,167
src/rules/windows__file__file_event__file_event_win_hktl_hivenightmare_file_exports.lucene,sha256=LX2OFwV7mnp5kwtwhBRv2PvOlKpaufp--MOxsXr2eyw,155
src/rules/windows__file__file_event__file_event_win_hktl_hivenightmare_file_exports.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_inveigh_artefacts.eql,sha256=Dlm2oEqPlXL3MRA-npWZzKgG4WPDFeHj1MzdOfFb5Wk,293
src/rules/windows__file__file_event__file_event_win_hktl_inveigh_artefacts.lucene,sha256=81HjYWvEPY5duSV9hNIX-o1hx7VK725b4SNXgF69DGg,283
src/rules/windows__file__file_event__file_event_win_hktl_inveigh_artefacts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_krbrelay_remote_ioc.eql,sha256=hWgPwoXEeLraXvG1wmSktpiYuDHca2RwDcY_iyw6PIY,117
src/rules/windows__file__file_event__file_event_win_hktl_krbrelay_remote_ioc.lucene,sha256=ojMxCxbnuCU4tduoOHvy8l7NZv6IXP0GGgDTHtI7BM0,102
src/rules/windows__file__file_event__file_event_win_hktl_krbrelay_remote_ioc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_mimikatz_files.eql,sha256=UbRMlMFOJd22r6oQJ_1dwZPCSo5joXScWDIjWi1ZJhw,54
src/rules/windows__file__file_event__file_event_win_hktl_mimikatz_files.lucene,sha256=0t1F2VY3gy-gasJ6HxwEH1kCFBT6_zSDNeWqHjACkB0,36
src/rules/windows__file__file_event__file_event_win_hktl_mimikatz_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_nppspy.eql,sha256=4ugXK3pXgLBWC51BAVw6CmEyy6yj2U7HvGCQZAH3Nog,61
src/rules/windows__file__file_event__file_event_win_hktl_nppspy.lucene,sha256=W33VKKM91fyB9jW6Jdq8nAZ3A2VjjGw31Qc_uDT1Cks,43
src/rules/windows__file__file_event__file_event_win_hktl_nppspy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_powerup_dllhijacking.eql,sha256=cX1944PgdnE725QsSJOTJYONSpZZpBFWqsSTBqV4Fyg,96
src/rules/windows__file__file_event__file_event_win_hktl_powerup_dllhijacking.lucene,sha256=NsGv_LLf9WErAJSkT_nJyvhkJKig73dI-7Uip5Gvdxc,76
src/rules/windows__file__file_event__file_event_win_hktl_powerup_dllhijacking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_quarkspw_filedump.eql,sha256=FxjaWYmKRd_HbgALAnvWe4df3Q10gfMU_yYmbfgmZN0,76
src/rules/windows__file__file_event__file_event_win_hktl_quarkspw_filedump.lucene,sha256=4tO83AeG7EOyk51CDwCDMWtTD5sDJlxneXgqnYmCCLY,63
src/rules/windows__file__file_event__file_event_win_hktl_quarkspw_filedump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_remote_cred_dump.eql,sha256=C-cCnqrZWktZpS043gDD4W9RMOdHDDmvoqwvzyt0hXw,172
src/rules/windows__file__file_event__file_event_win_hktl_remote_cred_dump.lucene,sha256=fIVUqjwFemjS1lQG1u9BaKnTbtr0C6FkMpED4Y5gWlo,176
src/rules/windows__file__file_event__file_event_win_hktl_remote_cred_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_hktl_safetykatz.eql,sha256=Z6lk38Vb-FpQD7h5sLVWIWkjBKfl_6WGdSCHDzJUWvI,41
src/rules/windows__file__file_event__file_event_win_hktl_safetykatz.lucene,sha256=zryn5OcEvo6nhE646D76IiY3nKiG3ck86vFb036mYAY,29
src/rules/windows__file__file_event__file_event_win_hktl_safetykatz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_impacket_file_indicators.eql,sha256=-6c-q--o689zAcRYm4HYYGfhlbw9tIXhbrvJfqsv37o,114
src/rules/windows__file__file_event__file_event_win_impacket_file_indicators.lucene,sha256=rDvZIfA6muDZvmPxENRU4h493cEmirdK0On1xwyV4fI,119
src/rules/windows__file__file_event__file_event_win_impacket_file_indicators.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_initial_access_dll_search_order_hijacking.eql,sha256=tKerE6q376AQqR1fbdZAO0wX_v4CnBqsCnytq3aHjec,713
src/rules/windows__file__file_event__file_event_win_initial_access_dll_search_order_hijacking.lucene,sha256=RoJ1E3CELO9-oaniBkHu5-0JOMqdyEa2Ck98HOFYm0A,679
src/rules/windows__file__file_event__file_event_win_initial_access_dll_search_order_hijacking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_install_teamviewer_desktop.eql,sha256=lwZ6hs6RqC6ae_cvJvhqdehpaM0W5OVazqEWPb2mnYo,48
src/rules/windows__file__file_event__file_event_win_install_teamviewer_desktop.lucene,sha256=8P9_5P6oKLD9-_aRjcLFnpRD7xdsUAyaZkPohyTI6HE,36
src/rules/windows__file__file_event__file_event_win_install_teamviewer_desktop.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_iphlpapi_dll_sideloading.eql,sha256=1YjpYVmcBYvTLsbSgFRUTYxb8DIt6bNXHw-msZ1gVOo,83
src/rules/windows__file__file_event__file_event_win_iphlpapi_dll_sideloading.lucene,sha256=RYt9BUj1qP3nRHHAdCK4PvvN7eHeOVrgPDnOACyT-eI,69
src/rules/windows__file__file_event__file_event_win_iphlpapi_dll_sideloading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_iso_file_mount.eql,sha256=clmU1ybBwcUbOWlRn347gCs-Kr0zPvFuf0O-OpRqxiM,205
src/rules/windows__file__file_event__file_event_win_iso_file_mount.lucene,sha256=-3bww7Bz0WLdcfzCRgpYP3PUtftDnxCtILT33it8zXY,185
src/rules/windows__file__file_event__file_event_win_iso_file_mount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_iso_file_recent.eql,sha256=v_nIbPzGYwwfwGv7eggr0ien5yWgFfp8m2J4FXJ87pg,130
src/rules/windows__file__file_event__file_event_win_iso_file_recent.lucene,sha256=B-RV-qGnRR9VDNcsyNBkQX5kG8jrhn6rYpFmr1HWRAQ,110
src/rules/windows__file__file_event__file_event_win_iso_file_recent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_lolbin_gather_network_info_script_output.eql,sha256=LFbtKAITkyEKM7Ec9UHd_BSrxWkRkgmYo2pVALp1GXE,163
src/rules/windows__file__file_event__file_event_win_lolbin_gather_network_info_script_output.lucene,sha256=hQAUfnj6wFCui7MYc2ZIwTqndrNwxTKg5YVCGVrVt-A,144
src/rules/windows__file__file_event__file_event_win_lolbin_gather_network_info_script_output.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_lsass_default_dump_file_names.eql,sha256=NM701w9azyuENS9xtE5kzCLsPqSalaBNjU7SNqOy6kc,414
src/rules/windows__file__file_event__file_event_win_lsass_default_dump_file_names.lucene,sha256=vAai33o3luB8VIbATo4XZ4-P8iZ6UGPeejIJy-cMqjs,370
src/rules/windows__file__file_event__file_event_win_lsass_default_dump_file_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_lsass_shtinkering.eql,sha256=TlhHkX18rDH9pqGMSpxUmlES6rerSVvt_h-xuoRgJwM,148
src/rules/windows__file__file_event__file_event_win_lsass_shtinkering.lucene,sha256=F4H0fRVTEzY1uYp2SGQxciQ1De6O_qLFw1wDHroV5qc,133
src/rules/windows__file__file_event__file_event_win_lsass_shtinkering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_lsass_werfault_dump.eql,sha256=h76z4-1807s1FiFOh7Dnh0ZSuKg9WA0_oty7U-61PVw,118
src/rules/windows__file__file_event__file_event_win_lsass_werfault_dump.lucene,sha256=4YXvnJtMaQtJxCkDQNIUWrbmEMbG-09aLcE_1SMV5ZA,99
src/rules/windows__file__file_event__file_event_win_lsass_werfault_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_mal_adwind.eql,sha256=w1FTe9D7VPwgNAeuc-cV6XC2awxlslH1h9h00wYoN_g,139
src/rules/windows__file__file_event__file_event_win_mal_adwind.lucene,sha256=H_ZWSJk-Dule2tDFJv3-pwdBKQfqsDfP35cQ0jagN5Q,121
src/rules/windows__file__file_event__file_event_win_mal_adwind.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_mal_octopus_scanner.eql,sha256=JZX3Mg2606hokW3M0yHJBmzn-JKhFF2PaMN2hxHZO_Y,122
src/rules/windows__file__file_event__file_event_win_mal_octopus_scanner.lucene,sha256=ZpPUvPjL4JiCkv3cUyEJMSoTYiMLiogQ8iXYCKJdJmg,104
src/rules/windows__file__file_event__file_event_win_mal_octopus_scanner.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_msdt_susp_directories.eql,sha256=4k3-MbHZutsJGG_QCVXwTG0zFiZYB_iAXL-oHSEZg18,185
src/rules/windows__file__file_event__file_event_win_msdt_susp_directories.lucene,sha256=4Oth87rpQ7ziqxzLVwFqij2JXm8kGIusdHo6lj14uVc,169
src/rules/windows__file__file_event__file_event_win_msdt_susp_directories.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_mysqld_uncommon_file_creation.eql,sha256=DrtAvVdNyZ0WNyd0bklvxNqnHpH9n07Ko1hRbC3bSHI,171
src/rules/windows__file__file_event__file_event_win_mysqld_uncommon_file_creation.lucene,sha256=ebZCkysL5xe7p_xWx7AiC5VOWAB7q0WAwydwberX6NY,146
src/rules/windows__file__file_event__file_event_win_mysqld_uncommon_file_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_net_cli_artefact.eql,sha256=ov0KdfSD16E1SexTNoag0LWBijwSPPtvJs6t2L2bHxE,585
src/rules/windows__file__file_event__file_event_win_net_cli_artefact.lucene,sha256=IxtApl-pnQ2Tmpm0JOE3tjKaeiVFAqiYFtTU5yg75s8,559
src/rules/windows__file__file_event__file_event_win_net_cli_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_new_files_in_uncommon_appdata_folder.eql,sha256=FxLnwOArNz3ckoZ018SCGSJbOdYgzjfqKhI99CtJ8oI,348
src/rules/windows__file__file_event__file_event_win_new_files_in_uncommon_appdata_folder.lucene,sha256=1jSPPEFZhg9tSX6hwv5uXB9tVBd7Vp6IuZ4RgtewQ80,318
src/rules/windows__file__file_event__file_event_win_new_files_in_uncommon_appdata_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_new_scr_file.eql,sha256=NWS997IW4Wy5gyv-q3ufoLrBhlfV9vaQOieASsfyd_w,190
src/rules/windows__file__file_event__file_event_win_new_scr_file.lucene,sha256=dcAl9wBCWFEoRc01gkYXSJRTYL_PJM--YWP_MN-C6JA,176
src/rules/windows__file__file_event__file_event_win_new_scr_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_notepad_plus_plus_persistence.eql,sha256=AIY0TPwdK3Aj5hTR1VI6QcaJOM-ePBOc-sbyhI73h5w,658
src/rules/windows__file__file_event__file_event_win_notepad_plus_plus_persistence.lucene,sha256=Rin-kA2_Kgxe8X9E9s0QtgEcMtlOG38tt1tmd3SCJTI,639
src/rules/windows__file__file_event__file_event_win_notepad_plus_plus_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ntds_dit_creation.eql,sha256=_Hw663aVjevVlaK14bzjinEeE7QEswPyxUDlQyP0uJc,32
src/rules/windows__file__file_event__file_event_win_ntds_dit_creation.lucene,sha256=CFx59JcHY6zuiVTwec20nojelFdNk9uaaVgt8BpVjCg,20
src/rules/windows__file__file_event__file_event_win_ntds_dit_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_parent_process.eql,sha256=LdiMYalS7vyqRBUBPcrrj_2EwrNS16oliduq0Yp5AOM,339
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_parent_process.lucene,sha256=I17cSQ8vZaZy1DFtQ2liBzZ8cmrl_DIdN8o_AP-8Ano,312
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_parent_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_process.eql,sha256=ObqXdptW_TgMyX6X_0lcVgPEg5u3qPiWmzUtxUIdA4I,327
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_process.lucene,sha256=Uh603vv-N-EpjrYJ1q-jrQRmY_kkuAAZUqp4ewd6VxY,299
src/rules/windows__file__file_event__file_event_win_ntds_dit_uncommon_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ntds_exfil_tools.eql,sha256=LyRJP9YXeeCTt3eCm5fYNDq-r_DmIbjdbdvoF2zBuAc,61
src/rules/windows__file__file_event__file_event_win_ntds_exfil_tools.lucene,sha256=TrF_5R7iarKbDo4x7c3uSusVrBZop0kCpmrVk9gQcTo,43
src/rules/windows__file__file_event__file_event_win_ntds_exfil_tools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_addin_persistence.eql,sha256=8V2QwthJqk6okaZgb1WiaRw7vAX00QPi_EP4PyyVcpY,307
src/rules/windows__file__file_event__file_event_win_office_addin_persistence.lucene,sha256=cRlK1j68JK9OV-CDLbxktBD2sMqJQc6Sqx9HZ6X8su4,275
src/rules/windows__file__file_event__file_event_win_office_addin_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_macro_files_created.eql,sha256=54fQTMun3v7Ic-xqtURX2wOllF9ZXyMArvX9V5J-92E,87
src/rules/windows__file__file_event__file_event_win_office_macro_files_created.lucene,sha256=QrAR_TH68s-Y87lq5K60hTeGNePambT16wZF8iV4DyE,69
src/rules/windows__file__file_event__file_event_win_office_macro_files_created.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_macro_files_downloaded.eql,sha256=7r4kzxR-8cFjzWrHK2OyXQcw0fOw4exr2_3Lt56iJ4k,546
src/rules/windows__file__file_event__file_event_win_office_macro_files_downloaded.lucene,sha256=BCgJV18YQExTpdADGDCjBxeJAP2nf4n0l1ikBNN6zTk,518
src/rules/windows__file__file_event__file_event_win_office_macro_files_downloaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_macro_files_from_susp_process.eql,sha256=RLglB5BmCaRibnw31YRXHlJsbR3h5V_amVr8THipv3c,341
src/rules/windows__file__file_event__file_event_win_office_macro_files_from_susp_process.lucene,sha256=jBV0NqW2pV4kXn2nQgaNNQr8Ee6GdDTIqDfThiYc-tw,307
src/rules/windows__file__file_event__file_event_win_office_macro_files_from_susp_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_onenote_files_in_susp_locations.eql,sha256=fIiBcZMdtL37bnPxJZA4yZvIG5PMAyQQFjucrRt6QY4,273
src/rules/windows__file__file_event__file_event_win_office_onenote_files_in_susp_locations.lucene,sha256=jn7Z5OCCBzPGYNKwfy1t7MW9UiH9jXSkdaEFmUO7PZo,247
src/rules/windows__file__file_event__file_event_win_office_onenote_files_in_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_onenote_susp_dropped_files.eql,sha256=t4PBjoQM_NRbmI8hqzoxNlHWkO8gbGOE-e2YqtsY4dw,295
src/rules/windows__file__file_event__file_event_win_office_onenote_susp_dropped_files.lucene,sha256=-bb-nTn8gBLwzuLeZSNEPOIHFudvrdAuITGaDc8gaOU,267
src/rules/windows__file__file_event__file_event_win_office_onenote_susp_dropped_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_outlook_macro_creation.eql,sha256=5o7psm0LVFKdyEjnA1yrOQ63eH4_FVTNKyUr63pRV3o,100
src/rules/windows__file__file_event__file_event_win_office_outlook_macro_creation.lucene,sha256=2YbISkQfhmJl5sDkaxqxdmGNoIR56xOS6_w38oJwBls,86
src/rules/windows__file__file_event__file_event_win_office_outlook_macro_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_outlook_newform.eql,sha256=4x2vGhklZ7q_jxdqYUJ-En3ug5IL21Hr-ZYliU2Dkm8,172
src/rules/windows__file__file_event__file_event_win_office_outlook_newform.lucene,sha256=ilgNK38gOjzEeWQqJd5Ne8YuPD1AcbL162O7j-1a-VA,154
src/rules/windows__file__file_event__file_event_win_office_outlook_newform.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_file_creation_in_temp_dir.eql,sha256=-TNkJW_49x0l2QvqNLeQmMyTqArWvG4aW9TeXO1WMkI,324
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_file_creation_in_temp_dir.lucene,sha256=t3CnseFtkNqklzt01lBfxopUDdj8O7ZL7zXBOqurnWY,294
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_file_creation_in_temp_dir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_macro_creation.eql,sha256=JOS7CcIA46keepKxeYhAvX51ZpFxFKycLs_v8XGrrio,106
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_macro_creation.lucene,sha256=HMgEHBLDgvso3Xba8EkMXwcS0R5pqUY6MKJfNsSEPJs,92
src/rules/windows__file__file_event__file_event_win_office_outlook_susp_macro_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_publisher_files_in_susp_locations.eql,sha256=d6B6Tpd4pf_sdmxS1HGIUfpIrlb7-nHkn66VFbgsGVQ,139
src/rules/windows__file__file_event__file_event_win_office_publisher_files_in_susp_locations.lucene,sha256=zRIOQ8N2Apv_OijSk_OG2fyFHmrcagVWVQYGn0NduCI,120
src/rules/windows__file__file_event__file_event_win_office_publisher_files_in_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_startup_persistence.eql,sha256=rKDmi_M5say84FYHJuNdp0byhGJvmRxBS4x_B05jqW4,509
src/rules/windows__file__file_event__file_event_win_office_startup_persistence.lucene,sha256=lQXvX_87stqf-TZDQNaswpF1l5EI4uMlRA_CBEHPt7Y,461
src/rules/windows__file__file_event__file_event_win_office_startup_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_susp_file_extension.eql,sha256=xsVd3aa1KIgd1f53im5wUFToWCx1lECXsnGtc6jwaPs,846
src/rules/windows__file__file_event__file_event_win_office_susp_file_extension.lucene,sha256=Ax0DQ6MyQnh-4Q80xnOxAgvhBviqDibU4z90KhqCZ8Y,790
src/rules/windows__file__file_event__file_event_win_office_susp_file_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_office_uncommon_file_startup.eql,sha256=CDuMxEmm03xKGZ5NYxB4s0WGapA6TKzDhU3lzOGUf3o,830
src/rules/windows__file__file_event__file_event_win_office_uncommon_file_startup.lucene,sha256=V69AJ9ixObrwQZJf8wrFTAzk7zFSK9zKEkHod1q9oY0,783
src/rules/windows__file__file_event__file_event_win_office_uncommon_file_startup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_pcre_net_temp_file.eql,sha256=YFypoBw2hlJxFqPL0mDnyDNdMoZyrNuPyuIn9k23VRY,82
src/rules/windows__file__file_event__file_event_win_pcre_net_temp_file.lucene,sha256=HE1Oo7o7IsebBf3B-tRHyCypnA800w9SSK_3ejCvQLA,70
src/rules/windows__file__file_event__file_event_win_pcre_net_temp_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_perflogs_susp_files.eql,sha256=MoqOiPj_MrS1p-JCny_WXGb_c0hqZhe8yV7rRiILjao,203
src/rules/windows__file__file_event__file_event_win_perflogs_susp_files.lucene,sha256=IwlnKHo-EzxCc6V4ea3SWC2GsCJTslzuTnzeeBmlwq8,184
src/rules/windows__file__file_event__file_event_win_perflogs_susp_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_drop_binary_or_script.eql,sha256=biK5l10itPAC3sGVVu8cUJO2q5na_7AqBFU3LGxORcE,743
src/rules/windows__file__file_event__file_event_win_powershell_drop_binary_or_script.lucene,sha256=16b6FVUGay2GYiATTcrAB7GgJD6a1HLY5ugUhEQzCGU,685
src/rules/windows__file__file_event__file_event_win_powershell_drop_binary_or_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_drop_powershell.eql,sha256=0MhHPbGqaleXVsQO2XrPJPqQ8FtH5Aw5_AO_z0IefPU,252
src/rules/windows__file__file_event__file_event_win_powershell_drop_powershell.lucene,sha256=MASOCtaMNwwfhoC-ONCO2DX2KcZWvXzvju_D4KCs-4M,226
src/rules/windows__file__file_event__file_event_win_powershell_drop_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_exploit_scripts.eql,sha256=m6uAw_PJi6CnSj29a_jO_BOsSnhTrBiBgWkY32-jQsU,6317
src/rules/windows__file__file_event__file_event_win_powershell_exploit_scripts.lucene,sha256=pBfKBF8QIFQND2_kOg7mhJ-0VP8lwoz04pwnrlKbLuc,6503
src/rules/windows__file__file_event__file_event_win_powershell_exploit_scripts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_module_creation.eql,sha256=UJE6-ytgyb9vKVYuUHYW11SR_wPFac21gZ1oMsIuQ_s,163
src/rules/windows__file__file_event__file_event_win_powershell_module_creation.lucene,sha256=R2bFRM0xPfsS6LNXXzBV3u2hDSTQ3ZnOjw6vK_VdqnQ,137
src/rules/windows__file__file_event__file_event_win_powershell_module_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_module_susp_creation.eql,sha256=N3KP8iS0cD6iyzKZDxBoD5ByYXw486ZdRB4ASYYxZlA,108
src/rules/windows__file__file_event__file_event_win_powershell_module_susp_creation.lucene,sha256=8vgmnlIm1AyKiPHrV7-YAbW1fnpUPxl2WluEK8Mex9M,90
src/rules/windows__file__file_event__file_event_win_powershell_module_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_module_uncommon_creation.eql,sha256=F_hLXU3uGSTFlsSykSvlxHMS-PMxH05MKxx5aj4ayFk,690
src/rules/windows__file__file_event__file_event_win_powershell_module_uncommon_creation.lucene,sha256=Tl57ztI-vYEUE1JkNuW6lZbaAZKAT6qc4BM3gNffkw4,669
src/rules/windows__file__file_event__file_event_win_powershell_module_uncommon_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_powershell_startup_shortcuts.eql,sha256=TmPUU7JjoEvHMkZKnNchm_tRR8AwZUczd8ggDCQyFEA,147
src/rules/windows__file__file_event__file_event_win_powershell_startup_shortcuts.lucene,sha256=nSckIKnWvb-309C53FZVZaFbhXg7uem-qFuaMd8bGzg,126
src/rules/windows__file__file_event__file_event_win_powershell_startup_shortcuts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ps_script_policy_test_creation_by_uncommon_process.eql,sha256=HgH_OOiaz0x-dIJ1AiqhCSgvf_mQ7uHXtqOnBmrzypI,902
src/rules/windows__file__file_event__file_event_win_ps_script_policy_test_creation_by_uncommon_process.lucene,sha256=SKTgbdBxt8u6Y0jRxjc5UA2OOK3b5WQXZfouS3jBVcA,880
src/rules/windows__file__file_event__file_event_win_ps_script_policy_test_creation_by_uncommon_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_rclone_config_files.eql,sha256=m0C-4dYprQn3-SuY8tj1sfz9O-QyCi-YkvWEB_oqyMs,71
src/rules/windows__file__file_event__file_event_win_rclone_config_files.lucene,sha256=8GFrPA5VH5rIKK66A6hGKuUVKFZnwZ4mUL2jdd95pmc,58
src/rules/windows__file__file_event__file_event_win_rclone_config_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_rdp_file_susp_creation.eql,sha256=uB5KtEu4vO1gkZeThRUbpk9dfizYkmvabCHTFoS0G9c,490
src/rules/windows__file__file_event__file_event_win_rdp_file_susp_creation.lucene,sha256=uyKpdN-NzT_dS7wg2IzkVV0ZU5UyX7qmspTPGjkpduU,471
src/rules/windows__file__file_event__file_event_win_rdp_file_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_redmimicry_winnti_filedrop.eql,sha256=_I0ddL1X3_NjC7vKo4phzBCv60VMzOu_-26oiz3aDtg,99
src/rules/windows__file__file_event__file_event_win_redmimicry_winnti_filedrop.lucene,sha256=JD18SNSoYQtLSHU4kdQkNX5LXX4pr4wqtQZsD13bdFk,83
src/rules/windows__file__file_event__file_event_win_redmimicry_winnti_filedrop.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_regedit_print_as_pdf.eql,sha256=1BCQBZWDCq1sKvKusHRgRU39pUzOcjegMLqAfBr9GSU,68
src/rules/windows__file__file_event__file_event_win_regedit_print_as_pdf.lucene,sha256=7_DDUbnDaOyhisfyabhYR2RLECrwWEMpuPBewFKq0ak,54
src/rules/windows__file__file_event__file_event_win_regedit_print_as_pdf.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_remcom_service.eql,sha256=-y1tTe6G77WU_mWyaLw-LAdWJVST1qItnhxRJ2WQDDA,39
src/rules/windows__file__file_event__file_event_win_remcom_service.lucene,sha256=oa0_UWSPxw1qcGTUkdOxC8dNymXl_eo9zVDX7S2U1dg,27
src/rules/windows__file__file_event__file_event_win_remcom_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_artefact.eql,sha256=VGV3WSUdHdnjKfyj0yx_m_-5U5MmP80AB3i-AM2098s,46
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_artefact.lucene,sha256=1NAeA9rN8r-Pmvgt5iwurMXjlshC5j-zH6Y2Yaa_tnc,34
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_artefact.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_remote_file.eql,sha256=IVU49vbmmZbusWdCHLn605zAP-RrE3UIMQOnIpAyBGI,123
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_remote_file.lucene,sha256=OWnDJkzyz4R3NGiQ35emgiHez1N3gW7pZsqvpXEouYw,109
src/rules/windows__file__file_event__file_event_win_remote_access_tools_screenconnect_remote_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_ripzip_attack.eql,sha256=n2_L8ZDTB6AaSamlfJIrTczY4ghvVfGO6XdJxH8D8co,181
src/rules/windows__file__file_event__file_event_win_ripzip_attack.lucene,sha256=xHojH03B-0uO8uHhv21r9j_9NhNqTgubrbKW5T-8ad8,172
src/rules/windows__file__file_event__file_event_win_ripzip_attack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sam_dump.eql,sha256=I2Rx4VlSU03DZx_iVGZ7GFpEpbfDINVzZKTLEQm-K4Y,418
src/rules/windows__file__file_event__file_event_win_sam_dump.lucene,sha256=7o8o9WC0NNlylNmITYdIPvKwzatVy4JJYqg5zBXZ1_A,394
src/rules/windows__file__file_event__file_event_win_sam_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sed_file_creation.eql,sha256=_9E68bVY8E-P6bd4LKtsrQV_yMKbtiQlzx-ouVz8YB4,196
src/rules/windows__file__file_event__file_event_win_sed_file_creation.lucene,sha256=6ruaoIqpO89rbYY2Ie2Dysau4lTHlJLt4UuJ_W2X5OE,181
src/rules/windows__file__file_event__file_event_win_sed_file_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_shell_write_susp_directory.eql,sha256=edN-0Dhmzu0dVjejPiSFw9qw6eRxslqVJAM0hVeKcaA,470
src/rules/windows__file__file_event__file_event_win_shell_write_susp_directory.lucene,sha256=Jwkc74qzxZOsyZpcpbOgZD8xVuvDX92YjcREtjypc2c,433
src/rules/windows__file__file_event__file_event_win_shell_write_susp_directory.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_shell_write_susp_files_extensions.eql,sha256=1G2JC-3DpETipoAjZ99LIpQIWdNIqcrN3SRG0b0e11g,1330
src/rules/windows__file__file_event__file_event_win_shell_write_susp_files_extensions.lucene,sha256=4k_afbhW5l1exXc5R3lMb-QUOVLSKnFy_BCop38-bHM,1254
src/rules/windows__file__file_event__file_event_win_shell_write_susp_files_extensions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_startup_folder_file_write.eql,sha256=8s3gwipinhpoSHaUHTvq06Oid7YP1L8ZRHa4iV2rZMk,373
src/rules/windows__file__file_event__file_event_win_startup_folder_file_write.lucene,sha256=EoKxwmtsdOK43znTjrep5XPwLTCrUQqVnb8wfwFIJzA,349
src/rules/windows__file__file_event__file_event_win_startup_folder_file_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_colorcpl.eql,sha256=_GGN7VGaDOof8eU7Ec_rfM0ax6zOXMAwRda6ZYPoF1k,115
src/rules/windows__file__file_event__file_event_win_susp_colorcpl.lucene,sha256=4v2v-kgyUjIKm96AkbkTZduDqt393y4uXlQxHz3xlpk,95
src/rules/windows__file__file_event__file_event_win_susp_colorcpl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_creation_by_mobsync.eql,sha256=gps5dlKKfeYc9lJNjKlcxgB78BR-Z1Mb0WogWgEZiOQ,87
src/rules/windows__file__file_event__file_event_win_susp_creation_by_mobsync.lucene,sha256=rvGw83QBXtLZJP3FVEpI3jkfLpnclUneHDBRbLsXQLk,67
src/rules/windows__file__file_event__file_event_win_susp_creation_by_mobsync.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_default_gpo_dir_write.eql,sha256=3yQJUKuuoK6lejUKraztda6Wp-lHadpZcTvLOMPe9FQ,117
src/rules/windows__file__file_event__file_event_win_susp_default_gpo_dir_write.lucene,sha256=WRPkW4mQd0X9ReqdhPZ5TVl2AKjbmfcv7TZd_zEMLBw,103
src/rules/windows__file__file_event__file_event_win_susp_default_gpo_dir_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_desktop_txt.eql,sha256=SdF54M6cm4l4jOdBHPc1hCKZERmYZKOE3c1h0U95qD0,122
src/rules/windows__file__file_event__file_event_win_susp_desktop_txt.lucene,sha256=QfCUoY7jkoZ0aSjxJ5fe1iDwRsxUICRj1vMRAuee49g,104
src/rules/windows__file__file_event__file_event_win_susp_desktop_txt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_desktopimgdownldr_file.eql,sha256=2zM5r4SiUJ07Ql96tAWOPJwfFGfrckvNuRkI7AX96ZQ,199
src/rules/windows__file__file_event__file_event_win_susp_desktopimgdownldr_file.lucene,sha256=wcPw8Fnblxdz20BBwhmQcYPrWDxksWUea7gbj9aBiuI,176
src/rules/windows__file__file_event__file_event_win_susp_desktopimgdownldr_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_diagcab.eql,sha256=lXpnJ0_jmgJTfmYVjBmoJ9bmocVsbjEDX85TakQy0U8,32
src/rules/windows__file__file_event__file_event_win_susp_diagcab.lucene,sha256=snA_uvnzG9Snuzt_h3KNdQCmHPzvmQU2Ekg-YyENmZk,20
src/rules/windows__file__file_event__file_event_win_susp_diagcab.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_double_extension.eql,sha256=v_OVTarmSdRCD3mIxNL2HfXTVKgM_wWhtfcO_MR6QmM,327
src/rules/windows__file__file_event__file_event_win_susp_double_extension.lucene,sha256=K4ak39CIujRYH8MRwSHKVvk6Rf-_nlfx80qTxYYbA0w,293
src/rules/windows__file__file_event__file_event_win_susp_double_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_dpapi_backup_and_cert_export_ioc.eql,sha256=rug_21PN4GW2qFiyXok1dC32eyYJ9tFZlTNldecYK4Y,141
src/rules/windows__file__file_event__file_event_win_susp_dpapi_backup_and_cert_export_ioc.lucene,sha256=OUkLJWZiPavEPYZlna1fL82ZmPesNhnCSKp7vP3qbt0,115
src/rules/windows__file__file_event__file_event_win_susp_dpapi_backup_and_cert_export_ioc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_exchange_aspx_write.eql,sha256=FjQQorxGQ10zM-KB5734i0X1lmQz8U8QFCGRVXoV9qo,109
src/rules/windows__file__file_event__file_event_win_susp_exchange_aspx_write.lucene,sha256=V0K9h6yuVTS2BmtKd2WqlG3foWmUqLGs994b4n5OOEU,89
src/rules/windows__file__file_event__file_event_win_susp_exchange_aspx_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_executable_creation.eql,sha256=0zxEwiN_z6R4KOmXz4rPgs9t__cAsHxOE5X_G7bKH8Q,171
src/rules/windows__file__file_event__file_event_win_susp_executable_creation.lucene,sha256=iTZ2TD3YW9OIi_OYoST_l3-O8-6YYrN-ovF8hkkgTWc,160
src/rules/windows__file__file_event__file_event_win_susp_executable_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_file_write_in_webapps_root.eql,sha256=32OrDWkfs_M6Ah5qLRBfNNIvsgotR2d9VT2iA-QPY8s,193
src/rules/windows__file__file_event__file_event_win_susp_file_write_in_webapps_root.lucene,sha256=gVFmdhKul1I8DDfbtJaztgv_rcNRFMQg_cN0taqXyiA,163
src/rules/windows__file__file_event__file_event_win_susp_file_write_in_webapps_root.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_filewrite_in_sharepoint_layouts_dir.eql,sha256=tAHy9wnUfF-TI3J9YFYPaA3j4B7Gy81O0-J12rjZky8,580
src/rules/windows__file__file_event__file_event_win_susp_filewrite_in_sharepoint_layouts_dir.lucene,sha256=8OBKHpP6baRmLwgIQidhj6HJHO_BKrZqz9x43iwPvMQ,553
src/rules/windows__file__file_event__file_event_win_susp_filewrite_in_sharepoint_layouts_dir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_get_variable.eql,sha256=r-h_qX7UbK1303lrPxAqb1VE1F3gRaNbAiXmVd8mpaw,71
src/rules/windows__file__file_event__file_event_win_susp_get_variable.lucene,sha256=MErl4bmtQu9obzwvtKB1ZpI8X5ooyd71moXuca4hITs,60
src/rules/windows__file__file_event__file_event_win_susp_get_variable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_hidden_dir_index_allocation.eql,sha256=BtuUvrSZI6h2DSV9KbLkQguGlGYN9PZ-OPCm8QKQP7E,44
src/rules/windows__file__file_event__file_event_win_susp_hidden_dir_index_allocation.lucene,sha256=gVl7AxdVdSHyJiUrgXx2ybVW4HRBELZ5lPmYhUPLFnE,34
src/rules/windows__file__file_event__file_event_win_susp_hidden_dir_index_allocation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_homoglyph_filename.eql,sha256=Mb05f6t5vTTa8qFxQbIzm6A8UnT2Bg6Upj4626svbvg,435
src/rules/windows__file__file_event__file_event_win_susp_homoglyph_filename.lucene,sha256=Jfbz8aWhhE9__qQhpuJuWL_VnJs_8JOScaoPswX53Z4,409
src/rules/windows__file__file_event__file_event_win_susp_homoglyph_filename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_archive.eql,sha256=qXT2uvRIisiI4wpkp6UI2YiYT33Oj8VcIEccf9TTyRw,471
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_archive.lucene,sha256=WUFb22ytFxaSnZzOOUb6N9Z-6GiYYUDpJmnNjS87-K0,445
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_archive.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_exe.eql,sha256=vCLF8ecMbbuJ2nn5VAP66MLra9glRSPSXuDsqFCTM88,327
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_exe.lucene,sha256=W50qj-QsMRWzAGuO41eZ9WMj8QGpMyAWS7yk-f70B5E,301
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_script.eql,sha256=Ha4fQECnMp2cvvV8xMErhiAKGO4n3ndfheharohRAAk,354
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_script.lucene,sha256=CUgfVPIPTP53SmHCBnUT5vL2zeCsxLHTR3BMCgg1xQU,328
src/rules/windows__file__file_event__file_event_win_susp_legitimate_app_dropping_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_lnk_double_extension.eql,sha256=Ni1D62DPvzr1VwI4mNI2-ybqHrg7RU1JAlivQV2xiP0,667
src/rules/windows__file__file_event__file_event_win_susp_lnk_double_extension.lucene,sha256=kjvVERdPdcMCQEoTvts0UeZHjsho_pd-N6w0ZGwxMZI,623
src/rules/windows__file__file_event__file_event_win_susp_lnk_double_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_powershell_profile.eql,sha256=l8qzXTIT4QPoTthe15QHf3KVQfYTO6-huLa5G81XMBI,299
src/rules/windows__file__file_event__file_event_win_susp_powershell_profile.lucene,sha256=hklp9F1AHyNHtU89xCyFEAQQCSmibyTgkRS15-_A4-Y,284
src/rules/windows__file__file_event__file_event_win_susp_powershell_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_procexplorer_driver_created_in_tmp_folder.eql,sha256=EyWi7_d6JZk5Nr_AJWC_DTU_1ctu9MmcKAfY13UkOzk,200
src/rules/windows__file__file_event__file_event_win_susp_procexplorer_driver_created_in_tmp_folder.lucene,sha256=cp0UfY3-qlurM52vMemJDJGzMzfrR0wh0ZGMsJXlobk,178
src/rules/windows__file__file_event__file_event_win_susp_procexplorer_driver_created_in_tmp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_public_folder_extension.eql,sha256=3tKrWG2dwfyVE7erJkM8iyPRH6NEPUKHyNnQSy5KmC8,136
src/rules/windows__file__file_event__file_event_win_susp_public_folder_extension.lucene,sha256=64is2XV5Y8fRVWK000hqsLHUWDM9VmGGg3iavsLnW5o,117
src/rules/windows__file__file_event__file_event_win_susp_public_folder_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_recycle_bin_fake_exec.eql,sha256=ezSCbFIpW7lDftKdK53JzSz1aO0GE_3YQ5YBn6FZ7KI,138
src/rules/windows__file__file_event__file_event_win_susp_recycle_bin_fake_exec.lucene,sha256=1ZwU7APAzvmZE-GMDwk2t6i3vZjvIjGh1vo5pQOMjnU,112
src/rules/windows__file__file_event__file_event_win_susp_recycle_bin_fake_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_right_to_left_override_extension_spoofing.eql,sha256=bR0hdnBRtt6JMC8lYvnJVm3HtoCN25Kdss3RyjsS40w,274
src/rules/windows__file__file_event__file_event_win_susp_right_to_left_override_extension_spoofing.lucene,sha256=RCZhju72rBrOqEshkmXUieb6AsecANQYt0-8zceFqJA,251
src/rules/windows__file__file_event__file_event_win_susp_right_to_left_override_extension_spoofing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_spool_drivers_color_drop.eql,sha256=Cl-oO-LmKJyoCe42ff1g9T4UyyrohyABdpibeMMZ4x8,119
src/rules/windows__file__file_event__file_event_win_susp_spool_drivers_color_drop.lucene,sha256=SRBJfOLXsNHClwGsdS-spFCGjgScFlI5sLHhyONMTYI,100
src/rules/windows__file__file_event__file_event_win_susp_spool_drivers_color_drop.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_startup_folder_persistence.eql,sha256=-xljaaRXxlxI1IYrMXhWIKNCg5mHxRHISYIwZn-kbd0,243
src/rules/windows__file__file_event__file_event_win_susp_startup_folder_persistence.lucene,sha256=5-qVPMdvfyjrQP6XODvFTtau2gkdfwM6Z9NXaNAE2N0,224
src/rules/windows__file__file_event__file_event_win_susp_startup_folder_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_system_interactive_powershell.eql,sha256=51uk1N-U4OjHNo9whJ5BdNEW2uTQ7CGuO6moECYyXx8,290
src/rules/windows__file__file_event__file_event_win_susp_system_interactive_powershell.lucene,sha256=jCvsruOfglyAitz-RHmjMR14e1MxobJJGpG5SUQe01I,275
src/rules/windows__file__file_event__file_event_win_susp_system_interactive_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_task_write.eql,sha256=mr4-CaUHSTPcLJXPxxL1dmu2UpCZkoJnQ38Yjj2zRAw,165
src/rules/windows__file__file_event__file_event_win_susp_task_write.lucene,sha256=bxId37zNdmpml8E5lby5u39jkrq9avLy6uY4_KoOqbU,146
src/rules/windows__file__file_event__file_event_win_susp_task_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_teamviewer_remote_session.eql,sha256=rdlcX_-3H4965pJCUp-ZVIsqFjvK16DvQyB0nlQEHZo,169
src/rules/windows__file__file_event__file_event_win_susp_teamviewer_remote_session.lucene,sha256=NJX0kINSpKlD0LxS1ag-lIQaFw6OkMgSqcAD7zmaMmI,147
src/rules/windows__file__file_event__file_event_win_susp_teamviewer_remote_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_vscode_powershell_profile.eql,sha256=01UFrWNMKREcn8pOQLToGA00OQG4-Z3L58JxMEWmDVQ,54
src/rules/windows__file__file_event__file_event_win_susp_vscode_powershell_profile.lucene,sha256=ylpBgZJcncmgPLTzqfmvHcaCx_bCwjJJDnPxiUbl10g,42
src/rules/windows__file__file_event__file_event_win_susp_vscode_powershell_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_wdac_policy_creation.eql,sha256=mWHmPmI6APkcAH-X-zwjw8G7GVcjSADp2whWmOxnvE4,1062
src/rules/windows__file__file_event__file_event_win_susp_wdac_policy_creation.lucene,sha256=GLnxmj7BY0rD3lsQyrdRT1D776UuuJedUWiK0iqAFBE,1049
src/rules/windows__file__file_event__file_event_win_susp_wdac_policy_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_windows_terminal_profile.eql,sha256=pVlJwjnx-9EVWeqH9V92xFMgLoTwvtSsy-mfXrtolh8,252
src/rules/windows__file__file_event__file_event_win_susp_windows_terminal_profile.lucene,sha256=_buX3mZdcnXeGlcNlrZcZlAOdW5qqpQ7hKWt2STFRoU,232
src/rules/windows__file__file_event__file_event_win_susp_windows_terminal_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_susp_winsxs_binary_creation.eql,sha256=oUP-RsQcJBz2eEghl0x3wEMYzcsgjOJe8rIGzQgMvE4,186
src/rules/windows__file__file_event__file_event_win_susp_winsxs_binary_creation.lucene,sha256=-TsqDXeqKE14CBSZb8YeSo0z5kZgbOm98ORG1lB6kp0,168
src/rules/windows__file__file_event__file_event_win_susp_winsxs_binary_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_adexplorer_dump_written.eql,sha256=u-CEuMevjvyh7d33fgenxI8qY9xyFtv5gyW7QfdcwlY,144
src/rules/windows__file__file_event__file_event_win_sysinternals_adexplorer_dump_written.lucene,sha256=yj0Ru4EN61iElBIVzNZTxajtUlMxnjAA5Y1fWbGwsGM,124
src/rules/windows__file__file_event__file_event_win_sysinternals_adexplorer_dump_written.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_default_dump_name.eql,sha256=O8Zq20T1u4rnOIsKX2bWjOKpDdfmdcbcWt4SYwFWpPQ,46
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_default_dump_name.lucene,sha256=HmZ03Z2mFGV-a-yAipz4Shihu4cMOrOmUIbfwx6M91Y,35
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_default_dump_name.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver.eql,sha256=j7nhJv-ULVtc_y398R3fI2QKmffwyqa8DocEl4I_vIQ,133
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver.lucene,sha256=aLiUDl17mxNaNmLZSqyqq8FIiTi-1yM5BOFxI-Jxvn0,114
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver_susp_creation.eql,sha256=1a1LJTUq9AjzqU1SMNhutNl8W2R9hoNjjFwG1QC-G0s,139
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver_susp_creation.lucene,sha256=TRwGm2qKKmRcc2jOhYi97lXM8xDOFipJHz1qjZ7QK04,120
src/rules/windows__file__file_event__file_event_win_sysinternals_livekd_driver_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_procexp_driver_susp_creation.eql,sha256=1u7MgXSrGWkawwlwJbN3HH9-xbHmf0URrtP3sJvVz98,134
src/rules/windows__file__file_event__file_event_win_sysinternals_procexp_driver_susp_creation.lucene,sha256=rR7-u2bcIED2RN5ppULk6DTYypNPTNKkRJchE26O080,112
src/rules/windows__file__file_event__file_event_win_sysinternals_procexp_driver_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_procmon_driver_susp_creation.eql,sha256=6Hzi2smm0ezOda-CxNPPNM6z53QPIiM9AMBSYcPGxck,134
src/rules/windows__file__file_event__file_event_win_sysinternals_procmon_driver_susp_creation.lucene,sha256=d9T-8Gpk3hoRE9Z3orVHEY1PqWqY_WdqLUS8fWOHTnc,112
src/rules/windows__file__file_event__file_event_win_sysinternals_procmon_driver_susp_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service.eql,sha256=ifZQBtD5tHrDxP3KBsBX23KjAOLPgxAriQ7L4xECOg0,38
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service.lucene,sha256=I-f6iaxMvev-np9AtxcoIueM-U-8SA30yt9Thd5ZBgM,26
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service_key.eql,sha256=7OyMAT48o7rUqG5MGgnemICcR0FDFmznI0FrK-p3I9g,66
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service_key.lucene,sha256=aS2_UkdhO3yrJLzo4cacQbfmoJK8dL7Vg9AWF0fson4,54
src/rules/windows__file__file_event__file_event_win_sysinternals_psexec_service_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_system32_local_folder_privilege_escalation.eql,sha256=KNOH8okjtTXN3gHWNlJbLwUs7ioFaRxm0bDrMekAVrQ,287
src/rules/windows__file__file_event__file_event_win_system32_local_folder_privilege_escalation.lucene,sha256=M8tPrVCtqz4aURsx4fgJILNB8IiBJREPiEXdRitoUDc,272
src/rules/windows__file__file_event__file_event_win_system32_local_folder_privilege_escalation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_taskmgr_lsass_dump.eql,sha256=bt_2yWgjN8s8es2VPys_On48B4K_XoEN4jOu7vG6PW8,207
src/rules/windows__file__file_event__file_event_win_taskmgr_lsass_dump.lucene,sha256=KSX2-dpQkoLAZW4AyVb3j6GYIyWYdbFcDtAXAldb3gU,185
src/rules/windows__file__file_event__file_event_win_taskmgr_lsass_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_tsclient_filewrite_startup.eql,sha256=kG7iIWcBLE0jsuo102qKNdb49V3mjDumZ7RVP14W4e8,115
src/rules/windows__file__file_event__file_event_win_tsclient_filewrite_startup.lucene,sha256=GV6zOOshTOrMjLszsyaPupOTJFdMT1jXGEWe7X4cPrY,102
src/rules/windows__file__file_event__file_event_win_tsclient_filewrite_startup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_consent_comctl32.eql,sha256=lJmW5waex-5tc5KYSlBG6iWYldywFKhiXB1_qyuQGI8,92
src/rules/windows__file__file_event__file_event_win_uac_bypass_consent_comctl32.lucene,sha256=qT6rvAY-PDV4ckUCDnka_IxJ_MkFmycLVceTzto6X-M,79
src/rules/windows__file__file_event__file_event_win_uac_bypass_consent_comctl32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_dotnet_profiler.eql,sha256=GcfDwGbV06pksFbmMnKMGJjLKfp4KydL2njIYyh8ElQ,85
src/rules/windows__file__file_event__file_event_win_uac_bypass_dotnet_profiler.lucene,sha256=7w-EB-a3RCn5jLT4B3zEUoVvKeanlVE_Z_o8h4dVekc,72
src/rules/windows__file__file_event__file_event_win_uac_bypass_dotnet_profiler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_eventvwr.eql,sha256=Ex0AbYx2Hfkcqny2d5PEplab0TftLwz3CII5mXksjaE,203
src/rules/windows__file__file_event__file_event_win_uac_bypass_eventvwr.lucene,sha256=Fh4YqSDiDPY6zI_fwyvkl9D0ao6PbHZUK74FN5BUyUg,181
src/rules/windows__file__file_event__file_event_win_uac_bypass_eventvwr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_idiagnostic_profile.eql,sha256=ahALtp8W0m0LM4vK7lCmxXDTG7B1iKMU3dL1Ay0oYhk,108
src/rules/windows__file__file_event__file_event_win_uac_bypass_idiagnostic_profile.lucene,sha256=UhRXskfAdkdDcYhqbszpNa24l2EuBO3mvoQ9hP5Dy2s,93
src/rules/windows__file__file_event__file_event_win_uac_bypass_idiagnostic_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_ieinstal.eql,sha256=IREyjIBR5rJvZZfFly4sipnJ-7DbTSRmHFmth2t-32E,181
src/rules/windows__file__file_event__file_event_win_uac_bypass_ieinstal.lucene,sha256=wnFnzR4-Ra5o9rzLmAeHGY5Vwg-rI3ZuZsBgDsqT6bI,167
src/rules/windows__file__file_event__file_event_win_uac_bypass_ieinstal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_msconfig_gui.eql,sha256=ywtsGcDZxbCCrWnnVi4wWRWpr1H9LVGmKuLjH1keGJ8,86
src/rules/windows__file__file_event__file_event_win_uac_bypass_msconfig_gui.lucene,sha256=gbA7-A0dkrsSLdx5nvJBWRt1TX_febr-vh6sQYMc08A,73
src/rules/windows__file__file_event__file_event_win_uac_bypass_msconfig_gui.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_ntfs_reparse_point.eql,sha256=7sPWXUqOgoclcFOGG1diykvRV1g-CKm0l012N5PTCPI,114
src/rules/windows__file__file_event__file_event_win_uac_bypass_ntfs_reparse_point.lucene,sha256=qKzRu-hbabWjN-yz2L4_OMfdFjlrkvCIfY4kbWbknLo,107
src/rules/windows__file__file_event__file_event_win_uac_bypass_ntfs_reparse_point.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_winsat.eql,sha256=z1N73igmSCV8Ux0ZBVuDabjw5YrP4OByMLbeDrncf1k,154
src/rules/windows__file__file_event__file_event_win_uac_bypass_winsat.lucene,sha256=Q3RGdXrrprVZdPxULPimkaE6skRfR4cd65_898p8Gqs,135
src/rules/windows__file__file_event__file_event_win_uac_bypass_winsat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_uac_bypass_wmp.eql,sha256=Src9ykGxIQwcMjBGlFOWUoZtFXpQHEVDQVNwFBJc_yI,218
src/rules/windows__file__file_event__file_event_win_uac_bypass_wmp.lucene,sha256=lczM4msK1_Q-GbXPW_fJd5k4cQ003erc-gI2tmsTl1w,206
src/rules/windows__file__file_event__file_event_win_uac_bypass_wmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_vhd_download_via_browsers.eql,sha256=LTIQF5TVeZThZHOk_dHwhiZDA9sW_dlgzIqDMOhsVuM,302
src/rules/windows__file__file_event__file_event_win_vhd_download_via_browsers.lucene,sha256=zGm3s6TSXawRtteHKpB3BNunyqpmQLx6bAkgsOVNNc8,282
src/rules/windows__file__file_event__file_event_win_vhd_download_via_browsers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_remote_creation_artefacts.eql,sha256=4WRSlrOVe5t6wFwV5tX7E508iq_iJOHOIsecEAAMxeE,154
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_remote_creation_artefacts.lucene,sha256=PbgfKPwQClK1off-KDH4faoNpYwxSiDt5kIBmxgjB0M,140
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_remote_creation_artefacts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_renamed_execution.eql,sha256=dFKyMgbHoZvVxt3WBVJcStTbyUOwOpbK_wVU42mVAUs,117
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_renamed_execution.lucene,sha256=BmRd5fepz0ts2WVFpQNRdM7rV0BkocqtQ1EWyz_VcaI,98
src/rules/windows__file__file_event__file_event_win_vscode_tunnel_renamed_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_webshell_creation_detect.eql,sha256=vm4Fm8CuE46LLzseoujABOgmrLAS-tELLMEF_TWmLHU,336
src/rules/windows__file__file_event__file_event_win_webshell_creation_detect.lucene,sha256=Y-EBpMI7LZ8K4dl5eSs9E2rbYXUN1C7FcpNS9sor6so,294
src/rules/windows__file__file_event__file_event_win_webshell_creation_detect.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_werfault_dll_hijacking.eql,sha256=e0hCAe80pMLpO9hnHsiJFTSnnFMuFWvep6pugF2A9ak,238
src/rules/windows__file__file_event__file_event_win_werfault_dll_hijacking.lucene,sha256=c0yNFnxfVLgnMzj54h0xjnj7aWY64W8tY2c72a3oucw,217
src/rules/windows__file__file_event__file_event_win_werfault_dll_hijacking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_winrar_file_creation_in_startup_folder.eql,sha256=da4ztkmDicMBDjubE0JU_T6H6hoJyoLQqw18xxY8Vcs,120
src/rules/windows__file__file_event__file_event_win_winrar_file_creation_in_startup_folder.lucene,sha256=v848tTfRjYDnDWE3y3TbrjF9EByrYn4ksOyowpQalIY,101
src/rules/windows__file__file_event__file_event_win_winrar_file_creation_in_startup_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_winrm_awl_bypass.eql,sha256=HVVSFh6w7mSUNd_1vFYqF8SJXXegXX_i403Is25dhyE,142
src/rules/windows__file__file_event__file_event_win_winrm_awl_bypass.lucene,sha256=4lkDCFxuuvSthktQt_O7WjuQr_Y19FnLbb7i-nrrXhc,118
src/rules/windows__file__file_event__file_event_win_winrm_awl_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_wmi_persistence_script_event_consumer_write.eql,sha256=EBr8C1frP8hif0uFfs1S_kXYG-IML39LHKwXFlgNZz8,72
src/rules/windows__file__file_event__file_event_win_wmi_persistence_script_event_consumer_write.lucene,sha256=r-KH0S-mWgM12ba5O4Pb87DghztZk3gKh72gQVP5Kmg,61
src/rules/windows__file__file_event__file_event_win_wmi_persistence_script_event_consumer_write.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_wmiexec_default_filename.eql,sha256=ZwH0nzzQckUVn1sZqyhuDvcWK_rtIvdv05F2X3LOaiY,312
src/rules/windows__file__file_event__file_event_win_wmiexec_default_filename.lucene,sha256=TxqWbQ6F2Vii_ylfkNR5IkcA_9y2jq7P-2ilwZEURko,341
src/rules/windows__file__file_event__file_event_win_wmiexec_default_filename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_wmiprvse_wbemcomn_dll_hijack.eql,sha256=L-7YiA4ttTNlWX1GdsZMtwCQSGG7G2ybkrsVZEBxuqs,76
src/rules/windows__file__file_event__file_event_win_wmiprvse_wbemcomn_dll_hijack.lucene,sha256=LSe_otauM760ld5qapQmZTYWjn6HugAEQVxsc7LJW4I,62
src/rules/windows__file__file_event__file_event_win_wmiprvse_wbemcomn_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_wpbbin_persistence.eql,sha256=3G0UqyaddJDup8SyIasGv2D6FKrBs1D1WCKs5Ws_RDc,56
src/rules/windows__file__file_event__file_event_win_wpbbin_persistence.lucene,sha256=FOtTW59x-YVNs7l9YDWWjMvD_MNqkNlaSGkq3zfCK3Y,45
src/rules/windows__file__file_event__file_event_win_wpbbin_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_event__file_event_win_writing_local_admin_share.eql,sha256=sHIUkxh6Z4Y7WXtzh3kTC-gRgHo4sCZo53AkuPFr75c,62
src/rules/windows__file__file_event__file_event_win_writing_local_admin_share.lucene,sha256=FgpgNrS3i7XkdfRXcpOz_iz3nbQhNvbIoaLl2juo6cc,48
src/rules/windows__file__file_event__file_event_win_writing_local_admin_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_executable_detected__file_executable_detected_win_susp_embeded_sed_file.eql,sha256=pJU89VSU2EyMASAg9WhrkY81c5nYAh0lMMxPaTcL5SM,28
src/rules/windows__file__file_executable_detected__file_executable_detected_win_susp_embeded_sed_file.lucene,sha256=iXtAFLzwjpR1qkh11b2A0-CTccV0UPvboWX-I7d_29M,16
src/rules/windows__file__file_executable_detected__file_executable_detected_win_susp_embeded_sed_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__file__file_rename__file_rename_win_ransomware.eql,sha256=QNgM9gOZlzW84eFXB_VTEe5EorIM_D2JCYKUPE2Z8yw,465
src/rules/windows__file__file_rename__file_rename_win_ransomware.lucene,sha256=CJtn_w1GUcYGn-epWCIzRtYjwwYlHFsOXleqXjRTmuU,429
src/rules/windows__file__file_rename__file_rename_win_ransomware.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_clfs_load.eql,sha256=_K2hB4hfUuJdyXURVOMvKG8QhC87r-gxCy2NfxG-coA,470
src/rules/windows__image_load__image_load_clfs_load.lucene,sha256=hKB0m4Y60mvHaiLnNQgGXnHdqTURKz7vqEZaRl_BouE,441
src/rules/windows__image_load__image_load_clfs_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_cmstp_load_dll_from_susp_location.eql,sha256=JpnZiW38TDbyjHHDqffYdrVg6LqRKcBxqkDqqltZ3cE,196
src/rules/windows__image_load__image_load_cmstp_load_dll_from_susp_location.lucene,sha256=nPjnf-X9OBog5h1q0dQz-i6IpiSZrrNbqNOs1G1DxCA,169
src/rules/windows__image_load__image_load_cmstp_load_dll_from_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_amsi_suspicious_process.eql,sha256=ZQAAOPeuI1gk0DOJozWVXrE7ZEzF5kLLHZD37l9vdUE,124
src/rules/windows__image_load__image_load_dll_amsi_suspicious_process.lucene,sha256=37dZw-skcvZ6-HPZfjVtDkWYdNT9z90kW7K9h8cE58k,104
src/rules/windows__image_load__image_load_dll_amsi_suspicious_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_azure_microsoft_account_token_provider_dll_load.eql,sha256=I4buhA0f_xrNgH9TSERwy_K-07BxJB8sbjgd99rIWKI,1218
src/rules/windows__image_load__image_load_dll_azure_microsoft_account_token_provider_dll_load.lucene,sha256=QSlD7dKJlMNXUoJr7FMSD8x7RXhcct4PRjV4AWd-D04,1193
src/rules/windows__image_load__image_load_dll_azure_microsoft_account_token_provider_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_comsvcs_load_renamed_version_by_rundll32.eql,sha256=Msa1g-2yYL-CSGPqEqf_Fkqr_X7rkqqKlo0zp-yXUq4,354
src/rules/windows__image_load__image_load_dll_comsvcs_load_renamed_version_by_rundll32.lucene,sha256=QX4R6YGrihJzvNQyS2azEWnXYLZESwk6VxPncAZp0PY,337
src/rules/windows__image_load__image_load_dll_comsvcs_load_renamed_version_by_rundll32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_credui_uncommon_process_load.eql,sha256=R27GRLk1RSPRdxY0w8ekoZ4wJauo1kvOjiIrKjz-_aY,828
src/rules/windows__image_load__image_load_dll_credui_uncommon_process_load.lucene,sha256=tabPbzEQpgottsOUeAl1odDw6YwULeFOWBn0XscotGo,781
src/rules/windows__image_load__image_load_dll_credui_uncommon_process_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_dbghelp_dbgcore_unsigned_load.eql,sha256=SUrhpE7Tsodu67R-8ItPRmAbaGcXO1AFktxj_SzGnDg,104
src/rules/windows__image_load__image_load_dll_dbghelp_dbgcore_unsigned_load.lucene,sha256=E31wWvzeJqCm5sQJxxMu8OCHaYm_IUrZT8nx52uE-R0,84
src/rules/windows__image_load__image_load_dll_dbghelp_dbgcore_unsigned_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_pcre_dotnet_dll_load.eql,sha256=YFypoBw2hlJxFqPL0mDnyDNdMoZyrNuPyuIn9k23VRY,82
src/rules/windows__image_load__image_load_dll_pcre_dotnet_dll_load.lucene,sha256=HE1Oo7o7IsebBf3B-tRHyCypnA800w9SSK_3ejCvQLA,70
src/rules/windows__image_load__image_load_dll_pcre_dotnet_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_rstrtmgr_suspicious_load.eql,sha256=bzl76ejtdzvkv_-VIEij2AvH_AEgrE3hAtjGMVEquvY,422
src/rules/windows__image_load__image_load_dll_rstrtmgr_suspicious_load.lucene,sha256=XAMfzem-iHIIKmqg0cHSL_sF3tGGXrs8eY9WoJW-vJI,394
src/rules/windows__image_load__image_load_dll_rstrtmgr_suspicious_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_rstrtmgr_uncommon_load.eql,sha256=Vapriv2DRHH1Vsyk-Xiv5juJgvsyrLHT48d6GOH7w2Y,812
src/rules/windows__image_load__image_load_dll_rstrtmgr_uncommon_load.lucene,sha256=UWMrGNt_yeitBZ5Kphlnl4d1dQR9bpppUHORIkh49E4,798
src/rules/windows__image_load__image_load_dll_rstrtmgr_uncommon_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_sdiageng_load_by_msdt.eql,sha256=Q9w1cbmRwzaMYQwkSjPW0aK-9noKbomx-S7UPe1bmKA,75
src/rules/windows__image_load__image_load_dll_sdiageng_load_by_msdt.lucene,sha256=3snfnheUDR_NFmtN59hKUWOT3O-4KTTNENQZJ1LjRVI,61
src/rules/windows__image_load__image_load_dll_sdiageng_load_by_msdt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_system_management_automation_susp_load.eql,sha256=bkcOcQ5qB_ktvMMvFpfywE5yvmmmoCCaSSgm4r7OWBE,2433
src/rules/windows__image_load__image_load_dll_system_management_automation_susp_load.lucene,sha256=BqYGL-S20zHj4DeZmgxWI-iPOApXfsixRMuxfj5dfg4,2401
src/rules/windows__image_load__image_load_dll_system_management_automation_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_tttracer_module_load.eql,sha256=aQ9oP7mB75H7vXd2lvpzPUKsGuNa7jDEvc7QmAAkxcw,87
src/rules/windows__image_load__image_load_dll_tttracer_module_load.lucene,sha256=LN_HQnJdR_BrXtSsKLJqUZbF4-jSqe8XDyY4j1gHA9g,69
src/rules/windows__image_load__image_load_dll_tttracer_module_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_unsigned_node_load.eql,sha256=xoxdLYuV-turZsQ_3365EXA5_EIFsHZnyqcJNgUT1ws,295
src/rules/windows__image_load__image_load_dll_unsigned_node_load.lucene,sha256=ilYipWx_Ez8Nmy6D-8kADxnvCyzpt_HCnO4m3zdwpGQ,269
src/rules/windows__image_load__image_load_dll_unsigned_node_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_vss_ps_susp_load.eql,sha256=kQS5fxPDFKuGrFmwRz7FxOSlL6sQB2cb3g6uPGM8BYE,797
src/rules/windows__image_load__image_load_dll_vss_ps_susp_load.lucene,sha256=bNo7kWCmDBDEd5Gdfd0qdRjMPEX8Wusy2S0WdoafXc8,777
src/rules/windows__image_load__image_load_dll_vss_ps_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_vssapi_susp_load.eql,sha256=7ZLXKjOWtsrUaewWts7c3rDsGJP-4UmpCt8uwpjpoNM,616
src/rules/windows__image_load__image_load_dll_vssapi_susp_load.lucene,sha256=TQ-V0QPWojVfsbSLyOxRwiAAEblOaoU_f4hHFivT3S8,594
src/rules/windows__image_load__image_load_dll_vssapi_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_dll_vsstrace_susp_load.eql,sha256=s4qAhKgxvMbOyNMTfKUAYnCpRiUqDoRueFwPAM20gu0,650
src/rules/windows__image_load__image_load_dll_vsstrace_susp_load.lucene,sha256=SCxy68smmCBWiS80lNjVxMFFWTcnN1LUb7kvNw_1SX4,630
src/rules/windows__image_load__image_load_dll_vsstrace_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_hktl_sharpevtmute.eql,sha256=HKIPTUwITJIKlJVWzqMCE2e5fwEg85U9mSe5pfPDQu4,80
src/rules/windows__image_load__image_load_hktl_sharpevtmute.lucene,sha256=LFcWyWmcSooGjA-wvO1XnKo-LZ1_bSXDEpU-eNF6Y2I,69
src/rules/windows__image_load__image_load_hktl_sharpevtmute.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_hktl_silenttrinity_stager.eql,sha256=_AmWhUcNydc1lwIxwvfr88jW8jau4wNCM-qnnQRSMhA,44
src/rules/windows__image_load__image_load_hktl_silenttrinity_stager.lucene,sha256=T75KyXXOgjXKUjBsDvvs2LD-N2yBk5Tb3XMBDGizziU,32
src/rules/windows__image_load__image_load_hktl_silenttrinity_stager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_iexplore_dcom_iertutil_dll_hijack.eql,sha256=TURYz41XJlqG683bZyUe2oGpSFwEYJjDFlh_TWZLn9U,117
src/rules/windows__image_load__image_load_iexplore_dcom_iertutil_dll_hijack.lucene,sha256=pA1F1oatJAOR1-9U8FLO6hFUMshtj_Y3hwg_X9IvcuE,105
src/rules/windows__image_load__image_load_iexplore_dcom_iertutil_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_lsass_unsigned_image_load.eql,sha256=oD02kFznZ6IRqWgT2OG9RR-rsd5suRMi8DF7Lf86ZXM,83
src/rules/windows__image_load__image_load_lsass_unsigned_image_load.lucene,sha256=1fi4g26Mcxtewigld-UhsP6sfFQReDNPZd5wG6rNDOA,69
src/rules/windows__image_load__image_load_lsass_unsigned_image_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_dotnet_assembly_dll_load.eql,sha256=zzJ1BZgYc7VN49eLPuEyeolx-4lbMsCpQ9TE4DcfBaY,203
src/rules/windows__image_load__image_load_office_dotnet_assembly_dll_load.lucene,sha256=CR5dIm2l9_TpArMj99OVGPRfPlfxVkll-vMJseaCVDc,184
src/rules/windows__image_load__image_load_office_dotnet_assembly_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_dotnet_clr_dll_load.eql,sha256=a3kAAP8yWiFq35YEddF-6CpMy8-10Yc42IBQmo-a85o,191
src/rules/windows__image_load__image_load_office_dotnet_clr_dll_load.lucene,sha256=V7ZAlQgCXef_SKI5_fej316nirqAI2ld6hSAj1i_zZE,171
src/rules/windows__image_load__image_load_office_dotnet_clr_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_dotnet_gac_dll_load.eql,sha256=A69ykKEJYMMEX58Im88W3Y0ULiFsJ_SO4fcWqcaEtWI,227
src/rules/windows__image_load__image_load_office_dotnet_gac_dll_load.lucene,sha256=zzDvv1zxuMnIBXmLdujdDeUzckHn6vbG-RrkNZRfAWE,208
src/rules/windows__image_load__image_load_office_dotnet_gac_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_excel_xll_susp_load.eql,sha256=XUW7EDsHnF8vUstHmrL5qRTs5BTj3A3WdtJYhBU5tyk,198
src/rules/windows__image_load__image_load_office_excel_xll_susp_load.lucene,sha256=YRaW10TT3bEYcbYYoG63h2mpUjihhN8NS1kVqx7jh8g,176
src/rules/windows__image_load__image_load_office_excel_xll_susp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_outlook_outlvba_load.eql,sha256=U9D12QQrzn0lQC6qXOEz5ndXKho3wFlngsOc5i-O3yw,77
src/rules/windows__image_load__image_load_office_outlook_outlvba_load.lucene,sha256=v6kvDqpuXTuR76KfpFZOM9dH3_-cqFnGWt2LvnkcoRU,63
src/rules/windows__image_load__image_load_office_outlook_outlvba_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_powershell_dll_load.eql,sha256=dnqm0UODDzGVMkd5JUYur7atRSmal1VFivFm4sxoKUk,269
src/rules/windows__image_load__image_load_office_powershell_dll_load.lucene,sha256=1qTsn7PVsAIygJlfYX1OoCdE3h4gC_xXzprs48aTJAs,243
src/rules/windows__image_load__image_load_office_powershell_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_office_vbadll_load.eql,sha256=ZZ-2whjE_r_S7LyFHuth7QEsQR8w391dFKu0fvElUUc,236
src/rules/windows__image_load__image_load_office_vbadll_load.lucene,sha256=6SHF4EhnOE6Xy_iaahrEbL08QVmprKO_YmfV6wintiw,210
src/rules/windows__image_load__image_load_office_vbadll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_rundll32_remote_share_load.eql,sha256=V-QPyWwDStk5lvd1CVuQYr3BcqxiOagLoTZvAg2oEN4,67
src/rules/windows__image_load__image_load_rundll32_remote_share_load.lucene,sha256=bCsqb3J4hqXwG-USH3_af2KxjYjjFf-MF-V_wnNcQks,53
src/rules/windows__image_load__image_load_rundll32_remote_share_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_scrcons_wmi_scripteventconsumer.eql,sha256=WQ3hlvYjcOfjIgTBoDTyzKvHaUMa3bY0RLb1tEuxAV4,140
src/rules/windows__image_load__image_load_scrcons_wmi_scripteventconsumer.lucene,sha256=Tg-laiX1LBKtLdROrzZIiHdIwT6_TYqiazUvD_Nvfj4,120
src/rules/windows__image_load__image_load_scrcons_wmi_scripteventconsumer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_7za.eql,sha256=qtWvnMtyT6tZXNsqTRq17VJtPzf23Yl9KWzhdQQcLQY,200
src/rules/windows__image_load__image_load_side_load_7za.lucene,sha256=AiJmFxeNZ33Cdg66Oc2bUy5w46Y8AZVUWHzdWV7qWaU,186
src/rules/windows__image_load__image_load_side_load_7za.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_abused_dlls_susp_paths.eql,sha256=XR4RNbJPT13QG3x__HSzuepxp6nXlvDiVpAmJNHHaTw,477
src/rules/windows__image_load__image_load_side_load_abused_dlls_susp_paths.lucene,sha256=KjeW6ZwYslaaNneSxDFD7CSrce7Livw-jSski4owsSI,442
src/rules/windows__image_load__image_load_side_load_abused_dlls_susp_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_antivirus.eql,sha256=gvTkcHzWA81kg8Xr2TjIPN2My0ZMsr3zeozam2HteJU,1807
src/rules/windows__image_load__image_load_side_load_antivirus.lucene,sha256=XV6xsSExH3cjPsTeD4RvoHD_regwYIaHo_163U869Ms,1781
src/rules/windows__image_load__image_load_side_load_antivirus.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_appverifui.eql,sha256=Sa3tOPBOlWEi3MfifpJ6HG5MAfmjYVss3z-GVbNcHOo,260
src/rules/windows__image_load__image_load_side_load_appverifui.lucene,sha256=PaThV2-QALXjjVjn8pl1Uystp6_vVgZbBV9dmcGrjm0,237
src/rules/windows__image_load__image_load_side_load_appverifui.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_aruba_networks_virtual_intranet_access.eql,sha256=OTymy3-l4y4lBCwuR00MUEXsbsQ8bXMTX4J4z09Lty4,453
src/rules/windows__image_load__image_load_side_load_aruba_networks_virtual_intranet_access.lucene,sha256=1CvLMYIuc6Njgz09bAqRakamsKYN0QFassAuxzXiVgk,428
src/rules/windows__image_load__image_load_side_load_aruba_networks_virtual_intranet_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_avkkid.eql,sha256=dNOxB8ljxcADlLIiIBhCws5wT5NR0seAkWSKDft_NPs,276
src/rules/windows__image_load__image_load_side_load_avkkid.lucene,sha256=aQRNk9rdIa6Tsx_jU9HeRNhWh8PvcB-L56HuPIZFWNk,264
src/rules/windows__image_load__image_load_side_load_avkkid.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_ccleaner_du.eql,sha256=reKYzDyMu9opA2CiJmrBBOVPbu0i24p14DWyOjv0oVM,224
src/rules/windows__image_load__image_load_side_load_ccleaner_du.lucene,sha256=M6dGpivUdxaHUvIXJxNeY1syrHjNhLRdaYdlRmpUqAQ,203
src/rules/windows__image_load__image_load_side_load_ccleaner_du.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_ccleaner_reactivator.eql,sha256=4Vqu1nZYxNLo5220RRjFtLMQ5tGHBr2ZHf1e9VIPCxw,213
src/rules/windows__image_load__image_load_side_load_ccleaner_reactivator.lucene,sha256=euMmOnfWh5l47f8eSJMh_TWUbE56p3MgHy_GjgdCO_I,198
src/rules/windows__image_load__image_load_side_load_ccleaner_reactivator.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_chrome_frame_helper.eql,sha256=F5aZ-UdEHqg_2a07Z6ThZBcUuJZ72Up08gpk8Wf0ODY,259
src/rules/windows__image_load__image_load_side_load_chrome_frame_helper.lucene,sha256=G2Dc2nFjPqYFg6loiclxsD94y0S2GVKUDfGOexVLIYs,244
src/rules/windows__image_load__image_load_side_load_chrome_frame_helper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_classicexplorer32.eql,sha256=xefn4DDxVQAgTyHJd9OOOyY0ZoQ2-K3l_Ty2ozU4UOk,104
src/rules/windows__image_load__image_load_side_load_classicexplorer32.lucene,sha256=bO9BdX8lgblaAlMenAH4RTUVE0YZiskxXUirTm1ePes,93
src/rules/windows__image_load__image_load_side_load_classicexplorer32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_comctl32.eql,sha256=3Qi8cb51xODI4nEgjrdETFuWDpLLCGfZMAQrlJ9l3v4,292
src/rules/windows__image_load__image_load_side_load_comctl32.lucene,sha256=aQkIdE1FGOo_niZmJH3NbXkn295jQ5seYr4LtSF_tkc,277
src/rules/windows__image_load__image_load_side_load_comctl32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_coregen.eql,sha256=bW4v77IrV68S9inyJM_EjNs6ynWrI2UCTpo22s3p2EY,227
src/rules/windows__image_load__image_load_side_load_coregen.lucene,sha256=ePaN8TxxnngNR201nKR_0IXFIDOQH4ITj6ZJQQ-7_7E,218
src/rules/windows__image_load__image_load_side_load_coregen.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_cpl_from_non_system_location.eql,sha256=UEQKuk2OLaLnOx94yBcRRVEpe3j4DTv4bNke08w1RoA,171
src/rules/windows__image_load__image_load_side_load_cpl_from_non_system_location.lucene,sha256=f_1Twk2zHG5u7xkSEwJeRLOk-maxq8W_39mv_ldEyP4,148
src/rules/windows__image_load__image_load_side_load_cpl_from_non_system_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_dbgcore.eql,sha256=wqmlvZA8GlveGCw_LcFlX3dK6xXh1zKcKHLa9JpkC6c,438
src/rules/windows__image_load__image_load_side_load_dbgcore.lucene,sha256=f3f3u-PBHVYgnlipIwdI92nT_d7Plvuo3Uo2bzBa4Ow,426
src/rules/windows__image_load__image_load_side_load_dbgcore.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_dbghelp.eql,sha256=0su8kk8bPH0_GULXLASa1XNgZZQB2wf46uqqYu4NdmE,715
src/rules/windows__image_load__image_load_side_load_dbghelp.lucene,sha256=MgT-NIrePCzEKpUj2mDvnR7mWuU3bPr8W-smqgEZjzY,693
src/rules/windows__image_load__image_load_side_load_dbghelp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_dbgmodel.eql,sha256=pQvxfNrljZIX5qXwwQMayIZALmvcz8tXhc9tTWA56dM,323
src/rules/windows__image_load__image_load_side_load_dbgmodel.lucene,sha256=lNmcwF-qpRwt_-y3NQyjfQberinTIZ4GouXGFcC5D-4,307
src/rules/windows__image_load__image_load_side_load_dbgmodel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_eacore.eql,sha256=us1TseHZBxZL7Upc8xx-MyNm6mhcahWROdlfq7KBqVY,232
src/rules/windows__image_load__image_load_side_load_eacore.lucene,sha256=BsG88x8qj4hhCAcma6xvGcw9x1qVWNlaYIGusnvxqQA,222
src/rules/windows__image_load__image_load_side_load_eacore.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_edputil.eql,sha256=islBE_WGMZjmD3BjgVx5Th10pUDYtVbH7wVbpA-R88w,144
src/rules/windows__image_load__image_load_side_load_edputil.lucene,sha256=tZ3ZuW1TsN2vEye83XrDTorTtXMbZBtTJerqoaJNqpE,126
src/rules/windows__image_load__image_load_side_load_edputil.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_from_non_system_location.eql,sha256=nbkTIyjH1azljLPPsn_J7cWKwuBl0xt2l8UZx4T4Ew8,10090
src/rules/windows__image_load__image_load_side_load_from_non_system_location.lucene,sha256=hk8B6AyiTkvy1Zw_t1W99gbLtq7JcpH9HQZDUTIW9lU,10035
src/rules/windows__image_load__image_load_side_load_from_non_system_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_goopdate.eql,sha256=pMoo1Sm5KYl1-IoPRZM5nQhjeVcGnsjjEo_D8ZVZmw8,549
src/rules/windows__image_load__image_load_side_load_goopdate.lucene,sha256=mzZUMBoBuciS9A8XMddkLbmesIk0TFMIPUXOS25grgQ,512
src/rules/windows__image_load__image_load_side_load_goopdate.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_gup_libcurl.eql,sha256=c81iCCmmUph5yhFU9fnlRhNYkYfSLRyAIw6CeR4jEVY,137
src/rules/windows__image_load__image_load_side_load_gup_libcurl.lucene,sha256=VMa03iFrVtE6w3_bF7KLLRh4tZPZIJTpHY4IP-p6wyM,123
src/rules/windows__image_load__image_load_side_load_gup_libcurl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_iviewers.eql,sha256=XyVPYyA6NnRa3DzFpI6m1jQL901TSPXajIjohEghhxE,147
src/rules/windows__image_load__image_load_side_load_iviewers.lucene,sha256=SYj3D7aXIAixMktNSZK0EvdDwKxzZ_HwUkq3fojcPDo,136
src/rules/windows__image_load__image_load_side_load_iviewers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_jli.eql,sha256=6fnfQ4Qg8KaZ3BNM5-Ib7xscFi3ydTGnxUtUHrN34dg,330
src/rules/windows__image_load__image_load_side_load_jli.lucene,sha256=3eYevUAwBlkgr5fWGPBYl3qTbQJjc-9Mhj6WzETZAVQ,311
src/rules/windows__image_load__image_load_side_load_jli.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_jsschhlp.eql,sha256=OCUoS3ozdian9AriCD-EiViGcb_zwQiiQrvtwZIJ2dg,114
src/rules/windows__image_load__image_load_side_load_jsschhlp.lucene,sha256=IUdQmxyG34tCXiz9tBRDSsGITuFBdVD9MriVASFtNTs,103
src/rules/windows__image_load__image_load_side_load_jsschhlp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_keyscrambler.eql,sha256=EZKpwFmFW0wAmw3-AZ1er3p3Tn9P7grwiIYJFf29u5M,457
src/rules/windows__image_load__image_load_side_load_keyscrambler.lucene,sha256=lLZl41ip0IP9LeZ5NEVmvLIQPmRoRmWU-U3PqP4mwzs,433
src/rules/windows__image_load__image_load_side_load_keyscrambler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_libvlc.eql,sha256=wHVj06ta7FjcVAgjSTpCYbtQyixtzVFZjyMinfQNWjs,147
src/rules/windows__image_load__image_load_side_load_libvlc.lucene,sha256=KUFX7-laKJMxLJthpbjqRP3eyORkGj4mrft3KMmr3L0,134
src/rules/windows__image_load__image_load_side_load_libvlc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_mfdetours.eql,sha256=vYdjtAOjzjQ3TvUiStpdZ7Q2qt5zfbGQfutzbQ9d8ok,110
src/rules/windows__image_load__image_load_side_load_mfdetours.lucene,sha256=Q6rWZm7slj9d7XIl66HBSEZA4txRntfVMONcKO3iNzw,102
src/rules/windows__image_load__image_load_side_load_mfdetours.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_mfdetours_unsigned.eql,sha256=0EvoadM8OXGq3EQQE-tRF2CfN1wk8FjKzPp7uXDv0MI,151
src/rules/windows__image_load__image_load_side_load_mfdetours_unsigned.lucene,sha256=HYC0G-5iTARdo4wNfg6TJx17SYSOm2D0UeGwiPNOFow,141
src/rules/windows__image_load__image_load_side_load_mfdetours_unsigned.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_mpsvc.eql,sha256=DOnlm260PWEWvwXFv9KR3RCxPG04aplsjAvNtUPH1bA,190
src/rules/windows__image_load__image_load_side_load_mpsvc.lucene,sha256=xSUkzEj4OBM-lANzKstVvTjm-syldYP1HmX7gn5xdoA,176
src/rules/windows__image_load__image_load_side_load_mpsvc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_mscorsvc.eql,sha256=ZeIwekxwme3hAVJlsRIIYMHLv3PeJ86jJZJepgLoRb0,274
src/rules/windows__image_load__image_load_side_load_mscorsvc.lucene,sha256=Xy16vdLEobBDc2UZk3hQOYH-MMtlVi7IjMea_kwVN-M,259
src/rules/windows__image_load__image_load_side_load_mscorsvc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_non_existent_dlls.eql,sha256=NLCUJdUWxF8tidq6ytMbPcg9s9FI8w4CPEvCNgskXMc,412
src/rules/windows__image_load__image_load_side_load_non_existent_dlls.lucene,sha256=TFyILPVPnMaRqU5gMDAecO2FlOq2W2YxzzHiwCwyTqE,395
src/rules/windows__image_load__image_load_side_load_non_existent_dlls.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_office_dlls.eql,sha256=_5XoDbzaxKZWJOWHHdAAliZd9Ki3a2KjTTgarNFN5io,282
src/rules/windows__image_load__image_load_side_load_office_dlls.lucene,sha256=9poZ6n-hJDTx0hId7oyhl8dWTVXhJGpFCzdn2TZDffg,280
src/rules/windows__image_load__image_load_side_load_office_dlls.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_python.eql,sha256=FNjLSVtah0w7Nsd8da5NZ0zPBJOPBSLMHPLMvCklm9o,682
src/rules/windows__image_load__image_load_side_load_python.lucene,sha256=tPJ7jA0G6BLiFeb4yBpTPBHDdgiTtgslEtKfVQaycw4,645
src/rules/windows__image_load__image_load_side_load_python.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_rcdll.eql,sha256=wdJX81_97tWXe1XXHnsLRf9hYaifFmu-PzNTL5rC11I,161
src/rules/windows__image_load__image_load_side_load_rcdll.lucene,sha256=h5dcyxwuV84_mT7y9LUqi8vJLVbRM_t45lkJEBIpwoA,154
src/rules/windows__image_load__image_load_side_load_rcdll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_rjvplatform_default_location.eql,sha256=0I9Zn8O5T_e07pdJYrfyRSttShgvJZlv8vnMe8aNF1M,164
src/rules/windows__image_load__image_load_side_load_rjvplatform_default_location.lucene,sha256=g_ogpIPTglh8dNBYvqO1-n1jpjyFyYAI_XEsqtqiCwU,152
src/rules/windows__image_load__image_load_side_load_rjvplatform_default_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_rjvplatform_non_default_location.eql,sha256=jFim7EYRio1rhBWwFd56dyNxU67QU_-Cyh-CbxncwqU,170
src/rules/windows__image_load__image_load_side_load_rjvplatform_non_default_location.lucene,sha256=dHyTiL0KzRj_u5FeGZVJ9VCrzX9-Q0YMN_3ewJH8uQA,155
src/rules/windows__image_load__image_load_side_load_rjvplatform_non_default_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_robform.eql,sha256=WOoFuEyvDK098joUpABLMYuAaCAdTAOBmuVyTfG-oZY,309
src/rules/windows__image_load__image_load_side_load_robform.lucene,sha256=oN5009nAEcWVp9pEq4yTXvHD2Pn88q-vyrB_h4k9a_E,290
src/rules/windows__image_load__image_load_side_load_robform.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_shell_chrome_api.eql,sha256=9NymrJrPSFMHLL5rP8OgfgRnjc2YKYcEsXvg0U2Z9WA,44
src/rules/windows__image_load__image_load_side_load_shell_chrome_api.lucene,sha256=EUFerXIshwuHlp3Lbt9D3-CWNRKTLLoYe8-QFgoCsXU,32
src/rules/windows__image_load__image_load_side_load_shell_chrome_api.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_shelldispatch.eql,sha256=zIilBqDk5xjpF6JkmkvSv6Nm4nEzi-TDtEwCwFvt8i8,158
src/rules/windows__image_load__image_load_side_load_shelldispatch.lucene,sha256=NgH5wFx023fXxGM4dJbcfx1Veq2Rj31PFbwAoa_R7xI,142
src/rules/windows__image_load__image_load_side_load_shelldispatch.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_smadhook.eql,sha256=cv7JrOMTm6JoPS26jSdydo6JY781aw7hQ4kv9yoGy-g,416
src/rules/windows__image_load__image_load_side_load_smadhook.lucene,sha256=EWYGNZBktIwUum94-q64pnV7QuWNTnu0IQLZxSlmJOc,403
src/rules/windows__image_load__image_load_side_load_smadhook.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_solidpdfcreator.eql,sha256=9y8OcHW_yH6PZHPkE-jUY29anQodnJxtMmgAeHjvNqU,242
src/rules/windows__image_load__image_load_side_load_solidpdfcreator.lucene,sha256=xcflXI1hIr-247rglo82wLXmAQBEVaxgLB-YGv3onA8,227
src/rules/windows__image_load__image_load_side_load_solidpdfcreator.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_third_party.eql,sha256=QIstvNAlvYqAzkWhK-mqPsO7pfSTo1RMpEjb0i4e5Vo,433
src/rules/windows__image_load__image_load_side_load_third_party.lucene,sha256=VC465zpyFGpGIRTUt107_W93DN9SfN9gEembXGy9qVc,421
src/rules/windows__image_load__image_load_side_load_third_party.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_ualapi.eql,sha256=Bv1unzasOGLcYyFpPFh6uPqxyCzI9hYrRnp2J8qvuW0,119
src/rules/windows__image_load__image_load_side_load_ualapi.lucene,sha256=OFCyHfKosUjfBnfBW9vhwtg51kHScZLPV6Kk5L53FEE,104
src/rules/windows__image_load__image_load_side_load_ualapi.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vivaldi_elf.eql,sha256=blTI7kVIbBXFvA5i3YZZJnmieev8g-MAMBVIp2Vc9A8,153
src/rules/windows__image_load__image_load_side_load_vivaldi_elf.lucene,sha256=MMXh08t58ZIm4dvDqD56ZZmZCoS0aaPsE3S7SfjMDn8,137
src/rules/windows__image_load__image_load_side_load_vivaldi_elf.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vmguestlib.eql,sha256=iKVvyYf9wJCgry6ppjHkftrlRegTM88UtF1nbFJeihQ,220
src/rules/windows__image_load__image_load_side_load_vmguestlib.lucene,sha256=ZGtP4pGjtdJAS-Y_ar_KyfLojENKAMQDSVoC99qxXnA,203
src/rules/windows__image_load__image_load_side_load_vmguestlib.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_signed.eql,sha256=o7pc405UHGFEQhg-a2yzAty0emER9kV3Qbzoez7LxjI,155
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_signed.lucene,sha256=mM73mF3npTGt2rsDaoYTEDiGMbDam0A0sVVviJz4dEI,134
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_signed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_unsigned.eql,sha256=LHru0L6p_DPB5-5pLpPWbtPeZtInB6p3s1Sqnfr4kMY,163
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_unsigned.lucene,sha256=Kkxqicc7XlO57vXRcE3gr4TJZZsmO9BqKQGnwQhIBv8,142
src/rules/windows__image_load__image_load_side_load_vmmap_dbghelp_unsigned.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_vmware_xfer.eql,sha256=wGjw09M4SbSX78VcL7ItAux9XjwmdndgxLjeP1s9ULU,137
src/rules/windows__image_load__image_load_side_load_vmware_xfer.lucene,sha256=Wz6ddP1kPuo0pdF5MaHWUKxvoHUkZIfu9F8zIQ5oX2I,124
src/rules/windows__image_load__image_load_side_load_vmware_xfer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_waveedit.eql,sha256=YdqfRBjE3PbUDy_Rhuw0LTlrMwKQaOhe2s7pSv0NOtQ,365
src/rules/windows__image_load__image_load_side_load_waveedit.lucene,sha256=Tr59uf0wgR7Dy9gtHRbzHRKl5hkDYTBKBVeO65DazFs,359
src/rules/windows__image_load__image_load_side_load_waveedit.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_wazuh.eql,sha256=o34Wd4V6dCMiw9vt_ZqFTGU5Rngpm8Yd6iT1gt5qcjk,288
src/rules/windows__image_load__image_load_side_load_wazuh.lucene,sha256=vGx3qKECSs0L656pPhgivfGADJRX2nA1ZpKB4jGIuIg,261
src/rules/windows__image_load__image_load_side_load_wazuh.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_windows_defender.eql,sha256=AoG2QF_buk2ABY7tIOu8nlJ21b-lRiNvrYwUGKyFeN0,369
src/rules/windows__image_load__image_load_side_load_windows_defender.lucene,sha256=V9Ara7SESdRPwAyHe7sYxFEllzrs7ww-2MeLd4D7Uss,357
src/rules/windows__image_load__image_load_side_load_windows_defender.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_side_load_wwlib.eql,sha256=Zts_NmyqoeejEzCd7isRGGW9oT98DE6jVzO9O2TOGgc,314
src/rules/windows__image_load__image_load_side_load_wwlib.lucene,sha256=7zq1r7aPRulehiepVSXm9dYsXYHWV_P5ewkGu42RMkY,302
src/rules/windows__image_load__image_load_side_load_wwlib.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_baaupdate_dll_load.eql,sha256=yMTBuTzqkR4haHAycdXIVq5Pn-a-7gJXFKD3I4TNcxU,395
src/rules/windows__image_load__image_load_susp_baaupdate_dll_load.lucene,sha256=WuLmiJOJXe6GTC9bmFZLQp3E2M_G5EnpICmN3Z6XEAo,378
src/rules/windows__image_load__image_load_susp_baaupdate_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_clickonce_unsigned_module_loaded.eql,sha256=MqhEpQT5ddGB-yHJWzNd1j-E5AuWwLDDRWqOK3z47-E,143
src/rules/windows__image_load__image_load_susp_clickonce_unsigned_module_loaded.lucene,sha256=xxzy5nOZaOenZRDqPG9BpKuUZ1g9CBsqyI1LOM5vitc,127
src/rules/windows__image_load__image_load_susp_clickonce_unsigned_module_loaded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_dll_load_system_process.eql,sha256=hDRd5hPOv7mVdeNXqoVj6U8o7sDfLCzqElSWPcA6bCY,109
src/rules/windows__image_load__image_load_susp_dll_load_system_process.lucene,sha256=b7Wq0eajEshMlTHxJEDy9CpFJ7Ck-GNkGcmFAp4r2T4,92
src/rules/windows__image_load__image_load_susp_dll_load_system_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_python_image_load.eql,sha256=rdu-FQb_acKy7AlM1Kz16YgkgE63G_Z2XpevNvb4yh8,281
src/rules/windows__image_load__image_load_susp_python_image_load.lucene,sha256=I5Wlzq6GKwtQ0TCstgaI3WP0hXTxEXCERB6mAQkFW60,271
src/rules/windows__image_load__image_load_susp_python_image_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_script_dotnet_clr_dll_load.eql,sha256=PM1h3vI1YRAW2uUuanqvkvcRnSZZHlTe1FddA_U4mgk,230
src/rules/windows__image_load__image_load_susp_script_dotnet_clr_dll_load.lucene,sha256=dd-FSxNfBMCp_XGtGEMoYTJph_Qi13sycCwO9Uz9N7w,204
src/rules/windows__image_load__image_load_susp_script_dotnet_clr_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_susp_unsigned_dll.eql,sha256=px5BoACj0NEPxIzU-jvBzrSWKyGDkgV0WGsUz0iwajo,1299
src/rules/windows__image_load__image_load_susp_unsigned_dll.lucene,sha256=7gLg-9Vnz-5AWg97_3MClDIY_DRNGH6mfDKRX2nnlRc,1243
src/rules/windows__image_load__image_load_susp_unsigned_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_thor_unsigned_execution.eql,sha256=e-hFS3lx20CnAVgL8o8fw6kLy1Sa1tWVl0qfuUqHJHA,267
src/rules/windows__image_load__image_load_thor_unsigned_execution.lucene,sha256=9cETDVavWfYAawv4F13buHOzEZAaDiATQdgiDsqs3Uc,237
src/rules/windows__image_load__image_load_thor_unsigned_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_uac_bypass_iscsicpl.eql,sha256=3aLVi8tuaZXMVTVb5fxOaDxpvG3hS5glFEzl-dPjwB4,171
src/rules/windows__image_load__image_load_uac_bypass_iscsicpl.lucene,sha256=asvvcZoh6_dDaby7NfUjjXqyxEG-W4TeI_9e1D2fr4Y,155
src/rules/windows__image_load__image_load_uac_bypass_iscsicpl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_uac_bypass_via_dism.eql,sha256=g4KVauuMh3flV7ExsxbIYJA46F1Ti_oW54q-vSCZxiE,141
src/rules/windows__image_load__image_load_uac_bypass_via_dism.lucene,sha256=QrM06su6OgXV_tT5f2fXSJ7K6cKiGz1ogFuGHW6drYs,126
src/rules/windows__image_load__image_load_uac_bypass_via_dism.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_win_mmc_loads_script_engine_dll.eql,sha256=C7ed5MfYw9UeFz4N5p-_E8Fomr5lqDfvAhN4iYdmrU4,121
src/rules/windows__image_load__image_load_win_mmc_loads_script_engine_dll.lucene,sha256=R8XkMlT2Ff1uopr5WV-WxYwJq7dKBiSm2alz6C4F9d0,101
src/rules/windows__image_load__image_load_win_mmc_loads_script_engine_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_win_susp_dbgcore_dbghelp_load.eql,sha256=c7CpasgAlcXjrqHIUvnEZ630GI-unYSXuvJgHexbNSk,411
src/rules/windows__image_load__image_load_win_susp_dbgcore_dbghelp_load.lucene,sha256=K-yJfdL-5r9erTYCbBAf-xEzNtsUG7zfy6yedy0tf6U,389
src/rules/windows__image_load__image_load_win_susp_dbgcore_dbghelp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_win_trusted_path_bypass.eql,sha256=gkJ4ZWOn4Br71p_YMCeS2E9p-83qswj5QzHdxUwOKRg,83
src/rules/windows__image_load__image_load_win_trusted_path_bypass.lucene,sha256=7j1kT91MvqrqtFzYLLFeGpzmf_EsR6chN9grP00KohE,69
src/rules/windows__image_load__image_load_win_trusted_path_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_win_werfaultsecure_dbgcore_dbghelp_load.eql,sha256=fXN3OFdbhL4CF1qmbvh_poiMyiZJbSh0qZNyGSdRRzI,112
src/rules/windows__image_load__image_load_win_werfaultsecure_dbgcore_dbghelp_load.lucene,sha256=iQ7yUqvXXtGpi2fqnx75WkFPr6xfXVBYa6rmCxbsv_4,92
src/rules/windows__image_load__image_load_win_werfaultsecure_dbgcore_dbghelp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_wmi_persistence_commandline_event_consumer.eql,sha256=00iZNpclsLeutaiVIsfrJy8wxt1nv49Tig3raacULVE,105
src/rules/windows__image_load__image_load_wmi_persistence_commandline_event_consumer.lucene,sha256=o2qfiO9yi1NlopD3VnjeQXnXTkGzE6FpleNJMAUCge4,92
src/rules/windows__image_load__image_load_wmi_persistence_commandline_event_consumer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_wmic_remote_xsl_scripting_dlls.eql,sha256=kIzzydOBFRKeYYGH3Uaxk0jlkLl6ystPHkLfyVpcNxc,103
src/rules/windows__image_load__image_load_wmic_remote_xsl_scripting_dlls.lucene,sha256=p2Gox-pkHmcCcrUPE-C_p1FFcCeQhS8_SSOve6nx0QA,83
src/rules/windows__image_load__image_load_wmic_remote_xsl_scripting_dlls.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_wmiprvse_wbemcomn_dll_hijack.eql,sha256=s0sAFerL-dphBc6DW4M-1OY0LtGL12hXf9iLS9hm0oI,85
src/rules/windows__image_load__image_load_wmiprvse_wbemcomn_dll_hijack.lucene,sha256=w7fAzbGHsjZIj81YJpN_lJuPgFSOK6BwgypjNzuqmzU,71
src/rules/windows__image_load__image_load_wmiprvse_wbemcomn_dll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__image_load__image_load_wsman_provider_image_load.eql,sha256=IwQQCDui5tYiEJB1btDFD6A8eq5kpc1eBde_RK3ppcI,1695
src/rules/windows__image_load__image_load_wsman_provider_image_load.lucene,sha256=XtbWRNSjv18f3V0z7gvwurvP0UvoVJH8Kz5cus-Q18A,1680
src/rules/windows__image_load__image_load_wsman_provider_image_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_addinutil_initiated.eql,sha256=ZLGk8-sLuVJDsrgtd4JZ41FOmnxwuFZfuvG7ZHscouA,77
src/rules/windows__network_connection__net_connection_win_addinutil_initiated.lucene,sha256=5HMMwJehcB2KX4u6sW4qz5-7KE5NvYV4ujLuSG_YwlU,63
src/rules/windows__network_connection__net_connection_win_addinutil_initiated.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_adws_unusual_connection.eql,sha256=wO_3NTTC2_MHwW4NEi5VQ4oi2Bhly3cSblWoq5D61LE,426
src/rules/windows__network_connection__net_connection_win_adws_unusual_connection.lucene,sha256=xu1ONnJ9jpHwneAoRf0cRgYIrQMksLvDLzmSQNpQ95Q,414
src/rules/windows__network_connection__net_connection_win_adws_unusual_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_certutil_initiated_connection.eql,sha256=3xhEyyOa1Tj03GSd7lJ1z7x49BQMsL5Tv09rX48ue-4,125
src/rules/windows__network_connection__net_connection_win_certutil_initiated_connection.lucene,sha256=xrtoCd-ch6Te9CWY6NtozZ1IzlfU2wppuF5p409lWzM,111
src/rules/windows__network_connection__net_connection_win_certutil_initiated_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_cmstp_initiated_connection.eql,sha256=cKdNlUR5V2CA2IeINLo5Z9oxMgPqCbPTPcQQmXEeONg,434
src/rules/windows__network_connection__net_connection_win_cmstp_initiated_connection.lucene,sha256=LemuuY4q1WIY3rJhulY1rj8TOxtbadnaCXSxp5lrWyY,322
src/rules/windows__network_connection__net_connection_win_cmstp_initiated_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_dialer_initiated_connection.eql,sha256=fTfJ1Q_SbT9xjf9Cnkz6NaIcUiDYPSK98_Unl88G7tw,455
src/rules/windows__network_connection__net_connection_win_dialer_initiated_connection.lucene,sha256=bIfBYNW8gjP_tNcd5S4tsDDMuw_BBMtrprDyTqd249s,344
src/rules/windows__network_connection__net_connection_win_dialer_initiated_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_azurewebsites.eql,sha256=Te1JleVKLDNqJaZ7wL-vFMFKnIc-rPSifpy_iY6femE,3662
src/rules/windows__network_connection__net_connection_win_domain_azurewebsites.lucene,sha256=Q59_DAdqjUcL55R6_e20VaPt6dHhW8pttNLImYTJVoA,3591
src/rules/windows__network_connection__net_connection_win_domain_azurewebsites.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_btunnels.eql,sha256=ytm06Uder_2r6yW4r3FjLwHzuWapJsFCvdU3QPUJdvU,76
src/rules/windows__network_connection__net_connection_win_domain_btunnels.lucene,sha256=wVunRqE5XCwjRe7bQmiZMss_K1gJjCdLTQlT7bcySsw,62
src/rules/windows__network_connection__net_connection_win_domain_btunnels.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_cloudflared_communication.eql,sha256=YPrRxLL77g3iWleSaIZVyus3ppJ3E7HbbOTYef6Of_Q,169
src/rules/windows__network_connection__net_connection_win_domain_cloudflared_communication.lucene,sha256=6jXMxvM6oPdUKs4NWtODzAiuTAdS0SCuQV4eaXXvTHw,150
src/rules/windows__network_connection__net_connection_win_domain_cloudflared_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_crypto_mining_pools.eql,sha256=4qZbFr4soKiworyik-NLCq3_lYdiCVpnyMA5sVlrKHw,4891
src/rules/windows__network_connection__net_connection_win_domain_crypto_mining_pools.lucene,sha256=XVECG76LO7_puf0CZVe1YNFs5yOVxOph9gXpxcUyHc0,4932
src/rules/windows__network_connection__net_connection_win_domain_crypto_mining_pools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_dead_drop_resolvers.eql,sha256=S5IAM6M3pph2MkqfPt_QqF8519eOSjGGDhXdYJYPqTE,5853
src/rules/windows__network_connection__net_connection_win_domain_dead_drop_resolvers.lucene,sha256=PhU6VKzUa_mYeL3Jg1ncvRAGtAq-AR2wlAgrknyRigc,5724
src/rules/windows__network_connection__net_connection_win_domain_dead_drop_resolvers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_devtunnels.eql,sha256=1r4Hlpk26jWFn4GOgFdFIXJawOT2vfoTVvr6JiU6v6k,76
src/rules/windows__network_connection__net_connection_win_domain_devtunnels.lucene,sha256=BWn1p6wnfBzGmZa3mkmsAeGEvqlvQTymFPcoSaUH408,62
src/rules/windows__network_connection__net_connection_win_domain_devtunnels.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_dropbox_api.eql,sha256=b3fHOspxqGBibI-y0J9LCjZYNRk0_J0EadZrgRFWKCs,162
src/rules/windows__network_connection__net_connection_win_domain_dropbox_api.lucene,sha256=n4VpsUS6oMHyS8qg6YgR28B80qFZcAWJK0qeNKUdZtM,140
src/rules/windows__network_connection__net_connection_win_domain_dropbox_api.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_external_ip_lookup.eql,sha256=Ox1rRkQNo7zotiP1amL3AqGGFP1Xi85_FV5f8jzETzE,2106
src/rules/windows__network_connection__net_connection_win_domain_external_ip_lookup.lucene,sha256=doJU6g5sgYeazUha-urbrHAMqNklgi2Ve9c57U_5itg,2062
src/rules/windows__network_connection__net_connection_win_domain_external_ip_lookup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_google_api_non_browser_access.eql,sha256=9gX5S3AoFzOEr7cCLg7eHMvwRWNlOQM8-qTMapezO8g,1650
src/rules/windows__network_connection__net_connection_win_domain_google_api_non_browser_access.lucene,sha256=pKlQQa8sEMTwTaU-N8zH_NEXas0hTJfsAtkKhoh01w4,1607
src/rules/windows__network_connection__net_connection_win_domain_google_api_non_browser_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_localtonet_tunnel.eql,sha256=4ZSjAdrIY9DMAMFaIpAXccXkDUs7LRxOqGEC0nHMrzs,104
src/rules/windows__network_connection__net_connection_win_domain_localtonet_tunnel.lucene,sha256=5FUvfZ5u--AZXzM9zhMdwprygwX1nEZberfGELi3zAM,84
src/rules/windows__network_connection__net_connection_win_domain_localtonet_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_mega_nz.eql,sha256=KkR4PD2NOP8-XiOqGnR2FRlfNtcEhgf7l4_Ei_FY6sQ,94
src/rules/windows__network_connection__net_connection_win_domain_mega_nz.lucene,sha256=TkaYRgiJ3XWykLtt_lAKzsOVflfEliHQ4nWPijjxMRY,74
src/rules/windows__network_connection__net_connection_win_domain_mega_nz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_ngrok.eql,sha256=OnF4lj4MTS9MoghyqKJdc-ZEB8SDuOxss5yCUGxwsr0,151
src/rules/windows__network_connection__net_connection_win_domain_ngrok.lucene,sha256=B1PuJFnhMdiOorbs9JuWjkOVA2kBne32v2NGcc7vRf0,133
src/rules/windows__network_connection__net_connection_win_domain_ngrok.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_ngrok_tunnel.eql,sha256=m71U14mNRJpIV-q1VsRHB7Wvfrij1pJgPioQfojcbzI,211
src/rules/windows__network_connection__net_connection_win_domain_ngrok_tunnel.lucene,sha256=3v4XR9UnT-9-B8nXnKGIcyv4VgnUngIapJapObdcDNU,193
src/rules/windows__network_connection__net_connection_win_domain_ngrok_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_notion_api_susp_communication.eql,sha256=S24IR78ygDV8ENBjBPTPGfxJfxfXA85Rpiz9d7sn5JI,1353
src/rules/windows__network_connection__net_connection_win_domain_notion_api_susp_communication.lucene,sha256=6oWqL1DH8rZ1MSZUvZJlXB2zUxL2yLUaH9E1X10Rw7s,1317
src/rules/windows__network_connection__net_connection_win_domain_notion_api_susp_communication.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_portmap.eql,sha256=SIjlaITh5uj31QYe9xn22t68fsbtmic1FAAcR3wfvwE,73
src/rules/windows__network_connection__net_connection_win_domain_portmap.lucene,sha256=KMe86MXkArLEgbSJaWv3XvvphPYU6U24PDuyhf4SVpE,59
src/rules/windows__network_connection__net_connection_win_domain_portmap.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_telegram_api_non_browser_access.eql,sha256=O2vpKbjLRTAWpBTXBVDfVNv3B8gA6Y92sAk69mETVs8,1283
src/rules/windows__network_connection__net_connection_win_domain_telegram_api_non_browser_access.lucene,sha256=wViNEMTVYytNouRv1vlx4merW5CPV6_iyI9K8eSlzJA,1249
src/rules/windows__network_connection__net_connection_win_domain_telegram_api_non_browser_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_domain_vscode_tunnel_connection.eql,sha256=dC16Yud-Qmkp7g0NmAdI8aED_pDfRcflsBfsiT3M8tY,91
src/rules/windows__network_connection__net_connection_win_domain_vscode_tunnel_connection.lucene,sha256=dB62Dqm5hrMUfk7zkcpijRb0pAjSylLJa4vyO-l8xfc,77
src/rules/windows__network_connection__net_connection_win_domain_vscode_tunnel_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_eqnedt.eql,sha256=MiewbYzmjPTfMw924UzXFc91edKF0PAPZ8GkxqFe1ts,47
src/rules/windows__network_connection__net_connection_win_eqnedt.lucene,sha256=iObZisq0IAvy9hwQDBz9REUp9YCBEclHnXjvtnYeoP4,35
src/rules/windows__network_connection__net_connection_win_eqnedt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_finger.eql,sha256=Qmhcp0GlFxh5rE8tFB2BMyk8SI4usl8jG6xQlOaSc3w,74
src/rules/windows__network_connection__net_connection_win_finger.lucene,sha256=SpwpIPv-HxHbqR3CU98w5rE3Oh2iGb4ZF7DRw3ezZmk,60
src/rules/windows__network_connection__net_connection_win_finger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_imewdbld.eql,sha256=4Z2edzYgH9x7jMcWcNk7fwx1I6gjLoiB7vsY4-uMsoM,76
src/rules/windows__network_connection__net_connection_win_imewdbld.lucene,sha256=0CdW3kakSxSY8_j9iMa7cJetqZE8zzqkCsaXHpuyjBA,62
src/rules/windows__network_connection__net_connection_win_imewdbld.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_notepad.eql,sha256=II2t05RrJ5WL8nRTnIx0yZrowXb-qoK9sqHNzDg6PjE,78
src/rules/windows__network_connection__net_connection_win_notepad.lucene,sha256=ZGgozmojY-FAEd3nWJiluUp5tMP_rhAYwoDdiiM7Hgw,66
src/rules/windows__network_connection__net_connection_win_notepad.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_office_outbound_non_local_ip.eql,sha256=kYiLyeiuoIkGzULCC8PR6hXUirZS4h6_llZeVfg7kSA,8596
src/rules/windows__network_connection__net_connection_win_office_outbound_non_local_ip.lucene,sha256=YziCSzvh1lCd0-8XqQTc1-UuGAcvTRb6RWZ5obeoyeg,6732
src/rules/windows__network_connection__net_connection_win_office_outbound_non_local_ip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_office_uncommon_ports.eql,sha256=8vW5fCYVghkZhj6eO_Z7rra2Ym9AgzIDgamLl18TwzY,390
src/rules/windows__network_connection__net_connection_win_office_uncommon_ports.lucene,sha256=kOl-Q9-YJc1w9YsZNjgddsYO2uqzL_x5anUUPLYi32k,377
src/rules/windows__network_connection__net_connection_win_office_uncommon_ports.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_python.eql,sha256=sldwxgTxmwiDsO2RGqWixNMHc0s5vEdAl_mOtQdLu0o,669
src/rules/windows__network_connection__net_connection_win_python.lucene,sha256=nL7PCkJybSnbEHFLfduiFtYayr8lLpUrG1ea2gvu0U0,640
src/rules/windows__network_connection__net_connection_win_python.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_rdp_outbound_over_non_standard_tools.eql,sha256=Pq4YdY68enD_vNJs2M4790rmxHT0MTJE1lExfKxWp7E,1448
src/rules/windows__network_connection__net_connection_win_rdp_outbound_over_non_standard_tools.lucene,sha256=jP3qDTnMQts4uRyC18oyVKsgB2g0-m9lUSUc040c4-s,1404
src/rules/windows__network_connection__net_connection_win_rdp_outbound_over_non_standard_tools.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_rdp_reverse_tunnel.eql,sha256=yxGgY1tgbmdEYRAYibjdwMDPGGDFtCZ48iWlzvqWH_o,185
src/rules/windows__network_connection__net_connection_win_rdp_reverse_tunnel.lucene,sha256=TcXDEiXO8ZjsyC6pedZQH0yOeBtpnLI865aSc8hBK_Y,147
src/rules/windows__network_connection__net_connection_win_rdp_reverse_tunnel.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_rdp_to_http.eql,sha256=2_8KNCwEcAWcv_Nt8ipSgwxR2ivVQtFP2iwL9triewI,135
src/rules/windows__network_connection__net_connection_win_rdp_to_http.lucene,sha256=_bKStts1hHP7cG3YqNTC9EDgtNx6MCu-fpHL902znFY,117
src/rules/windows__network_connection__net_connection_win_rdp_to_http.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_regasm_network_activity.eql,sha256=j7dBHZULc66Y9uHsU8oOM_t6x2EwZuHt-jpOS1Rz2c8,435
src/rules/windows__network_connection__net_connection_win_regasm_network_activity.lucene,sha256=euN8n2MDo9pvMAMs-8et2wRKLsKbg_2asxPzSIbxfxg,323
src/rules/windows__network_connection__net_connection_win_regasm_network_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_regsvr32_network_activity.eql,sha256=Z8t4SGrI4FdbrWcKC7BY1LALzONFcIEtjG8CJPiJUBE,76
src/rules/windows__network_connection__net_connection_win_regsvr32_network_activity.lucene,sha256=ixBMSv-rAnZRw5GVZPmmcJoWYEvJszHTRiU4e8ogyhE,62
src/rules/windows__network_connection__net_connection_win_regsvr32_network_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_remote_access_tools_anydesk_incoming_connection.eql,sha256=8jNxCggMjDikq8Sw_CoQFcxvtuwQS6a4Hn2Pf1EUx8w,107
src/rules/windows__network_connection__net_connection_win_remote_access_tools_anydesk_incoming_connection.lucene,sha256=9u667h0qFST_2nxO3uTpLNeZWzllQrYWVXMMFVLJ9ZA,87
src/rules/windows__network_connection__net_connection_win_remote_access_tools_anydesk_incoming_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_rundll32_net_connections.eql,sha256=ysgtcgwuKNpEUE-PHkC_SfZCeyHb2_v9gFMDZiG0kXY,833
src/rules/windows__network_connection__net_connection_win_rundll32_net_connections.lucene,sha256=U496yxgUE7X907elnMWnNUFXdhjAfIdFUDVwsiZ2zIo,664
src/rules/windows__network_connection__net_connection_win_rundll32_net_connections.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_silenttrinity_stager_msbuild_activity.eql,sha256=0ubQOsTd2KBj8kj2Ag7rFWXMNezfWkUKzHlWSSdCpFE,116
src/rules/windows__network_connection__net_connection_win_silenttrinity_stager_msbuild_activity.lucene,sha256=sQnZTStN4msV-rDsJzNcBps3cuwapPry0GxxGCcgvo8,98
src/rules/windows__network_connection__net_connection_win_silenttrinity_stager_msbuild_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_binary_no_cmdline.eql,sha256=CKw-Yd3QzsD_xZV51zQ4LolPQNvlL1GSX-FfWqlqPtg,329
src/rules/windows__network_connection__net_connection_win_susp_binary_no_cmdline.lucene,sha256=MWGzLV5L5vBYil4C-UgE0ASJeTBLxc7IcWtPOdxRYfM,300
src/rules/windows__network_connection__net_connection_win_susp_binary_no_cmdline.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_file_sharing_domains_susp_folders.eql,sha256=Jts4Bc-ynQdouMi_UJN5fMoqewz22f_8G0j__flJCZs,981
src/rules/windows__network_connection__net_connection_win_susp_file_sharing_domains_susp_folders.lucene,sha256=MjNYvQMz0477tqhHV7cW4mi9bx2C0yJ3X-yNIkNAwqg,963
src/rules/windows__network_connection__net_connection_win_susp_file_sharing_domains_susp_folders.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_initiated_uncommon_or_suspicious_locations.eql,sha256=phS75dk5eTw4E7wZr6z_1IkwiUV0khJqzYmMKxZpDDM,1038
src/rules/windows__network_connection__net_connection_win_susp_initiated_uncommon_or_suspicious_locations.lucene,sha256=WUZIGT4qHCUZagesFDSF9xdKfXEq-Lg4A2e-LJX0Y4s,1019
src/rules/windows__network_connection__net_connection_win_susp_initiated_uncommon_or_suspicious_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_port.eql,sha256=i07Bg2zIPyM0dgQ1eWF9XeIxD3RA9H72nL_FALFg2NY,835
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_port.lucene,sha256=dMxfkKZkFVnQJa0xD9ar1__s9G-i624LiJFC7dWwjPU,820
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_port.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_ports_uncommon.eql,sha256=X9YzTFhaXLDs8bZbv0GWAF2HjONL1HT2yAIh9IH6dPo,528
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_ports_uncommon.lucene,sha256=xRqzi3Sa_QtaS7XbsX2PJnZS9_ZoDbvlip9STPJEFUI,413
src/rules/windows__network_connection__net_connection_win_susp_malware_callback_ports_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_outbound_kerberos_connection.eql,sha256=__bT7nEYCJloFKqPao02IUPo1LDtyvp92YfpA-C_EmY,486
src/rules/windows__network_connection__net_connection_win_susp_outbound_kerberos_connection.lucene,sha256=ZpLWexVPNK_F_-5i8wmgBglZh1ZjTAwCIuTTxIJUZEc,471
src/rules/windows__network_connection__net_connection_win_susp_outbound_kerberos_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_outbound_mobsync_connection.eql,sha256=_GigEjBF8rBMUNA05c0446TUuTd0gRvBcxBgxRlaB1M,405
src/rules/windows__network_connection__net_connection_win_susp_outbound_mobsync_connection.lucene,sha256=FDEaSRj3sFqWzlZm97Q8gdk-jwCGSxnL5LoXmvGS4GQ,295
src/rules/windows__network_connection__net_connection_win_susp_outbound_mobsync_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_outbound_smtp_connections.eql,sha256=a018po-O6p6BWAy-FdD14SPpONv5fWaQPC9uMLfctNE,373
src/rules/windows__network_connection__net_connection_win_susp_outbound_smtp_connections.lucene,sha256=kLyhCsOUpmTC3bQgtsXD5fycvMpsL-dWq9xrzGIP4Kw,352
src/rules/windows__network_connection__net_connection_win_susp_outbound_smtp_connections.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_susp_remote_powershell_session.eql,sha256=YEdnmiy1Q2suMOWlGO8G2pCNm6NFo2RghmVfBMbjDSM,543
src/rules/windows__network_connection__net_connection_win_susp_remote_powershell_session.lucene,sha256=9h30tjbBT8oFY4w2fAzbYtOJWkgIDssSSaIqwTX19L4,508
src/rules/windows__network_connection__net_connection_win_susp_remote_powershell_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_winlogon_net_connections.eql,sha256=xFifLouGeBgxH636cDHZ7k634okJXr4g2gU6iIc85P4,437
src/rules/windows__network_connection__net_connection_win_winlogon_net_connections.lucene,sha256=u8EwTuWAcfj_7qk2ikgV-UPdw9-M7MPB9iV3nMdR93U,325
src/rules/windows__network_connection__net_connection_win_winlogon_net_connections.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_wordpad_uncommon_ports.eql,sha256=1TqQKYYjVvGpp8SwBJcFuoUiYI4ED46mb3y1wUlAqFo,152
src/rules/windows__network_connection__net_connection_win_wordpad_uncommon_ports.lucene,sha256=EX0Npens5o138HRCL14_RQeelXeZkrmfe_ZUCmW1imQ,146
src/rules/windows__network_connection__net_connection_win_wordpad_uncommon_ports.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_wscript_cscript_local_connection.eql,sha256=v9Mb5xGVxsWhICibSwLdz_1GV_mL1XeSb6hYHMDl2AI,456
src/rules/windows__network_connection__net_connection_win_wscript_cscript_local_connection.lucene,sha256=rF5o2guTTriyXXoWa_nnWevF3lJfJFv7zP4K9wRmbNY,338
src/rules/windows__network_connection__net_connection_win_wscript_cscript_local_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_wscript_cscript_outbound_connection.eql,sha256=6J6E8Lckwrloz1txgs2IQjV3XdkAFyTer_cmP5-gNSw,510
src/rules/windows__network_connection__net_connection_win_wscript_cscript_outbound_connection.lucene,sha256=Kmd9LC7GtHDXK9_KTY0kuv4ixHjxK95t_MLTob40iBQ,379
src/rules/windows__network_connection__net_connection_win_wscript_cscript_outbound_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__network_connection__net_connection_win_wuauclt_network_connection.eql,sha256=544-y30FVY9eYaelo-0HHkjDIUa32TO4WAQHsUScYic,1204
src/rules/windows__network_connection__net_connection_win_wuauclt_network_connection.lucene,sha256=fyjMM4hzzZCTmHZ8ePqCCXPszlbQX3iPUfdzTGKAA2E,1003
src/rules/windows__network_connection__net_connection_win_wuauclt_network_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__pipe_created__pipe_created_adfs_namedpipe_connection_uncommon_tool.eql,sha256=uzwUyjukAoVLb0ZgY7i_eLdcGgjuZADXPFrDidqSTis,514
src/rules/windows__pipe_created__pipe_created_hktl_cobaltstrike.eql,sha256=bgPinGVOu1-YNmfzTAR_yKTr0KYadeIJ37va_EXVkzM,325
src/rules/windows__pipe_created__pipe_created_hktl_cobaltstrike_re.eql,sha256=s6GMf_CjnoXR57bUfEM78pk30stFE9btURKrT7M8SWU,1970
src/rules/windows__pipe_created__pipe_created_hktl_cobaltstrike_susp_pipe_patterns.eql,sha256=liyaShDyvp8URSY21FLm_QuQQwRYueCMn2q5bhAH83I,843
src/rules/windows__pipe_created__pipe_created_hktl_coercedpotato.eql,sha256=FWd3skHTZbu8pnGUx_4jIx5JpUsTWVwHuOM81kUehUE,35
src/rules/windows__pipe_created__pipe_created_hktl_diagtrack_eop.eql,sha256=vylWKSZ7l-3bKCLLCaTUUT1bQC96tB7spqojWD0VzzE,35
src/rules/windows__pipe_created__pipe_created_hktl_efspotato.eql,sha256=pSQJtYd6uCTNrplJPNVjzhHInir4bBoXVlz15-3yy3I,119
src/rules/windows__pipe_created__pipe_created_hktl_generic_cred_dump_tools_pipes.eql,sha256=8mug91m9bEWe3KNYQZEgCxiRWlWcuFch97KEFAMbXb4,81
src/rules/windows__pipe_created__pipe_created_hktl_koh_default_pipe.eql,sha256=OQtvnrFNttaGDra842jVO3gokurqVQ8g5YkPZT-J3l0,65
src/rules/windows__pipe_created__pipe_created_powershell_alternate_host_pipe.eql,sha256=zaoDMLZNbhYIydTHy8hzVjuXwlC2EST7TXw4r0tdTXU,1497
src/rules/windows__pipe_created__pipe_created_powershell_execution_pipe.eql,sha256=R__dMEwSY4Ynu_1p7yIoWvOEju1i7kQKa2R-4YMPNCQ,32
src/rules/windows__pipe_created__pipe_created_pua_csexec_default_pipe.eql,sha256=mITOSngKjBad76-FsrmSnhw7a8ZXKKsIKJtzWtRY5ig,36
src/rules/windows__pipe_created__pipe_created_pua_paexec_default_pipe.eql,sha256=3cXkl5CQaUmaMJLHLvvdqIoHq4dCJ3h8aJHYa20ky5I,32
src/rules/windows__pipe_created__pipe_created_pua_remcom_default_pipe.eql,sha256=E3nX9zWcWPZVrIRPWGPu5nqU0JNxzH9M4F2Pbx6E9IY,33
src/rules/windows__pipe_created__pipe_created_scrcons_wmi_consumer_namedpipe.eql,sha256=jcK2tmwNrgMG-rIzjiLbotsmJVuLxdA18XCKKuhDHcE,46
src/rules/windows__pipe_created__pipe_created_susp_malicious_namedpipes.eql,sha256=CAD2xKc4xqMlnFmK905HitfXdcTo8kG1q8t-9WFRdkw,551
src/rules/windows__pipe_created__pipe_created_sysinternals_psexec_default_pipe_susp_location.eql,sha256=5VwqJhgyX4F3EWSO_unpY4UIs4UwZ5TXDC0oHWFzEZc,174
src/rules/windows__powershell__powershell_classic__posh_pc_abuse_nslookup_with_dns_records.eql,sha256=E0aIxiuTQuxq4pzmAw3q8rTnvZxKYTyzK6xE_EPIOaY,223
src/rules/windows__powershell__powershell_classic__posh_pc_abuse_nslookup_with_dns_records.lucene,sha256=FG2jeBH1-xPdvc3JrdFEGWGVdXe6SZ4A_ljVKWHC9hw,210
src/rules/windows__powershell__powershell_classic__posh_pc_abuse_nslookup_with_dns_records.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_delete_volume_shadow_copies.eql,sha256=DgTwZEtKNYpBmjYtQoEn95js4MjY3ZoKXen46hxEreM,173
src/rules/windows__powershell__powershell_classic__posh_pc_delete_volume_shadow_copies.lucene,sha256=XsoBvqYyWXFApsvr-Te8YAseGStziM0n5g5vmZKz05Q,155
src/rules/windows__powershell__powershell_classic__posh_pc_delete_volume_shadow_copies.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_downgrade_attack.eql,sha256=IDi0C3X5poT6iM-yE3eMC2oevNIUDBIJQmq1-e964wE,106
src/rules/windows__powershell__powershell_classic__posh_pc_downgrade_attack.lucene,sha256=Y5h0_z8xzyo6tM3Hl9jq1UDn4KPHxPpVaZCc52toghc,94
src/rules/windows__powershell__powershell_classic__posh_pc_downgrade_attack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_exe_calling_ps.eql,sha256=bnvWAF7VCm-tNoDyam-Za_x2dvD3u1CEu9cd4k1Ek68,154
src/rules/windows__powershell__powershell_classic__posh_pc_exe_calling_ps.lucene,sha256=DFet-S-QAW35_C6u9zfNOvTMvU89hOOY27-X3nk3Sc4,138
src/rules/windows__powershell__powershell_classic__posh_pc_exe_calling_ps.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_powercat.eql,sha256=8P7PZMu1RWkyelNNmOKtV-rLMM1wsH_iIeMTFYKpt7g,73
src/rules/windows__powershell__powershell_classic__posh_pc_powercat.lucene,sha256=y2-c3NWTCMzVIYqLimx89Gtsu6bYm7KhPmffLkhyfpU,56
src/rules/windows__powershell__powershell_classic__posh_pc_powercat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_remote_powershell_session.eql,sha256=3Tm-zz2xsVbtG9db7NRpRbZuHsxkaM1sqv6auL2DgMg,110
src/rules/windows__powershell__powershell_classic__posh_pc_remote_powershell_session.lucene,sha256=_bRboJg2pdZSZjIYvr8xXwX8hJY9LamgD9ZM6rVb7E0,97
src/rules/windows__powershell__powershell_classic__posh_pc_remote_powershell_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_remotefxvgpudisablement_abuse.eql,sha256=atOx9O8emxA4gjyp097NDTwVhMGscsVYJqAQ-YMnFbA,138
src/rules/windows__powershell__powershell_classic__posh_pc_remotefxvgpudisablement_abuse.lucene,sha256=0jbzfnxWWqh5hVeSQPA_CaJMPSCXOJe1ZwEghg0aXWY,130
src/rules/windows__powershell__powershell_classic__posh_pc_remotefxvgpudisablement_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_renamed_powershell.eql,sha256=YzbCTo5jxoJR6BzZFj69mt0cqPlgEKHxwW6p7GbEEPk,743
src/rules/windows__powershell__powershell_classic__posh_pc_renamed_powershell.lucene,sha256=6KqHVBNGSBhgAALMYscEsC4N0vUNSHe7uZZLD_Tex_g,767
src/rules/windows__powershell__powershell_classic__posh_pc_renamed_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_susp_download.eql,sha256=DanKciHqMIBrmQ8WiTWivgJhMpDMEkWSO7Gh0lSKAtg,129
src/rules/windows__powershell__powershell_classic__posh_pc_susp_download.lucene,sha256=ANxtszAJAdZ4IYiPt7peguJs71QAAqCZC34ZCAhb7No,111
src/rules/windows__powershell__powershell_classic__posh_pc_susp_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_susp_get_nettcpconnection.eql,sha256=9sbAuShY1TKg6Y4fntf8d900ql2HE8A5gP0Bxm2Y0VQ,58
src/rules/windows__powershell__powershell_classic__posh_pc_susp_get_nettcpconnection.lucene,sha256=0Y1vWzvZqSEBDvVgFzUkm2rK-gCi-_iuytrhwxTr06M,47
src/rules/windows__powershell__powershell_classic__posh_pc_susp_get_nettcpconnection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_susp_zip_compress.eql,sha256=HTQVp5dn-QZgzQbdfVMn9VW0yt1DXY_az-FUF7kw6iY,269
src/rules/windows__powershell__powershell_classic__posh_pc_susp_zip_compress.lucene,sha256=WJDjju7J5Q7nApWa-5lN18Wdwyr7gb2z6g-oWtBjV2o,265
src/rules/windows__powershell__powershell_classic__posh_pc_susp_zip_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_tamper_windows_defender_set_mp.eql,sha256=N3CQy-yBboVXGHZr7sVoV2bGk2cEKzwhR-8RICsskyk,1571
src/rules/windows__powershell__powershell_classic__posh_pc_tamper_windows_defender_set_mp.lucene,sha256=-81qvcQHNqbRl4BeDIyYopDHawETy-9mB58FUlhicPw,1640
src/rules/windows__powershell__powershell_classic__posh_pc_tamper_windows_defender_set_mp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_classic__posh_pc_wsman_com_provider_no_powershell.eql,sha256=tx7-fX1rk9mqrvpE9Ru2S6wXbgsiGYk74P-sMF7PfLI,722
src/rules/windows__powershell__powershell_classic__posh_pc_wsman_com_provider_no_powershell.lucene,sha256=M5FeqLCqtMth9w1r-wLHUvkWKmDk8L8bow8ZvP21zDU,742
src/rules/windows__powershell__powershell_classic__posh_pc_wsman_com_provider_no_powershell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_active_directory_module_dll_import.eql,sha256=ZXE4g6qBs9DMRn_i5bXFWkJ93-L9DAPQ372RYGfAtAU,167
src/rules/windows__powershell__powershell_module__posh_pm_active_directory_module_dll_import.lucene,sha256=OrxwrVbRrzFlCbeCPD-boG2vzV8ebtbqyEKTlvk2IXo,150
src/rules/windows__powershell__powershell_module__posh_pm_active_directory_module_dll_import.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_alternate_powershell_hosts.eql,sha256=yPqRvLRM_r26JHnIadOPKhEGXNsZfppmu0BbKjlO4t8,913
src/rules/windows__powershell__powershell_module__posh_pm_alternate_powershell_hosts.lucene,sha256=fg4_Een4XpsVYpXhRXpybM49xpvMmurLf41TdMFzEA0,923
src/rules/windows__powershell__powershell_module__posh_pm_alternate_powershell_hosts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_bad_opsec_artifacts.eql,sha256=oea0_2AGPzj9L2h01jJ6boT7nxDPk1iKzWKBE6xCLCU,141
src/rules/windows__powershell__powershell_module__posh_pm_bad_opsec_artifacts.lucene,sha256=Z5zT6um3owPbzZ-dgmDxqSNfW5bpbaud2aQZv4e0omA,123
src/rules/windows__powershell__powershell_module__posh_pm_bad_opsec_artifacts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_clear_powershell_history.eql,sha256=29QG04eBHKS5ieNdaykZbvz9qXPlFFUFHB8lCABj908,530
src/rules/windows__powershell__powershell_module__posh_pm_clear_powershell_history.lucene,sha256=DA_dG_o_Beo5oGDXSJicEufpR90bVGZ_CFaFGSPMOjQ,505
src/rules/windows__powershell__powershell_module__posh_pm_clear_powershell_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_decompress_commands.eql,sha256=VYwv-IDZ9M7q2jqIZzhA5giWyqd-2NUB6DGWB1sTzYU,63
src/rules/windows__powershell__powershell_module__posh_pm_decompress_commands.lucene,sha256=p_dI-2JoniW3IspTU1pZuftnHJWZk9VQLjfpvmsLijg,52
src/rules/windows__powershell__powershell_module__posh_pm_decompress_commands.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_exploit_scripts.eql,sha256=bLMY-iNGRTC40TJhg5NyP-PJxvQlKYs01BEh82eByzE,6064
src/rules/windows__powershell__powershell_module__posh_pm_exploit_scripts.lucene,sha256=PB1nyOKHTgquw4XTRr8-Oa5-ZaSFBkrE0eR1bN4YD4E,6249
src/rules/windows__powershell__powershell_module__posh_pm_exploit_scripts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_get_addbaccount.eql,sha256=MIhJVyK8J1eKxEgcJPjLytjD3C-VuzVqgH3gBuVLsGw,171
src/rules/windows__powershell__powershell_module__posh_pm_get_addbaccount.lucene,sha256=8OmWOM2WesGdDVTedqBU5GnfikOAgHoXG0ihOevWudY,158
src/rules/windows__powershell__powershell_module__posh_pm_get_addbaccount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_get_clipboard.eql,sha256=BToRMbL9prd09CGEzun6MqnoWZnNs-mkpeTKhbCbxhM,62
src/rules/windows__powershell__powershell_module__posh_pm_get_clipboard.lucene,sha256=B2uNJN9jZiWHU3kW6CXvXNqTgwRCf0oE1UMK5oVaObQ,51
src/rules/windows__powershell__powershell_module__posh_pm_get_clipboard.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_hktl_evil_winrm_execution.eql,sha256=B5ZKK1X8fpNJCQfDM1rI-qhMiF1U69HnpAeGoYUu4bM,925
src/rules/windows__powershell__powershell_module__posh_pm_hktl_evil_winrm_execution.lucene,sha256=2w2RbM1DCD3s6BO-SmbmrrF_MbLajJt068BgVROn5Yw,981
src/rules/windows__powershell__powershell_module__posh_pm_hktl_evil_winrm_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_clip.eql,sha256=poCeiCV7NoO7XKN_NO6WJ4euQ64-nYshDzBt_o8SjFw,308
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_clip.lucene,sha256=nlV1CiSGuXhCLz-YRjGwp2NcWY0cJ7yN6QxmpaFJctM,351
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_clip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_obfuscated_iex.eql,sha256=ZlJ7iSPDCHDQITddDDqbUfxMxUNdcvmDV42DqfLmQGY,1479
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_obfuscated_iex.lucene,sha256=vPUpwVu2DZTrrraEczmgi64iewFxLRyXc7FpkU-L-P0,1678
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_obfuscated_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_stdin.eql,sha256=CD_9ttVvnCUsxCBjSQG5GNBfo3Ux41xBC-mLfY9zEhE,323
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_stdin.lucene,sha256=nOmgrbULjEaEk3WTjJHvenaStOM7FfkMXg3ONQfveMk,363
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_stdin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_var.eql,sha256=Py9fThfNtZn7FAa1nDx0pKNOogR3jnOjkjPQtOf_0tg,505
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_var.lucene,sha256=k25ujZZOlHFrXl71zeHJtzDsYdS8Io-NDeWz0KAZfQo,585
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_var.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_compress.eql,sha256=TOuTWkOi2PtXyyOtLUr7xnOTWrEKv1qvVMeKD9ZFZnY,292
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_compress.lucene,sha256=xLWoXOw6Xy7wNCdGcHf_Upowy_QfdLA_PZlDatQgRs4,272
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_rundll.eql,sha256=RpEXsV_ojSRsu9V3dO6KvQvIv62iBorEfr_uRyq8vyw,227
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_rundll.lucene,sha256=5q0mX-YHUEMZeXAOpoePMfZ4v5di5uG1qI8YV3_z5CQ,209
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_rundll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_stdin.eql,sha256=_pYtQhbKhroJ8bUsScFr9gsmjRxk1FREIhgyh306sRI,472
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_stdin.lucene,sha256=uT72TcXwuU1BbKbr2WKQELGfu0CLR5FoEI5QS6fsCxo,532
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_stdin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_clip.eql,sha256=FTsHhp8oGYOcb0VeJaTUqKwqCnNj5i02nwsSZGgkdME,535
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_clip.lucene,sha256=lAI97MKEbQQfwq0ID2NqR4nBQ8-KblXE8wzS18pKr7Y,601
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_clip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_mhsta.eql,sha256=ZbBuQGAdGtNKzyA6vtbCqQtHaNRA4hLnodc3naCaLr8,313
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_mhsta.lucene,sha256=CUKJUEKv0w_mXMTPbAssBA7fNUZV2SkWjbH5ansHW9Q,296
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_mhsta.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_rundll32.eql,sha256=O324PGzLXd47TVN1tE6gLCN7mRkkyz2sH18xg0OnWZI,309
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_rundll32.lucene,sha256=5IK8IoL4llYsbs1PU8wpmc3DvYgjJbmSbSesQ_RLyRo,285
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_use_rundll32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_var.eql,sha256=P9BKSbfFV6KeV8DQ3WLKGA5GZpX3pUhk9vsJOSx5gd8,384
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_var.lucene,sha256=a88bgfuTybEFXSRf2aeF9T7LnJ941edE3L5AVcDAeO0,434
src/rules/windows__powershell__powershell_module__posh_pm_invoke_obfuscation_via_var.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_malicious_commandlets.eql,sha256=o_WNz0j8hV7FugJHKkdmfnmYGgI4y0RLTlEW176QHzY,4558
src/rules/windows__powershell__powershell_module__posh_pm_malicious_commandlets.lucene,sha256=kx41eSHUWN164vamKfz7X5J1blOAZnJEXhcrkOkUgLE,4732
src/rules/windows__powershell__powershell_module__posh_pm_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_remote_powershell_session.eql,sha256=qCakF2TXkLuGwoML6b-i7zXCvwVpAuBUYghh2pcFLno,284
src/rules/windows__powershell__powershell_module__posh_pm_remote_powershell_session.lucene,sha256=CJR_3t6PVTdVJVMRfBU6LpaC-IwgPPTGUisIb_Wjarg,272
src/rules/windows__powershell__powershell_module__posh_pm_remote_powershell_session.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_remotefxvgpudisablement_abuse.eql,sha256=Mz0OJ3FirDXhYP249CFD0p3L-E9rsGExo0lzXBdnn3E,109
src/rules/windows__powershell__powershell_module__posh_pm_remotefxvgpudisablement_abuse.lucene,sha256=RYDGMa289OftVYsNZEdFHgFjVo2jXWEv7uNnedmtch4,102
src/rules/windows__powershell__powershell_module__posh_pm_remotefxvgpudisablement_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_ad_group_reco.eql,sha256=nWU9eu6Mxmph5BZJtEQL7d1RDRxqPh_htmN116JoTfE,557
src/rules/windows__powershell__powershell_module__posh_pm_susp_ad_group_reco.lucene,sha256=LSUlSfLwcPfBgqCP6HoshptD9zLzWT2tA59O8vzftuc,539
src/rules/windows__powershell__powershell_module__posh_pm_susp_ad_group_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_download.eql,sha256=K1JlimVDtcbZoO9CfsMGBQkcL2xWTSoQN8hBPwSC8GY,150
src/rules/windows__powershell__powershell_module__posh_pm_susp_download.lucene,sha256=mutaCOzW_SxulDweg97H9BOUHtyH-0NuIbtyRkYGJCc,132
src/rules/windows__powershell__powershell_module__posh_pm_susp_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_get_nettcpconnection.eql,sha256=1rzVJFsKzSfK3Ofysefyr1rJFdoKwoMIf3uoHAtlw2s,65
src/rules/windows__powershell__powershell_module__posh_pm_susp_get_nettcpconnection.lucene,sha256=2x8qSCV3MQPZkSrQ2rILBEfxyWVxWB9svf7k7KosDn8,54
src/rules/windows__powershell__powershell_module__posh_pm_susp_get_nettcpconnection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_generic.eql,sha256=8QXSTMm0E7uq3gRhoHwENBbwHxd9chRAv8HsYenpmRw,295
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_generic.lucene,sha256=YxUIu1M9DCExcrN8olphv-qLl9aV3EWdLTP8IY7k1NE,292
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_generic.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_specific.eql,sha256=ZwSHNmdA9bQd42-8EdluFW9GBxQgW9nTj_xh-nXKDV0,1879
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_specific.lucene,sha256=oMehJjSxmsfWWvurotpTXNvlaLwWWMYGirZ49hMFrqk,1830
src/rules/windows__powershell__powershell_module__posh_pm_susp_invocation_specific.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_local_group_reco.eql,sha256=UKBIxVp4UBlCK4Nug6LvDvpDq9FOgKmJuhfEvKHq_2U,609
src/rules/windows__powershell__powershell_module__posh_pm_susp_local_group_reco.lucene,sha256=s7437lAh6eIcgHFtUuHSX0Q02VFDO9Ju9_snQbd16QY,583
src/rules/windows__powershell__powershell_module__posh_pm_susp_local_group_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_reset_computermachinepassword.eql,sha256=mavp0D1Gnlwl87TYCR_2iv8OV6aE4QWQTQG9N9i1Ijc,74
src/rules/windows__powershell__powershell_module__posh_pm_susp_reset_computermachinepassword.lucene,sha256=RUFj1m4IEbA5ai6U3BFgRJEaNID-lRMnmVQZP8qWPNA,63
src/rules/windows__powershell__powershell_module__posh_pm_susp_reset_computermachinepassword.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_smb_share_reco.eql,sha256=tb5Wa0D_guzlKXtkDNmLb7BjB1k_j-YYa2yk0q1wQdo,111
src/rules/windows__powershell__powershell_module__posh_pm_susp_smb_share_reco.lucene,sha256=D7IwuJm5BBz0KpHuyuUJcViYBVChUUeRmWizmF8HHWo,99
src/rules/windows__powershell__powershell_module__posh_pm_susp_smb_share_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_susp_zip_compress.eql,sha256=EuTFX-p3_Xch-0_63WdTJXGNzzV3BdmUcnEhEzgQQ0Q,292
src/rules/windows__powershell__powershell_module__posh_pm_susp_zip_compress.lucene,sha256=XrUYDf1gRgSYySER0F5sP47cArcroapqV8BKbaiflxc,291
src/rules/windows__powershell__powershell_module__posh_pm_susp_zip_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_module__posh_pm_syncappvpublishingserver_exe.eql,sha256=3CEh0clRZLZqlNTK_H-1RTuYKa7Df5ZuVNG01-5EH5g,73
src/rules/windows__powershell__powershell_module__posh_pm_syncappvpublishingserver_exe.lucene,sha256=rHftQy4XcX9R1zZFhkF3avnBPS58W8gVrEey44hllUI,61
src/rules/windows__powershell__powershell_module__posh_pm_syncappvpublishingserver_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_aadinternals_cmdlets_execution.eql,sha256=llEU0ie0kuDYcdLJTH--jZEALX3n7jHLJ72K6TWaptQ,553
src/rules/windows__powershell__powershell_script__posh_ps_aadinternals_cmdlets_execution.lucene,sha256=oRuO-KWuuymClDKsddmk4u3JvsI-jfcpE8YJphos0GU,562
src/rules/windows__powershell__powershell_script__posh_ps_aadinternals_cmdlets_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_access_to_browser_login_data.eql,sha256=mr0I8TszD2eKJHEn2huPaqQVYmN6NdBHlZVQSqmA_Lg,407
src/rules/windows__powershell__powershell_script__posh_ps_access_to_browser_login_data.lucene,sha256=dTcx47CMwPQ8XeGF2OcSNsS-sA8WrBH8dMpVF9YGMUU,397
src/rules/windows__powershell__powershell_script__posh_ps_access_to_browser_login_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_active_directory_module_dll_import.eql,sha256=JncIKXcmIdFtb_upUNT64k5aDDCuZAIfZ1Eu233VPP8,235
src/rules/windows__powershell__powershell_script__posh_ps_active_directory_module_dll_import.lucene,sha256=S_OwRnU9kWFnwmHelU2X4z2Y9HIQgGbYKh2urj_zlww,222
src/rules/windows__powershell__powershell_script__posh_ps_active_directory_module_dll_import.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_add_dnsclient_rule.eql,sha256=eS8da1XWKu762Fni6h5hYX5XeNEw4MG42MH0K3ipoIE,170
src/rules/windows__powershell__powershell_script__posh_ps_add_dnsclient_rule.lucene,sha256=v6azfGPUlfa7L6DeGbL2DUaQhhw3_1pIdSIidg68tIc,157
src/rules/windows__powershell__powershell_script__posh_ps_add_dnsclient_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_add_windows_capability.eql,sha256=u71vrOQ31lg-oQ5gqKDQJXJrbXL2bREomLkaH8I1rdc,128
src/rules/windows__powershell__powershell_script__posh_ps_add_windows_capability.lucene,sha256=-1VpWt6cxgO8bOXgJvpJumzc0BdIdcRhSt_3NGMP0Po,118
src/rules/windows__powershell__powershell_script__posh_ps_add_windows_capability.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_adrecon_execution.eql,sha256=_emOFVolQV49bk-zgep0HmKJ-Dz_6p7k1CeB1OGva1I,153
src/rules/windows__powershell__powershell_script__posh_ps_adrecon_execution.lucene,sha256=P6_MOToAhQ6o5xh0GB1Rn0qSZUtcskqFmTf1DmGQfzw,140
src/rules/windows__powershell__powershell_script__posh_ps_adrecon_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_amsi_bypass_pattern_nov22.eql,sha256=QzyXL3NmqhoW-qChmdMrujGMHoCVjoHm8cP_ydZaJiM,194
src/rules/windows__powershell__powershell_script__posh_ps_amsi_bypass_pattern_nov22.lucene,sha256=tA_zy2Dffa5YXNTzJERGSqD_p-YH5s9MBlAdsAqKRNs,182
src/rules/windows__powershell__powershell_script__posh_ps_amsi_bypass_pattern_nov22.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_amsi_null_bits_bypass.eql,sha256=Avikf2z7UAvw53LTURLS_L-EIKWcFyJHJgHVaNOVedg,104
src/rules/windows__powershell__powershell_script__posh_ps_amsi_null_bits_bypass.lucene,sha256=ECSmgC4S9TaoGgFh3sSpDtrcj45J3nsrZkR76p2R63M,108
src/rules/windows__powershell__powershell_script__posh_ps_amsi_null_bits_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_apt_silence_eda.eql,sha256=uFkOh8zizDtnMnqBO6-CLJMtim02amRuj8VMMLepqAw,794
src/rules/windows__powershell__powershell_script__posh_ps_apt_silence_eda.lucene,sha256=j9kQlGela_b2IIpTn6G1VOkMSURmyGMd2IoXz0k-ows,792
src/rules/windows__powershell__powershell_script__posh_ps_apt_silence_eda.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_as_rep_roasting.eql,sha256=8IXqKYcepWby4jHn7flHF66SkAEnuuJEoBWegKleGJ4,268
src/rules/windows__powershell__powershell_script__posh_ps_as_rep_roasting.lucene,sha256=jv8HaG7V4E8ofi6LbH7vCT3E4jjR2kGDM2DrIxR8k48,251
src/rules/windows__powershell__powershell_script__posh_ps_as_rep_roasting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_audio_exfiltration.eql,sha256=nK7HeC15-IAWCl4fpDCOXOC-lL_u6XYILUCMUnN5Dhg,557
src/rules/windows__powershell__powershell_script__posh_ps_audio_exfiltration.lucene,sha256=42sQMyJznWlzMhfGdSzK5U5oag7P1WspLX6u-Gtnfgw,533
src/rules/windows__powershell__powershell_script__posh_ps_audio_exfiltration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_automated_collection.eql,sha256=9uHiyyVHdJ92UiPulNeUOSWN5szDKXe4HcP7BjookXU,310
src/rules/windows__powershell__powershell_script__posh_ps_automated_collection.lucene,sha256=UjNtNMzDimPK3UsUnT1ice5SjOsUdmqVtpnqfxvqWwE,293
src/rules/windows__powershell__powershell_script__posh_ps_automated_collection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_capture_screenshots.eql,sha256=OolIcym86Y5nSi2FJ4R63TTwBh1fzN0QXXIQ8IGshAI,64
src/rules/windows__powershell__powershell_script__posh_ps_capture_screenshots.lucene,sha256=2pJDNV05Rs08XtTpJbgx9Kl820N83yqeEoWYtuQxy-k,52
src/rules/windows__powershell__powershell_script__posh_ps_capture_screenshots.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_clear_powershell_history.eql,sha256=29QG04eBHKS5ieNdaykZbvz9qXPlFFUFHB8lCABj908,530
src/rules/windows__powershell__powershell_script__posh_ps_clear_powershell_history.lucene,sha256=DA_dG_o_Beo5oGDXSJicEufpR90bVGZ_CFaFGSPMOjQ,505
src/rules/windows__powershell__powershell_script__posh_ps_clear_powershell_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_clearing_windows_console_history.eql,sha256=VgFcFSeSkHub4alfHX6gJwn7hrzdEA3-zsoYx_b2vfc,255
src/rules/windows__powershell__powershell_script__posh_ps_clearing_windows_console_history.lucene,sha256=MonXW4rqndxcgfZHCXvLlvnj-z7oR92xp2ZuAGNK-2E,232
src/rules/windows__powershell__powershell_script__posh_ps_clearing_windows_console_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_cmdlet_scheduled_task.eql,sha256=oFfCzFRt3R0xfg1dgyE8VVbomWXC8iMjUSnaiDi0Ekw,799
src/rules/windows__powershell__powershell_script__posh_ps_cmdlet_scheduled_task.lucene,sha256=QT-JntTb4mEwoSX4GrlQ8nO8yMtqiEgRkWEwB7cez9M,775
src/rules/windows__powershell__powershell_script__posh_ps_cmdlet_scheduled_task.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_computer_discovery_get_adcomputer.eql,sha256=K6WZPgdqP9U-tUw9nPXCmrnh44ljl8ufg4KdJrjNdUQ,231
src/rules/windows__powershell__powershell_script__posh_ps_computer_discovery_get_adcomputer.lucene,sha256=3u6Uird-zmSbnxZptcROEzCjAlYWvf3ipGBkityzy6A,221
src/rules/windows__powershell__powershell_script__posh_ps_computer_discovery_get_adcomputer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_copy_item_system_directory.eql,sha256=TW_OXKC_H0MNJ3c5e8U_8CROQq2ZdxgqIZawi5P8PKs,187
src/rules/windows__powershell__powershell_script__posh_ps_copy_item_system_directory.lucene,sha256=UqvZ8gL8sp5OvDI5ug0ZSXPK9QHaqdTK6Q2xdOn2zVA,201
src/rules/windows__powershell__powershell_script__posh_ps_copy_item_system_directory.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_cor_profiler.eql,sha256=WjD3CINWEIF2ucxEWpoVfO85S720copslIDuCEK0qi8,199
src/rules/windows__powershell__powershell_script__posh_ps_cor_profiler.lucene,sha256=_GrjZc9a1SzIGH0hV5dlGL3iCZLhphFkRn1QWEC81KM,186
src/rules/windows__powershell__powershell_script__posh_ps_cor_profiler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_create_local_user.eql,sha256=lRqCGamoD5ApDFQjrQF0Ub-ZZdnvcGkaLQYgOs3-4Dw,62
src/rules/windows__powershell__powershell_script__posh_ps_create_local_user.lucene,sha256=7VI4v5fBdg1Fj0eU2m-ZI1TVxqPhB2TI7KFbt7jEs9o,51
src/rules/windows__powershell__powershell_script__posh_ps_create_local_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_create_volume_shadow_copy.eql,sha256=whj0paCJbXrUHiegkCVI11bvI_ByMHWof6Yqoc3BitM,176
src/rules/windows__powershell__powershell_script__posh_ps_create_volume_shadow_copy.lucene,sha256=qCJtDGWluQOqb7uVMxewwny596wuGpWBq-fl-CueHmE,162
src/rules/windows__powershell__powershell_script__posh_ps_create_volume_shadow_copy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_detect_vm_env.eql,sha256=NOOZNvzDHcUDBoabKmhnru9vI48TzKwBnWHOi_6nbRw,190
src/rules/windows__powershell__powershell_script__posh_ps_detect_vm_env.lucene,sha256=Q-3u0wqFETLvy2QUGeQvJyutylaNYaDMiINnagT2TBA,165
src/rules/windows__powershell__powershell_script__posh_ps_detect_vm_env.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_directorysearcher.eql,sha256=2WAmJL6jLoeTik8KYSI4w02Z0Mz2tes2Yyx2LZNuFpM,320
src/rules/windows__powershell__powershell_script__posh_ps_directorysearcher.lucene,sha256=vaAp462IKplWe8Ct_anemZNOjtB_j7yY5h6cCWG5L0U,304
src/rules/windows__powershell__powershell_script__posh_ps_directorysearcher.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_directoryservices_accountmanagement.eql,sha256=q-1u4umYVFI0za4TBb0KKTey8c88vmbWXtbqTPocl5E,91
src/rules/windows__powershell__powershell_script__posh_ps_directoryservices_accountmanagement.lucene,sha256=aMubTtxGB_dny51u2WQePTDuQWdhmHDzomEXfQ0wfpw,79
src/rules/windows__powershell__powershell_script__posh_ps_directoryservices_accountmanagement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_disable_psreadline_command_history.eql,sha256=v7tqrWcr8lVMqmgIVAAZzHtjvc36_Jgh58uRRQ3oJQ0,115
src/rules/windows__powershell__powershell_script__posh_ps_disable_psreadline_command_history.lucene,sha256=3WslvsAyQW8VhOUEE4v5g3fpM7K10ArJFf6iyq8yjc4,102
src/rules/windows__powershell__powershell_script__posh_ps_disable_psreadline_command_history.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_disable_windows_optional_feature.eql,sha256=BDbE1y7XcN7gnOkBqSw8x3LqolCgJhJgOHdH1cT6tyw,351
src/rules/windows__powershell__powershell_script__posh_ps_disable_windows_optional_feature.lucene,sha256=0ZGbxjkyHolOay1lV5tWcA-RogQecWPqDiO5oafJ_-M,337
src/rules/windows__powershell__powershell_script__posh_ps_disable_windows_optional_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_dotnet_assembly_from_file.eql,sha256=OxGQFlzme9Ug2us05ueSlz5ryJr-E67EkHbPP3sZZjI,76
src/rules/windows__powershell__powershell_script__posh_ps_dotnet_assembly_from_file.lucene,sha256=tDu151SoolhFmi8KQZl3CC5gX0onfqbfTONGMjbWjA4,68
src/rules/windows__powershell__powershell_script__posh_ps_dotnet_assembly_from_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_download_com_cradles.eql,sha256=P2vzi6z-rdjk9bgZ99t6pFC0S-kFKNOrHMIp7s076uM,541
src/rules/windows__powershell__powershell_script__posh_ps_download_com_cradles.lucene,sha256=G3pcr0-YyFucHkyqxy_ibAplILCMTd-fCd2HDqi28Kc,566
src/rules/windows__powershell__powershell_script__posh_ps_download_com_cradles.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_dsinternals_cmdlets.eql,sha256=ZsTUctrw9wu2grS3AV2LEfB9A6IPpQlLG5NIMBDxjK0,1682
src/rules/windows__powershell__powershell_script__posh_ps_dsinternals_cmdlets.lucene,sha256=qsNxMAWBPpkmLnQKMQBwfO1g7YMzSud0EsO2fdzPNjM,1727
src/rules/windows__powershell__powershell_script__posh_ps_dsinternals_cmdlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_dump_password_windows_credential_manager.eql,sha256=qz9XEcpHPQ0PR4DTj08e3jeRvyvoRHCtvelY-hvjvak,647
src/rules/windows__powershell__powershell_script__posh_ps_dump_password_windows_credential_manager.lucene,sha256=9RBz-DgcHi6Mjf5JdDae_Zf6Kx46UPfsjw1Jjzv_yWI,626
src/rules/windows__powershell__powershell_script__posh_ps_dump_password_windows_credential_manager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_enable_psremoting.eql,sha256=olqHR5q5ZxjDWkRikWq_m3T70DJA-XwjBCRkZNeWcO8,67
src/rules/windows__powershell__powershell_script__posh_ps_enable_psremoting.lucene,sha256=QcY1OjOY4lEIBFAkVncWX02j42Ccm_0A-PQoWeY2KGI,57
src/rules/windows__powershell__powershell_script__posh_ps_enable_psremoting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_enable_susp_windows_optional_feature.eql,sha256=k-nOEy684nwht6QObfQ--ZvdNRlaoqQUt2t_p3o5ytU,374
src/rules/windows__powershell__powershell_script__posh_ps_enable_susp_windows_optional_feature.lucene,sha256=E1SiSLY8mQzdYLso1__oEAWbIVpV9jqRmb_5Q74tEuY,360
src/rules/windows__powershell__powershell_script__posh_ps_enable_susp_windows_optional_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_enumerate_password_windows_credential_manager.eql,sha256=IVzfW7A5r1ikwk6GcqwR6XN-am--nWSTwjmltbE464s,206
src/rules/windows__powershell__powershell_script__posh_ps_enumerate_password_windows_credential_manager.lucene,sha256=emPlzD6Jt4YZLoUMHAUj3QNAPp_Tc5DG8CxjgM8JyEg,188
src/rules/windows__powershell__powershell_script__posh_ps_enumerate_password_windows_credential_manager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_etw_trace_evasion.eql,sha256=wBtB0FbIcXnCjK88sS6MpbV6Mm0K_2EWdu7o5zxVGuU,185
src/rules/windows__powershell__powershell_script__posh_ps_etw_trace_evasion.lucene,sha256=lUjkwyM0hJ6P6LwtH_0Fsf6hBmvRN718IAQmClaoxds,173
src/rules/windows__powershell__powershell_script__posh_ps_etw_trace_evasion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_exchange_mailbox_smpt_forwarding_rule.eql,sha256=bKA512JUU2hBOYBSIlZH3Kyr3WuUMJN_0Xg0-4NdW-o,200
src/rules/windows__powershell__powershell_script__posh_ps_exchange_mailbox_smpt_forwarding_rule.lucene,sha256=qKufySOYnFk8RDsYul3vWevFGR1Nq-9uLe7QKyUqvqM,192
src/rules/windows__powershell__powershell_script__posh_ps_exchange_mailbox_smpt_forwarding_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_export_certificate.eql,sha256=JuimX8noR7cLq25U_fPVrlbGlJf3faADY0NDgYtXvfA,173
src/rules/windows__powershell__powershell_script__posh_ps_export_certificate.lucene,sha256=lhnlcHTbwKcxJown_N9H4S-TVSPR4gXIgVwwZ8EdNvU,159
src/rules/windows__powershell__powershell_script__posh_ps_export_certificate.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_frombase64string_archive.eql,sha256=mbxCbRBMbuu8BENbBcVnwqyWDht0srljIgaq4WI_Ry4,167
src/rules/windows__powershell__powershell_script__posh_ps_frombase64string_archive.lucene,sha256=uzShXC-Iop4OrivLEIYwvz-1hzXTnrL-bE4tB40M3B8,151
src/rules/windows__powershell__powershell_script__posh_ps_frombase64string_archive.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_acl_service.eql,sha256=c3Ncs7CwKs00I0EWbo1j3_aQe-KjgrQJBHJ8C-_FVuY,151
src/rules/windows__powershell__powershell_script__posh_ps_get_acl_service.lucene,sha256=KPXhVo0HRrjkaQN379jGx_T03rTwRuv-jnrukP6W0EM,140
src/rules/windows__powershell__powershell_script__posh_ps_get_acl_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_adcomputer.eql,sha256=ItIqN75VIZWS0kbvXlNDD7QyLVFGKYazhM5hP0U1nZA,161
src/rules/windows__powershell__powershell_script__posh_ps_get_adcomputer.lucene,sha256=9IhKvEfMP8uTyALW9txyMFg8qHoHFHje5JspmqklfuQ,149
src/rules/windows__powershell__powershell_script__posh_ps_get_adcomputer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_adgroup.eql,sha256=7iR0tFJPSvc8--TwjF7fcxYue9BtwJZcPeXF2Bhstss,111
src/rules/windows__powershell__powershell_script__posh_ps_get_adgroup.lucene,sha256=q0oSK8nP3oKlYamT0jpDVjWoiUZebGiGOo33tiS-QxE,100
src/rules/windows__powershell__powershell_script__posh_ps_get_adgroup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_adreplaccount.eql,sha256=tIdC6tlzyvh6rrZkI80KD9HShNo3bFU6MvsHCr15A_Q,165
src/rules/windows__powershell__powershell_script__posh_ps_get_adreplaccount.lucene,sha256=R44zG3hLdlO3Uf1qdtLrTsr__XVRE9eyEAC8_bvQpUQ,154
src/rules/windows__powershell__powershell_script__posh_ps_get_adreplaccount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_childitem_bookmarks.eql,sha256=61F6Rlz-uSbLJOqGzFdkXLvBJcTbRIvAUhhhOsK1n9o,349
src/rules/windows__powershell__powershell_script__posh_ps_get_childitem_bookmarks.lucene,sha256=ZywZGDocmUNQsGAMbdLLemFHCN1fjf4VZqDVK2yDhOk,342
src/rules/windows__powershell__powershell_script__posh_ps_get_childitem_bookmarks.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_get_process_security_software_discovery.eql,sha256=J1ODhiB3wYWnfaOmqBlStRd3yi0eArRraYK-ZdFBWa4,476
src/rules/windows__powershell__powershell_script__posh_ps_get_process_security_software_discovery.lucene,sha256=sp27FQnvZH1g5gboJqaEgIZg634x5FX45MxYtFQgWKk,466
src/rules/windows__powershell__powershell_script__posh_ps_get_process_security_software_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_hktl_rubeus.eql,sha256=kMa9_9-NYm87IjSw8TIHOgOFYGqykrafVWT5Y0XKbas,359
src/rules/windows__powershell__powershell_script__posh_ps_hktl_rubeus.lucene,sha256=6eMm4O3ui0xjgUVr7A-avVuoTLMIsoVqea-qZPBM818,382
src/rules/windows__powershell__powershell_script__posh_ps_hktl_rubeus.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_hktl_winpwn.eql,sha256=3tXPZ2KH_NLmvKPr6qH9px9Nr_8YQB7__oZ1eVJjQFQ,116
src/rules/windows__powershell__powershell_script__posh_ps_hktl_winpwn.lucene,sha256=1U4s-ZGVv4UddQ628xRdd6Rl05kiS0yreCPrAji_kRU,99
src/rules/windows__powershell__powershell_script__posh_ps_hktl_winpwn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_hotfix_enum.eql,sha256=Jf2MzCV-2rWa0JH6L0nLmWr_DbdKlIuOC9Gk9dC1-yY,125
src/rules/windows__powershell__powershell_script__posh_ps_hotfix_enum.lucene,sha256=7N2NhqWh7lMkQyasZ2smEm2d46GjF8zatBI5w4aBZVA,111
src/rules/windows__powershell__powershell_script__posh_ps_hotfix_enum.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_icmp_exfiltration.eql,sha256=WjE6EstSbp_KATvQLu5Hz5LVBLH61RFM0kz6stcJ2gc,185
src/rules/windows__powershell__powershell_script__posh_ps_icmp_exfiltration.lucene,sha256=kRYCQov1Tuz4fw5GWaUVZ3eUcLcsvIDjfJl9bcAAPpk,171
src/rules/windows__powershell__powershell_script__posh_ps_icmp_exfiltration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_import_module_susp_dirs.eql,sha256=bJ1GzOIdwRqjxPTgc9vQfI_p0ao8L-ixkuFGZ1f3uO4,454
src/rules/windows__powershell__powershell_script__posh_ps_import_module_susp_dirs.lucene,sha256=jYq7ISrU_3u3rJMaDzh2Ld_IA_eFq_ba3yq2IE9T2ns,471
src/rules/windows__powershell__powershell_script__posh_ps_import_module_susp_dirs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_install_unsigned_appx_packages.eql,sha256=z7UXrlxvec9fg3fwD5B0FcmCn3b_SI6a-F0LiZjOilI,154
src/rules/windows__powershell__powershell_script__posh_ps_install_unsigned_appx_packages.lucene,sha256=WaB9oCpjd0tysSRBhhaRmdB0rDMytSjw2Cr-KrhnYIk,140
src/rules/windows__powershell__powershell_script__posh_ps_install_unsigned_appx_packages.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_command_remote.eql,sha256=EGQAgW5fgj9lACz_GHwl6t8A5vp8hu-29WK7QguSrkQ,122
src/rules/windows__powershell__powershell_script__posh_ps_invoke_command_remote.lucene,sha256=Dk2gKKT_uiGXjuMX0xNmsh7Zcn0EwnGxd2SWEELOrMw,113
src/rules/windows__powershell__powershell_script__posh_ps_invoke_command_remote.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_dnsexfiltration.eql,sha256=vq5s5xwaQftI46hwnwv-C7voWINhTsDo0BcH01tjdVc,308
src/rules/windows__powershell__powershell_script__posh_ps_invoke_dnsexfiltration.lucene,sha256=oK85jaYCuPA5UJ0txQCR0yzt9NYROe9jbKb1Vz5v-XU,302
src/rules/windows__powershell__powershell_script__posh_ps_invoke_dnsexfiltration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_clip.eql,sha256=poCeiCV7NoO7XKN_NO6WJ4euQ64-nYshDzBt_o8SjFw,308
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_clip.lucene,sha256=nlV1CiSGuXhCLz-YRjGwp2NcWY0cJ7yN6QxmpaFJctM,351
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_clip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_obfuscated_iex.eql,sha256=1baWqKs9NJjOB9LqEYIM3TP6EwLPIFmIzwyCC7DlhsY,1341
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_obfuscated_iex.lucene,sha256=0kzTNpOgHVfO-BAsTUftrXOtJxcS5chYPCZC-7saBbs,1521
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_obfuscated_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_stdin.eql,sha256=OsFJ8MYBhKJmoz2M_-8E56AjXH7xH_rcxevuu3sGKnE,362
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_stdin.lucene,sha256=d6xrw0Xz4uZusAJX76apzzr0vRVMfm0wrhFwBLJvibM,408
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_stdin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_var.eql,sha256=Py9fThfNtZn7FAa1nDx0pKNOogR3jnOjkjPQtOf_0tg,505
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_var.lucene,sha256=k25ujZZOlHFrXl71zeHJtzDsYdS8Io-NDeWz0KAZfQo,585
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_var.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_compress.eql,sha256=TOuTWkOi2PtXyyOtLUr7xnOTWrEKv1qvVMeKD9ZFZnY,292
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_compress.lucene,sha256=xLWoXOw6Xy7wNCdGcHf_Upowy_QfdLA_PZlDatQgRs4,272
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_rundll.eql,sha256=RpEXsV_ojSRsu9V3dO6KvQvIv62iBorEfr_uRyq8vyw,227
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_rundll.lucene,sha256=5q0mX-YHUEMZeXAOpoePMfZ4v5di5uG1qI8YV3_z5CQ,209
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_rundll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_stdin.eql,sha256=IAKil1oPt8GHD2Ncr_twjXS9J2TmFLvNXcDMfoXMD_M,433
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_stdin.lucene,sha256=y8qSn9uTAVK4CSJ9u0N6fbcKYtuV9JiuekMLQzGpwK0,487
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_stdin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_clip.eql,sha256=FTsHhp8oGYOcb0VeJaTUqKwqCnNj5i02nwsSZGgkdME,535
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_clip.lucene,sha256=lAI97MKEbQQfwq0ID2NqR4nBQ8-KblXE8wzS18pKr7Y,601
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_clip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_mhsta.eql,sha256=ZbBuQGAdGtNKzyA6vtbCqQtHaNRA4hLnodc3naCaLr8,313
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_mhsta.lucene,sha256=CUKJUEKv0w_mXMTPbAssBA7fNUZV2SkWjbH5ansHW9Q,296
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_mhsta.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_rundll32.eql,sha256=O324PGzLXd47TVN1tE6gLCN7mRkkyz2sH18xg0OnWZI,309
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_rundll32.lucene,sha256=5IK8IoL4llYsbs1PU8wpmc3DvYgjJbmSbSesQ_RLyRo,285
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_use_rundll32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_var.eql,sha256=P9BKSbfFV6KeV8DQ3WLKGA5GZpX3pUhk9vsJOSx5gd8,384
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_var.lucene,sha256=a88bgfuTybEFXSRf2aeF9T7LnJ941edE3L5AVcDAeO0,434
src/rules/windows__powershell__powershell_script__posh_ps_invoke_obfuscation_via_var.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_keylogging.eql,sha256=yP2_RUdklQD39vk6GFzo_lWzsyaV3uNxCLUsbb0lHyk,239
src/rules/windows__powershell__powershell_script__posh_ps_keylogging.lucene,sha256=sLpIvX01Qnwbj97Zkz4-wVwftOAJXVEOcS9v43MVFrM,230
src/rules/windows__powershell__powershell_script__posh_ps_keylogging.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_localuser.eql,sha256=uG66YuNceQs6FqXmSu0UYbcmaTnpf7FIwj-WnCTOcwM,197
src/rules/windows__powershell__powershell_script__posh_ps_localuser.lucene,sha256=DvLBqDYamgJUuNSJFCmG1zHaGMsYuiflVPOzKCVmS5U,186
src/rules/windows__powershell__powershell_script__posh_ps_localuser.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_mailboxexport_share.eql,sha256=kgxiNYb3Kgc5S6_2OMkedxouM0w7kLr0CFCsCJHIqqk,182
src/rules/windows__powershell__powershell_script__posh_ps_mailboxexport_share.lucene,sha256=yfXlj0Y55njb_W-XpOdUoLWpmqu_CoVE9dre2l9ZGIc,173
src/rules/windows__powershell__powershell_script__posh_ps_mailboxexport_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_malicious_commandlets.eql,sha256=yFc-GcMsSXp08L6QjLFNm5d_J4QlzWFRXYDGbHgN7MI,4354
src/rules/windows__powershell__powershell_script__posh_ps_malicious_commandlets.lucene,sha256=MVAiPONRVqvdxPEoV72_-XR-U-0ndXJoMTGTeKtmv38,4507
src/rules/windows__powershell__powershell_script__posh_ps_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_malicious_keywords.eql,sha256=1IKfcY0zmTyRQAZbRgEtPZG5oghhwkH1HwDPDGU-Xow,521
src/rules/windows__powershell__powershell_script__posh_ps_malicious_keywords.lucene,sha256=XSo5V7-YDfBGcV0XvyhfjPrp4f9Bj07atXhy50Smx9I,503
src/rules/windows__powershell__powershell_script__posh_ps_malicious_keywords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_memorydump_getstoragediagnosticinfo.eql,sha256=iyEMzD9Fu6lVvLNcCpLAG_OboAL4SyYrLS_b69WfDiw,133
src/rules/windows__powershell__powershell_script__posh_ps_memorydump_getstoragediagnosticinfo.lucene,sha256=bshxaeQImF4Ze-9Ndj0tUPV2JhmmeGsd9BKvb6iDw1A,121
src/rules/windows__powershell__powershell_script__posh_ps_memorydump_getstoragediagnosticinfo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_modify_group_policy_settings.eql,sha256=ycxSQirHro-pU4z938etW6O2MA01YN7zC_W7Tw8iRek,322
src/rules/windows__powershell__powershell_script__posh_ps_modify_group_policy_settings.lucene,sha256=anuH76k4Dx8S2Mt-Sb4uc1mfi0lICdS_2NhMGaQtLec,302
src/rules/windows__powershell__powershell_script__posh_ps_modify_group_policy_settings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_msxml_com.eql,sha256=nhjTwMUKqEqCIoj_VmlZEqp0nd-7FrhK5ydL4u0YmMo,212
src/rules/windows__powershell__powershell_script__posh_ps_msxml_com.lucene,sha256=n_amLeojRA5DtPoLFbRBD3v2ymW9QJsc11Hc-gufEB4,196
src/rules/windows__powershell__powershell_script__posh_ps_msxml_com.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_nishang_malicious_commandlets.eql,sha256=3CrWZXioQ2PjR9kXM-jCtUKg6tjYY_mxKAiFXafH_Ws,1556
src/rules/windows__powershell__powershell_script__posh_ps_nishang_malicious_commandlets.lucene,sha256=tJlP43rf-mL6IxOX3IH3BzFqS_LQ4w9N_1nA_VhIKj8,1595
src/rules/windows__powershell__powershell_script__posh_ps_nishang_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_ntfs_ads_access.eql,sha256=ChEAEH53GYRTe3wmfaZQNmVLo0Yo2gnIeXgToajGX9w,137
src/rules/windows__powershell__powershell_script__posh_ps_ntfs_ads_access.lucene,sha256=zEUePhrnEuaVYydIv77LRWBpj_00_UmKyJRItaEhH78,120
src/rules/windows__powershell__powershell_script__posh_ps_ntfs_ads_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_office_comobject_registerxll.eql,sha256=76whAN8Kpw5IxnHx-3_Kp3-t7GPEydpCj_898WtrAj8,224
src/rules/windows__powershell__powershell_script__posh_ps_office_comobject_registerxll.lucene,sha256=AvPBXf9ZrRQl8bOD80X-h9ddqwoUTMEY6Ie9UMTFsZY,210
src/rules/windows__powershell__powershell_script__posh_ps_office_comobject_registerxll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_packet_capture.eql,sha256=jRktIMbBuCfKN-VnZtihv7m_vTmJRNEnXv99e231e6w,70
src/rules/windows__powershell__powershell_script__posh_ps_packet_capture.lucene,sha256=-Iml4sDOr_pG9u3YzVVtDx3PW3HpKMksbLk0eAJRnAc,59
src/rules/windows__powershell__powershell_script__posh_ps_packet_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_potential_invoke_mimikatz.eql,sha256=zPVUGC0yC9o1qc0MxAElz0Ddm5Q_EwJ-dkXpyXFYmnA,316
src/rules/windows__powershell__powershell_script__posh_ps_potential_invoke_mimikatz.lucene,sha256=le5b8vJXWWXzODN2ODlDES3MiCAZARwoOF_-NGMGll4,300
src/rules/windows__powershell__powershell_script__posh_ps_potential_invoke_mimikatz.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_potential_unconstrained_delegation_discovery.eql,sha256=TawZQAnjuxV5M9P1KlhbvobkzG8sf6klo-yNFFKFu9g,298
src/rules/windows__powershell__powershell_script__posh_ps_potential_unconstrained_delegation_discovery.lucene,sha256=jd3Pzos5BawrvIYFH6jBJwgstEdHThu9X4mkcN6Z6ss,291
src/rules/windows__powershell__powershell_script__posh_ps_potential_unconstrained_delegation_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_powershell_web_access_installation.eql,sha256=0Ie72mT-F0RJguVLSz81J4IQIpVLnQqj6pMdYjsDwsY,345
src/rules/windows__powershell__powershell_script__posh_ps_powershell_web_access_installation.lucene,sha256=YfLuuVGPjqLSHv_BsxmKvIrcBkUCXy61t28qYargZmU,333
src/rules/windows__powershell__powershell_script__posh_ps_powershell_web_access_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_powerview_malicious_commandlets.eql,sha256=pSDXGU8fI4CqK_Ayy9q5clqDSvulnOOXgmEuH2OqMA0,1416
src/rules/windows__powershell__powershell_script__posh_ps_powerview_malicious_commandlets.lucene,sha256=An1ipcSRk_JlT6N008yf3_5vb50JFaECzTB64elfo5U,1450
src/rules/windows__powershell__powershell_script__posh_ps_powerview_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_prompt_credentials.eql,sha256=Y2aWcX5IPDP_ncoG4utliEHuiRYvV0h7LnszkKGC54Q,68
src/rules/windows__powershell__powershell_script__posh_ps_prompt_credentials.lucene,sha256=luuXycRgCBVdof4X--Y9LK9O503O_nebgXcntbxChGM,56
src/rules/windows__powershell__powershell_script__posh_ps_prompt_credentials.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_psasyncshell.eql,sha256=6Iz2sb_VzEHoOrslGAZxQuk5h7z1VT6Fp1AQV3NEU7E,61
src/rules/windows__powershell__powershell_script__posh_ps_psasyncshell.lucene,sha256=vJ-Ylz6UNbVnYgJ3ymF9QeCsDCbSjQmufasq6zKm6b8,49
src/rules/windows__powershell__powershell_script__posh_ps_psasyncshell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_psattack.eql,sha256=gaqlsXGupco2ko12n799ymWEz4DE_HF29MK-ztT55MQ,61
src/rules/windows__powershell__powershell_script__posh_ps_psattack.lucene,sha256=XqcXcV47KRFuAgvMfLPna27R9PAp25pPqfjA0UaYTTM,53
src/rules/windows__powershell__powershell_script__posh_ps_psattack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_remote_session_creation.eql,sha256=i_qQlee9lPACXLIUp-wm-XTbkRDFJXucBvvRRIdvW9E,119
src/rules/windows__powershell__powershell_script__posh_ps_remote_session_creation.lucene,sha256=fvbl-SzNed1BHv1fe7wU2U2hoDz5GRSlV6uAn5wz_Us,108
src/rules/windows__powershell__powershell_script__posh_ps_remote_session_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_remotefxvgpudisablement_abuse.eql,sha256=12--xXIj8fjXz-mixSUxsAh9nP77PpkB3iBwPGPMY_0,93
src/rules/windows__powershell__powershell_script__posh_ps_remotefxvgpudisablement_abuse.lucene,sha256=i0dr9XDYgK0vEfYlN7dQBmBY_oNaO-i63Gnn7pVgXoI,85
src/rules/windows__powershell__powershell_script__posh_ps_remotefxvgpudisablement_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_request_kerberos_ticket.eql,sha256=90WYOu3gHmBrcURWVuZuorFgaQyoG44ZPFPlZWfC1bI,163
src/rules/windows__powershell__powershell_script__posh_ps_request_kerberos_ticket.lucene,sha256=v5_UtDsPKBzIMivQ83a5UeMpmdQ_fIQPQjJXU5X9M8o,151
src/rules/windows__powershell__powershell_script__posh_ps_request_kerberos_ticket.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_resolve_list_of_ip_from_file.eql,sha256=XsoSTlqpUxqT4MXbHtnkbvUIVUD2Zw325AbkyMxjFSA,235
src/rules/windows__powershell__powershell_script__posh_ps_resolve_list_of_ip_from_file.lucene,sha256=wVwktCHMeZh7ZPcjg51aOzFD_K2cVGPPauLwChSnnec,224
src/rules/windows__powershell__powershell_script__posh_ps_resolve_list_of_ip_from_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_root_certificate_installed.eql,sha256=tDJQ3q_4Lqfr-QKjYGqeSSjzY2M7Orz5rJIhFFdpJeg,258
src/rules/windows__powershell__powershell_script__posh_ps_root_certificate_installed.lucene,sha256=tB5W-IYtT54xSz5lGkIrRF4RtlbgvhrWpH91QqEGGCg,244
src/rules/windows__powershell__powershell_script__posh_ps_root_certificate_installed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_run_from_mount_diskimage.eql,sha256=s3zWouG9vcOuC6itPLKHZUSFn71HsQp4X_IXsEmrVBs,328
src/rules/windows__powershell__powershell_script__posh_ps_run_from_mount_diskimage.lucene,sha256=L4F8aGFi5IdQscnbWBcjdyTZigzbbx4eCrTKzt6-rWg,315
src/rules/windows__powershell__powershell_script__posh_ps_run_from_mount_diskimage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_script_with_upload_capabilities.eql,sha256=ZjrDGfRR5MNPVWraH6_PPkJLgg_XIlhgi_75tZ0bSc8,283
src/rules/windows__powershell__powershell_script__posh_ps_script_with_upload_capabilities.lucene,sha256=zbmXT2NbuYDF2D02P85Eihhyo5oqZ06WDoQkoviwQf4,273
src/rules/windows__powershell__powershell_script__posh_ps_script_with_upload_capabilities.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_sensitive_file_discovery.eql,sha256=gKQbwgC96cG6i9YpFeqtXWUwvnkNfFDkzgItD3wMJro,219
src/rules/windows__powershell__powershell_script__posh_ps_sensitive_file_discovery.lucene,sha256=x4khKbvSBzvUlK2YJqbvOgd0xSc6hRLT4D7vr9fq1DQ,193
src/rules/windows__powershell__powershell_script__posh_ps_sensitive_file_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_set_acl.eql,sha256=XrxQhVMEdZCgShGsD5OeOiILZSpTgD-fNr99xh7Id4g,160
src/rules/windows__powershell__powershell_script__posh_ps_set_acl.lucene,sha256=HMRPSrXVwbXO8Uum3xPusqP1d7cAEn1LGH-mpukLPPE,150
src/rules/windows__powershell__powershell_script__posh_ps_set_acl.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_set_acl_susp_location.eql,sha256=2xZYG1hMGTmURQg1EJfd4lgnqNCbOIdiJy5hfQapMew,448
src/rules/windows__powershell__powershell_script__posh_ps_set_acl_susp_location.lucene,sha256=1JCo8E-1xR2owGDnSW6ZEBwJ_AlYFEYA3YcdwCPoNqU,452
src/rules/windows__powershell__powershell_script__posh_ps_set_acl_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_set_policies_to_unsecure_level.eql,sha256=ONT0-26AUJYr20ZOp_kUp7j5yzWsEIbvNzMYLk8pWPc,394
src/rules/windows__powershell__powershell_script__posh_ps_set_policies_to_unsecure_level.lucene,sha256=srv3qEEuCXiAqTaslpw8Vmf1ajn9ax1hgGQR3jg8nc8,387
src/rules/windows__powershell__powershell_script__posh_ps_set_policies_to_unsecure_level.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_shellcode_b64.eql,sha256=-vTKyaKsYvNF6W3Fx3XsnLTr77kGRW6moBF0neqduQA,87
src/rules/windows__powershell__powershell_script__posh_ps_shellcode_b64.lucene,sha256=Qo2QxORTMamEd1VQj2ZBfhU1A1EQdtUBpob_3KIDO0Q,69
src/rules/windows__powershell__powershell_script__posh_ps_shellcode_b64.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_shellintel_malicious_commandlets.eql,sha256=a_BngbUCA5QMX6vI0w8AbO-X-u1rColXKyC_4WCRo2A,116
src/rules/windows__powershell__powershell_script__posh_ps_shellintel_malicious_commandlets.lucene,sha256=iQqttgELrQrKcCKhiweK_vbxSycQ6vY1B5_1iySz2kw,101
src/rules/windows__powershell__powershell_script__posh_ps_shellintel_malicious_commandlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_software_discovery.eql,sha256=VINN0voYxd14LfRvmIA_Idhl4hjke_6lf5zMidvpaTk,230
src/rules/windows__powershell__powershell_script__posh_ps_software_discovery.lucene,sha256=DLNtlyKn6160tFzCr2lwXgkpWKfkcBpJMfw6jC5i19Y,215
src/rules/windows__powershell__powershell_script__posh_ps_software_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_store_file_in_alternate_data_stream.eql,sha256=Z66OtBjTGEyo7X1mv8t8TDeO6nboyI4k0Jgz14Qd_B4,233
src/rules/windows__powershell__powershell_script__posh_ps_store_file_in_alternate_data_stream.lucene,sha256=lDLc3NA3z8nfLoMKxC_oZF48l4sCMwmFVn9HRBobKKo,223
src/rules/windows__powershell__powershell_script__posh_ps_store_file_in_alternate_data_stream.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_ace_tampering.eql,sha256=0rntt37TLBTsw_VuctqKcQKreHbddSxxCuiqA-fvRIk,399
src/rules/windows__powershell__powershell_script__posh_ps_susp_ace_tampering.lucene,sha256=ebEKHsq7OHL2xhpqx9faU9XhGmlIJr1NjQE0FuGEQAM,371
src/rules/windows__powershell__powershell_script__posh_ps_susp_ace_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_ad_group_reco.eql,sha256=tcFRRXDEQzhAGKfbw6uF6pN7CcQrycrpKRV2qahs6WA,290
src/rules/windows__powershell__powershell_script__posh_ps_susp_ad_group_reco.lucene,sha256=uSB_cihD5xvKVIbRJOcpIAUztwoOteRYZknygorSGeA,276
src/rules/windows__powershell__powershell_script__posh_ps_susp_ad_group_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_alias_obfscuation.eql,sha256=ILmi9gX1fSSgssWSgwq1A0ZasMOlmeD9pIEcQMA9hb4,113
src/rules/windows__powershell__powershell_script__posh_ps_susp_alias_obfscuation.lucene,sha256=_P1PqfZijKV3UCoCVfn8cK0Of-6VPZe8P2KTxzRGSMM,106
src/rules/windows__powershell__powershell_script__posh_ps_susp_alias_obfscuation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_clear_eventlog.eql,sha256=9JuKnaCHr95CSmsPiwjmixIRH3vb5UeAFr1OH5J5s4Q,376
src/rules/windows__powershell__powershell_script__posh_ps_susp_clear_eventlog.lucene,sha256=FJsPZsEvb7LPqxB7cUL7DwkF5jM0d7E1dMj4IkSM63o,358
src/rules/windows__powershell__powershell_script__posh_ps_susp_clear_eventlog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_directory_enum.eql,sha256=S88-LaQYvewmrpjLmj1WGKQ7BEVfMX3GYzw6Rx5GGmA,378
src/rules/windows__powershell__powershell_script__posh_ps_susp_directory_enum.lucene,sha256=28bRZ8fnB7RJWHuCwrz4GjkUanerw-IXP0jQYQ_CBTs,362
src/rules/windows__powershell__powershell_script__posh_ps_susp_directory_enum.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_download.eql,sha256=W4jPuXUT_4Nttz7YOARecm74s9-Zn_OR82Zc-3OGfFM,210
src/rules/windows__powershell__powershell_script__posh_ps_susp_download.lucene,sha256=nbsCyQNFgrB-oiIs3rm6bfcSIKZsaZVHKVz7_rPfoE0,194
src/rules/windows__powershell__powershell_script__posh_ps_susp_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_execute_batch_script.eql,sha256=xZRYl-gYnknwZXzOrsTpR98TGIneEc-xpYEou0LCMbM,129
src/rules/windows__powershell__powershell_script__posh_ps_susp_execute_batch_script.lucene,sha256=ORWatb6f983ffHDx4UAZNsG-304cGm7X1Z4lazMrU5U,110
src/rules/windows__powershell__powershell_script__posh_ps_susp_execute_batch_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_extracting.eql,sha256=QZWXk5pcn58ZReL__hWTAWRExIAz2Yj2KgWrOKUKoz4,206
src/rules/windows__powershell__powershell_script__posh_ps_susp_extracting.lucene,sha256=k7p3WFvD3UBTf9DKskAU3T5uc8iVD591jGgGp2afYsQ,194
src/rules/windows__powershell__powershell_script__posh_ps_susp_extracting.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_follina_execution.eql,sha256=aVGjcWqGLKnBHa_teWp6567PFRMkcjY7fIqnxNdVxns,263
src/rules/windows__powershell__powershell_script__posh_ps_susp_follina_execution.lucene,sha256=ea9uz3q5VlaBA97YWjWmLRStvOnZa4kAMGypeXPqhJg,249
src/rules/windows__powershell__powershell_script__posh_ps_susp_follina_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_addefaultdomainpasswordpolicy.eql,sha256=z7mYYJEH5ktNvfgWViGRZTOzXAWowia2T0rOiRpJzrs,82
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_addefaultdomainpasswordpolicy.lucene,sha256=CbfI5OtypnAZ3_rK0MDid7ijiZmX7FIXVLFLbiq5kkk,71
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_addefaultdomainpasswordpolicy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_current_user.eql,sha256=vhgPrHuDiC60h_oGWA9auPwPiaFcNnc_o15w7I3f75w,169
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_current_user.lucene,sha256=Itb8QjVLhDm10wYJ0ueFE0DSAljJotw-88Dx8mtdT6w,162
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_current_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_gpo.eql,sha256=epb8c_5clIqNbpnQmw61JOvvyCd25pjONdir4XRN16A,56
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_gpo.lucene,sha256=9j3S6Ohk_1Addtv_npjBMkxjaQTREQseNsbUGg6mz4c,45
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_gpo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_process.eql,sha256=Qb9trEQ1gms9BPM3lODT7vEZXeKzHXF6RRwKrYj7fnk,60
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_process.lucene,sha256=UagL16IVtS77hZK2j1vQqOCmfpRK0THwl-G5rwKuD8o,49
src/rules/windows__powershell__powershell_script__posh_ps_susp_get_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_getprocess_lsass.eql,sha256=HYSojpxzqU1YAKNk_zWTLqn7kR2v0ytXWlZ6D5KoMn0,66
src/rules/windows__powershell__powershell_script__posh_ps_susp_getprocess_lsass.lucene,sha256=T8pWkYuerajpTZgSI5h6veps0kSZHajLUiSY3nhhAaM,56
src/rules/windows__powershell__powershell_script__posh_ps_susp_getprocess_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_gettypefromclsid.eql,sha256=AiiaCoHrGnNT9SXT-VKk4XABDqHedUbuyHc3dFd3R7E,125
src/rules/windows__powershell__powershell_script__posh_ps_susp_gettypefromclsid.lucene,sha256=VM8ieEwmFwZ9s5s1gp3E1CSVXbcfrbiRwPVZH_aY934,115
src/rules/windows__powershell__powershell_script__posh_ps_susp_gettypefromclsid.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_hyper_v_condlet.eql,sha256=GWUhaCS6ZSfTqtlRiGw4TKnkVcNJ8jn9hX_g8mJSHCA,97
src/rules/windows__powershell__powershell_script__posh_ps_susp_hyper_v_condlet.lucene,sha256=2xM75DVNBASoTtup-0r07TD8eCI2cXo1xFgf8BTV4Hg,82
src/rules/windows__powershell__powershell_script__posh_ps_susp_hyper_v_condlet.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_generic.eql,sha256=CkS5GAYhUdSf_PPE-oSMn4rKzdTpeoMgD0IvVpH78Ks,307
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_generic.lucene,sha256=gwHLkYG6V5UFka7z4Mdhbt9xJ9xB269w7BpyZ4B8xHU,304
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_generic.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_specific.eql,sha256=twqmb7tqA1KWcDKefwiCUfaja4nAHqUe_1nyvNwQYeM,2103
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_specific.lucene,sha256=kRXxQxmn4C9jl6OzU6Zc40SbM3maWCe_IDBAKSz3Ht0,2064
src/rules/windows__powershell__powershell_script__posh_ps_susp_invocation_specific.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_invoke_webrequest_useragent.eql,sha256=we8M_hwRWNZ8KA8suUWcq_oEJFCSsSz8vtTlMXGjPBA,174
src/rules/windows__powershell__powershell_script__posh_ps_susp_invoke_webrequest_useragent.lucene,sha256=1bISIOWl022DH4-XGhB64F0LGktuyrSON-ZNAkHqOyY,161
src/rules/windows__powershell__powershell_script__posh_ps_susp_invoke_webrequest_useragent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_iofilestream.eql,sha256=XDlrPOAmR0SPltXa1iQMduLDvcaDxgpmsASimDYbU-A,162
src/rules/windows__powershell__powershell_script__posh_ps_susp_iofilestream.lucene,sha256=qm42-ceZxrGnXt2NMNlxFxp64yqGt0Nz14gYFtOoxk0,147
src/rules/windows__powershell__powershell_script__posh_ps_susp_iofilestream.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_keylogger_activity.eql,sha256=V7mr3NVUpKfSd47m1J3SjRtV7dR0BBYRmzFimEBoykw,113
src/rules/windows__powershell__powershell_script__posh_ps_susp_keylogger_activity.lucene,sha256=TsGx9KE8YObE9U6XnElAmA1qz8G7rn8lBeZjaw2onBg,110
src/rules/windows__powershell__powershell_script__posh_ps_susp_keylogger_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_keywords.eql,sha256=IN_S2ABIa1DrAPibsfcBB_CcUrlJ1NMl9Wsr6p_7YF0,414
src/rules/windows__powershell__powershell_script__posh_ps_susp_keywords.lucene,sha256=ZfiFD9IY90nIQF_os8XKTvrYmoUiJTa1wTe1P7SYl9k,407
src/rules/windows__powershell__powershell_script__posh_ps_susp_keywords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_local_group_reco.eql,sha256=Mka0zFBjYkZCdDX6Tzcf0wzQgtRRB-5G8CGOiSH0hrM,267
src/rules/windows__powershell__powershell_script__posh_ps_susp_local_group_reco.lucene,sha256=4ky3vm0WLcTQt1rci6DKnBzgQRe7HPt4m4qpzcMjrmM,249
src/rules/windows__powershell__powershell_script__posh_ps_susp_local_group_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_mail_acces.eql,sha256=ahRCJr2SdxpK67hptq6bDoMktulPla7yaMgLiBUQ7To,199
src/rules/windows__powershell__powershell_script__posh_ps_susp_mail_acces.lucene,sha256=aer-ia8t36vuCccwhGEakYB275KS7v83L7yFCdVpD-E,184
src/rules/windows__powershell__powershell_script__posh_ps_susp_mail_acces.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_mount_diskimage.eql,sha256=4f9xKf9xzmmr-Syyxh7nXQxvUU_ZFwlF0OxaWE_RNXg,119
src/rules/windows__powershell__powershell_script__posh_ps_susp_mount_diskimage.lucene,sha256=__hjUjtkKYudzA155JI-417N9_fP8LgyKmGOFGh9gw8,109
src/rules/windows__powershell__powershell_script__posh_ps_susp_mount_diskimage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_mounted_share_deletion.eql,sha256=4SMXnX4SmJrtUwLSWE7xjz89Q9gX1RDVniorPUf6mlQ,472
src/rules/windows__powershell__powershell_script__posh_ps_susp_mounted_share_deletion.lucene,sha256=j-taI7IBNrJRTc_wraCbM6OmZ_BFBxbuFnxHyK31e6E,451
src/rules/windows__powershell__powershell_script__posh_ps_susp_mounted_share_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_networkcredential.eql,sha256=EpeTbXr_T4XSRCqo1Lq6SlE9JAj2FEMG9JzZJcJwvwM,204
src/rules/windows__powershell__powershell_script__posh_ps_susp_networkcredential.lucene,sha256=m2zj-C0qam5MSl-De0qOm8Avwnxi81pCD8dC37LVoUI,186
src/rules/windows__powershell__powershell_script__posh_ps_susp_networkcredential.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_new_psdrive.eql,sha256=dqjb8z98wVP51eZzbcNJBo1KDeHnnBZ9BlWoNl_BBdE,306
src/rules/windows__powershell__powershell_script__posh_ps_susp_new_psdrive.lucene,sha256=Bn-gp0ydAYi2L57bGUg7NRD0MaT6puqCcHMFCcAkAX8,289
src/rules/windows__powershell__powershell_script__posh_ps_susp_new_psdrive.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_proxy_scripts.eql,sha256=Rec8jaqrb0NH-ZwSoavZKIiyzaKU6QPC_m-LDHEAjQM,207
src/rules/windows__powershell__powershell_script__posh_ps_susp_proxy_scripts.lucene,sha256=h5PR-OfadZkiH-N0LJa4SYZn1QZAaEUxqF8DwaUwLN4,193
src/rules/windows__powershell__powershell_script__posh_ps_susp_proxy_scripts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_recon_export.eql,sha256=s0ALqqpEhXI0RGnaAtiLHW2MnBYdof4QSNWspMFcNfg,164
src/rules/windows__powershell__powershell_script__posh_ps_susp_recon_export.lucene,sha256=1r1mTRM15OQMr1UOObmqviLWb8UW-kzjqQyTNPLEais,153
src/rules/windows__powershell__powershell_script__posh_ps_susp_recon_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_remove_adgroupmember.eql,sha256=bUHujoxCsnCJyyDRpb6WCEoOtPGCfyPAYOt38w1PZGM,174
src/rules/windows__powershell__powershell_script__posh_ps_susp_remove_adgroupmember.lucene,sha256=Tzvq9MCQIt4-SjQcZfScmh8uH7_DcmVN64zbKzN0E2I,163
src/rules/windows__powershell__powershell_script__posh_ps_susp_remove_adgroupmember.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_service_dacl_modification_set_service.eql,sha256=oPy01_okCNumUi92wkkAKALgADIKyk82kzktmwrfwpk,300
src/rules/windows__powershell__powershell_script__posh_ps_susp_service_dacl_modification_set_service.lucene,sha256=CI6-y-h5zhs1UNQ-eLhz5oJYrZ8VLiSBJH5v2rMT8c4,276
src/rules/windows__powershell__powershell_script__posh_ps_susp_service_dacl_modification_set_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_set_alias.eql,sha256=JfrFsoqlfCQanL76g7D4AWyU7HjbwQ4VkurA52uIa1w,1414
src/rules/windows__powershell__powershell_script__posh_ps_susp_set_alias.lucene,sha256=O6VDmVlM_0mQYgaWJUDnAhKKpX_x2cmdNJpwiDI5HEk,1572
src/rules/windows__powershell__powershell_script__posh_ps_susp_set_alias.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_smb_share_reco.eql,sha256=vyr0RTo0lFHivlmNlwcrIKCmPqfvGv95E74rGgdf3Rg,61
src/rules/windows__powershell__powershell_script__posh_ps_susp_smb_share_reco.lucene,sha256=T9NN8OzI70M8To3ZVTwjh6HiFqIoojGkAOx5yl7W02U,50
src/rules/windows__powershell__powershell_script__posh_ps_susp_smb_share_reco.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_ssl_keyword.eql,sha256=oujVN2vmINIcwexNCucebIRn8KwhaWT1vIp5vsSfAes,233
src/rules/windows__powershell__powershell_script__posh_ps_susp_ssl_keyword.lucene,sha256=YAbGBDD3YrqI9JU2XpZvnQ_mwbb9lBgrtv869p8R0QA,217
src/rules/windows__powershell__powershell_script__posh_ps_susp_ssl_keyword.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_start_process.eql,sha256=ntbjrQX9HBw7b3ChatHDeV2YzyCHw4WhMff5RY3iQH0,168
src/rules/windows__powershell__powershell_script__posh_ps_susp_start_process.lucene,sha256=FrYwXjrr3F3PGIUFfSmtmXHGFIHHbfCkT0GyQZDtUCg,157
src/rules/windows__powershell__powershell_script__posh_ps_susp_start_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_unblock_file.eql,sha256=flYvrWi0hn50_baxdHP-3NmheiHi1P1Y8HKUv1TBjOA,111
src/rules/windows__powershell__powershell_script__posh_ps_susp_unblock_file.lucene,sha256=rjU9a75dg9eo1OnM_g-UgL_ubGZH4fF_1xgu_Dl791s,101
src/rules/windows__powershell__powershell_script__posh_ps_susp_unblock_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_wallpaper.eql,sha256=kA6LM8KVOd8b6l2T-QeNK_l9pceHkQLCc9xTiBQSJI4,329
src/rules/windows__powershell__powershell_script__posh_ps_susp_wallpaper.lucene,sha256=2XZYAh9RkvQ5kNYw2jZe7Ik2igPNTFWc7ti9WAt-W54,315
src/rules/windows__powershell__powershell_script__posh_ps_susp_wallpaper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_pnpentity.eql,sha256=PNIVuWvSJJZG0O6QfUx82iH4nwoW4PNfEpWKrZza1Jo,64
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_pnpentity.lucene,sha256=19ojaXzCzB63KPf4_YyuQ0jiRmB1Apyl-g4EKvVGXJ8,52
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_pnpentity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_shadowcopy_deletion.eql,sha256=aNayHrIhwkI6NAq7jFEuXgmwlTi1Ca1hkSOanl1BnpU,300
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_shadowcopy_deletion.lucene,sha256=Z41oOiYTw5XSPhIAQjOlq86Yw8UlR7hnXI7-mbDpjug,278
src/rules/windows__powershell__powershell_script__posh_ps_susp_win32_shadowcopy_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_windowstyle.eql,sha256=ymvyXnsDiRQh3LoIrOKnDrHRrqVZDv67RYHi9J_YLjU,377
src/rules/windows__powershell__powershell_script__posh_ps_susp_windowstyle.lucene,sha256=aAI3mzcAK7-nePvc1ZNwHMJyvAh82X1PvsXZGJizkO0,359
src/rules/windows__powershell__powershell_script__posh_ps_susp_windowstyle.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_write_eventlog.eql,sha256=WdCin0CkzjVYiv-cORsh8SZt6IDCO1pIk9lIUlxs4yk,115
src/rules/windows__powershell__powershell_script__posh_ps_susp_write_eventlog.lucene,sha256=wiTP-RaiOHiA-E0e7rQBlk0BiPoqG0AXyXbsrSQfD5U,104
src/rules/windows__powershell__powershell_script__posh_ps_susp_write_eventlog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_susp_zip_compress.eql,sha256=JfhLGfmFbSPgzMqefsVEHxEhoIzM2sgkI81JfeThNkY,238
src/rules/windows__powershell__powershell_script__posh_ps_susp_zip_compress.lucene,sha256=BITAkutvPD-F1CjXBNGi1mPVgOnVY9BqZQ1qMHdivRk,235
src/rules/windows__powershell__powershell_script__posh_ps_susp_zip_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_syncappvpublishingserver_exe.eql,sha256=k4GWFR5NMStzA0jZr76VX2pbGO67CX1cL83MNs_kFEQ,77
src/rules/windows__powershell__powershell_script__posh_ps_syncappvpublishingserver_exe.lucene,sha256=68HffwzerQDK0xm22BvO_lUpEta9sUTMpkYD4W3qK60,65
src/rules/windows__powershell__powershell_script__posh_ps_syncappvpublishingserver_exe.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_rem_mp.eql,sha256=uxpi7nRIVCIumaoAM4kgIb6GgSB5mVv-xzByPgr8OJI,286
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_rem_mp.lucene,sha256=kshWDBcE61DJ8wVYk5csVi7tVtRVYuhItj4FlZ_xKag,275
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_rem_mp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_set_mp.eql,sha256=E1Z3I87_gs5jsVEHBCY__US_x8q9BOqUdx7-j6Cef9E,1665
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_set_mp.lucene,sha256=7HjWr176s6yX3hRhuvD0vkYWDZL9Aj66qrKMMMWLaUI,1733
src/rules/windows__powershell__powershell_script__posh_ps_tamper_windows_defender_set_mp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_test_netconnection.eql,sha256=BCQGhfm2SCm8adQb4YB0hMokSi4FCRgAd8jt8OQGIqA,249
src/rules/windows__powershell__powershell_script__posh_ps_test_netconnection.lucene,sha256=hS5scP_YjaAR2dzYIjuVl7-qtFJeRkH80sB_WMI7PiI,234
src/rules/windows__powershell__powershell_script__posh_ps_test_netconnection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_timestomp.eql,sha256=vlK4CjcyKNLHQJEpCeY9ycfMEK3wxdWYg87Bxq52roU,216
src/rules/windows__powershell__powershell_script__posh_ps_timestomp.lucene,sha256=qJpTaYh1fK39E3R01BLnl41RM_pXx6LIb5Qofx8Jfmg,216
src/rules/windows__powershell__powershell_script__posh_ps_timestomp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_user_discovery_get_aduser.eql,sha256=8aVhlnGzE8YaPvW-DN1BITnUhFcaG_HzYLNlYd2DwyA,236
src/rules/windows__powershell__powershell_script__posh_ps_user_discovery_get_aduser.lucene,sha256=JUhSyoCVN8nlRfap_X5spIlU46KLNaEcudHIfHK9lak,229
src/rules/windows__powershell__powershell_script__posh_ps_user_discovery_get_aduser.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_user_profile_tampering.eql,sha256=Gpj-zmsTrQPEO05P7EEjmc8HTXNna76UNrBbU3Tfrnc,334
src/rules/windows__powershell__powershell_script__posh_ps_user_profile_tampering.lucene,sha256=MkF339qtg7MzRC7uB-Jeo8_bWhXU7xR9g3D-4wg9b54,340
src/rules/windows__powershell__powershell_script__posh_ps_user_profile_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_using_set_service_to_hide_services.eql,sha256=uLN7EzMgLXvPOB9IPQ6gV4vrbrS-fA4z_HUJ6eOkhlg,203
src/rules/windows__powershell__powershell_script__posh_ps_using_set_service_to_hide_services.lucene,sha256=YqZa0bg-jaO0t-gU-YfLNIegy2gmqAAQxNC-5yZ_Zfc,187
src/rules/windows__powershell__powershell_script__posh_ps_using_set_service_to_hide_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_vbscript_registry_modification.eql,sha256=gb0hpgGLAf8MZJgqHBg8HTBeGdlBczhZ6kuPW4svtII,169
src/rules/windows__powershell__powershell_script__posh_ps_vbscript_registry_modification.lucene,sha256=xgflLcBnSVdXapgXRx4D8pzGgg36DXTlsr_CdPXoyUU,153
src/rules/windows__powershell__powershell_script__posh_ps_vbscript_registry_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_veeam_credential_dumping_script.eql,sha256=xMux5rjAU8z_z-1Qzux7_hkk1ZJqMc5TwQdnD-0hzMo,286
src/rules/windows__powershell__powershell_script__posh_ps_veeam_credential_dumping_script.lucene,sha256=bbMk6qUzW_KCnrBD2jbH2NyHUYPbU-LQfK9elt8AIqM,278
src/rules/windows__powershell__powershell_script__posh_ps_veeam_credential_dumping_script.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_web_request_cmd_and_cmdlets.eql,sha256=_zAsfzlemyhFMylFJ6UWY4p8MuWVgYVZYlxIMapACDM,369
src/rules/windows__powershell__powershell_script__posh_ps_web_request_cmd_and_cmdlets.lucene,sha256=3BlVjm_E4pf5ZkH0FfE9FsJQ4MKNnD6NO8BUUfWzjZc,363
src/rules/windows__powershell__powershell_script__posh_ps_web_request_cmd_and_cmdlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_win32_nteventlogfile_usage.eql,sha256=TfHB-L_riSNxpH1lSHYHXQyUzzapI7IfiKfQNM5OsGA,315
src/rules/windows__powershell__powershell_script__posh_ps_win32_nteventlogfile_usage.lucene,sha256=OwGVi1o1LPfpdkbj72DLQCTxVryBKX69OuF3Q66tpmo,304
src/rules/windows__powershell__powershell_script__posh_ps_win32_nteventlogfile_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_win32_product_install_msi.eql,sha256=LUVVFp9YGmf5UiHTKly8wn3tKkXqFm5R7EnRlhkG2-0,279
src/rules/windows__powershell__powershell_script__posh_ps_win32_product_install_msi.lucene,sha256=XVS7l1ZvEPOFRCTbE5ewzPnm7MaLPjhbwImJCHSyHJA,266
src/rules/windows__powershell__powershell_script__posh_ps_win32_product_install_msi.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_win_api_susp_access.eql,sha256=dGWmYjjXyp5sQXI54HJ4aAVqxPeh1P2yU_Rj0lfgPyM,830
src/rules/windows__powershell__powershell_script__posh_ps_win_api_susp_access.lucene,sha256=tth-beHTuKfezDYL-YKfwJFC6uesRX8gWRZb5bZwhL4,792
src/rules/windows__powershell__powershell_script__posh_ps_win_api_susp_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_win_defender_exclusions_added.eql,sha256=vN9ivOuNSAGUgMEercvD9_M1QmJJVMX1F9HCXeDNiyU,247
src/rules/windows__powershell__powershell_script__posh_ps_win_defender_exclusions_added.lucene,sha256=F_m8cLr6VElXh7L33lN8oYoG54kH2HPMP601LElZaYE,237
src/rules/windows__powershell__powershell_script__posh_ps_win_defender_exclusions_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_windows_firewall_profile_disabled.eql,sha256=706rAurO2zs7Yqv7TwT_UYnRLMEBqRSlJvZDAPND-9s,272
src/rules/windows__powershell__powershell_script__posh_ps_windows_firewall_profile_disabled.lucene,sha256=zyw6C8cIKaHq4HVYg38dO_NzlGMUNOvRjhk_0kQRkiE,257
src/rules/windows__powershell__powershell_script__posh_ps_windows_firewall_profile_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_winlogon_helper_dll.eql,sha256=NaBQQb3skVr3WGbntRpQFGaUtkhg4kaxlY9uCdc-QtE,156
src/rules/windows__powershell__powershell_script__posh_ps_winlogon_helper_dll.lucene,sha256=xHEBv7DMAB6x1MlUAImAJ5LaPRwuZK5Tz5Np8DZTMvw,138
src/rules/windows__powershell__powershell_script__posh_ps_winlogon_helper_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_wmi_persistence.eql,sha256=0C8xL9xKG57fhDDL7I7RtRSOgpisZZo1gFqwlpE3YDE,524
src/rules/windows__powershell__powershell_script__posh_ps_wmi_persistence.lucene,sha256=1FXEOZEVMVE86Tz90zeBYEDdNHYC5_fPySDfhY3FlEk,520
src/rules/windows__powershell__powershell_script__posh_ps_wmi_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_wmi_unquoted_service_search.eql,sha256=2Ms5n8pJJ-kYG2TgN1_ojTXInHwP9oR6hpN2JTdIfwE,348
src/rules/windows__powershell__powershell_script__posh_ps_wmi_unquoted_service_search.lucene,sha256=KFVKNR4ILAC4gZqoyd6_zyK4hCUKzOZM-QtjLpU3jaI,325
src/rules/windows__powershell__powershell_script__posh_ps_wmi_unquoted_service_search.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_wmimplant.eql,sha256=lg0DGdtKclCfZIzqZ-b2Vf8y08CbqnuncR4bl5dEW6Q,397
src/rules/windows__powershell__powershell_script__posh_ps_wmimplant.lucene,sha256=Azb93IXZqkKhrbix95ch09UZ_OWEGLlqRKZFeLcXFnI,413
src/rules/windows__powershell__powershell_script__posh_ps_wmimplant.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_x509enrollment.eql,sha256=bhzs0Z38eU2Ceo_tjodtvakcAKaE-TZenyQl3pfE44w,130
src/rules/windows__powershell__powershell_script__posh_ps_x509enrollment.lucene,sha256=pLNrUHzztYXYlyIPnFAs1fbffO0Th0oXynZ3ag7xTz8,116
src/rules/windows__powershell__powershell_script__posh_ps_x509enrollment.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__powershell__powershell_script__posh_ps_xml_iex.eql,sha256=B2p3hXpsNcmn8a0hTxg-klh1ShYMS2XEMWPkvTbuDSw,287
src/rules/windows__powershell__powershell_script__posh_ps_xml_iex.lucene,sha256=JeVlluxUfoPas3l79TkmSjB-Cp8JFyAI7orrpcb0YS4,271
src/rules/windows__powershell__powershell_script__posh_ps_xml_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_cmstp_execution_by_access.eql,sha256=fHNcaTRzCGg__azj6LGeOZK2K0yAlT-1C-gyWuM7_jU,52
src/rules/windows__process_access__proc_access_win_cmstp_execution_by_access.lucene,sha256=KwsMO8EwclWT-s33lowx1nDjR0MIEo5ICN8dszEZ31A,40
src/rules/windows__process_access__proc_access_win_cmstp_execution_by_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_cobaltstrike_bof_injection_pattern.eql,sha256=r8zea18lEdR41G2rxQ1raoLv_05FLLuYIii0u2Uv9Sg,319
src/rules/windows__process_access__proc_access_win_hktl_cobaltstrike_bof_injection_pattern.lucene,sha256=OnKlvaFbzYl8R2aQYrxv9zeoYWLNdYKQ4VHRj7_uRSE,337
src/rules/windows__process_access__proc_access_win_hktl_cobaltstrike_bof_injection_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_generic_access.eql,sha256=Xw8QgUG98p5Z2MkakmHln80_14CLa2zAAVHkwSAA4ZM,1953
src/rules/windows__process_access__proc_access_win_hktl_generic_access.lucene,sha256=zoQAVYoqVR2x-69DwtRdI6jDl1ptz0n_7M7HvcgYMRQ,1928
src/rules/windows__process_access__proc_access_win_hktl_generic_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_handlekatz_lsass_access.eql,sha256=UFKR1DcB71OkV2EthH_k7wuQvQtNaDSNGEalXetEkRQ,252
src/rules/windows__process_access__proc_access_win_hktl_handlekatz_lsass_access.lucene,sha256=F7uq3Gd9TGgZ_FAEd3kG2fP8F4x8kg7pGB7mlZ1IslQ,237
src/rules/windows__process_access__proc_access_win_hktl_handlekatz_lsass_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_littlecorporal_generated_maldoc.eql,sha256=FnuGIsBWzSW8VRrRiZYwxDUk9Jct_PAGER7JWrruZTE,172
src/rules/windows__process_access__proc_access_win_hktl_littlecorporal_generated_maldoc.lucene,sha256=RsIzfErwBLrbCY7LJ3KzrkuCunUTPilpNxUxyhgdnM0,157
src/rules/windows__process_access__proc_access_win_hktl_littlecorporal_generated_maldoc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_hktl_sysmonente.eql,sha256=M3gQ9jAZeRzK5HsRpBQl0i22imhz79chhWRpBQASfAc,463
src/rules/windows__process_access__proc_access_win_hktl_sysmonente.lucene,sha256=YRPF02vWGSGGYpD5tRpyZiSiwKWYANy0isW1ihqpYZs,442
src/rules/windows__process_access__proc_access_win_hktl_sysmonente.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_dump_comsvcs_dll.eql,sha256=DT9f6vdhwYjsRBEC3mf2anAmz4bkOXi1_Mv7F9t3DEo,144
src/rules/windows__process_access__proc_access_win_lsass_dump_comsvcs_dll.lucene,sha256=vVahN3Pjp4dE77sKy3tCsVfES5mXh2h_F5sAB029tLY,128
src/rules/windows__process_access__proc_access_win_lsass_dump_comsvcs_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_dump_keyword_image.eql,sha256=7RSL4s2LPOmguN9SwdUVJqD_DFcuIBBHxNFTU9oXtuI,318
src/rules/windows__process_access__proc_access_win_lsass_dump_keyword_image.lucene,sha256=PlB7WlzU05D58vgfkoWqeM2N486r-zuQsyezqt2z6MM,296
src/rules/windows__process_access__proc_access_win_lsass_dump_keyword_image.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_memdump.eql,sha256=jTS7b_FvmRnBabqrZ1yEP6zKfZHuexHoerQT-heW0xg,633
src/rules/windows__process_access__proc_access_win_lsass_memdump.lucene,sha256=ku1dDiVLhd-SDfsb_TjTKxDHwNUk0Kcta-fe4pzSc0E,593
src/rules/windows__process_access__proc_access_win_lsass_memdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_python_based_tool.eql,sha256=2vD0tywCJd6_464c3eSsBs1_TOmy5ZltzD7MOpcYFo8,375
src/rules/windows__process_access__proc_access_win_lsass_python_based_tool.lucene,sha256=TLzqm5z1aWoL6D-SPJ4VycKBTmt6sfeigwpTfa9ONuA,354
src/rules/windows__process_access__proc_access_win_lsass_python_based_tool.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_remote_access_trough_winrm.eql,sha256=X7O1sEu6tAXFEkXcSCZ7u4EJ9b7aU8nbS12zQEGoyuU,176
src/rules/windows__process_access__proc_access_win_lsass_remote_access_trough_winrm.lucene,sha256=JQbjggLsgi0hW73-u11c6bS6v-5l2mX1LzT8mVazlC8,161
src/rules/windows__process_access__proc_access_win_lsass_remote_access_trough_winrm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_seclogon_access.eql,sha256=yo_Y-Qy0NqMCRMTmOimD42k5mtw-rte0dzniN8AQAeo,189
src/rules/windows__process_access__proc_access_win_lsass_seclogon_access.lucene,sha256=K2e4o8B_ltLxyuWL4yxkfHQd62YEbccj60xnIevhoKs,171
src/rules/windows__process_access__proc_access_win_lsass_seclogon_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_susp_access_flag.eql,sha256=oZdmFsll3dOYrwczVCir7CLZMV5Xt9XCIfsz7JWg0dY,2060
src/rules/windows__process_access__proc_access_win_lsass_susp_access_flag.lucene,sha256=De3bc5wQfNUZDCxuQ0Gu21qzI6LF1D3P078BG3Zu1_M,1988
src/rules/windows__process_access__proc_access_win_lsass_susp_access_flag.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_werfault.eql,sha256=u8iSfAJZgUiewXtYNyQE6a2vR2Mfeh6kyjmH4JHsTcA,143
src/rules/windows__process_access__proc_access_win_lsass_werfault.lucene,sha256=Z0LISsph7-wkk-Rb7li10zCxpg8iJV5NvePQmbzlpAA,127
src/rules/windows__process_access__proc_access_win_lsass_werfault.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_lsass_whitelisted_process_names.eql,sha256=Qys0Pc_9aKVMthIg7u2moayxAw9ayrPdrTfdVMAta5I,382
src/rules/windows__process_access__proc_access_win_lsass_whitelisted_process_names.lucene,sha256=-a0a2iTtb0lve82ZSiewOcrLHwIr5Rv9Ut4ZW0WbZJ4,354
src/rules/windows__process_access__proc_access_win_lsass_whitelisted_process_names.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_susp_all_access_uncommon_target.eql,sha256=1LCoHD8j2eyLUTEkE5MjeoW1is63phMfdX2jtxW_7-w,217
src/rules/windows__process_access__proc_access_win_susp_all_access_uncommon_target.lucene,sha256=_o-JgUg8zF4eYjCcWmaGhOGbzLxIwRoM_tZ68oKcTq8,197
src/rules/windows__process_access__proc_access_win_susp_all_access_uncommon_target.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_susp_dbgcore_dbghelp_load.eql,sha256=nTqgi43U5ux5oVehRfICKMbq701-9V5guMeb5U55fUs,525
src/rules/windows__process_access__proc_access_win_susp_dbgcore_dbghelp_load.lucene,sha256=ZiLtMgjGT8m-HvXXVQu7Rnvzj3Dt-wnWnE5Xz9Owcts,501
src/rules/windows__process_access__proc_access_win_susp_dbgcore_dbghelp_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_susp_direct_ntopenprocess_call.eql,sha256=tgU8oF3OXkDLk_Y352U0r4tCjwDXp-MnK9t4Ib7Lt40,1987
src/rules/windows__process_access__proc_access_win_susp_direct_ntopenprocess_call.lucene,sha256=Bls4uYtvC5-b0MbPcADIhvNkYB9dOvS4_NuWGFIFovA,1950
src/rules/windows__process_access__proc_access_win_susp_direct_ntopenprocess_call.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_svchost_credential_dumping.eql,sha256=FsF6dqkUWOugnb-FJYxa1Lo4k8lHvpPRn_1s06V_gZ4,179
src/rules/windows__process_access__proc_access_win_svchost_credential_dumping.lucene,sha256=KuoFuibul_qMY2Nw7kVQLA7Z4V5XC7XAbqqcjs8fcdk,157
src/rules/windows__process_access__proc_access_win_svchost_credential_dumping.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_svchost_susp_access_request.eql,sha256=q3zQtSbY5tGUr3yHslQo0pKbCYaDDGcma6c7RLgRyxI,399
src/rules/windows__process_access__proc_access_win_svchost_susp_access_request.lucene,sha256=FkJ1cmIaFvbnd4ZJxLQTaZIigEOk9ldv68QmGGMQP5M,376
src/rules/windows__process_access__proc_access_win_svchost_susp_access_request.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_uac_bypass_editionupgrademanagerobj.eql,sha256=J-it4oHbhsT3hL2ZEFqbEo7DhTMPM6a98Ac6B1dRjlY,71
src/rules/windows__process_access__proc_access_win_uac_bypass_editionupgrademanagerobj.lucene,sha256=H5j-Qf-5XK3on82bXyFfLbn8Txkmv8Lf6SIbi3mSIq8,59
src/rules/windows__process_access__proc_access_win_uac_bypass_editionupgrademanagerobj.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_uac_bypass_wow64_logger.eql,sha256=1gEQQ98fKCwElEVXxYuHaeZYOp7CWboJ-21UnCfXOlQ,190
src/rules/windows__process_access__proc_access_win_uac_bypass_wow64_logger.lucene,sha256=GUt7YsaG1K9cxpmJzhHUhWbfBZ4c9_MEpxp40t-pWiM,181
src/rules/windows__process_access__proc_access_win_uac_bypass_wow64_logger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_access__proc_access_win_werfaultsecure_msmpeng_access.eql,sha256=MTA_s39858afQUh9JXNgz76UwDd6a7N2n_0meex3RUY,183
src/rules/windows__process_access__proc_access_win_werfaultsecure_msmpeng_access.lucene,sha256=Bn_QG1WNfsRu6AsmD3txoYLvoUkTaliRumPRJPH4ptg,161
src/rules/windows__process_access__proc_access_win_werfaultsecure_msmpeng_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_7zip_exfil_dmp_files.eql,sha256=32vvUglGA_FYZTgupEhNXO4D1qxXuQh1Di8LQ4UPOFk,246
src/rules/windows__process_creation__proc_creation_win_7zip_password_compression.eql,sha256=E9puGB0SK73oKzWvkW8Mdbj7bykne4skuggK7PE4kA4,265
src/rules/windows__process_creation__proc_creation_win_acccheckconsole_execution.eql,sha256=p8Z26mhUWLVYBx6F6Bzw2wZJnUZMJoS9Wn1W8jDq5oU,188
src/rules/windows__process_creation__proc_creation_win_addinutil_suspicious_cmdline.eql,sha256=d944aLJNiRdbGYpBcsvgReoOEanf4hvTXOTcz6F6hQo,582
src/rules/windows__process_creation__proc_creation_win_addinutil_suspicious_cmdline.lucene,sha256=slMVD3nL05Ke-nIsmtJSa-IY6yhmLxJfhVl_OXjla7w,548
src/rules/windows__process_creation__proc_creation_win_addinutil_suspicious_cmdline.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_child_process.eql,sha256=ikSdV3d4w8y28_zABw1xfmMaUPAT8PSQBBAD8QaVHmU,209
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_cmdline.eql,sha256=pJShVnTcawRUiQXn2MTYgLyR13pfAmAsR7O-gO0OKD4,534
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_dir_exec.eql,sha256=vseWP2_gQB0Jor8Vewb3EBIyVOCNwctPHQsnvUoDZzI,344
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_dir_exec.lucene,sha256=uymP0PBp44jAkc9eWh_vUr6S-e2vk2uUvalHigYPW90,327
src/rules/windows__process_creation__proc_creation_win_addinutil_uncommon_dir_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_adplus_memory_dump.eql,sha256=6okPZvSegDeSRUY6pBLDLdbCEdG-InEpjpBzFL92PFw,205
src/rules/windows__process_creation__proc_creation_win_agentexecutor_potential_abuse.eql,sha256=Y_Y_nMBbXRTCNYWwCTw1POf47nnqr1W-1CBbqTfCn3U,279
src/rules/windows__process_creation__proc_creation_win_agentexecutor_susp_usage.eql,sha256=6jsGYnXZ7abJVwYK2ESFDrNfCvQ0AsJBfI9nC0jlEOE,421
src/rules/windows__process_creation__proc_creation_win_appvlp_uncommon_child_process.eql,sha256=0FGvaCWzNe4cfMwi-LhJrRWcB0CV7YJkTDhWKl1UqLU,528
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_exectuion.eql,sha256=VBvZF3jl_Q6HkdTD-3BsaosGfP3jegX0EygKL9hafTs,268
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_exectuion.lucene,sha256=GDTyJHtt_G_mTOecBAyiqwCIhgV9A1HG2H7uLNB4ASE,252
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_exectuion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_susp_child_process.eql,sha256=8F6-xCs42UrAxnxbv2oBCL-YB_Upk-tn55bHLi6tPAE,337
src/rules/windows__process_creation__proc_creation_win_aspnet_compiler_susp_paths.eql,sha256=Qx0WscD5ynGr2oj-8Lg3kTSNVjVVjyJqsOWnqirFzmI,480
src/rules/windows__process_creation__proc_creation_win_at_interactive_execution.eql,sha256=wMENX3qZVFFkk8XELuAXt8NeIgRgdWB87aX1cbLpm64,82
src/rules/windows__process_creation__proc_creation_win_atbroker_uncommon_ats_execution.eql,sha256=ede5Xj7gPo1By8tDfCqPDpfysYCaHQmTdAv6FUxbUXM,813
src/rules/windows__process_creation__proc_creation_win_atbroker_uncommon_ats_execution.lucene,sha256=ORAMkBBZ6y8A6z5DNbm4ZNW6rXXguH2lRBW1hxqudd8,787
src/rules/windows__process_creation__proc_creation_win_atbroker_uncommon_ats_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_attrib_hiding_files.eql,sha256=VTuTo0QILTk6sIQCIPAQCKSbVcvLXazfF1uTT3iQq3A,340
src/rules/windows__process_creation__proc_creation_win_attrib_system_susp_paths.eql,sha256=8S3z46XotL9n2M0eixj9uQt4MQMA3oaWkJn3V9wQ65o,467
src/rules/windows__process_creation__proc_creation_win_auditpol_nt_resource_kit_usage.eql,sha256=lMLUhEryk55ylzdSsBU6tu67UvI6wL-Fidp1A1ql-Zc,164
src/rules/windows__process_creation__proc_creation_win_auditpol_susp_execution.eql,sha256=oIhwANmtu1kfRs4HwsV8JCo4CqisflK3OBOXtPiHU0E,180
src/rules/windows__process_creation__proc_creation_win_autorun_registry_modified_via_wmic.eql,sha256=MT5qisA_QmlFsdgMatj9RWOeA4GMYRC7ZWlvGowFaQ4,912
src/rules/windows__process_creation__proc_creation_win_baaupdate_susp_child_process.eql,sha256=TtaaebdSbBUyFSphTv5Z7HNodmnS8Ido1qsU1GpmyR0,291
src/rules/windows__process_creation__proc_creation_win_bash_command_execution.eql,sha256=NFfRbRlbABCTwabTlsZpdgS51y7zarPfZSRq81fYjLY,188
src/rules/windows__process_creation__proc_creation_win_bash_file_execution.eql,sha256=4hyN9_oLCeHnQMXpwf1SfCWIKcSj4pDqGQBj4vj-UEo,380
src/rules/windows__process_creation__proc_creation_win_bash_file_execution.lucene,sha256=X0Ow4rk65NgkuekmYLGol_O1Z3_XJhp8w9BPEa9FifQ,352
src/rules/windows__process_creation__proc_creation_win_bash_file_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bcdedit_boot_conf_tamper.eql,sha256=HQwnmqqaFw-FEZvRCts1qqtyaa9LwA6RVLlL88xKSzo,303
src/rules/windows__process_creation__proc_creation_win_bcdedit_boot_conf_tamper.lucene,sha256=HJytNAecaM_6cw4bM8ZjDUxNg3SRsp9SFHELkshuUmY,279
src/rules/windows__process_creation__proc_creation_win_bcdedit_boot_conf_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bcdedit_susp_execution.eql,sha256=0tR-aP7hzX550dqXhWU744pNuZXVHjhZ3DSbV3Hrlq0,197
src/rules/windows__process_creation__proc_creation_win_bcp_export_data.eql,sha256=dvC8O2CXE9hd4d5edxx2RN7dk9bkXjJ8RIdGBMM7jWA,148
src/rules/windows__process_creation__proc_creation_win_bginfo_suspicious_child_process.eql,sha256=pMDjyc96uQZbYjqlVJL5qIWc90luzuj0AWlpZUaK6VU,407
src/rules/windows__process_creation__proc_creation_win_bginfo_uncommon_child_process.eql,sha256=9ZIFzjAb0QRI4eWrwXmkr__629hg_eGO8Akv2eQDlDg,79
src/rules/windows__process_creation__proc_creation_win_bginfo_uncommon_child_process.lucene,sha256=9AMLtPl3d_1Zgh9_9EbtQkKlDKiKgwC0IvgBgQkIZ5w,61
src/rules/windows__process_creation__proc_creation_win_bginfo_uncommon_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bitlockertogo_execution.eql,sha256=Vrm01hstvm2qsVJ3kjGV8eoddHVZPuZ_MqtXkAxW1Zw,52
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download.eql,sha256=J_7NP0xoBz1Not1qwxrqLIy4KROueRebHRk2tZpC6DY,242
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_direct_ip.eql,sha256=yz24EUKf0Fo7QAzju5OfLw_Nm0Ly5uXnerdDq-xFIMI,348
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_direct_ip.lucene,sha256=9A2ufQmzh0gxt-zXjx5fY7C-m7HenDje52GkzC25zIM,356
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_direct_ip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_file_sharing_domains.eql,sha256=G2e2o7LZL3ccdTb3PzmB8S3zs0wg_A_RosEmhlFSHA8,773
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_file_sharing_domains.lucene,sha256=gkMr08xUhqyKubKVJpEIdc-Do2EODDvu8W6tfsSxfnM,752
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_file_sharing_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_susp_extensions.eql,sha256=lzpUMGPiS2nU5A8Jrl8iFBQDtmz0oNMxiOiPa036fqE,541
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_susp_targetfolder.eql,sha256=nhziqci8mjPoJSUJkqLPQwbdCwEwCcSnqMA70UnRufI,410
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_uncommon_targetfolder.eql,sha256=6cRvyScwHlUu7iSegYvvV4V4j_j4G6-c0x1-uQxsSuc,300
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_uncommon_targetfolder.lucene,sha256=T8frkPn2D3l56KhVdek5p5NOpc4AJAq1wS7YLJJ82nI,280
src/rules/windows__process_creation__proc_creation_win_bitsadmin_download_uncommon_targetfolder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_bitsadmin_potential_persistence.eql,sha256=R6uN64GXzCJVguXvS7wHdvdSpwcHw2tbYueQiFE7IJM,347
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_debugging.eql,sha256=ZiYM9AauHvLFLPfL2IqhlFDzwybYa-3bsjoL5AV3Utk,140
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_exec.eql,sha256=0gxKzKJhnEOvi8Ka70JWhGa5NJCUIIYZCdHKLrNOZp4,162
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_exec.lucene,sha256=iWAqxuRPjC1Ne5JZbO2sM6RkneiiLkWZYZeByXpjXsI,144
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_headless_file_download.eql,sha256=quTfiMzbfUaDwMGHvMjz28mZ0FH43oSH4Pbq_KJ-Ghs,1291
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_load_extension.eql,sha256=p_AanphjieQFJZpmUhj6f-MDnDR9w8EiSHSXJ4JqbiA,169
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_mockbin_abuse.eql,sha256=lyYyGDeAD9ZQEVvlDS-64bTNYNLqtWpfd5wW75qFmlk,230
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_susp_load_extension.eql,sha256=YrpQWAHOoXX5lPOPlc1CgFeOIc-scrHwAkChyO2aj80,348
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_susp_load_extension.lucene,sha256=0aNBaKCRgZmn6_1DzNshOcG_fHiRD1aZ0Cip5LtJNRk,324
src/rules/windows__process_creation__proc_creation_win_browsers_chromium_susp_load_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_browsers_inline_file_download.eql,sha256=X5f1pd-Zq7aiZGDlQFg7J9fFnyblfIlYTzQpvc0IqWY,444
src/rules/windows__process_creation__proc_creation_win_browsers_remote_debugging.eql,sha256=AVTthyoN7tJ0WBdyYGsXgT3XXp1y-2AIaZ5jPpoFQ4U,150
src/rules/windows__process_creation__proc_creation_win_browsers_tor_execution.eql,sha256=VxdhFze83TdltQvRybBTl9jZNq6IQUqAd2lNheyVOlQ,168
src/rules/windows__process_creation__proc_creation_win_calc_uncommon_exec.eql,sha256=ukSAkrE9QR1eTG6r4CX1rjq6kfDGTjorwWl-lDrbbxU,202
src/rules/windows__process_creation__proc_creation_win_cdb_arbitrary_command_execution.eql,sha256=T6qJ6nEbvOvNAhaAfGEqhlfKy3QJmYJKE-Z_WYm3rdc,142
src/rules/windows__process_creation__proc_creation_win_cdb_arbitrary_command_execution.lucene,sha256=jNYlSZP2LrT95e8iUiy9_ct_h7sSV8GDhOdwV6poC84,126
src/rules/windows__process_creation__proc_creation_win_cdb_arbitrary_command_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_certmgr_certificate_installation.eql,sha256=_VpPB1RYRQ9XH-9EmQqMLn8cJD1OL-b_j-rK9pmyeDM,165
src/rules/windows__process_creation__proc_creation_win_certmgr_certificate_installation.lucene,sha256=GvkUHaaCSqg0xccqrEwxIuu9j4J9PLrwl5u4vSLkYcE,148
src/rules/windows__process_creation__proc_creation_win_certmgr_certificate_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_certoc_download.eql,sha256=nz1ZiGtI2Z7FCAjdpLeG8L_gGWIpvN3QlTAqxFKOahs,169
src/rules/windows__process_creation__proc_creation_win_certoc_download.lucene,sha256=QzUfvIxrNJkJYjc22ecwVo2P3Y3WkyNsWVtYabWNUyA,152
src/rules/windows__process_creation__proc_creation_win_certoc_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_certoc_download_direct_ip.eql,sha256=C82xqNaFpBigRPHqRn0bPECu-8xrdmakm9w6VB5VaTY,274
src/rules/windows__process_creation__proc_creation_win_certoc_load_dll.eql,sha256=Gn3r84LLd7dm5IA-QXJQFL-AeA70Dl9663QmDez1yOw,211
src/rules/windows__process_creation__proc_creation_win_certoc_load_dll_susp_locations.eql,sha256=AvjAtddhMIhyHf6S7UrC1Dnx3j6bPgMzijoFfDVFvAE,379
src/rules/windows__process_creation__proc_creation_win_certreq_download.eql,sha256=QZnxosrGY2fnyYewo0OM91U-EpF7Sj8nD3MJyacyyLo,325
src/rules/windows__process_creation__proc_creation_win_certutil_certificate_installation.eql,sha256=GgvZyjO8Lnq6g_8xVz1JIDBuZuSPC8FjAKpZiHiteSY,244
src/rules/windows__process_creation__proc_creation_win_certutil_certificate_installation.lucene,sha256=qOcF87rcFqkYXyzp1IJlaI09BTpaOYbmtZNW8vIcsXk,222
src/rules/windows__process_creation__proc_creation_win_certutil_certificate_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_certutil_decode.eql,sha256=8vQHrZt0g-GCHbVKZvELJEX0M2JDLtdaUnGl-yADjWo,329
src/rules/windows__process_creation__proc_creation_win_certutil_download.eql,sha256=hjZ7w0VDVtByty_uGDmGNy7xT2apdVmk56daIB7eRL0,206
src/rules/windows__process_creation__proc_creation_win_certutil_download_direct_ip.eql,sha256=WVe_qWvUyfdL3ikVBU1Zkt_1X_-Tk1NfO_Ox7KOKD9g,339
src/rules/windows__process_creation__proc_creation_win_certutil_download_file_sharing_domains.eql,sha256=uGCpARPt7nT5FwGUOcW7RHVyp9H8nEJgsP3uy9F3AG0,780
src/rules/windows__process_creation__proc_creation_win_certutil_encode.eql,sha256=tW9jF2KZpJMMFdfHxnKZpZEO8ct8qxSMCAeCe2I3o9U,200
src/rules/windows__process_creation__proc_creation_win_certutil_encode_susp_extensions.eql,sha256=H6NuRfi6SpRhAOiq9oswpd63jG5jnq2GK2qVLApu7fQ,365
src/rules/windows__process_creation__proc_creation_win_certutil_encode_susp_location.eql,sha256=jXvI95aSZQJZoPBZqWL7m4SYtQsXvP_Zqll_4OHNwHM,374
src/rules/windows__process_creation__proc_creation_win_certutil_export_pfx.eql,sha256=Z57Nuk05zZuL_o3s5dsAKPtaC-GbRfN4QeYWm1spRtk,220
src/rules/windows__process_creation__proc_creation_win_certutil_ntlm_coercion.eql,sha256=X2NjVNX35S2H7pqBdo6c-8RkkSLgj-jnmz0s6wNnIQY,175
src/rules/windows__process_creation__proc_creation_win_chcp_codepage_lookup.eql,sha256=5cR3JlpiTrNYX6ihyBev1fwn1c2iADrR2YHgcZIT9nI,435
src/rules/windows__process_creation__proc_creation_win_chcp_codepage_switch.eql,sha256=NzKlmiGANoz4-qe4JdfW_pGZ6PvlVi9ISfg-HL54M8Y,96
src/rules/windows__process_creation__proc_creation_win_cipher_overwrite_deleted_data.eql,sha256=yFnZl7ZCZF_MDU_yvNXiq8W8StISr_FphLWTWogzNyI,127
src/rules/windows__process_creation__proc_creation_win_citrix_trolleyexpress_procdump.eql,sha256=PHWKGr5K0KdKUBzgirafwOT9m0XzIJldaB0n_4gUlnM,392
src/rules/windows__process_creation__proc_creation_win_clip_execution.eql,sha256=4bJLYSQ3Ix6p-m8gaktpwbYgwK2jqJnKdk1snzKLJ9E,87
src/rules/windows__process_creation__proc_creation_win_clip_execution.lucene,sha256=x8_xb2moHcvSoXf_fmx6gtmOW5ntRCBEM6YCbTDQRf8,73
src/rules/windows__process_creation__proc_creation_win_clip_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cloudflared_portable_execution.eql,sha256=15p_cephC4MTTLFQDiAHCSULku9gGgUp3RbYmR-NS2k,166
src/rules/windows__process_creation__proc_creation_win_cloudflared_portable_execution.lucene,sha256=KwCb4TjrLFq26NcSSP5E9tW7B1pk-av5wCyurMWkiVI,153
src/rules/windows__process_creation__proc_creation_win_cloudflared_portable_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cloudflared_quicktunnel_execution.eql,sha256=g0TnktN5fczLJsZLYwk5u7JZGGHJ7dmPYngo5C-6Fv0,3314
src/rules/windows__process_creation__proc_creation_win_cloudflared_quicktunnel_execution.lucene,sha256=07x8s7ufyPFev5U-sKHM6MA5OOd91aUK9Y8cFevK0fQ,3323
src/rules/windows__process_creation__proc_creation_win_cloudflared_quicktunnel_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cloudflared_tunnel_cleanup.eql,sha256=W9fBs1_mfbPihRp6_BPleBqRbcNPg7dbBmgLq3YcPUs,152
src/rules/windows__process_creation__proc_creation_win_cloudflared_tunnel_run.eql,sha256=JPWOZGjfxLQnvwVZ1_RnSZ-q8KIS9F_0lBWG5VMWxbc,194
src/rules/windows__process_creation__proc_creation_win_cmd_assoc_execution.eql,sha256=TCJRy8VJhS-n1a8kQUrut4Ua9avVl0s1l84Ejpz3wOI,122
src/rules/windows__process_creation__proc_creation_win_cmd_assoc_execution.lucene,sha256=qoduvefRh-ihkpiEAvcyp-S7y4SjVqJp4agulL4FU3A,106
src/rules/windows__process_creation__proc_creation_win_cmd_assoc_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_assoc_tamper_exe_file_association.eql,sha256=SrXh2wYTBl2JBQrr65eu3OtKDXvU9gCqVIvyViFq3Cw,212
src/rules/windows__process_creation__proc_creation_win_cmd_copy_dmp_from_share.eql,sha256=nKZcjbYb_HtSUXQO0emb7SRu3RNToSDMT3eTWopY4QA,225
src/rules/windows__process_creation__proc_creation_win_cmd_copy_dmp_from_share.lucene,sha256=y_tE1VAQSdtRvKuc0yhKJi2fN75RE_De0NQLaice4SA,201
src/rules/windows__process_creation__proc_creation_win_cmd_copy_dmp_from_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_curl_download_exec_combo.eql,sha256=9Y9pBBzKcQNff5Xh7gNOl9nFpkT5iZOo8uY4RLs4EpI,228
src/rules/windows__process_creation__proc_creation_win_cmd_del_execution.eql,sha256=vwrE1t0oBwKlQjdAdS5OG9pn3Y21YVKoxK33NqgWPH0,392
src/rules/windows__process_creation__proc_creation_win_cmd_del_greedy_deletion.eql,sha256=Bb60l-gSut3MHaSfnK9mrIJVnenA1Rb52Znv4I-_Kek,228
src/rules/windows__process_creation__proc_creation_win_cmd_dir_execution.eql,sha256=VjE4UGpagtqYrxKvIMSx3eGRsQunFhF6pPVCKfmDc1o,185
src/rules/windows__process_creation__proc_creation_win_cmd_dosfuscation.eql,sha256=qkibOacMG9nzSdOA58v1mV54Ejb71qjmAD0r6pIacvU,205
src/rules/windows__process_creation__proc_creation_win_cmd_http_appdata.eql,sha256=YhTTdb1UTwT2oo9SkPMIXI8_kqUxIWb7rStpvsP2FsA,150
src/rules/windows__process_creation__proc_creation_win_cmd_mklink_osk_cmd.eql,sha256=aEw3ZOWr43f8Qqd2IJjBh0K986fdWJxHFtBRVAYN0i8,203
src/rules/windows__process_creation__proc_creation_win_cmd_mklink_shadow_copies_access_symlink.eql,sha256=YhNGAiUPruIhNEyYes8MwGMtoK_dSinbyLkrb8IaCRo,96
src/rules/windows__process_creation__proc_creation_win_cmd_net_use_and_exec_combo.eql,sha256=F-OudI_b1p7381tQeN71dY9wwJqFSFQ-yoBqbYBl548,306
src/rules/windows__process_creation__proc_creation_win_cmd_net_use_and_exec_combo.lucene,sha256=VXZEbHQgnvTjaUXaVyfDrppqLRTM1S03qqy3rG6mJLA,291
src/rules/windows__process_creation__proc_creation_win_cmd_net_use_and_exec_combo.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_no_space_execution.eql,sha256=RgSyarAKBdamUKAkCJAkXHi-vfHn3vEMAvoegaYw0Ho,751
src/rules/windows__process_creation__proc_creation_win_cmd_ntdllpipe_redirect.eql,sha256=lKADREK0LUV4E0zlau95q5vbS-ourW65XDo6zjCZY8I,195
src/rules/windows__process_creation__proc_creation_win_cmd_path_traversal.eql,sha256=dbmf22rRC7I3H9j7MW01UhMvhaskPoNF3L6QMD-n03g,418
src/rules/windows__process_creation__proc_creation_win_cmd_path_traversal.lucene,sha256=_ak_SeVpLBZlh5deQGPfI7tWLuus1kZ0BfVBHKR6xfc,395
src/rules/windows__process_creation__proc_creation_win_cmd_path_traversal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_ping_copy_combined_execution.eql,sha256=ga3RSHd-zjIZKc_DC1NA18lrqJWidlb_QU8kiy8FARE,334
src/rules/windows__process_creation__proc_creation_win_cmd_ping_copy_combined_execution.lucene,sha256=f6KvDox1u8txaCAOVHprlLSWSxTTdz6OzpmINAT-Lm8,325
src/rules/windows__process_creation__proc_creation_win_cmd_ping_copy_combined_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_ping_del_combined_execution.eql,sha256=3bmz5K8x1EmJp6DTz-JYBQK2RA7X8gK-FVh-Tyqj4gc,374
src/rules/windows__process_creation__proc_creation_win_cmd_redirection_susp_folder.eql,sha256=dOoSn4QQtwQsMnxElIuiHjdvJO9bXl5luYpF1wsaaj0,434
src/rules/windows__process_creation__proc_creation_win_cmd_redirection_susp_folder.lucene,sha256=fLgSkWNQYLBxxhEELi0vEOl9GTdG--e6e0jz6u6e9Mw,417
src/rules/windows__process_creation__proc_creation_win_cmd_redirection_susp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_rmdir_execution.eql,sha256=3bjuEUNK1ngwWuDS2DUumVeVJK5YA6mNU2GUBrprW5U,172
src/rules/windows__process_creation__proc_creation_win_cmd_shadowcopy_access.eql,sha256=72BF2q7FKCyuiQ4dU0wyMaIstaYBOx6LZz3vu8t8IRo,121
src/rules/windows__process_creation__proc_creation_win_cmd_stdin_redirect.eql,sha256=QN--5NVUSNVmh-YtMbCh9nHbqaGnMeBsPz-bKx2bvuM,118
src/rules/windows__process_creation__proc_creation_win_cmd_sticky_key_like_backdoor_execution.eql,sha256=iHSHQ8R2q3Mt-2kDtaLonZ5pdQT2GvPgOHDOKEOstdo,376
src/rules/windows__process_creation__proc_creation_win_cmd_sticky_key_like_backdoor_execution.lucene,sha256=ErCE1nG9Jb3CzpUKoUZRqvwiLnsUl4qF6lumAqJ5hS8,348
src/rules/windows__process_creation__proc_creation_win_cmd_sticky_key_like_backdoor_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmd_sticky_keys_replace.eql,sha256=NGWu75O1G2tcL8yGn2P8aqyZ4Cseg4HT8S5e5lK_GHU,167
src/rules/windows__process_creation__proc_creation_win_cmd_type_arbitrary_file_download.eql,sha256=DXWv5NvbL-VhEr3cI7-bfJ0uaIA9EsmezGIXX7I-Bng,149
src/rules/windows__process_creation__proc_creation_win_cmd_unusual_parent.eql,sha256=qG4itU-PTxqlpDjnFPP3qqKQnj4llHKb7FfmE1ogdwo,546
src/rules/windows__process_creation__proc_creation_win_cmdkey_adding_generic_creds.eql,sha256=CdvYQqibGiHGSUq6RayCqFX75QUoUoa0lI_AU84IdnA,342
src/rules/windows__process_creation__proc_creation_win_cmdkey_recon.eql,sha256=gK3hWKK_tP7WQ_y01i6MJi3wrpFLZ-89fBfmQeNDm-Q,176
src/rules/windows__process_creation__proc_creation_win_cmdkey_recon.lucene,sha256=if3SfuTh3M0nHksfU4Gf9KYwjTFztq20xvf4GD859Mo,161
src/rules/windows__process_creation__proc_creation_win_cmdkey_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_cmdl32_arbitrary_file_download.eql,sha256=jBN8c9RmylUUzwkB8GYu6DULa-N2pgqHx7yVMoE1q3I,163
src/rules/windows__process_creation__proc_creation_win_cmstp_execution_by_creation.eql,sha256=i9zskmco9u3DbEPSGZkyn7Ntlu2oAf78uyeCynIK5zo,51
src/rules/windows__process_creation__proc_creation_win_configsecuritypolicy_download_file.eql,sha256=AYObkxrfC6Hx5QE4LB9TYtSxhdKPFQerCVzmGZuT-Fs,247
src/rules/windows__process_creation__proc_creation_win_configsecuritypolicy_download_file.lucene,sha256=u-0U2sCx4ebI3jy2v5oKntkgMxt1t2h_mv8cQogVcYw,232
src/rules/windows__process_creation__proc_creation_win_configsecuritypolicy_download_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_conhost_headless_powershell.eql,sha256=WLcpQTb9QXBV1AlO763mwMOt4vTD20Llr-0r-lhIXVc,177
src/rules/windows__process_creation__proc_creation_win_conhost_legacy_option.eql,sha256=Tf8s53HV2DGgyEcNhD9CI4tsRQwgPSLKiSeA5Ojk0cM,197
src/rules/windows__process_creation__proc_creation_win_conhost_path_traversal.eql,sha256=aw3SP6g9Tvqhx84o80NvELKUMebgr1B6aAu1S5CgGzA,87
src/rules/windows__process_creation__proc_creation_win_conhost_susp_child_process.eql,sha256=tBhYQggyyuwgkN0FQ4ESqMTUVV86L3j5dHx8WJ2FFho,246
src/rules/windows__process_creation__proc_creation_win_conhost_susp_winshell_child_process.eql,sha256=VN6GZqhrMTJASrC6rbGNuyaDdNLaLTv4-IjwYfBzYyk,397
src/rules/windows__process_creation__proc_creation_win_conhost_uncommon_parent.eql,sha256=Zuvo2FW8d37rU34965zshT3GWY3NdgCrrci-y0H21zg,825
src/rules/windows__process_creation__proc_creation_win_control_panel_item.eql,sha256=4bOsH6cudMNarzB_AEv4ht8ZWekgag7P5J-Nn_A-WZg,440
src/rules/windows__process_creation__proc_creation_win_createdump_lolbin_execution.eql,sha256=w0Zqb8u_FuUrHF6g2j4vniIUE_N_8wVdQV3ITiWWMbE,203
src/rules/windows__process_creation__proc_creation_win_csc_susp_dynamic_compilation.eql,sha256=qL07PLsXdwN8IoNjQsH9nh63_0qu5xqeZ2XzcTQHatQ,1883
src/rules/windows__process_creation__proc_creation_win_csc_susp_parent.eql,sha256=0ZE2A5NFT4TDe8ONYNuNeQTVXdOvphyh37BXF1pOBw4,2242
src/rules/windows__process_creation__proc_creation_win_csi_execution.eql,sha256=BC72hOvcFwK40gLGfS2Jijl5ym3KGxrnGX5Q1hFYiyw,181
src/rules/windows__process_creation__proc_creation_win_csi_use_of_csharp_console.eql,sha256=iJX0Q0jwzXvTzkDM5QBYbR4VoSFaJzX1D8nMZlbf2aw,186
src/rules/windows__process_creation__proc_creation_win_csi_use_of_csharp_console.lucene,sha256=IbmyOq8BTwjSbvz7XunYGN5TsZ0nm_qPkwJXDFpzsrw,164
src/rules/windows__process_creation__proc_creation_win_csi_use_of_csharp_console.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_csvde_export.eql,sha256=L2gygH4uM0L5FZfMSJ_9WPblpqRvNQvJ3HW2v3EWCw4,165
src/rules/windows__process_creation__proc_creation_win_csvde_export.lucene,sha256=WC-NYDIziwBClwKZqTgeYQ7QVqaUc1TFQv0UslYPhyU,151
src/rules/windows__process_creation__proc_creation_win_csvde_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_curl_cookie_hijacking.eql,sha256=8T0jpV5KOAZsXFXxZRDbRalxFRgxLUUA__CwQMsvb6Q,214
src/rules/windows__process_creation__proc_creation_win_curl_custom_user_agent.eql,sha256=i-YtHi5Kyh6BcTU2phxWZ0I5mMhQy9UOuF6fjCsC6Rc,229
src/rules/windows__process_creation__proc_creation_win_curl_download_direct_ip_exec.eql,sha256=6EZqnZ98tdTiXrr9QXHkF1XDsnYPiLB1vCsSX16j-uk,808
src/rules/windows__process_creation__proc_creation_win_curl_download_direct_ip_susp_extensions.eql,sha256=AbfaeGPZJWnYvYvd3K83w-iGCshY1nTQ5Fls8o1cR0A,800
src/rules/windows__process_creation__proc_creation_win_curl_download_susp_file_sharing_domains.eql,sha256=6xtf7gkhAJbuL1Yox9o75HYlr1GU0M24j2LyiiQaO70,1164
src/rules/windows__process_creation__proc_creation_win_curl_download_susp_file_sharing_domains.lucene,sha256=ixc87F92ru-m6TMHameWRVeEEgzWdPyYj-eARice6AI,1131
src/rules/windows__process_creation__proc_creation_win_curl_download_susp_file_sharing_domains.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_curl_insecure_connection.eql,sha256=h8PbM39hIeGEYj41dTKVfkNi8wYYpp5vgz8QljHZs6U,212
src/rules/windows__process_creation__proc_creation_win_curl_insecure_porxy_or_doh.eql,sha256=FtYgWTx9DMvPEE2YdnyPbF7METNw8mLQhP-zzMJvOLs,165
src/rules/windows__process_creation__proc_creation_win_curl_local_file_read.eql,sha256=eA8MeeCo3U460542lFahqNhSfIsAXjZmQIN8ZCCIxZA,127
src/rules/windows__process_creation__proc_creation_win_curl_susp_download.eql,sha256=b_KSRVmGu8HMKJlSIfcnlMcRwKrTPXXPwpRj1ZYUlt0,729
src/rules/windows__process_creation__proc_creation_win_customshellhost_susp_exec.eql,sha256=WD0MHomB-X-N6rsAQvKh3hfTjHMpQpD2XvW-5fKpPzg,118
src/rules/windows__process_creation__proc_creation_win_dctask64_arbitrary_command_and_dll_execution.eql,sha256=-do37oh0Q5JstjVzaEyGbBIFXZG5sJP_iVEHpFjBqbY,358
src/rules/windows__process_creation__proc_creation_win_defaultpack_uncommon_child_process.eql,sha256=_bDMfMgaA7HZCIXhj-sk0BGLa5eHUzCFq_6Qx_IVjPI,57
src/rules/windows__process_creation__proc_creation_win_defender_default_action_modified.eql,sha256=uKgq6mS-retlxzl23_xcarAfQEqakdemmXfpfxHwdbo,344
src/rules/windows__process_creation__proc_creation_win_defender_remove_context_menu.eql,sha256=SDjk4Yi_UKKNpVLxAQI-KifAmx_uCCuVDblzIL4imnE,354
src/rules/windows__process_creation__proc_creation_win_desktopimgdownldr_remote_file_download.eql,sha256=gW27Dx29Gbobbqy6LhpjikCeXNR1W0mXQ5Uc5ALqJJo,162
src/rules/windows__process_creation__proc_creation_win_desktopimgdownldr_susp_execution.eql,sha256=9J4DmCb_ip4RhOtdt84J23Q_PU28RHzdCD8MDWkXawI,216
src/rules/windows__process_creation__proc_creation_win_device_credential_deployment.eql,sha256=j0C3SObAh6EuUqf21oPBmshyeBATiqzXjeww66t8JIQ,65
src/rules/windows__process_creation__proc_creation_win_deviceenroller_dll_sideloading.eql,sha256=mxo5KjA8zIncO_3MWLt9OqBeovk5hghnd56ippaBqtU,153
src/rules/windows__process_creation__proc_creation_win_deviceenroller_dll_sideloading.lucene,sha256=eDY_pONjNUaz1L10AZfqe-NdprJ9i5uNylAk7F3G71M,138
src/rules/windows__process_creation__proc_creation_win_deviceenroller_dll_sideloading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_devinit_lolbin_usage.eql,sha256=bHlEKf9oH3jYWk-Puqj8ZFIuAIBc5CmPzhIDt4kcoDQ,90
src/rules/windows__process_creation__proc_creation_win_dfsvc_suspicious_child_processes.eql,sha256=EOWtBf25rIprtP-nLT6fdMNdixGF5sJsEQNWmrWkPf0,391
src/rules/windows__process_creation__proc_creation_win_dirlister_execution.eql,sha256=A587rXp09j2HbITVJfreJJLuhBcTtRa2f8YMcjzWtTA,97
src/rules/windows__process_creation__proc_creation_win_discovery_via_reg_queries.eql,sha256=wQhrvW8d0e4n9DK-fVOk6H-2i7YiV7SmJ9rLVqtS_5E,601
src/rules/windows__process_creation__proc_creation_win_diskshadow_child_process_susp.eql,sha256=2Z1agkniVZUp6qXTGDCh9H8en14tycyoFYgaRiCMlvw,233
src/rules/windows__process_creation__proc_creation_win_diskshadow_script_mode_susp_ext.eql,sha256=Y8vRRHXeGU_-1NzWuLuPbghXySPNJ2cjBrXZL64fVKc,226
src/rules/windows__process_creation__proc_creation_win_diskshadow_script_mode_susp_location.eql,sha256=DXR0z5VDYmx2wY26gjdoXMdJRA5YBaEZT23z5kslUhg,345
src/rules/windows__process_creation__proc_creation_win_dism_enable_powershell_web_access_feature.eql,sha256=9kC2tPhXoeyLnrFhn9nJ65-G9ImEztGjJ1Z3XOTlH7w,229
src/rules/windows__process_creation__proc_creation_win_dism_remove.eql,sha256=P7bELZQCYYQg4xz2HLzLE3f36Pz8Cbx3_KlkTqwfUVs,271
src/rules/windows__process_creation__proc_creation_win_dism_remove.lucene,sha256=1388z6pDWNFXAbts5KKpJpTD44TqLpLKGnK7eT5Bofg,255
src/rules/windows__process_creation__proc_creation_win_dism_remove.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dll_sideload_vmware_xfer.eql,sha256=MvoHLnyBAYzKcYhOH4jUFFzQTkZS-YN98T8nG1Qngok,112
src/rules/windows__process_creation__proc_creation_win_dllhost_no_cli_execution.eql,sha256=BigMoZXuu-fMtqCRBHpxwkcbiyfuMBKO9FIyc9fCbUA,190
src/rules/windows__process_creation__proc_creation_win_dllhost_no_cli_execution.lucene,sha256=vkko0qoe_B_u6m-5tdmFozhWF45Dham2uhOE8uFKXKM,173
src/rules/windows__process_creation__proc_creation_win_dllhost_no_cli_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dns_exfiltration_tools_execution.eql,sha256=vMwbrO1jF2S4-5eaZvnm5NVNGvHL_tR2SV5mgvrrqE0,68
src/rules/windows__process_creation__proc_creation_win_dns_susp_child_process.eql,sha256=keXiXA7jIcEFU3oVF6fy0MXMOafXlNIZDqDWSbqkfmg,95
src/rules/windows__process_creation__proc_creation_win_dns_susp_child_process.lucene,sha256=5QC00NxXSutoUuncYM7FoCkgSrcduVuCQpkenhmg52I,81
src/rules/windows__process_creation__proc_creation_win_dns_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dnscmd_discovery.eql,sha256=pZJWN-UQzUxp1-fAIjMXDGMCDTg_pDYXCQfUF_IGKnQ,140
src/rules/windows__process_creation__proc_creation_win_dnscmd_discovery.lucene,sha256=D7-ROfamSlY9ApCagSpBF134ZDt6xduVko6a7Rry4Qg,124
src/rules/windows__process_creation__proc_creation_win_dnscmd_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dnscmd_install_new_server_level_plugin_dll.eql,sha256=-lIUY8rvACAad9VbbBZep2XRmWsxDYYZVVI03nHSxs0,135
src/rules/windows__process_creation__proc_creation_win_dnx_execute_csharp_code.eql,sha256=Ob-k3wkukRz-QpR1ec07xPzCK3LnD3kRjA26CsqfKV8,42
src/rules/windows__process_creation__proc_creation_win_dnx_execute_csharp_code.lucene,sha256=0xsF9ugiHkWbQzln6mYD26QH4WNb6MShycmiAof8dGo,30
src/rules/windows__process_creation__proc_creation_win_dnx_execute_csharp_code.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dotnet_arbitrary_dll_csproj_execution.eql,sha256=voQoqC-SGVeT4fQ-q6Wbtlp6-blyO68cg1ur4M-msE4,497
src/rules/windows__process_creation__proc_creation_win_dotnet_arbitrary_dll_csproj_execution.lucene,sha256=DyUlt15BdOsUXQpkqDCWrWe-x1R1WkBkCoEB8IOpY58,481
src/rules/windows__process_creation__proc_creation_win_dotnet_arbitrary_dll_csproj_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dotnet_trace_lolbin_execution.eql,sha256=Zx0EE5YUoa6w0sMD_L81771Ql4um-XyI-S9ne0fpDbs,177
src/rules/windows__process_creation__proc_creation_win_dotnet_trace_lolbin_execution.lucene,sha256=-d3orA5zYdX4Iv6y0o4ruZFDce6Btbwf9c_ehEtRSk8,164
src/rules/windows__process_creation__proc_creation_win_dotnet_trace_lolbin_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dotnetdump_memory_dump.eql,sha256=ZVdRH6fxaoFz4ezrMD1AXU5BPEpcIK78euptbUO2Rpo,140
src/rules/windows__process_creation__proc_creation_win_dotnetdump_memory_dump.lucene,sha256=xJ3aGxTQZcKy734E_hWQqHkZLt0sI5pnwP3JclQ1Kf4,126
src/rules/windows__process_creation__proc_creation_win_dotnetdump_memory_dump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_driverquery_recon.eql,sha256=x987tQxBnLbuU-Nn_unWLEDJWFNBKIBjeAjzSeLKpcU,332
src/rules/windows__process_creation__proc_creation_win_driverquery_usage.eql,sha256=ZcWZuF1HWP7a6EQ1iQSzCO6_Xt7BEPAMw9983h01sgI,338
src/rules/windows__process_creation__proc_creation_win_dsacls_abuse_permissions.eql,sha256=HJwx7i5hEtFFL88vFeMTD0XI7v7PHQhnz8ck9MdFTdU,209
src/rules/windows__process_creation__proc_creation_win_dsacls_password_spray.eql,sha256=M085aOsE6lscmxVN0dF4BbqYMHN7F2dPbI702A4CyPk,169
src/rules/windows__process_creation__proc_creation_win_dsquery_domain_trust_discovery.eql,sha256=587bxB3TQqBo2KfE4xZljIKUIYzb6egj-Cx5VOUpfrk,138
src/rules/windows__process_creation__proc_creation_win_dtrace_kernel_dump.eql,sha256=Ao0UN7iTm4itg85pJk1zLr8WMxUHCHWmwxu10mC50Ro,164
src/rules/windows__process_creation__proc_creation_win_dump64_defender_av_bypass_rename.eql,sha256=mJPWJpsABo2GzcenBCMpmp7K_UO3Wd94-UQo8CB5g-w,246
src/rules/windows__process_creation__proc_creation_win_dump64_defender_av_bypass_rename.lucene,sha256=WMhEx3mRGPmYmmTy4lzrLptZROCZxCw26hDkeRXOGUg,230
src/rules/windows__process_creation__proc_creation_win_dump64_defender_av_bypass_rename.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_dumpminitool_execution.eql,sha256=BPWh3URfhuiMnY8q63MYpujsM5binJlQ5okUINzV0fI,302
src/rules/windows__process_creation__proc_creation_win_dumpminitool_susp_execution.eql,sha256=liBT8bMfjuSXrVsZ4KloFRhNcGEgcCIWZKm_IVMjDxI,473
src/rules/windows__process_creation__proc_creation_win_dxcap_arbitrary_binary_execution.eql,sha256=DTuV4fYu9Uvr2M2BJs9Yx33yWwgHsJ4T5oQCe0tLVEg,125
src/rules/windows__process_creation__proc_creation_win_esentutl_params.eql,sha256=RMMDTJmtU_SAt9luHGQO60fnrbR8TGIVU_ah376CACk,77
src/rules/windows__process_creation__proc_creation_win_esentutl_params.lucene,sha256=WYpU55NrRPQzylKc4jqulKYsRfa_RjyosO6riVA1GGo,65
src/rules/windows__process_creation__proc_creation_win_esentutl_params.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_esentutl_sensitive_file_copy.eql,sha256=PLREVW-zlbkl7kJAgi31KbAM6hIuxo6cSakKNFpZhc4,605
src/rules/windows__process_creation__proc_creation_win_esentutl_webcache.eql,sha256=PqR4vgX9VxmWdzNttHln066S0n5wFvEVaKVKvxSCv9Y,224
src/rules/windows__process_creation__proc_creation_win_event_logging_disable_via_key_minint.eql,sha256=UoK_CETf3uiSfRH2grUqdl_SS1eHk6q_VpwWWAJaB-s,500
src/rules/windows__process_creation__proc_creation_win_eventvwr_susp_child_process.eql,sha256=OrG4Su8zPLUrvU0T-HqhUhWklvJKkEcbHWzT8SGSqzM,204
src/rules/windows__process_creation__proc_creation_win_eventvwr_susp_child_process.lucene,sha256=rlCJ5Qs7xtWyA_rlM6DkEqOH1f23oNIznlIdCwGEFRY,187
src/rules/windows__process_creation__proc_creation_win_eventvwr_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_expand_cabinet_files.eql,sha256=4PI93jO2b3HKRLEn0RRpdFys5VDx1yTlb8TRXqy3X7I,780
src/rules/windows__process_creation__proc_creation_win_explorer_break_process_tree.eql,sha256=h3j5RUQOom66TClc9KDLBbSP8rib5frlyl_XDsIQA50,229
src/rules/windows__process_creation__proc_creation_win_explorer_break_process_tree.lucene,sha256=sK0E43bnPmHgorsF7K6PG-3MIcteU3YqP6Bh9XXNimA,221
src/rules/windows__process_creation__proc_creation_win_explorer_break_process_tree.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_explorer_folder_shortcut_via_shell_binary.eql,sha256=g77Of-nhng7QwcIuiLjPdlbyF4tQhAdmYJ989X4VFbY,188
src/rules/windows__process_creation__proc_creation_win_explorer_folder_shortcut_via_shell_binary.lucene,sha256=JVBkaymyFI7-xn6QWIEU6IA51iSgaKAR_naev0r1Jog,167
src/rules/windows__process_creation__proc_creation_win_explorer_folder_shortcut_via_shell_binary.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_explorer_nouaccheck.eql,sha256=V1O_kFaAAiH_VCw0c36zD5LJ-fV70-HfnRPCvaxlwoo,259
src/rules/windows__process_creation__proc_creation_win_findstr_download.eql,sha256=7wX48RwgbPirFIX8WKS1jJWTasqmNPMcnXmfuWerpKI,339
src/rules/windows__process_creation__proc_creation_win_findstr_gpp_passwords.eql,sha256=DulDgU4wphXL4q1kYUNofYPql6jKtgFhDGucytlbtkQ,256
src/rules/windows__process_creation__proc_creation_win_findstr_gpp_passwords.lucene,sha256=wU42EFBRAFIwZrjAeV3A1OnArESRqPUsyNpDrVqh4Vo,224
src/rules/windows__process_creation__proc_creation_win_findstr_gpp_passwords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_findstr_lnk.eql,sha256=txsk0B68DOvPfxdgqrc_wMSv2ugBLYyay6cgBbKkPmI,206
src/rules/windows__process_creation__proc_creation_win_findstr_lsass.eql,sha256=573uMElejZwVdKdZI0h5yU6vUplDRuV9HcKJPgwcudY,647
src/rules/windows__process_creation__proc_creation_win_findstr_recon_everyone.eql,sha256=P0DVodAyoau_gQrwr4rxjSnyKvV_ussyTFnaFZFBB80,362
src/rules/windows__process_creation__proc_creation_win_findstr_recon_pipe_output.eql,sha256=X4lPN1GnVKp9h55dZ3Vk__EpizY3snQwOBo0JEAiQWk,364
src/rules/windows__process_creation__proc_creation_win_findstr_recon_pipe_output.lucene,sha256=W0Y3qvjr0FjJmR5mdsbJpKv36t0KytD8a3a1eohgqDk,354
src/rules/windows__process_creation__proc_creation_win_findstr_recon_pipe_output.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_findstr_security_keyword_lookup.eql,sha256=Ob49Wu7qmoax5Xwot0KA-1xpvMFDs435DpfcFVFMYQo,450
src/rules/windows__process_creation__proc_creation_win_findstr_subfolder_search.eql,sha256=rtEc2oc3K2bmC9ChguqwGl2AkiP76jloJM0iA1sT4ZE,307
src/rules/windows__process_creation__proc_creation_win_findstr_sysmon_discovery_via_default_altitude.eql,sha256=lSS1xIza4gIejRVXrZcXEF11cEb6-MRBXnlW3k3nniY,179
src/rules/windows__process_creation__proc_creation_win_findstr_sysmon_discovery_via_default_altitude.lucene,sha256=SOvBJR7z0Gn-v9x91jU1XjThQeNG_ERkaSzzF3vhgrE,152
src/rules/windows__process_creation__proc_creation_win_findstr_sysmon_discovery_via_default_altitude.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_finger_execution.eql,sha256=ORDbDH3JfElCEvmbkZ76yw543y73zl3fbJYowMBzsIk,91
src/rules/windows__process_creation__proc_creation_win_fltmc_unload_driver.eql,sha256=q7X16QqlELIUy4ygD_14oyJdG6BN6ys2Zv8FeJ5uoQs,544
src/rules/windows__process_creation__proc_creation_win_fltmc_unload_driver.lucene,sha256=GjS-jOVKluzxUeAHGy6jywQssS1X8o04d96-htxiZ-o,518
src/rules/windows__process_creation__proc_creation_win_fltmc_unload_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_fltmc_unload_driver_sysmon.eql,sha256=vnXsUVMIjyc8LALVz0El0JC3nV4LaiL1-NOkyz5lZO0,165
src/rules/windows__process_creation__proc_creation_win_forfiles_child_process_masquerading.eql,sha256=lMy3DlgPVn3DGf2eGb0W2q5oJUFohCgNg93FE9ICsu0,415
src/rules/windows__process_creation__proc_creation_win_forfiles_child_process_masquerading.lucene,sha256=wUfjWOBOxIKQInN_tnWBG1gkfszqxp6CvmeILpKgGMg,380
src/rules/windows__process_creation__proc_creation_win_forfiles_child_process_masquerading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_forfiles_proxy_execution_.eql,sha256=EPIahA4VCV1JGo7Agaqy9u0KiQ4rFMqYrw0aeaGgzhE,185
src/rules/windows__process_creation__proc_creation_win_forfiles_proxy_execution_.lucene,sha256=stbjurDxaKwQKzruFoljsOeU0hpyDstu_lrGC4IvFrc,175
src/rules/windows__process_creation__proc_creation_win_forfiles_proxy_execution_.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_format_uncommon_filesystem_load.eql,sha256=YCUYJT1PqSRjhUezU1SloiWRsTVXgjFKccQoMuvOLPg,190
src/rules/windows__process_creation__proc_creation_win_fsi_fsharp_code_execution.eql,sha256=nmp2MRUhV0arDYL6MnGrlo8eGrE9IhMjQMV46GpAfRo,142
src/rules/windows__process_creation__proc_creation_win_fsutil_drive_enumeration.eql,sha256=VheQCwpfOYuo04wfCdVexVrm8OCadKt_KdDY0T_qZHg,129
src/rules/windows__process_creation__proc_creation_win_fsutil_symlinkevaluation.eql,sha256=C7Lq7UtL5kP5ekxf6c9mImjnvVh0r9SURjcbA4F9ncI,396
src/rules/windows__process_creation__proc_creation_win_fsutil_usage.eql,sha256=HuOfMlCTITNSq-1Y6ZW9dPvFk7mv4cTJobKzuXWj6Hg,182
src/rules/windows__process_creation__proc_creation_win_fsutil_usage.lucene,sha256=6xkcc8iTxFhzPuxkkVIuJjs8h_9d9vKnnp6GRnY4ouI,160
src/rules/windows__process_creation__proc_creation_win_fsutil_usage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ftp_arbitrary_command_execution.eql,sha256=lHQ1aplDAV1k3rmsIHKWc6W1WQT_VyiuAbPlX7qp-JU,214
src/rules/windows__process_creation__proc_creation_win_gfxdownloadwrapper_arbitrary_file_download.eql,sha256=zxqykwreRNIGagYFZpoV-LKERr8MRPcborXmLtn6xsk,186
src/rules/windows__process_creation__proc_creation_win_git_susp_clone.eql,sha256=m-SwYU7lR0zWi42fHlxrMml6tp3EZ_1f3iIROkGiJKs,426
src/rules/windows__process_creation__proc_creation_win_github_self_hosted_runner.eql,sha256=_WImYQ9nySXEhKfiv_MgIk_gx2JgG7CdB6oCrg0CY_8,314
src/rules/windows__process_creation__proc_creation_win_googleupdate_susp_child_process.eql,sha256=4PgeLimJ2EEYr0XfQJWmTXV8TaLSqfIV86atwpSiLAw,272
src/rules/windows__process_creation__proc_creation_win_gpg4win_decryption.eql,sha256=B6FY0TWU_ydxN4UTI-x5orEqCF45xIFLhx5AZRgKaAM,196
src/rules/windows__process_creation__proc_creation_win_gpg4win_decryption.lucene,sha256=wSg_i84-3maLEtS-P5ghyNN5Ec6d9eV1UnDpU62nQec,177
src/rules/windows__process_creation__proc_creation_win_gpg4win_decryption.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_gpg4win_encryption.eql,sha256=R9f1vFxnIRe0V8q3s9I0KZ7TrkeLKPHCoNICbC4pA38,196
src/rules/windows__process_creation__proc_creation_win_gpg4win_portable_execution.eql,sha256=vBnjoxHkTPXZ96Dgozv2zTqjE-WygeNGN4apmTydgpk,378
src/rules/windows__process_creation__proc_creation_win_gpg4win_portable_execution.lucene,sha256=uO3aBwZ93qZJq4xQLHzeSegij7FnVj2Eorchh_pjpcg,372
src/rules/windows__process_creation__proc_creation_win_gpg4win_portable_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_gpg4win_susp_location.eql,sha256=KZosYAsy_YLcwM0czL_iGtX3-7iq7_vuc9CGmoDg_E0,377
src/rules/windows__process_creation__proc_creation_win_gpresult_execution.eql,sha256=IB--qs9sfyOO1mDtHDwCoFcG9Xpu18ZhCtFTeKmkrHM,97
src/rules/windows__process_creation__proc_creation_win_gup_arbitrary_binary_execution.eql,sha256=cxVSoBXUbiivrJKy7c9iCdSFE04uQKGLrOE-_AntXuE,329
src/rules/windows__process_creation__proc_creation_win_gup_arbitrary_binary_execution.lucene,sha256=I3P69vu5vwzX8nKdUkwqd-6K1oRemW8UfwVFYAZlrUg,318
src/rules/windows__process_creation__proc_creation_win_gup_arbitrary_binary_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_gup_download.eql,sha256=aBllJ04OpyfACFcNKROUXPWTwgcrJW51OcIKaE7vLgo,220
src/rules/windows__process_creation__proc_creation_win_gup_suspicious_execution.eql,sha256=04zhZNrVzDZ45es3tEhIEpZRi6CrFZvJxLHzcZsTCwo,357
src/rules/windows__process_creation__proc_creation_win_hh_chm_execution.eql,sha256=yEo6A5FaBp5DXNkDoI7-ref6qqhGsL_Iu5euY0BO9Ng,119
src/rules/windows__process_creation__proc_creation_win_hh_chm_execution.lucene,sha256=cBj6EeLpCJcBCQtOIUl-GNlMGi78vPr94LH13CtB140,103
src/rules/windows__process_creation__proc_creation_win_hh_chm_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hh_chm_remote_download_or_execution.eql,sha256=VFsoYKKYYKUT1kv5b6BDRwDsafXAko-7kB9j4Gpi33M,154
src/rules/windows__process_creation__proc_creation_win_hh_chm_remote_download_or_execution.lucene,sha256=OKkfFjZmUl1xg_IWOrWGZhkCuVvfHWrQSltx8MUj0bE,138
src/rules/windows__process_creation__proc_creation_win_hh_chm_remote_download_or_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hh_html_help_susp_child_process.eql,sha256=GociWCTGrBrGNet7jkv4GGDSoHyddvxTYYPQgTN6dws,349
src/rules/windows__process_creation__proc_creation_win_hh_susp_execution.eql,sha256=DWvZfPDoCB3M1qvWvN0Ler9NIqTIuEQG-MXKdVVGFrg,252
src/rules/windows__process_creation__proc_creation_win_hh_susp_execution.lucene,sha256=M3TjevkXOo9dPH_xkhPAKU-0B_MyXUwRkeTzLFia3Hs,230
src/rules/windows__process_creation__proc_creation_win_hh_susp_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_adcspwn.eql,sha256=IF5a4P6K6lzRG_dKwGmJNvsHs1DiDhwbyEVG8lHhyUc,82
src/rules/windows__process_creation__proc_creation_win_hktl_bloodhound_sharphound.eql,sha256=XOHglwmAzd-VR63gjQ8yHc0CeRLvuNbyUtDx0b6YFBM,615
src/rules/windows__process_creation__proc_creation_win_hktl_bloodhound_sharphound.lucene,sha256=ysoeLvtL-Vxu74mA9byufXE3wtsJRaI1H5RNLpH4UoI,610
src/rules/windows__process_creation__proc_creation_win_hktl_bloodhound_sharphound.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_c3_rundll32_pattern.eql,sha256=vpMlg23kRveb9AeyYGhm2gAxutDmqU_087illnj4OTQ,126
src/rules/windows__process_creation__proc_creation_win_hktl_c3_rundll32_pattern.lucene,sha256=wdUPE-WWPw9CrzTErkk-5QEJluauItV8IwQN_-1Y8qw,110
src/rules/windows__process_creation__proc_creation_win_hktl_c3_rundll32_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_certify.eql,sha256=5uFTQgq6FbwDrRiwSBMU7zR4y_S0zoJxKXqYKvWt3ho,384
src/rules/windows__process_creation__proc_creation_win_hktl_certify.lucene,sha256=pWB-som8Mi1_BiibTY2xEg0Z6sWMXBZEMWEdCKZAmkw,379
src/rules/windows__process_creation__proc_creation_win_hktl_certify.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_certipy.eql,sha256=pftzxEwZRv0ZNRnF9C-k6EHZuJTgDk21_CxrPF_Pkd4,539
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_bloopers_cmd.eql,sha256=HL6MG314t0ctsSl__U1FzTLlZ4CicRJITG3ePbyaQ38,356
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_bloopers_cmd.lucene,sha256=5lftDCGw_YyzhRlpHINAxTSm3P9mUopLpIztAppY4jA,330
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_bloopers_cmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_bloopers_modules.eql,sha256=kAUV1nrM-DBWSKVxZDZLU8-iYV_oN7K9z_Kd9tY2eBw,267
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_load_by_rundll32.eql,sha256=B2Z4u8p4ZU21d7pAsXKw4Ye9jcEiTJwbZxd3XoDS72I,257
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_process_patterns.eql,sha256=vBvmB-gVXHcQPuJ7PxddkdsgTc840kjamCNhjQOF1kA,531
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_process_patterns.lucene,sha256=wviXH7RnPTqLFl3ziFzd0eaE20ZLni-X1HAg5YwMJ8w,518
src/rules/windows__process_creation__proc_creation_win_hktl_cobaltstrike_process_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_coercedpotato.eql,sha256=AD2T-06b8xqEWet-HFC0X7xd8mt-tY8s-O_0vr2XhEg,269
src/rules/windows__process_creation__proc_creation_win_hktl_covenant.eql,sha256=Kb0xNWNtaKQWm7gZbd9SLrwoNeQqfbr5-5l3joYbW8c,367
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_execution.eql,sha256=8hU0e2ggNzTii05KSyA8QsBVrWZm-GHdDrJIKp4kIuY,1078
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_execution_patterns.eql,sha256=2FVS2tgj9ULfzI6Ez3TDCRfxz3LlTodbwychJVOh2tY,240
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_execution_patterns.lucene,sha256=O6dc4daYbRTfDAPs0yMANkpf85Y9LqecVcDyqbe-J6s,274
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_execution_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_patterns.eql,sha256=4A-dXUGSZfVga7l9YC6EYXfEHLlDbDR_HgzyWbS0xSo,582
src/rules/windows__process_creation__proc_creation_win_hktl_crackmapexec_powershell_obfuscation.eql,sha256=eqqshaSBQs3sd61li97WCC3cCYd7DImydzCsirJtTEA,367
src/rules/windows__process_creation__proc_creation_win_hktl_createminidump.eql,sha256=zoMrjt5ss2Z5tM4Y1H0OUXGZVH68fY1prvMfsAJ76V0,126
src/rules/windows__process_creation__proc_creation_win_hktl_dinjector.eql,sha256=NJEkHj5IsAXbMc09YI_diabvKGP_JJpGJUas10oxe5E,82
src/rules/windows__process_creation__proc_creation_win_hktl_doppelganger.eql,sha256=Uov6eDuR2qHX6Gl8qXkKpUinhWSTWjcUvVNo0k0OhtA,180
src/rules/windows__process_creation__proc_creation_win_hktl_dumpert.eql,sha256=9HWQccvM3vRwjDlbINUvGva7LKGWWdahrXxZL35b9Gw,116
src/rules/windows__process_creation__proc_creation_win_hktl_edr_freeze.eql,sha256=gtgLK5VEuxjGUyrNCSnbJLBpvH2BltKxZ0bOdvOnttg,511
src/rules/windows__process_creation__proc_creation_win_hktl_edrsilencer.eql,sha256=EYbLstW9eA-c_ylZW7p2Z5usPN4IO3oKn03CxvScWsA,143
src/rules/windows__process_creation__proc_creation_win_hktl_empire_powershell_launch.eql,sha256=5VRxMfU2Kmm73fz3YEwien7IKlOXYBkq4h7Qf8bT0i4,219
src/rules/windows__process_creation__proc_creation_win_hktl_empire_powershell_uac_bypass.eql,sha256=0bvqK7MjNWLS5cjGnGypDO_fm64X08UXh3AcaPTsHn8,207
src/rules/windows__process_creation__proc_creation_win_hktl_evil_winrm.eql,sha256=uw2EPEDNqY4mmAlQzeqFfcxjjidvV5vd7NnOVGCWYJE,144
src/rules/windows__process_creation__proc_creation_win_hktl_evil_winrm.lucene,sha256=OTeb63z5G5U_OFV4u9sq_snTbQOCEnnrcG_yflgjaRE,132
src/rules/windows__process_creation__proc_creation_win_hktl_evil_winrm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_execution_via_imphashes.eql,sha256=vWYRb0hw_eqYI4evy_N6RSVy0h_LS_1kMC3nK-PDoCM,4090
src/rules/windows__process_creation__proc_creation_win_hktl_execution_via_pe_metadata.eql,sha256=Ds_FEcGF9CMGwhg6bBPvEaom5ex6m_1zCw_w_0m7pSw,39
src/rules/windows__process_creation__proc_creation_win_hktl_gmer.eql,sha256=W76UVrIyFnYkEDIEC_AsuIYTE7r-z1ZqLJLXNab_8BY,250
src/rules/windows__process_creation__proc_creation_win_hktl_gmer.lucene,sha256=FHfg7kIhUnWqGFmvfUkCkxWi1amTDH41Cq_O1IcFxLA,233
src/rules/windows__process_creation__proc_creation_win_hktl_gmer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_handlekatz.eql,sha256=47I_hwWvKNZmOblummT_o5t-PVAW7LkCmVTJtVCtV1Q,366
src/rules/windows__process_creation__proc_creation_win_hktl_hashcat.eql,sha256=HXVTZ2hHr5vXUNsxOn4yHufnXn1eewO1JcXmSDhaa_Q,151
src/rules/windows__process_creation__proc_creation_win_hktl_hollowreaper.eql,sha256=W3xDn2TDwIH3kmiipd15w25uDM__KJLJH-mcu5jf7no,51
src/rules/windows__process_creation__proc_creation_win_hktl_hollowreaper.lucene,sha256=uZW-3iQjOIjED7JzRYqnM0pt-LJOULS1lhSU8KmmBFg,39
src/rules/windows__process_creation__proc_creation_win_hktl_hollowreaper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_htran_or_natbypass.eql,sha256=iHtXP_4bkpTSxG4UCgFCdDufSrs1PUDSKHnjvuRvz0A,136
src/rules/windows__process_creation__proc_creation_win_hktl_hydra.eql,sha256=esTjLHPZsGfxtk2Rj5yA-AG90guFUw6jmhMCrHeLlLE,132
src/rules/windows__process_creation__proc_creation_win_hktl_hydra.lucene,sha256=OSYhiydnesLsxdgacpPBzkSysVL_vLDH8cRYyuu5muE,118
src/rules/windows__process_creation__proc_creation_win_hktl_hydra.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_impacket_lateral_movement.eql,sha256=T7ddPBNXJ0hBruIhPUMEX5eY2ePo8lji1iw31_BgZpw,529
src/rules/windows__process_creation__proc_creation_win_hktl_impacket_tools.eql,sha256=DfH_V7rUx9Wwuwbn8X3PzePTEdLjrhEyiwTbSeBks_8,900
src/rules/windows__process_creation__proc_creation_win_hktl_impersonate.eql,sha256=ZLrSIpKaMaFERD4fPrhy5rQvfg1zG8UvAQ1YF33f20A,328
src/rules/windows__process_creation__proc_creation_win_hktl_inveigh.eql,sha256=nPPdXbhIsc1-G1MwT50QDY1uepAOXusqAunGauEiYCU,287
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_clip.eql,sha256=YALDQApSO6lmpYyf0sImcRJE_IS7jFoOYcr6WvKaJvU,197
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.eql,sha256=ErsPX-VrY_oJejl6q_rK7LSfB3ZJ4ZRvWonDyqvVByo,1466
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.lucene,sha256=R5H-1yBftQIgduW0DWQ03UtlK_U9PD8PU9IPQeZ20Go,1665
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_stdin.eql,sha256=E1x2Wa5te5pUwEAkBSvjet7JohQHoI266ykhenDAIUg,312
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_var.eql,sha256=JpJcRpYHbGioCBWdQSKDAVqUabB8smuYSYc6-N3Gk18,500
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_compress.eql,sha256=tq1-oIXXlNceqpgkQqjnJT4JfWUO9SKGmjUy0NSkynY,218
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_compress.lucene,sha256=MB39ZpThyLr3SlNCSVlJsydo7KXCGo71-gTEwZ8zA0g,201
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_compress.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_stdin.eql,sha256=yKDrpUBPIBbXBlTvG4QSseutcxREGX1Za2btyClEtOo,420
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_use_clip.eql,sha256=H3rKW6TpUS4bL82rUrVNqFTSoOPbRh69EbHdmGFRp4w,522
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.eql,sha256=l56puTvScZWXl-0Rpt8JaBczOR2LKNVmSdEGCR3MLPU,235
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.lucene,sha256=KcZMk41VcXUz7-aAisv0ECJefS0tOvzPr6Sm70nDh0o,218
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_invoke_obfuscation_via_var.eql,sha256=LEQuB-ehxxZyr-N-T0LCTTFHVrL-jrlAccWvMa9nu28,228
src/rules/windows__process_creation__proc_creation_win_hktl_jlaive_batch_execution.eql,sha256=LzCCji27miBq36_Fq-OrOf4fElvqlLGT2ukaIoDgevk,478
src/rules/windows__process_creation__proc_creation_win_hktl_jlaive_batch_execution.lucene,sha256=nc-jKILQ1TCQy1hROMqwzfch4xcYlKrj4T1o6MuTovM,446
src/rules/windows__process_creation__proc_creation_win_hktl_jlaive_batch_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_koadic.eql,sha256=AhFcWbzKtnCHjtXWhuv0UB8zXMIutxVhqOLDrfEia8M,187
src/rules/windows__process_creation__proc_creation_win_hktl_krbrelay.eql,sha256=ophfTmteUahjkmO_e5bMhP61a99r2eJQgTUPrIa7XVw,427
src/rules/windows__process_creation__proc_creation_win_hktl_krbrelay_remote.eql,sha256=3-i05fHvdFGNOrnIX8F4USmSJt5cWTvd6YbKad-tjD0,731
src/rules/windows__process_creation__proc_creation_win_hktl_krbrelayup.eql,sha256=ZNexvbFt0iGs_TR0OVZ3kuWW5px4RnKWDX0HfldOsSU,439
src/rules/windows__process_creation__proc_creation_win_hktl_lazagne.eql,sha256=VlUGZ1OayUabdvX7t5v_2ujOcjyf0VTKU-ZNjasgdLM,1868
src/rules/windows__process_creation__proc_creation_win_hktl_localpotato.eql,sha256=H17bNjIfd4-xvlnTeCV9MmeKCsP4pQsYFMatjY-MLfs,262
src/rules/windows__process_creation__proc_creation_win_hktl_meterpreter_getsystem.eql,sha256=QzqTzhlOAQbRNaEkp3CnmS-39yIGNXNtwarKlxavsyk,373
src/rules/windows__process_creation__proc_creation_win_hktl_meterpreter_getsystem.lucene,sha256=HoSIJIfPay7_qVtMzLx--DPO-H_8wquYYSCPoxFcMBc,342
src/rules/windows__process_creation__proc_creation_win_hktl_meterpreter_getsystem.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_mimikatz_command_line.eql,sha256=A6oRc5Nbk73eaYw4jOg4b9vNqb3yz5ElM_ErQ1yrW0M,455
src/rules/windows__process_creation__proc_creation_win_hktl_pchunter.eql,sha256=75uxoE3L7UrxGTWrMcSHF3tI0u8RdM-L_62QCKS45Jc,668
src/rules/windows__process_creation__proc_creation_win_hktl_pchunter.lucene,sha256=YGrD3W_J0Ab5eI8lSeN91O8OOVu771HZBGYzsYcqXdM,650
src/rules/windows__process_creation__proc_creation_win_hktl_pchunter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_powersploit_empire_default_schtasks.eql,sha256=dBRF_0xSkmcSQWYzuX_m0onIegE7n50lj-ZMufrkVz8,358
src/rules/windows__process_creation__proc_creation_win_hktl_powertool.eql,sha256=58EWvBuIraRMw4o6JAY0HBGk8DsGtdnQVVv2wGqRfCg,129
src/rules/windows__process_creation__proc_creation_win_hktl_purplesharp_indicators.eql,sha256=Vr1YEzl1VJlsk5IUVKIM6deLdW2v90XYdK1Su0vi2ew,169
src/rules/windows__process_creation__proc_creation_win_hktl_pypykatz.eql,sha256=qRp4onsoUCaswjOE2-f3KTxCvf1PDjLvljXs4pgP2jM,148
src/rules/windows__process_creation__proc_creation_win_hktl_quarks_pwdump.eql,sha256=qKuK6owxwyuEbs0iof59AFtLsJXLvv7PDYe5fq27j1s,225
src/rules/windows__process_creation__proc_creation_win_hktl_quarks_pwdump.lucene,sha256=DnMrCs0IBU-rrsH5pLl-qaWL-PZQIaYoKAGbxJDufx4,236
src/rules/windows__process_creation__proc_creation_win_hktl_quarks_pwdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_redmimicry_winnti_playbook.eql,sha256=nCeAUHhsaQDLDvsHBsPsPgSmWvne4HJ20J3Zy8wdRh0,176
src/rules/windows__process_creation__proc_creation_win_hktl_redmimicry_winnti_playbook.lucene,sha256=jGQPkJGkQ_zVrcnzOE6uQH0Re_W8TXlq34yy7YHcAl8,152
src/rules/windows__process_creation__proc_creation_win_hktl_redmimicry_winnti_playbook.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_relay_attacks_tools.eql,sha256=Y3nEqWDVN8xnYbAn4itQlGSQO5cTyPfmbGimyI_nY5Q,607
src/rules/windows__process_creation__proc_creation_win_hktl_rubeus.eql,sha256=uawzuXS1CR5qM3xtZAREAwvSgKtrSSxqhKqQ8Nk61Ys,467
src/rules/windows__process_creation__proc_creation_win_hktl_safetykatz.eql,sha256=jXFdsRK9kP5a6_3UEdU8npxWUqowPkNMZ4U8eBgDOvg,138
src/rules/windows__process_creation__proc_creation_win_hktl_secutyxploded.eql,sha256=dErN_s1dMLuEtaYmZiQgboK355iltQLXPcmcnol-STA,142
src/rules/windows__process_creation__proc_creation_win_hktl_secutyxploded.lucene,sha256=6ZoL_lQ3VsYOvvxCndTQ55mCx29pGEhkpnCODI43Ckc,126
src/rules/windows__process_creation__proc_creation_win_hktl_secutyxploded.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_selectmyparent.eql,sha256=xA_wS0ODZOUo4HXcfz9GEN04SbQT7FXTD9ss37gxcdo,630
src/rules/windows__process_creation__proc_creation_win_hktl_selectmyparent.lucene,sha256=eC-6NM4JJTz49z4XJQooVuR22yfkTm4d5O20ZV2s9fY,603
src/rules/windows__process_creation__proc_creation_win_hktl_selectmyparent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_chisel.eql,sha256=ML3pWNFVLKPFFwvp9EQscaVbHst3_nFuKGz6axrRFvU,86
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_dpapi_execution.eql,sha256=VMUCzRAQyHZeIJmhO_QeP-kpcgeCJqj6SK7IX1csdLM,482
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_dpapi_execution.lucene,sha256=8wAFtCN5byBVsRqc96hlFqD_5QqK3ImU7ueUkQrucJA,490
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_dpapi_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_impersonation.eql,sha256=qFCyX9RIq9PHGjKq4Iup75CbHxbg-mMrHDRzW1p_4B0,382
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_ldap_monitor.eql,sha256=xA0Dh2R-oXT5x_KPVp4KH94lwp91u5SX9miNLqONWSk,222
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_ldap_monitor.lucene,sha256=KxMPIfVJhfebJ5u1mwN46CA0BT4lxGjYI8zjoym_Mr4,208
src/rules/windows__process_creation__proc_creation_win_hktl_sharp_ldap_monitor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharpersist.eql,sha256=d_GjlkyJGVamttmDQerlOaOCsJqXmVYFk0uJyZh40K8,414
src/rules/windows__process_creation__proc_creation_win_hktl_sharpevtmute.eql,sha256=rHdH6Zh-mf9tBih4fCGUVT_v_tDDxdbSfnSg_CVkL0w,176
src/rules/windows__process_creation__proc_creation_win_hktl_sharpldapwhoami.eql,sha256=b6eOC5Q08JaCV2AwGKlll5O_DMG4UcKk4N_3CWkHt84,275
src/rules/windows__process_creation__proc_creation_win_hktl_sharpldapwhoami.lucene,sha256=OKosbnQk5hDKl3ti5ynJ1TPQlVl-x9vXzH6_hXjeiHs,269
src/rules/windows__process_creation__proc_creation_win_hktl_sharpldapwhoami.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharpmove.eql,sha256=-s0TuPDUM5PQWleICiG8jzIkHa-Y1U_CAkNE935xAps,386
src/rules/windows__process_creation__proc_creation_win_hktl_sharpsuccessor_execution.eql,sha256=4ZIgFYYSNhXzdnYVnWbkalkJ49Tmp_yPhfRf7TKGtzI,340
src/rules/windows__process_creation__proc_creation_win_hktl_sharpsuccessor_execution.lucene,sha256=IzGHSfM_7NtrfaQUQHkX8GPfYOe8s9Cj-DYeDmcpSjo,324
src/rules/windows__process_creation__proc_creation_win_hktl_sharpsuccessor_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sharpup.eql,sha256=4ua50THwHLTWQlVOmVefdvoW-hi9eO7CAeripCeFR7M,289
src/rules/windows__process_creation__proc_creation_win_hktl_sharpview.eql,sha256=dXIQ0zuYnZoAqcrgI3th24VHPLVWBWcoIeXxPj4LqA4,2057
src/rules/windows__process_creation__proc_creation_win_hktl_sharpwsus_wsuspendu_execution.eql,sha256=YUNT03nCoknLBbN4JsrDmJVVY4KNaNCZhL-njE7NSus,312
src/rules/windows__process_creation__proc_creation_win_hktl_silenttrinity_stager.eql,sha256=LtDCTABC_wIdGqadMavuvkSHSbyiRe1ZeWnyjL9YqJE,47
src/rules/windows__process_creation__proc_creation_win_hktl_silenttrinity_stager.lucene,sha256=KFtZS5Noce8F9uZj_vkv7xXr8z0Q7HHQqPhUUtjT5Qk,35
src/rules/windows__process_creation__proc_creation_win_hktl_silenttrinity_stager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_sliver_c2_execution_pattern.eql,sha256=D3wnkcNe9JiyqeM_L9t1vERxWcPtYaBScexlFhdv3ig,104
src/rules/windows__process_creation__proc_creation_win_hktl_soaphound_execution.eql,sha256=2qNlfvvUg-1vmJHJZHz5kelK_AjBYfNE3WCbKOI5NJc,212
src/rules/windows__process_creation__proc_creation_win_hktl_soaphound_execution.lucene,sha256=6gSBuZQr3fP1iz2KBQC0J0QNG2t-lAwjJLirU17rUZQ,215
src/rules/windows__process_creation__proc_creation_win_hktl_soaphound_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_stracciatella_execution.eql,sha256=leN1UliiH-no1wXKq2gjR4CvOgBE98i5SJBisOKyKqM,338
src/rules/windows__process_creation__proc_creation_win_hktl_sysmoneop.eql,sha256=OSbyO02vghQa04Ed7y2zH8nIgVmLE7i0hPGlMjELiLw,177
src/rules/windows__process_creation__proc_creation_win_hktl_trufflesnout.eql,sha256=gonAMHqOPFyDsENchMiVDNb_Sce96JikKaBcOSkkSYE,103
src/rules/windows__process_creation__proc_creation_win_hktl_uacme.eql,sha256=xBY5mvze61uKcRdnqW8uT1RI9OCCaukfW8mVxzYXP3I,907
src/rules/windows__process_creation__proc_creation_win_hktl_uacme.lucene,sha256=a8HxOflR1vYVQin1dAw-ESOQDOFHt39AYMxgX4_K-xU,875
src/rules/windows__process_creation__proc_creation_win_hktl_uacme.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_wce.eql,sha256=V008onSwPizkn7f3JUI8iejWNt3Z2C1mITk5fjtBX30,519
src/rules/windows__process_creation__proc_creation_win_hktl_wce.lucene,sha256=zMd1DA3hSLbxLDA0gBLHsfpHiTbbiuwhGxxwryonb4E,502
src/rules/windows__process_creation__proc_creation_win_hktl_wce.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_winpeas.eql,sha256=r3tGd6nlzVx_mzWhnBpbxxTWjfcakwMJrtDjPhq5jdg,584
src/rules/windows__process_creation__proc_creation_win_hktl_winpwn.eql,sha256=96xm3fw3SIScALnHdGoo9wpWAbG4bJNjN8XyRjTVmOA,103
src/rules/windows__process_creation__proc_creation_win_hktl_wmiexec_default_powershell.eql,sha256=GnT9QZtd-9jTD8TiWq4Ah_i_0ms14eiqIeCTI2w0lJY,84
src/rules/windows__process_creation__proc_creation_win_hktl_wsass.eql,sha256=-SGiU1bckUWcjEcDasfprmtycyI9DwdTiKU-nOeq6Us,424
src/rules/windows__process_creation__proc_creation_win_hktl_xordump.eql,sha256=bUK5-pX4KfYYICogQmcNMkkZd0x599JCBuKy_lhO3pA,159
src/rules/windows__process_creation__proc_creation_win_hktl_xordump.lucene,sha256=X7bk61wuUlAM5TikEsdRzEZ1dXADU_6ny0a4wSt9AU0,155
src/rules/windows__process_creation__proc_creation_win_hktl_xordump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hktl_zipexec.eql,sha256=NZ6pkux5CF3NvCtA4m8MTO72uPGHdwLSwrRGN3OTDaU,341
src/rules/windows__process_creation__proc_creation_win_hktl_zipexec.lucene,sha256=gZ7WXKuKh5vnQtJeZy5AZSqOKGTP6E-9Zy7-RKPVI_s,328
src/rules/windows__process_creation__proc_creation_win_hktl_zipexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hostname_execution.eql,sha256=sJyAfhyl9LNWp1KFaG2ACa2g1iV8L993Eop3W27ltKE,47
src/rules/windows__process_creation__proc_creation_win_hostname_execution.lucene,sha256=RGFfbTl1EFnMuMStBE7GJ5E6svKHqWyRWsSFs03NsRU,35
src/rules/windows__process_creation__proc_creation_win_hostname_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hwp_exploits.eql,sha256=EVWFkUnMTi_XdslfSVAoBr7_bw72DpvPIgVzpfk9QqE,85
src/rules/windows__process_creation__proc_creation_win_hwp_exploits.lucene,sha256=EM7GeCSV49nMvf88RbxXbDkPcu_AA1Hi3RmOxNqnZfQ,71
src/rules/windows__process_creation__proc_creation_win_hwp_exploits.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_hxtsr_masquerading.eql,sha256=up7f4yUJOUctvFVDVAfhueHujkUBHE5R6X79komGd5I,185
src/rules/windows__process_creation__proc_creation_win_icacls_deny.eql,sha256=_pKVny3b8e94dqcY4Z5tBMZUJ0LZ29_0WS7OqcDgK08,168
src/rules/windows__process_creation__proc_creation_win_ieexec_download.eql,sha256=rEa4ODsgfdLHZfndmusptdsXmr4t0vxzglv7mpvIPcw,154
src/rules/windows__process_creation__proc_creation_win_ieexec_download.lucene,sha256=JcvzBcWg1NKx7eday0sZ7shkiEFOVzFUNOu1A91ti3Q,138
src/rules/windows__process_creation__proc_creation_win_ieexec_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_iexpress_susp_execution.eql,sha256=RGvWytL20XS1KmW_8aHCZ60qdWaMmcBRb8v6PGAGiw8,364
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_http_logging.eql,sha256=K0Oz2oP71p6jOoigFfqNb-jcG_Azjy5SxVRguvAfCxk,255
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_http_logging.lucene,sha256=3v2NWb7RkeiVc2vLNX8L2itSKX6uBvm41m2NmTTX8o4,235
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_http_logging.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_service_account_password_dumped.eql,sha256=WyBFrBBqWvOnGR5nowuKvDsqjtq7oZHiYBx-LcUo3tU,376
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_susp_module_install.eql,sha256=LCPgDzDD2I0bmWocGvXmhndFoRzB795UncSeA3G-b1Y,353
src/rules/windows__process_creation__proc_creation_win_iis_appcmd_susp_rewrite_rule.eql,sha256=bUVLudpQoZsFvysP1ZD7F2Rc8kMUxBa6V3jZ6AzH7vw,275
src/rules/windows__process_creation__proc_creation_win_iis_connection_strings_decryption.eql,sha256=FtDPMV0xuNcrrczXwQV44o6t9WAINH0ECRAQHDHUWM0,191
src/rules/windows__process_creation__proc_creation_win_iis_logs_deletion.eql,sha256=qjgYwxRADe0_keD5nw9D8BovLoJI2_VFi-s6vuL5pLA,361
src/rules/windows__process_creation__proc_creation_win_iis_logs_deletion.lucene,sha256=FWEWCTx5GnimSmcgnIljQBo5qujtu6SRKKbT2NmD_xw,331
src/rules/windows__process_creation__proc_creation_win_iis_logs_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_iis_susp_module_registration.eql,sha256=wICMxYzw1ztOK90K-vWrvLE5SUgyzF6hdqF5FcILQes,291
src/rules/windows__process_creation__proc_creation_win_iis_susp_module_registration.lucene,sha256=e2KrsTg9nrf8EePJ33UzW6YFoe5D8uM6kq_X5nhqWMc,274
src/rules/windows__process_creation__proc_creation_win_iis_susp_module_registration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ilasm_il_code_compilation.eql,sha256=X1VL3255c4YMGx6yq8hGoaGvl9pmkp-RkzatqYj87Qs,147
src/rules/windows__process_creation__proc_creation_win_imagingdevices_unusual_parents.eql,sha256=Q7R-NLEEgNd9rCjFo3ntZMpv0MHOyhZaahnD7vXJ3F4,202
src/rules/windows__process_creation__proc_creation_win_imewbdld_download.eql,sha256=cJ2PvZkzqUEQFQY9QVkVZftncOg2oZdoibyIPPHb6H8,158
src/rules/windows__process_creation__proc_creation_win_imewbdld_download.lucene,sha256=3-HhMaLfn2iqc1XXL5Dlk5hqf_ysWWdMze_29CPZ4_c,142
src/rules/windows__process_creation__proc_creation_win_imewbdld_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_infdefaultinstall_execute_sct_scripts.eql,sha256=FisZ_Y_GOPBqWDv-LZEuzgI46Qwp9JhIQWiInIwK7rM,92
src/rules/windows__process_creation__proc_creation_win_installutil_download.eql,sha256=izUvtpOg3Ueo0IFmGV4ZXQKmIqvQCO1zxGYhUbIbx64,176
src/rules/windows__process_creation__proc_creation_win_instalutil_no_log_execution.eql,sha256=K6RjDryyBSRvRZDTznYB9na7oAkIxZ0sAfD1WsrSYcE,193
src/rules/windows__process_creation__proc_creation_win_java_keytool_susp_child_process.eql,sha256=RY76Cqlr28Ao0qdAF4yinxRPHn_IX8UIzZTHZtjZBGc,502
src/rules/windows__process_creation__proc_creation_win_java_keytool_susp_child_process.lucene,sha256=QhYWjAjQ0FU2YJY4miOSnD7-uuv9bqZkjTocIRHpY6c,482
src/rules/windows__process_creation__proc_creation_win_java_keytool_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_java_manageengine_susp_child_process.eql,sha256=NAnv2u6G09ma2vmCDL6A7JcJq_reXJ7xmJvZ1Bi9m8o,660
src/rules/windows__process_creation__proc_creation_win_java_remote_debugging.eql,sha256=Gsfz32CfkOioXpk0-1IOhhOrxBwiC52WuQUL4q1YNAc,208
src/rules/windows__process_creation__proc_creation_win_java_susp_child_process.eql,sha256=_RiN0XtRxWX4bylRyvHISjYJckENv6n2tTXeVJIrPPc,478
src/rules/windows__process_creation__proc_creation_win_java_susp_child_process_2.eql,sha256=jnkbDT-0uexgy2sxjAFN39eqOtPbeIo9-Fzzn-v4TxQ,232
src/rules/windows__process_creation__proc_creation_win_java_sysaidserver_susp_child_process.eql,sha256=InCJAjY-CfS6VnPNvBE-Y8BQtDkkitsyUVNpI-IW_b4,125
src/rules/windows__process_creation__proc_creation_win_java_sysaidserver_susp_child_process.lucene,sha256=3C5KJ9yXj1fj01DJa4Mz8N98VB34fPoVAzjS923v0us,105
src/rules/windows__process_creation__proc_creation_win_java_sysaidserver_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_jsc_execution.eql,sha256=4yCSkAOcePbWUtpl6jSkMXivEMgWJXJA-DejsCMgyqI,85
src/rules/windows__process_creation__proc_creation_win_kavremover_uncommon_execution.eql,sha256=FFk3T_nZwo8m0e-2qAz44M72-1hvyVJPnuCBBy040lE,134
src/rules/windows__process_creation__proc_creation_win_kavremover_uncommon_execution.lucene,sha256=WibC2lYxT4mFDQ0DOyygNH2tV2JuUyn05t6xa5bhT8o,118
src/rules/windows__process_creation__proc_creation_win_kavremover_uncommon_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_kd_execution.eql,sha256=nCjY3AXmt8JV4d8KwmHbCGv7j37nuFiQJE6m-jriRho,83
src/rules/windows__process_creation__proc_creation_win_kd_execution.lucene,sha256=7pv1yL-Zp-trEY3wHCLmTx-r9BGKKJn3vLEnC55APgU,69
src/rules/windows__process_creation__proc_creation_win_kd_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.eql,sha256=HhqPKjcbXZAj-o7UhQxOmcQfOM0UmwaLRhBtyQwrBxw,77
src/rules/windows__process_creation__proc_creation_win_keyscrambler_susp_child_process.eql,sha256=w3nZ48d26aL-Bfzb4drlc9qRdwq2VHIogI_bIyHI_4Q,390
src/rules/windows__process_creation__proc_creation_win_ksetup_password_change_computer.eql,sha256=QcbER6yXHw9SMbA19RiNL1KDfZS1RRtTYLqOekgd0R8,145
src/rules/windows__process_creation__proc_creation_win_ksetup_password_change_user.eql,sha256=nbFHVmDjDnYmaxRREjyuoqe0nsMAFcE99zs5f0z5jn0,140
src/rules/windows__process_creation__proc_creation_win_ldifde_export.eql,sha256=FFH9X-bbkoZFQTKnLP2RqzadJ3MFrP3h1VyKynafKZ0,166
src/rules/windows__process_creation__proc_creation_win_ldifde_export.lucene,sha256=RBbAIz4n4md55u-WRf5qs19zvqCzgQhS36xwJhOkzK4,151
src/rules/windows__process_creation__proc_creation_win_ldifde_export.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ldifde_file_load.eql,sha256=GekkHqUwqvRD9bFi4n-6LiSRjmWZ04Dq-pWbrBtYRtc,159
src/rules/windows__process_creation__proc_creation_win_ldifde_file_load.lucene,sha256=11cZNK6SX9cc73Kae2sVoejXSVSEv8u1CzBRR9nnlOk,143
src/rules/windows__process_creation__proc_creation_win_ldifde_file_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_link_uncommon_parent_process.eql,sha256=vREFoRJaTcPQJz3Hg3_dwVBavK0vIq9-BjqDUrraxvg,303
src/rules/windows__process_creation__proc_creation_win_lodctr_performance_counter_tampering.eql,sha256=czgpBMB4ofeEvvO3Eai55FpHuFc8FBBq2bOW22NBu68,177
src/rules/windows__process_creation__proc_creation_win_logman_disable_eventlog.eql,sha256=JBI5eLAM3-uQw6Z8i6ALb3tlo8yqxp3J_wtfIm34fJg,279
src/rules/windows__process_creation__proc_creation_win_logman_disable_eventlog.lucene,sha256=gGWOCySVhccuQafWY0XQo1lKMYqX2n18sRYX3Y02jjw,256
src/rules/windows__process_creation__proc_creation_win_logman_disable_eventlog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.eql,sha256=isAu-epNmFgxIscLiMvhxBxErT6IemzWqAkvEOGJGwQ,169
src/rules/windows__process_creation__proc_creation_win_lolbin_devtoolslauncher.eql,sha256=kXAMulf3TiXo-F5iC7QD7ZcleJU0WyUTgSxvPqnqBb0,100
src/rules/windows__process_creation__proc_creation_win_lolbin_devtoolslauncher.lucene,sha256=hz9R6CNIP1oEAuChD5xd8NXcDwaGjwpQmyU455IsVUY,86
src/rules/windows__process_creation__proc_creation_win_lolbin_devtoolslauncher.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_diantz_ads.eql,sha256=VtOaCQ9pCxvvvcYm0vHs_pp4NLgWvN_CounqIbJLHVY,179
src/rules/windows__process_creation__proc_creation_win_lolbin_diantz_remote_cab.eql,sha256=t27G7wRivhKk-Xy6AEsZazUA3bVjpPhkybICY0Z5wg4,113
src/rules/windows__process_creation__proc_creation_win_lolbin_extrac32.eql,sha256=2ERrvLt9_JVPxbGHP5Pv9WnWlRn9HJJLoicdShwMRZw,231
src/rules/windows__process_creation__proc_creation_win_lolbin_extrac32.lucene,sha256=tlKvek20oCsISE11IqleAz0HsOIkBnPufIrAvrqeFww,208
src/rules/windows__process_creation__proc_creation_win_lolbin_extrac32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_extrac32_ads.eql,sha256=pURNTPU4yE9kcnSezbjLxEiPJr_lbqIMtuaru2dNBkA,181
src/rules/windows__process_creation__proc_creation_win_lolbin_gather_network_info.eql,sha256=NgmqSYR6ODuvrTwaTxJvlsdMB7idsBv9Dx6dzX0i-xc,199
src/rules/windows__process_creation__proc_creation_win_lolbin_gather_network_info.lucene,sha256=3Yz_1onURjYDadNwB2evP2JPaJJL_1D2yFKiR44jyn0,171
src/rules/windows__process_creation__proc_creation_win_lolbin_gather_network_info.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_gpscript.eql,sha256=t2FsPqPZkblHBCSbf6Eu7OP2JWR0aJ3uKmR4q3ZJAd0,259
src/rules/windows__process_creation__proc_creation_win_lolbin_ie4uinit.eql,sha256=nayW_whrQxhFdfuB1dUcGDhzmlS2znGBW6nxJplyVhc,278
src/rules/windows__process_creation__proc_creation_win_lolbin_launch_vsdevshell.eql,sha256=9gdQNyVSIvL1FDdoQpd07q24kZPXjuiWkM34cQW7EKo,134
src/rules/windows__process_creation__proc_creation_win_lolbin_launch_vsdevshell.lucene,sha256=JfeLx5PqHeXr4XpFles2KqbttwdiHyCXj4LXavv0hRo,117
src/rules/windows__process_creation__proc_creation_win_lolbin_launch_vsdevshell.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_manage_bde.eql,sha256=hWHeYfPjwE7R9quVkYM8ppCxnxgfnTglM-dtbOUu4Ws,312
src/rules/windows__process_creation__proc_creation_win_lolbin_mavinject_process_injection.eql,sha256=slqWv31CvcFlBILK08C44Vlz_pzT5wvDb_QnGVdtViQ,128
src/rules/windows__process_creation__proc_creation_win_lolbin_mpiexec.eql,sha256=0Xl97dAoyxDWgAzjxO6TRKP_iVAvq3BXOLlD-RIvoVs,179
src/rules/windows__process_creation__proc_creation_win_lolbin_mpiexec.lucene,sha256=GHe_oBzPAW5Dl_FSa010QvlmzCMUXf2quxmER8dSTI0,166
src/rules/windows__process_creation__proc_creation_win_lolbin_mpiexec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_msdeploy.eql,sha256=F3Nm8FGJTVhiEtlTsHLnXWG8CyEe3WqxUXjULAa6hTw,182
src/rules/windows__process_creation__proc_creation_win_lolbin_msdeploy.lucene,sha256=xgDYW6LqRZGlciM-2LDqkkgp91B5sttwoSSuLSvPEp0,169
src/rules/windows__process_creation__proc_creation_win_lolbin_msdeploy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_openconsole.eql,sha256=8zyx7K-BOdjambdlHdStyVILb5km2c6L615xAkeLJm0,193
src/rules/windows__process_creation__proc_creation_win_lolbin_openwith.eql,sha256=Sa7b-NcGa7KP5mLQqA6V9e9OE6DJWKO_ARcRzg4Mktk,79
src/rules/windows__process_creation__proc_creation_win_lolbin_openwith.lucene,sha256=aYYI1LAvETifUwPjDIHjzacmRH3PGaH9yErpaHYn_6M,66
src/rules/windows__process_creation__proc_creation_win_lolbin_openwith.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_pcalua.eql,sha256=7X1pqH5JldL-KltWH1QKuBOnl7E3rwGnYrP-UMozJ14,78
src/rules/windows__process_creation__proc_creation_win_lolbin_pcwrun.eql,sha256=HAWzgNwkigGIrSg6HggL62vewGeemwl2i2CUnsMrm8E,52
src/rules/windows__process_creation__proc_creation_win_lolbin_pcwrun_follina.eql,sha256=NWQzhyv5j8MsJkQpgCIb-dKJlfcmPufL2kD36hy05g4,78
src/rules/windows__process_creation__proc_creation_win_lolbin_pcwutl.eql,sha256=UGubB-82GFFLtd4FMVwkdEtIKTSRVGFaIMDkrR9IPqA,182
src/rules/windows__process_creation__proc_creation_win_lolbin_pester.eql,sha256=W3lDD04Jrjxa5AJcMJKTRHfEbkxmQTGu5K0g-D7jk1E,252
src/rules/windows__process_creation__proc_creation_win_lolbin_pester.lucene,sha256=D5T2gVtMtVOaEWEbmhrfoUFA-aZOuL8hUin566sy4i0,234
src/rules/windows__process_creation__proc_creation_win_lolbin_pester.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_pester_1.eql,sha256=gLQQfl6ZuplCkb7fRVmlM4aukmDbPONNtb-HRh378G8,312
src/rules/windows__process_creation__proc_creation_win_lolbin_printbrm.eql,sha256=1U4JRvCk1nXbbqmHr47ljOyUNRPv-xWlrz7u1BqBbGA,116
src/rules/windows__process_creation__proc_creation_win_lolbin_pubprn.eql,sha256=VHCI5drr51dK_UaZaP-t-6_WX7MzJHhaKcLu5lwkgy4,85
src/rules/windows__process_creation__proc_creation_win_lolbin_pubprn.lucene,sha256=8E6_3GC9oTij3jZsgmKi9xrTjjjWKbDFBm7IlfLtxaY,72
src/rules/windows__process_creation__proc_creation_win_lolbin_pubprn.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_rasautou_dll_execution.eql,sha256=VGp_XrjEZS0PHHH2iJjHmXasaR1A8NuQgJNmgDYCoi8,166
src/rules/windows__process_creation__proc_creation_win_lolbin_register_app.eql,sha256=MyHPxVomPSEDXsSyTAiD2wy1UrzRngkvykb-AYrOLYI,93
src/rules/windows__process_creation__proc_creation_win_lolbin_remote.eql,sha256=McRbDAsPO9Pd7TiCIwEM-Q0UAZFyri72ChqkCbAN4ww,91
src/rules/windows__process_creation__proc_creation_win_lolbin_replace.eql,sha256=97syQXZF46a7hZ4YQ8BKTT_xJaFkfE6fdjDIqPvWFRM,124
src/rules/windows__process_creation__proc_creation_win_lolbin_runexehelper.eql,sha256=KWjX5bBUhsw65BExeNchYrBIBF2TbmCQoHJR6w7DXsY,58
src/rules/windows__process_creation__proc_creation_win_lolbin_runexehelper.lucene,sha256=dDDfSxvK7zhph3Pj5wGae3c2Lj67Bxcug3LhW6qcsNA,46
src/rules/windows__process_creation__proc_creation_win_lolbin_runexehelper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_runscripthelper.eql,sha256=vlYpzshndQo-ouN6C4TdcYnXinrbVt5VnsCzhHqpi_g,96
src/rules/windows__process_creation__proc_creation_win_lolbin_runscripthelper.lucene,sha256=1JK24sCvEQRt49VPIWcUmtr53OjSqNSV3MXCmd_P-aM,82
src/rules/windows__process_creation__proc_creation_win_lolbin_runscripthelper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_scriptrunner.eql,sha256=E__alsasaaS0HkZQ_J_PKb3WxRiEw2HevZ7Jzxsl884,148
src/rules/windows__process_creation__proc_creation_win_lolbin_settingsynchost.eql,sha256=LnUx4nR2RZN2s2vPi_85qAqlxXeLT4l-DaJ1zjyDGl0,244
src/rules/windows__process_creation__proc_creation_win_lolbin_settingsynchost.lucene,sha256=i9p1RbmdezciRmlfTBmqc2uT0F72B7Eb5XOt3NbAGg8,225
src/rules/windows__process_creation__proc_creation_win_lolbin_settingsynchost.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_sftp.eql,sha256=HsnlGkzXxe6wo21AYfsA5XXHKLmsAdbyF-hoIRzPbbw,102
src/rules/windows__process_creation__proc_creation_win_lolbin_sftp.lucene,sha256=viqUiJ6qpjzOO30bDUDQ--hUEBx329pKJDuQwvNFGRE,89
src/rules/windows__process_creation__proc_creation_win_lolbin_sftp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_driver_installed_by_pnputil.eql,sha256=LmTq9yW0ku3PwbkH2QcKmAKFEU07ravuhk_o_P6dD0I,137
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_grpconv.eql,sha256=mI6bPQuC1lzvOV0RHjV96lbENlLQ3QrLLP1mFDGvA1w,74
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_grpconv.lucene,sha256=Z8br-3fkWpdqRluGTkkqHH-EXX68jmKvhnz4iJ5mRQU,60
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_grpconv.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_sqldumper_activity.eql,sha256=ioCu8_GiaSct6dceMzZiItEJ9uOuuNAV3ifjJjZk5eY,110
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_sqldumper_activity.lucene,sha256=N_M1iJTy2minw0bVlRyMgnhfT11RdjmfOP57uBbveFU,91
src/rules/windows__process_creation__proc_creation_win_lolbin_susp_sqldumper_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.eql,sha256=OPDaPs5RrhiPajRtZZJ8HWHhvDig9TQDYJRvqqE897w,164
src/rules/windows__process_creation__proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.eql,sha256=u-sI5sTHPKG0DQiPdvIXA6TklVaeWjdBIc6xW7vRaN8,97
src/rules/windows__process_creation__proc_creation_win_lolbin_tracker.eql,sha256=BjRX3jC5jMSTiPZt_6KZJWzIxFwdBV_IWD9K8rrKRQc,326
src/rules/windows__process_creation__proc_creation_win_lolbin_tracker.lucene,sha256=pWefHOxgdAk_iGvxgSVJoC9yQ5P8BOsyBprWyfEHk2w,304
src/rules/windows__process_creation__proc_creation_win_lolbin_tracker.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_ttdinject.eql,sha256=_laiC-7Q514pGyxhc5OaGStiUgqtUjKXeiDmtpoU60g,95
src/rules/windows__process_creation__proc_creation_win_lolbin_tttracer_mod_load.eql,sha256=kE3Vnumhq64T6jdhFrHJIoV5hf7sx9Q4uoaQqTDutRQ,54
src/rules/windows__process_creation__proc_creation_win_lolbin_tttracer_mod_load.lucene,sha256=2BntqZ9Pf8pWveJ2eisS4mKMBwVdItpe5wG-y12k18I,42
src/rules/windows__process_creation__proc_creation_win_lolbin_tttracer_mod_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_unregmp2.eql,sha256=Cgt_kmRuXxtOGmWTdUuJ06_abLZJFvPOugLKGoPvZQ0,210
src/rules/windows__process_creation__proc_creation_win_lolbin_utilityfunctions.eql,sha256=xM5zOZXFa4vCuRsnclZEFtBQLuEMvZIZm4PQXhzZDrM,80
src/rules/windows__process_creation__proc_creation_win_lolbin_visual_basic_compiler.eql,sha256=ZssfSLVKUmqGP6m7zxxqpFw3JlRE0NNtUtTl_BrAulU,88
src/rules/windows__process_creation__proc_creation_win_lolbin_visualuiaverifynative.eql,sha256=XU6C32XqgzHM4KG_8qyaDEVu8H4gk46DxAr01Cr4x3w,121
src/rules/windows__process_creation__proc_creation_win_lolbin_vsiisexelauncher.eql,sha256=NDPbG6A-wjaKx10JSaEZbblBSnQHXDmCDWBNNLkjAE8,167
src/rules/windows__process_creation__proc_creation_win_lolbin_vsiisexelauncher.lucene,sha256=9IP-JJBtnOnXH189p2QtCmsj5JIm3kYjvQeLbIlx6xQ,151
src/rules/windows__process_creation__proc_creation_win_lolbin_vsiisexelauncher.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lolbin_wfc.eql,sha256=FFfpXWcXo4d0tAJFD1YfdccObS1CFdxvV3pcceL7Yww,85
src/rules/windows__process_creation__proc_creation_win_lolscript_register_app.eql,sha256=9vDc17pUeDS1m0p_oKcFBgp1tdDRhrhzdD0voAHmay8,193
src/rules/windows__process_creation__proc_creation_win_lolscript_register_app.lucene,sha256=kKn3FD--z70srXj06D10ob7qw39t4xPrK9k2Gq7DxEU,168
src/rules/windows__process_creation__proc_creation_win_lolscript_register_app.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_lsass_process_clone.eql,sha256=88_cmYz-v-deIVAi0tk5IjBUdCZZZrgmdkrBJnquU9I,127
src/rules/windows__process_creation__proc_creation_win_mftrace_child_process.eql,sha256=vDQ9uS-x8scDygGqWMO9ef7qzSwgBrriUGAVhUnA33c,53
src/rules/windows__process_creation__proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.eql,sha256=oxwYQf5ZMEOVKvA7FSbkmKQx6WJZ3I2IxGh8jw4zy88,284
src/rules/windows__process_creation__proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.lucene,sha256=G1u65ZSbiOj5cbowW-MrH5wzjhIS8pBWpjEJTLxeVUE,267
src/rules/windows__process_creation__proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mmc_mmc20_lateral_movement.eql,sha256=gOmcSt-ol9WMjaPscl3pSKlpUi64Uqe72Ol7K3nysN4,129
src/rules/windows__process_creation__proc_creation_win_mmc_rlo_abuse_pattern.eql,sha256=uUroxSWwSaVskWoOpl2ehs4sUDgUYmt5DIZQBUr_6t0,242
src/rules/windows__process_creation__proc_creation_win_mmc_rlo_abuse_pattern.lucene,sha256=4WWPZXFJ-DmfGBDb9ASbXMMmfwEApE7qgct918asKjI,220
src/rules/windows__process_creation__proc_creation_win_mmc_rlo_abuse_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mmc_susp_child_process.eql,sha256=3XRHw1IgUmFsZsIG86YDlOUX0FSdogWbEMbal7CqNUU,268
src/rules/windows__process_creation__proc_creation_win_mode_codepage_russian.eql,sha256=ynKHpSwkrM58BgeYQQq8wn2o_32hcX0wHSriZS2BO08,253
src/rules/windows__process_creation__proc_creation_win_mofcomp_execution.eql,sha256=t8tBo3AEMvAKcgsouVuhxoS5vCTrGsBCMMuNlneD4_o,633
src/rules/windows__process_creation__proc_creation_win_mpcmdrun_dll_sideload_defender.eql,sha256=N1wqNot1sftdtrpNyMmv5W6OeNEFZcLWMN57ojeQlrA,335
src/rules/windows__process_creation__proc_creation_win_mpcmdrun_download_arbitrary_file.eql,sha256=b3ybXvapKLhvPKDU_TncjKFKFj9ekfzGL9qzAG5FKA4,293
src/rules/windows__process_creation__proc_creation_win_mpcmdrun_remove_windows_defender_definition.eql,sha256=3GXDuy8P59UNuL-oYHkZ13BkmDB9mYlIMjEgQN9evOQ,183
src/rules/windows__process_creation__proc_creation_win_msbuild_susp_parent_process.eql,sha256=fQYRplHJXUIFqFDzmwP94q6KwCqHyMrBrIsZOyQZqME,241
src/rules/windows__process_creation__proc_creation_win_msdt_answer_file_exec.eql,sha256=jIpK4PXV8z2mlSoNmWg1BCNuh0KiTWio74pYo0tGyqE,268
src/rules/windows__process_creation__proc_creation_win_msdt_arbitrary_command_execution.eql,sha256=MNRX3g1a6Alz06nQkFbPAD6pxr1ozkyZCdOOnO6pEIQ,276
src/rules/windows__process_creation__proc_creation_win_msdt_arbitrary_command_execution.lucene,sha256=-DBwzUsL0k-ODfTacpAdvYmVaNcHNQA2E92RyNX8ikQ,264
src/rules/windows__process_creation__proc_creation_win_msdt_arbitrary_command_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msdt_susp_cab_options.eql,sha256=9cKGgogxS206Fh0wU0drlWQzOmhahCyIXdtGoPDCDq4,187
src/rules/windows__process_creation__proc_creation_win_msdt_susp_parent.eql,sha256=WrMoCdu4xus1iY_9iuGplDYAH1xrlPq-c7rtR1Knysc,316
src/rules/windows__process_creation__proc_creation_win_msdt_susp_parent.lucene,sha256=CmEJZqg9m3osGkJyYfkkAJYfeN9ekSvA2oLWF81Uuhk,294
src/rules/windows__process_creation__proc_creation_win_msdt_susp_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msedge_proxy_download.eql,sha256=w0Vf8zOvvnfZ92KyRigRfuQMExPa1XQQoxCkQKvjCeQ,166
src/rules/windows__process_creation__proc_creation_win_msedge_proxy_download.lucene,sha256=oU4sdXTKd2rM9UKv-gq6swmXYTpQXzLlYakDUWnrx04,150
src/rules/windows__process_creation__proc_creation_win_msedge_proxy_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mshta_http.eql,sha256=tNsK50rQ1yxq8rdPbQv6I_odVJfbJzvD3y5Z54w_EtM,164
src/rules/windows__process_creation__proc_creation_win_mshta_inline_vbscript.eql,sha256=gXl6UgWAN3CnboIo2VDa1wcg-dzSZ_xYx7DXT62-bwg,114
src/rules/windows__process_creation__proc_creation_win_mshta_javascript.eql,sha256=pbZKT8I9Uc9EmMNUkqkkyvaZoOTZYx7AEOIl6cuXzWE,131
src/rules/windows__process_creation__proc_creation_win_mshta_lethalhta_technique.eql,sha256=_Ma0u5Cc-uJ1ZNs281b_pReQbHY_OeDGJ4-T5mQRN6w,91
src/rules/windows__process_creation__proc_creation_win_mshta_susp_child_processes.eql,sha256=kOPtvyC5QpHQwxqZL81xd5-FWQcx9InlabZdjQ29Cq4,421
src/rules/windows__process_creation__proc_creation_win_mshta_susp_child_processes.lucene,sha256=YojmbRhR7sEuj3w7QwzOLI2MCxem-B15WiXdMkme1ZI,393
src/rules/windows__process_creation__proc_creation_win_mshta_susp_child_processes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mshta_susp_execution.eql,sha256=Jk8K__iy5oP9C4ynx-4BCBkFLGy0NAAJW_cqMu--hjg,470
src/rules/windows__process_creation__proc_creation_win_mshta_susp_pattern.eql,sha256=seWnevxzjsYLxyoC6Ak5lfwIBUc1m5HgZHkwYGxo9Xw,675
src/rules/windows__process_creation__proc_creation_win_mshta_susp_pattern.lucene,sha256=Pze7zAc9BhctSMk9WzYp8uyjwbl7GpPMpVY_RXOUlxo,622
src/rules/windows__process_creation__proc_creation_win_mshta_susp_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msiexec_dll.eql,sha256=MBkjAg6ljh6fZL02fx0mFuoRLziPpgf7aTibOQH5OS8,219
src/rules/windows__process_creation__proc_creation_win_msiexec_dll.lucene,sha256=Y4yJ-qAGVVNiMsSq1m0uAOcs3935WqGtmMR0-xJaUZk,207
src/rules/windows__process_creation__proc_creation_win_msiexec_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msiexec_embedding.eql,sha256=BBS0y5IlWJ7FLHfpnvWYGUBDEW1Ad1WYA50R2rcidz0,499
src/rules/windows__process_creation__proc_creation_win_msiexec_execute_dll.eql,sha256=ihMw1J_WzT2x8CYUbyXRiL3DOis0ZUyaFFFaZ8Ig_vE,1013
src/rules/windows__process_creation__proc_creation_win_msiexec_install_quiet.eql,sha256=vte1wvUJhVPTO50kWyAgZ9PnGCruZSo7sYQDPrP06GQ,823
src/rules/windows__process_creation__proc_creation_win_msiexec_install_remote.eql,sha256=sFIX3TUsdzy5qoWXfh4ifUlsvDMUWFH0d8fd-D6MY_k,700
src/rules/windows__process_creation__proc_creation_win_msiexec_masquerading.eql,sha256=N8H1I5oNoRFqY7pW5q8qRXdKzL1oAtnMclzrXuqbeWo,214
src/rules/windows__process_creation__proc_creation_win_msiexec_masquerading.lucene,sha256=EjoGj6AZDvrkI_MfqJ_79PXA9Ie6c99DlLJaOP_fad0,195
src/rules/windows__process_creation__proc_creation_win_msiexec_masquerading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_msiexec_web_install.eql,sha256=SOKMtvMiENq_r2Vm8dkJCKFDrGXfUrLReejSMQ4UsqI,77
src/rules/windows__process_creation__proc_creation_win_msohtmed_download.eql,sha256=hLJymXWjKfPuEHxKnJF6rR7_7OYNRDdHjM80TsJ25Yc,170
src/rules/windows__process_creation__proc_creation_win_msohtmed_download.lucene,sha256=0vFjc4Mqni-TKZD0sSPHf2gnfsmZQox8usRfLuK0hgM,157
src/rules/windows__process_creation__proc_creation_win_msohtmed_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mspub_download.eql,sha256=fN6Zac4VBNPoke1umMxjIOwq05ddjGALKMaIAI8C0PM,164
src/rules/windows__process_creation__proc_creation_win_msra_process_injection.eql,sha256=-pzwUPSl7uE2z_0L4oe-sXk2ZINAo86_6fbJL6HksTc,257
src/rules/windows__process_creation__proc_creation_win_msra_process_injection.lucene,sha256=CazRq644-GYTmfetEjuzkpiD_DVNQmOibf0Y5_kuNeQ,235
src/rules/windows__process_creation__proc_creation_win_msra_process_injection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mssql_sqlps_susp_execution.eql,sha256=74iLzE-SeRIYMrrOyZuVAew2lx2hzDCxgXSxyzZjPpw,191
src/rules/windows__process_creation__proc_creation_win_mssql_sqltoolsps_susp_execution.eql,sha256=m90lqqUw60P8mj9mwuNHr_GwGtCWuaW9nyo0rlNJGrk,202
src/rules/windows__process_creation__proc_creation_win_mssql_susp_child_process.eql,sha256=FHgTqytozZB49tjYYSIuPgalY_3UUcRz3fa4f8WjIyA,605
src/rules/windows__process_creation__proc_creation_win_mssql_veaam_susp_child_processes.eql,sha256=ts5BtSHClkm2TCWEQANnK1u8Zf2tRdDee1law0osyws,539
src/rules/windows__process_creation__proc_creation_win_mstsc_rdp_hijack_shadowing.eql,sha256=xuzbQS_nWhRjQx2gPfJ4oGdfveHG71cA_2GkOVsfnlA,88
src/rules/windows__process_creation__proc_creation_win_mstsc_rdp_hijack_shadowing.lucene,sha256=apT44RTjxYdto9gjOAVzqH8Vr-c_R5KGwHu3T9KlLxA,75
src/rules/windows__process_creation__proc_creation_win_mstsc_rdp_hijack_shadowing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_mstsc_remote_connection.eql,sha256=uX07JEFHjBZTQN6dFz0XU6OB_eRvFZjw7u8vdEMQ4JM,333
src/rules/windows__process_creation__proc_creation_win_mstsc_run_local_rdp_file.eql,sha256=HdXSt9G7skz5syQ6X1PZXWh8BMnU8CxPrL2lCNnthJM,299
src/rules/windows__process_creation__proc_creation_win_mstsc_run_local_rdp_file_susp_location.eql,sha256=ZPg9SKN93srNrUTk0zQtaP2jw70H_hetK4ToPgFhIF0,414
src/rules/windows__process_creation__proc_creation_win_mstsc_run_local_rpd_file_susp_parent.eql,sha256=b5Nxl3xHyyH4mmWLZCW24LDMV5TFta58K8PYrGRjwDM,354
src/rules/windows__process_creation__proc_creation_win_msxsl_execution.eql,sha256=uuBgy-oc9IiHQKHe8obbMee6gPZuHWX1h9Pel_WBflY,44
src/rules/windows__process_creation__proc_creation_win_msxsl_remote_execution.eql,sha256=8WX99-aCtLIbhzBENDqHsxOIWtQHdsb7btQSor6CJFM,78
src/rules/windows__process_creation__proc_creation_win_net_groups_and_accounts_recon.eql,sha256=k8tUSfu-NVcrWtUcCGchc0uGBXG_11upgJuFwJI8qCo,581
src/rules/windows__process_creation__proc_creation_win_net_share_unmount.eql,sha256=rIawTksBNW7jJfxEPmH8hjsm7qR9xjJdqalylLnOg1w,208
src/rules/windows__process_creation__proc_creation_win_net_share_unmount.lucene,sha256=CX9vx8gbqZaIQ3w6qbooQRPJ91LEKYszTF1aaAzy9zI,179
src/rules/windows__process_creation__proc_creation_win_net_share_unmount.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_net_start_service.eql,sha256=tL0aWPeNvAHa1jHFobejoyZr_coqSnx1Ivllqxlh_tI,171
src/rules/windows__process_creation__proc_creation_win_net_stop_service.eql,sha256=zJ5Rske6103QgF_SNvy-XaRbOianaqbZK824pkFPiJ0,170
src/rules/windows__process_creation__proc_creation_win_net_use_mount_admin_share.eql,sha256=N_NbhuZ-4TDOysWKeUCdjKeKlkT-j3FCA58yBcBuWzE,208
src/rules/windows__process_creation__proc_creation_win_net_use_mount_admin_share.lucene,sha256=XfvJojXnfpEXT50NitHoEru3pLA6XTZhOr2Co7WnC9Y,181
src/rules/windows__process_creation__proc_creation_win_net_use_mount_admin_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_net_use_mount_internet_share.eql,sha256=NUuawzg3x2LTfXH8yXGqM1lZtSDjqINzDMYRq6qyyMU,206
src/rules/windows__process_creation__proc_creation_win_net_use_mount_share.eql,sha256=o7aFsDeixSEMtD19cuZkIAwpIGR1Op53SCmriNvMcLk,188
src/rules/windows__process_creation__proc_creation_win_net_use_network_connections_discovery.eql,sha256=YPzE0rR-R5hmwK47H5JY1NXNF3jFaZC_s-RaX1T4mW8,253
src/rules/windows__process_creation__proc_creation_win_net_use_network_connections_discovery.lucene,sha256=rr0ecRo04ArGh645Q7ZZO0IDT_hgDWyzzHNpqnN0qR0,217
src/rules/windows__process_creation__proc_creation_win_net_use_network_connections_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_net_use_password_plaintext.eql,sha256=u1m4GNOHsa-BsGlxiqf3UZGm5ORTzWTPrcTyZ7_3Sg4,280
src/rules/windows__process_creation__proc_creation_win_net_user_add.eql,sha256=gdw51AfpijomF06agEjVpocjuVbYOuyUv_wwCnPmst4,203
src/rules/windows__process_creation__proc_creation_win_net_user_add_never_expire.eql,sha256=msNHzJp9i9AmcceIjmi2uRiTTm-u0hd2OkCix4A86iA,246
src/rules/windows__process_creation__proc_creation_win_net_user_default_accounts_manipulation.eql,sha256=EnV2WyyAYwnnjZTmZkehJK50anzqWA75Yfbn5s4CTls,958
src/rules/windows__process_creation__proc_creation_win_net_user_default_accounts_manipulation.lucene,sha256=82HdCu_0rKInNvP7tJl7tObXGF5J6rLvjeVc84Q2wBE,976
src/rules/windows__process_creation__proc_creation_win_net_user_default_accounts_manipulation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_net_view_share_and_sessions_enum.eql,sha256=aBxprcJaOO9dBkpKuLUoMCX3IinZJtuNPEskkrmp7Zo,208
src/rules/windows__process_creation__proc_creation_win_net_view_share_and_sessions_enum.lucene,sha256=2nVsEXloB9kx3tJEzExKyYEjnWrn_2mIOxoR1shiNFQ,178
src/rules/windows__process_creation__proc_creation_win_net_view_share_and_sessions_enum.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_fw_add_rule.eql,sha256=085eK2C594ZPfJx8_FkKLBNwXFMGjJFmg9KO6z901LM,518
src/rules/windows__process_creation__proc_creation_win_netsh_fw_allow_program_in_susp_location.eql,sha256=mrU9lgNgPVoM2-VZDlB1MGPOUon_Es0Pgjaa_LV5_qo,1040
src/rules/windows__process_creation__proc_creation_win_netsh_fw_allow_program_in_susp_location.lucene,sha256=sWRxryVdUzAZrpcpWyf9f2xhxQReGuSlcvkcuznWPhM,1024
src/rules/windows__process_creation__proc_creation_win_netsh_fw_allow_program_in_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_fw_allow_rdp.eql,sha256=aciPi6k9e9hM_qssVqpXDY7WYLoKnpLBjxEoIgrPjLw,298
src/rules/windows__process_creation__proc_creation_win_netsh_fw_delete_rule.eql,sha256=kobY8GCD9MFtV5BTqhhioKxMlGPRHEBPLYIH03xck-8,416
src/rules/windows__process_creation__proc_creation_win_netsh_fw_delete_rule.lucene,sha256=NJoiK75SBofg4qyzInFFj1x8zEZsgzvrX0jiiCSkHwY,400
src/rules/windows__process_creation__proc_creation_win_netsh_fw_delete_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_fw_disable.eql,sha256=gCKowaxTa0dCIjp4uFYo82J5HpFCWukPzW8rqkhspb4,382
src/rules/windows__process_creation__proc_creation_win_netsh_fw_enable_group_rule.eql,sha256=ud1dvJcx19BdDs9pFa6FPVdfrh5fdKRLRCREslENuNA,348
src/rules/windows__process_creation__proc_creation_win_netsh_fw_enable_group_rule.lucene,sha256=Zj-TVZsXqcr6a1ZNuYDndaKjoh_pm8Y2vdvhlFuZ3U4,322
src/rules/windows__process_creation__proc_creation_win_netsh_fw_enable_group_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_fw_rules_discovery.eql,sha256=TuRibFsRqa9yJgZJjEFGRz0Jbq_-seK4A-4w-G3Paoo,288
src/rules/windows__process_creation__proc_creation_win_netsh_fw_set_rule.eql,sha256=ToWmMDbFuz75_6BRYuyLnPF_MAoBMLGk5kPHLs-k_p8,168
src/rules/windows__process_creation__proc_creation_win_netsh_fw_set_rule.lucene,sha256=5bNTX2hAtkqBpTxhrOysOliJLknjs06SeNjZnLK6xZI,154
src/rules/windows__process_creation__proc_creation_win_netsh_fw_set_rule.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_helper_dll_persistence.eql,sha256=yRG2g5BxKJxqAAtcI4lgrR6MNHaqrW-abahA-8M7SCQ,162
src/rules/windows__process_creation__proc_creation_win_netsh_packet_capture.eql,sha256=GUVIgMVl7NHLCYycYff9laZmNihksjsTURdBR9R3Ae0,163
src/rules/windows__process_creation__proc_creation_win_netsh_packet_capture.lucene,sha256=-5OtVBQ2p3xdNWOMx7L3J3AMAVYG8nfgQNssXbS6tRM,145
src/rules/windows__process_creation__proc_creation_win_netsh_packet_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_port_forwarding.eql,sha256=RCGX0Dek7kZRXmCbrbdwQzyu_1BTjcvgwPAXUhMRQps,479
src/rules/windows__process_creation__proc_creation_win_netsh_port_forwarding.lucene,sha256=ReMJmqWgMHGjibYnbECeDpSl1XH5454DtwrrZ81_RxE,448
src/rules/windows__process_creation__proc_creation_win_netsh_port_forwarding.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_netsh_port_forwarding_3389.eql,sha256=dBKn2_DGIhF5dfk7KXrYlGpiJWM5eMzcwRBnjaDqik4,224
src/rules/windows__process_creation__proc_creation_win_netsh_wifi_credential_harvesting.eql,sha256=5C_gPNx1L-R981bJB0HY6Pe35QJHTqVVFlcL5SvxpI8,259
src/rules/windows__process_creation__proc_creation_win_nltest_execution.eql,sha256=UbftB1pUsRXl_vkHTKUJVOwt_uycKWxwg_FfdvJ3Kl0,93
src/rules/windows__process_creation__proc_creation_win_nltest_recon.eql,sha256=icr55JPPscKeAKMeJZJGD8wpWy2vDo40bvRwv3pkM3A,330
src/rules/windows__process_creation__proc_creation_win_node_abuse.eql,sha256=YXZ_c_Ly91vG_d_iUN-lcvSiyjCtsD5qgu6P1qKLWI8,262
src/rules/windows__process_creation__proc_creation_win_node_adobe_creative_cloud_abuse.eql,sha256=9h1br29W-H0P2PCa8yb11nIyPYH9zoiL1C5eOv2x5Co,153
src/rules/windows__process_creation__proc_creation_win_notepad_local_passwd_discovery.eql,sha256=oyyjaRzk3WIzAEj88O-7jIXUCZujY9Yp4tBv_LKuf8k,200
src/rules/windows__process_creation__proc_creation_win_notepad_local_passwd_discovery.lucene,sha256=-wx-Lp4Gqx0qgpRg0w6R-I_-rrfvUPUi6g7kvwkLWTI,178
src/rules/windows__process_creation__proc_creation_win_notepad_local_passwd_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_nslookup_domain_discovery.eql,sha256=q8JvSWQckMrftjUy4hQ36tk3uZCpxzRzwJmri7B0Glg,95
src/rules/windows__process_creation__proc_creation_win_nslookup_domain_discovery.lucene,sha256=yn8HvY9N6Lpa3jpef7FtuC_wFGRCOcyW6GzYpRLbP8o,81
src/rules/windows__process_creation__proc_creation_win_nslookup_domain_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_nslookup_poweshell_download.eql,sha256=bKqzWgzCBUN-XUJKfb8IVmbU-AAkRAy4zENHMGd1zLk,247
src/rules/windows__process_creation__proc_creation_win_ntdsutil_susp_usage.eql,sha256=IdaeVzufrIiIjv07KF_UPNw61BL1RHCvoiJYFdIdNRg,275
src/rules/windows__process_creation__proc_creation_win_ntdsutil_usage.eql,sha256=gAdJV1ve2HuMqMcDnD9NFYP13upUGQni47SxBaDWAmA,47
src/rules/windows__process_creation__proc_creation_win_odbcconf_driver_install.eql,sha256=Maoh83BgnYpQX1T-7E4r02p5HzqXN3_IQFmKsYXuLIw,177
src/rules/windows__process_creation__proc_creation_win_odbcconf_driver_install.lucene,sha256=ZYjU9MxMhPj4OuNQbwvfHgxVbpaurDW9gYja5BCXjn8,160
src/rules/windows__process_creation__proc_creation_win_odbcconf_driver_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_odbcconf_driver_install_susp.eql,sha256=ol7d_0W-xU1sdOH6t0WnXRiX1py31LiwvIr41WRGfDY,183
src/rules/windows__process_creation__proc_creation_win_odbcconf_exec_susp_locations.eql,sha256=aDEV_hviwaWboO9rZ-nLQO6BqtPjxgyjtbmTykj5N2U,959
src/rules/windows__process_creation__proc_creation_win_odbcconf_register_dll_regsvr.eql,sha256=FzLea-BDnl55NM6SCKRlkB34qtfoqzsZnfUIWYnx4nQ,170
src/rules/windows__process_creation__proc_creation_win_odbcconf_register_dll_regsvr_susp.eql,sha256=yxdkz4RTfFEEkpuki8MZa9G0klP1FuaWqBm_KG7W2rM,176
src/rules/windows__process_creation__proc_creation_win_odbcconf_response_file.eql,sha256=hJ9V3fccNnOuG--0orYo7SBuAehipLbvwpO_h1hXl_g,219
src/rules/windows__process_creation__proc_creation_win_odbcconf_response_file_susp.eql,sha256=RejIjXTTmpVWYm2mr27xzE0hAGGCkjE1xktZV_OCI0I,438
src/rules/windows__process_creation__proc_creation_win_odbcconf_uncommon_child_process.eql,sha256=hnOksELIEl2HsCSbVFr4NUb5WBKBhRiJ3f9e32rffr8,54
src/rules/windows__process_creation__proc_creation_win_odbcconf_uncommon_child_process.lucene,sha256=vo8jGGb5wEiuY00rIaihlJS5vtr7lC1_2b3OuK_FHjQ,42
src/rules/windows__process_creation__proc_creation_win_odbcconf_uncommon_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_arbitrary_cli_download.eql,sha256=oNhL1T_J4w1pTuOhClvHAXQzWHRIfFTIAsGCrw2GtI0,240
src/rules/windows__process_creation__proc_creation_win_office_excel_dcom_lateral_movement.eql,sha256=jwlVS1jDeJ8Ri21iP8aiJf4l0EG0KC_r3PcEwmfbvoM,228
src/rules/windows__process_creation__proc_creation_win_office_excel_dcom_lateral_movement.lucene,sha256=9hPmvmBKi26gu54QqKl7GV5B0JcFaw8pd9SQNJvKZUk,200
src/rules/windows__process_creation__proc_creation_win_office_excel_dcom_lateral_movement.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_exec_from_trusted_locations.eql,sha256=se0PG20oS4ARPCPz_PsgzJxfgRWo3Grf7y7S_83vnqs,534
src/rules/windows__process_creation__proc_creation_win_office_onenote_embedded_script_execution.eql,sha256=6xUgI7nuD_l10utRqxG0k0WXZnYXl5xQkhngNJPGBj4,272
src/rules/windows__process_creation__proc_creation_win_office_onenote_susp_child_processes.eql,sha256=qy6Xy7wBhcz0dP_M04AlaYJNsImV_J5DOefbnhj2vhg,1894
src/rules/windows__process_creation__proc_creation_win_office_onenote_susp_child_processes.lucene,sha256=RMoR8Cc3CCAZck7UF5iEuXxWN9VryKqI-h7JswaO8pk,1840
src/rules/windows__process_creation__proc_creation_win_office_onenote_susp_child_processes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.eql,sha256=VyUFOHylUXvrREQNLhjVvF6KPTnj6Rwu7_ulkKF4DVs,84
src/rules/windows__process_creation__proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.lucene,sha256=HD2VEheTIe7Tjhc8jxxmk8nwj9H6Rea4m4TZDTe-rsc,72
src/rules/windows__process_creation__proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_outlook_execution_from_temp.eql,sha256=2EuQG_vT3ri8L6dsXcl64Hv55ZwFd4Zd7YOcgCzkuQY,78
src/rules/windows__process_creation__proc_creation_win_office_outlook_execution_from_temp.lucene,sha256=88d-pnmc3NmFckd4qsfT4Efdch3G3Av_UHUJghGxeJ4,68
src/rules/windows__process_creation__proc_creation_win_office_outlook_execution_from_temp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_office_outlook_susp_child_processes.eql,sha256=-K_26c0KJPwAxvQUS_KWZhF5Tn2KJdBqZzzellmqi-A,445
src/rules/windows__process_creation__proc_creation_win_office_outlook_susp_child_processes_remote.eql,sha256=oZFiuuDpezW8h21lwzaS7jsqnmijFWmm5kWd_CIEc4A,82
src/rules/windows__process_creation__proc_creation_win_office_spawn_exe_from_users_directory.eql,sha256=tJYC2ipuV_7uHyNZ2fHuajljNtH-A6p4dEZruRMFnHc,282
src/rules/windows__process_creation__proc_creation_win_office_susp_child_processes.eql,sha256=Lh4Ot1tjGZUCcyGkcpXWQxcqlRoXzPOpcVky06dkOxI,1622
src/rules/windows__process_creation__proc_creation_win_office_winword_dll_load.eql,sha256=mV17ibwuE-Sw2K-E7e2vlEUFosBDHnr4WdM4GBP65kE,164
src/rules/windows__process_creation__proc_creation_win_office_winword_dll_load.lucene,sha256=laVv_JjY4xpRb02r9-5t_UfFHx9fOYZGHkgh9pjHDeg,148
src/rules/windows__process_creation__proc_creation_win_office_winword_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_offlinescannershell_mpclient_sideloading.eql,sha256=WuRjzttGv_mdFhDOVCct88pRjMyugGJSA2rbrqT6JgY,270
src/rules/windows__process_creation__proc_creation_win_pdqdeploy_execution.eql,sha256=Lzmie1Yc-fgQ5KWDF-W0Ifrdbt6fJlJkSMYPAfX7INA,177
src/rules/windows__process_creation__proc_creation_win_pdqdeploy_execution.lucene,sha256=OalF7-4iB14u6FyPn4ZSLnOmFbCqsvnCCC7t4jo3nXk,162
src/rules/windows__process_creation__proc_creation_win_pdqdeploy_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pdqdeploy_runner_susp_children.eql,sha256=kb2RSyZM_b1li5ZkqLfSev0yWm4So0zXhveLs-o0K7A,633
src/rules/windows__process_creation__proc_creation_win_perl_inline_command_execution.eql,sha256=eDR2dF2pemre2T-UDYQSflDqNInNSEtai_n54h0Ygdw,122
src/rules/windows__process_creation__proc_creation_win_php_inline_command_execution.eql,sha256=tCVD5mM6BtsvQEyeLwNtxmQUW0bVwM52PqwmwTQEnig,120
src/rules/windows__process_creation__proc_creation_win_ping_hex_ip.eql,sha256=R_hHkOhI3f9AXnsOXkQxLGS9ZFIMMTBC8ljS-1AWxdg,148
src/rules/windows__process_creation__proc_creation_win_pktmon_execution.eql,sha256=v0SQQYLDCbGZU5SD6enX7jzliUJ6vBUvoQPLH3KmKRY,91
src/rules/windows__process_creation__proc_creation_win_plink_port_forwarding.eql,sha256=MfyDG6DZpZTnIcVWyG-EgvGqBxXHQRLb3T0vaa2aUdQ,113
src/rules/windows__process_creation__proc_creation_win_plink_susp_tunneling.eql,sha256=xLK6fN6AJh8MCIpiLie9uzOaB64dICvu51yWtuzUM5s,226
src/rules/windows__process_creation__proc_creation_win_plink_susp_tunneling.lucene,sha256=EHXO5pGSdDWHBGYsHSyQb_GER3jR9JBnt1rVhfapO6k,209
src/rules/windows__process_creation__proc_creation_win_plink_susp_tunneling.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powercfg_execution.eql,sha256=LI3JisMF6Lde6xGycaRZTqFVUqpEgMpHQw3PsTJQZd4,359
src/rules/windows__process_creation__proc_creation_win_powershell_aadinternals_cmdlets_execution.eql,sha256=tvucKWpqcVcbBB7tYlH0CW36BBcqWr4YTjor64vMA0Q,709
src/rules/windows__process_creation__proc_creation_win_powershell_active_directory_module_dll_import.eql,sha256=t_FOzHHxYIsw_ZBggShR8WuuQ1D4AeTPku3Za6P-7DE,283
src/rules/windows__process_creation__proc_creation_win_powershell_add_windows_capability.eql,sha256=lD_eyKir0BRoSOo-ZhiNDU4zz2RxINUVh0Tp9deggm4,237
src/rules/windows__process_creation__proc_creation_win_powershell_amsi_init_failed_bypass.eql,sha256=cyKZtKrDcqn8JyDZCQDiUKEMEipbyOxBQytrde9zs4g,270
src/rules/windows__process_creation__proc_creation_win_powershell_amsi_null_bits_bypass.eql,sha256=FEztJva9UrmQKVXX43yQa19ayVzPNR67EdHPgt7Qj64,91
src/rules/windows__process_creation__proc_creation_win_powershell_audio_capture.eql,sha256=OrbBIuvehHrgRbBrTuZAdkgzBV_oj9MvTlGAq_hHdRE,172
src/rules/windows__process_creation__proc_creation_win_powershell_audio_capture.lucene,sha256=cB_fuBi-96VZMd3rNzgAFnJ9YVOi4C12Rya-VBSSwh0,163
src/rules/windows__process_creation__proc_creation_win_powershell_audio_capture.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_base64_encoded_cmd.eql,sha256=UeFd6TY9tGpZm2j11FahPLVbqJq8I4w0pC1qwQYZfEk,455
src/rules/windows__process_creation__proc_creation_win_powershell_base64_encoded_cmd_patterns.eql,sha256=LBFDbkGC3qw-5J8ZS263zRRyB0UG7SECHMJC2fbU1-Y,495
src/rules/windows__process_creation__proc_creation_win_powershell_base64_encoded_obfusc.eql,sha256=Hvq6N8EKz6qKc_xzhMsWDCu2IWcRnKLVL6st95_-H6U,862
src/rules/windows__process_creation__proc_creation_win_powershell_base64_frombase64string.eql,sha256=yOAIEz4nPiA8RXHF6Y2tnckoxN1-sAdm0K__lyWhDO8,319
src/rules/windows__process_creation__proc_creation_win_powershell_base64_hidden_flag.eql,sha256=Om6tBsj_KC37ZRXE0_muMzUgYYrz9kTy1I4FnwF4HZE,1732
src/rules/windows__process_creation__proc_creation_win_powershell_base64_iex.eql,sha256=FPKo5uddwF2EYIGrbcSAYh0O8g_A7HfHyqPbbSfWV0s,1056
src/rules/windows__process_creation__proc_creation_win_powershell_base64_iex.lucene,sha256=K1fYotsvUN-kJ1kxrb4vWMsqeLOIirnq6rSbAzCA85g,958
src/rules/windows__process_creation__proc_creation_win_powershell_base64_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_base64_invoke.eql,sha256=brFgDdRTY4TlBNAssXGxzVpcJgmdNhO-EPa0tkraKsA,331
src/rules/windows__process_creation__proc_creation_win_powershell_base64_invoke.lucene,sha256=LZIzMJUEqqYQNpBZw0dGzqGnUWAkt4VxLl9t3XA0n6Q,297
src/rules/windows__process_creation__proc_creation_win_powershell_base64_invoke.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_base64_mppreference.eql,sha256=NV_3JJEU3-tOSbWwB2_6--7Bo4IPEakI7kAFAIsY8h0,1110
src/rules/windows__process_creation__proc_creation_win_powershell_base64_mppreference.lucene,sha256=3gW8tAl-OiF3ZElDAmFmMxYDaOPBDvzzv2qCfoB6X5w,1060
src/rules/windows__process_creation__proc_creation_win_powershell_base64_mppreference.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_base64_reflection_assembly_load.eql,sha256=4bDi7Zt3V_JLD5QoauwztWuT0y9Jzg_11bX7idA2_Y8,1046
src/rules/windows__process_creation__proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.eql,sha256=sBIkYwOLJKFNSkOqpgM0LPYT3dlWzHMxmstmS03eiuk,758
src/rules/windows__process_creation__proc_creation_win_powershell_base64_wmi_classes.eql,sha256=tTMvsS9fOX8a20pxUTajA-ZZDGDIT19jGfAnIAXxfeI,1460
src/rules/windows__process_creation__proc_creation_win_powershell_cl_invocation.eql,sha256=8rdm8_piSl00853IwG6KeHfaiQdMaxsCfu5_J5mUx0s,47
src/rules/windows__process_creation__proc_creation_win_powershell_cl_invocation.lucene,sha256=a4qaiFYXqsAddK2bwV3FgSK4fjEgvBBi85CDbGxZRsA,36
src/rules/windows__process_creation__proc_creation_win_powershell_cl_invocation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_cl_loadassembly.eql,sha256=V1J3nXk5_kz3aYXHBlju_lG3w-VB7RPWpKV7uy7ZBVY,90
src/rules/windows__process_creation__proc_creation_win_powershell_cl_mutexverifiers.eql,sha256=J5mFXkaeLfpTptVkUxjl5J1iyTmxYFYSw0jvwTHIWpg,279
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_convertto_securestring.eql,sha256=FdV31zAebMmDBRj6oVEaGSRqAsIPqE-G2dEPabAiJrI,200
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_reversed_strings.eql,sha256=kYUkvnhgztYTHf_jMF9TWhF6hGGrUcJ62XpBn7kLj9o,573
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_reversed_strings.lucene,sha256=gPBSvPoNDKrE36AsxIxzYDJQdinACliEIg_oR1fBY1s,537
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_reversed_strings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_cmdline_special_characters.eql,sha256=2dFxGntTzI4PKgAkkpE3Zzh6Cd1c5UDSOUCQ_aQWXsA,1984
src/rules/windows__process_creation__proc_creation_win_powershell_comobject_msi.eql,sha256=-dubwbaSJLun7-jQeCo7K7_YTEev3l5UU57uJJezat0,357
src/rules/windows__process_creation__proc_creation_win_powershell_comobject_msi_remote.eql,sha256=y4dXqmwOcUkPu0UsRBQ1QBlVwy-YcP68LWeXBMNU3OM,412
src/rules/windows__process_creation__proc_creation_win_powershell_comobject_msi_remote.lucene,sha256=LahRP-oNKGibPYmp6HhkvyBSgF_MPiOWlWd9fN3uikM,374
src/rules/windows__process_creation__proc_creation_win_powershell_comobject_msi_remote.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_computer_discovery_get_adcomputer.eql,sha256=1EH6-4ZsFkAFvBZ-1gn92K3MXYM0KCe-hDjm3v9PNSE,345
src/rules/windows__process_creation__proc_creation_win_powershell_console_history_file_access.eql,sha256=lFV_ayrHb8yOxxq3wmcKt2vSDsdPWD5mEjThQMrX7pk,111
src/rules/windows__process_creation__proc_creation_win_powershell_create_service.eql,sha256=jatvJ-AaqlO-hfhFWnU1pXDG3cA4FvZYn9JlkozYSAg,92
src/rules/windows__process_creation__proc_creation_win_powershell_decode_gzip.eql,sha256=0Lb40ggcYX52Gkp0LTIgYzWDAHv-IKXZnTUFY-17i-0,88
src/rules/windows__process_creation__proc_creation_win_powershell_decrypt_pattern.eql,sha256=p3yfMw3SMnue4O0xJYMzObfi4oEvx5luGqUFWDIxcSE,646
src/rules/windows__process_creation__proc_creation_win_powershell_defender_disable_feature.eql,sha256=0imKY-zeJmTAGt1JFiaXOEJo9t2Gj4gBunZGpVl2g3Q,4319
src/rules/windows__process_creation__proc_creation_win_powershell_defender_disable_feature.lucene,sha256=4NfoznufbypQv0EngQffB2pdqprb4fpk7nlWWRVdqL8,4178
src/rules/windows__process_creation__proc_creation_win_powershell_defender_disable_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_defender_exclusion.eql,sha256=jlcen8S21rSYHP-xXP5DSDUWnCEfD1cWt5232KhyXXE,221
src/rules/windows__process_creation__proc_creation_win_powershell_disable_defender_av_security_monitoring.eql,sha256=otz2H86myxM4XZYyCm0GJCyRr6H48NMqcwBkKkS-BlQ,612
src/rules/windows__process_creation__proc_creation_win_powershell_disable_firewall.eql,sha256=Dq75dMR9jrPFHE9gzxSdTrQ1_8qzyZ8mK3tFVM2r8Hc,387
src/rules/windows__process_creation__proc_creation_win_powershell_disable_ie_features.eql,sha256=dqGZIJpRpoupqRvvsjX8ZLPYGVtXKGodbsu7U7MUckY,282
src/rules/windows__process_creation__proc_creation_win_powershell_downgrade_attack.eql,sha256=s5vlCqzhU6DoBht_9y0mqoMe9HoWfSHGqmoY9WPSqII,188
src/rules/windows__process_creation__proc_creation_win_powershell_downgrade_attack.lucene,sha256=Pr-WQ9oSw0pIMScX0WLaRgPsprLRJdqWl8e8IbjWJD8,196
src/rules/windows__process_creation__proc_creation_win_powershell_downgrade_attack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_download_com_cradles.eql,sha256=scwtVT_NSY6oen1wONCuEq93a9yE9HIx1o-UBrCLWWI,515
src/rules/windows__process_creation__proc_creation_win_powershell_download_com_cradles.lucene,sha256=Bny-DNgXJ9NAOOOORdn30MYGfxOwpxOtWkzz2cXC2KY,540
src/rules/windows__process_creation__proc_creation_win_powershell_download_com_cradles.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_download_cradle_obfuscated.eql,sha256=BjictGalNMXLTOtnpgDA_3QcddCJrWwWFGZ_KHqLADg,174
src/rules/windows__process_creation__proc_creation_win_powershell_download_dll.eql,sha256=Ed8GgmOhJE2jCBg7Kk5fWUr35sTQToT7GMENhN9TyTM,215
src/rules/windows__process_creation__proc_creation_win_powershell_download_iex.eql,sha256=UXijhGMcCoL_JNp-Udhaphs-XNhw4tIrrZmFG6Zr2_8,303
src/rules/windows__process_creation__proc_creation_win_powershell_download_iex.lucene,sha256=NF7YGlIqJmHdgDT3az5foWgRRSq9Muacub11U1zWQLo,295
src/rules/windows__process_creation__proc_creation_win_powershell_download_iex.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_download_patterns.eql,sha256=SdoA0ANOOBPV6D5c1E0uynVIVU18GdDzFpIIjVuBOwI,380
src/rules/windows__process_creation__proc_creation_win_powershell_download_patterns.lucene,sha256=283Ufe83NgjEwPw0V_iBpOoOkiqBLp_RLfWvU9PHrdU,344
src/rules/windows__process_creation__proc_creation_win_powershell_download_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_download_susp_file_sharing_domains.eql,sha256=SiNAq44SEDTUfaewwESYkKU9t7f6y6xEi_C0GG5j9wM,853
src/rules/windows__process_creation__proc_creation_win_powershell_dsinternals_cmdlets.eql,sha256=LmHMANk-xKXGx1vfsxtynSw61v4TYoA49MBMbzVKwl0,1669
src/rules/windows__process_creation__proc_creation_win_powershell_email_exfil.eql,sha256=yYJ5gg7nBM8qfJeJ7C-V5iIxkFjfZjfhTn06BDqOPfA,338
src/rules/windows__process_creation__proc_creation_win_powershell_enable_susp_windows_optional_feature.eql,sha256=J3MIsni2zSJFv_W4U2c7tbrp7aoXtZki7tyujMu7F1k,322
src/rules/windows__process_creation__proc_creation_win_powershell_enable_susp_windows_optional_feature.lucene,sha256=CXJ8foZtlt639Jk5JiCHyXNvwzLE-SW2iDpT7saBVy8,308
src/rules/windows__process_creation__proc_creation_win_powershell_enable_susp_windows_optional_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_encode.eql,sha256=7jU4iNIRYVlXujz7Nk37MKVNTBSYf6SXaqvJQwC4Lgg,356
src/rules/windows__process_creation__proc_creation_win_powershell_encode.lucene,sha256=9TzEd-s6hL5W6BRxDBdePNuqUTeseW9VHLUKkqEBTQQ,338
src/rules/windows__process_creation__proc_creation_win_powershell_encode.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_encoding_patterns.eql,sha256=B_nLPTGYShtS8SvcjrOjJr6YgivzeDnZTjQ_H8NpGEM,476
src/rules/windows__process_creation__proc_creation_win_powershell_exec_data_file.eql,sha256=wqMEpOjjCNx5FM2DkV-fE8SyPi0zlCnpHeZlu8jKgEk,213
src/rules/windows__process_creation__proc_creation_win_powershell_export_certificate.eql,sha256=ve3TiMlLkx0Xs0HZeJLU-WD4ArXjaCRxPzy7tcRtnlY,91
src/rules/windows__process_creation__proc_creation_win_powershell_frombase64string.eql,sha256=rDqypG40xkHnpz7_tbtT2ZMwBT2hJ3zhPcmgN2uGEX0,55
src/rules/windows__process_creation__proc_creation_win_powershell_frombase64string_archive.eql,sha256=9GyMrq7s5cAsiD4oyVEC_CIULJfS79zmDI73XjGoRMc,128
src/rules/windows__process_creation__proc_creation_win_powershell_get_clipboard.eql,sha256=aQwYBRWYQDfG0TMloHDuNaE9f3WNj_uJ1firO6M9gdI,49
src/rules/windows__process_creation__proc_creation_win_powershell_get_clipboard.lucene,sha256=ykahYQUKX09Efb88Z6xzl1dYylj_cidlm1boQldt4MA,38
src/rules/windows__process_creation__proc_creation_win_powershell_get_clipboard.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_get_localgroup_member_recon.eql,sha256=2_Cf7mBXFVqp76qXJUFDJpPaZryxN_jxqTJCcxgLdzc,307
src/rules/windows__process_creation__proc_creation_win_powershell_getprocess_lsass.eql,sha256=EiNMICGHqsJFq7W6coMnn-6v58ndmdC0_lR2oG8ZdM0,87
src/rules/windows__process_creation__proc_creation_win_powershell_hide_services_via_set_service.eql,sha256=3zcma-GkM7mBWeuoN0W4wRndFYoGisDBAlEGwLr0gfM,247
src/rules/windows__process_creation__proc_creation_win_powershell_hide_services_via_set_service.lucene,sha256=LXgf6qk9OFYkXoNVLjYIKw1COzCGdkecp_bzgxPGoHM,227
src/rules/windows__process_creation__proc_creation_win_powershell_hide_services_via_set_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_iex_patterns.eql,sha256=jiJbRYeaZE_h58GJbHV9Zn2YGj-AS-63y04y1qXTFew,409
src/rules/windows__process_creation__proc_creation_win_powershell_iex_patterns.lucene,sha256=PpaC9MIFcziX_VjNF8W-pLeupBRlFgWEosub0S0In0c,416
src/rules/windows__process_creation__proc_creation_win_powershell_iex_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_import_cert_susp_locations.eql,sha256=1JGQrg0DA1KtdZNK0w8RJnb3p32lyNADPk-wWXe0d7w,312
src/rules/windows__process_creation__proc_creation_win_powershell_import_cert_susp_locations.lucene,sha256=yTu9qgeExlyqjuWs1EScjrpDeRnkCd7Dyv6j7_a-DvA,295
src/rules/windows__process_creation__proc_creation_win_powershell_import_cert_susp_locations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_import_module_susp_dirs.eql,sha256=FmtRrL4sr0tDtPMk4E45hjWBwE-QUvd2knQpa4YD5Bs,441
src/rules/windows__process_creation__proc_creation_win_powershell_install_unsigned_appx_packages.eql,sha256=6iXIZkjuKGXldJyt0OQ2WKx6V_TCgLTXrX1cc-bgn7A,270
src/rules/windows__process_creation__proc_creation_win_powershell_invocation_specific.eql,sha256=RB9km271nnr2HFcMDn_5ts8jpMVQ6I-mEiqjQbYZGtE,1383
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_direct_ip.eql,sha256=MlJEq96vaSK53J6Y-KLlUlhrcZ31bGAk4Y8RwTX2e3g,442
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_direct_ip.lucene,sha256=EMHqj8v230DHoNfsjCBdVOkGQnqlqMAKCj2Uw14Eztc,434
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_direct_ip.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_download.eql,sha256=6A4jNC4WPmcefWr_6KjvctBWrldxediasnedix61lPo,507
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_download.lucene,sha256=OKRhtHgL7gMntfhnZ_RplzvcmMAZcx2SK8shv8qa_H0,466
src/rules/windows__process_creation__proc_creation_win_powershell_invoke_webrequest_download.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_kerberos_kerberos_ticket_request_via_cli.eql,sha256=oGOTlrXxycwQgLhe_QvdjkzDLizHpWnLSKnyvR8ptiA,281
src/rules/windows__process_creation__proc_creation_win_powershell_mailboxexport_share.eql,sha256=PK49M1Y2KlnLbw0Or7mwGBhueowWf3fLP-Udku44CJY,143
src/rules/windows__process_creation__proc_creation_win_powershell_malicious_cmdlets.eql,sha256=rT2P8ztb2KzfdFmkSWkcgGcfjvMBfLnnxxxBcPXdQyM,4527
src/rules/windows__process_creation__proc_creation_win_powershell_malicious_cmdlets.lucene,sha256=Q_1sU3vhGBAyaJGTJ05byFSn2qSozA6jhoX2knft45o,4701
src/rules/windows__process_creation__proc_creation_win_powershell_malicious_cmdlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_msexchange_transport_agent.eql,sha256=5fuEB19TxdwoMT0zJGSn09WsGR8O-yWu6J4rU0yIzR4,58
src/rules/windows__process_creation__proc_creation_win_powershell_msexchange_transport_agent.lucene,sha256=qziVu4z4uz83ZysI_4Utsgi6XDV8905FFHjnKSOBXSg,47
src/rules/windows__process_creation__proc_creation_win_powershell_msexchange_transport_agent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_non_interactive_execution.eql,sha256=QUNblMtXKkaw9FcvXCZs2BHBwyeMTVQJMMyUiWI8yG4,698
src/rules/windows__process_creation__proc_creation_win_powershell_obfuscation_via_utf8.eql,sha256=tW73-P-_eIZ_eE-b5U_-d2dhSfb6Rx_XAsFp2Ala6VU,67
src/rules/windows__process_creation__proc_creation_win_powershell_obfuscation_via_utf8.lucene,sha256=Jz5EkzU4YJu1ErYTlwdWV4LnZrFh3JTKeXpMLXYbAP4,53
src/rules/windows__process_creation__proc_creation_win_powershell_obfuscation_via_utf8.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_public_folder.eql,sha256=D0jBVsEnjK16GjtZTmzpYVrwAHQ3jxcY7DoefQIaa40,410
src/rules/windows__process_creation__proc_creation_win_powershell_remotefxvgpudisablement_abuse.eql,sha256=t6FG7qXTpPincOhZ9w5rX6lcvyE6ZbTSiAtEpie8ijw,121
src/rules/windows__process_creation__proc_creation_win_powershell_remove_mppreference.eql,sha256=VeahVNPB_I4aOt457HRl6wn1MZ9jYhsOEyflG8NUvZ8,260
src/rules/windows__process_creation__proc_creation_win_powershell_remove_mppreference.lucene,sha256=SrUl0Lqkx9jARlD3jItRNygUlgA3Q_G4M1QoMColbKk,249
src/rules/windows__process_creation__proc_creation_win_powershell_remove_mppreference.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_reverse_shell_connection.eql,sha256=SqXc9gYploNCvyTAJK_TbhO_iy3UToaF3_R04JIXyFw,280
src/rules/windows__process_creation__proc_creation_win_powershell_run_script_from_ads.eql,sha256=21hO-Fo8zimLZEdNQyxFhhjQMYB6ZAI8HZLOcxsholA,229
src/rules/windows__process_creation__proc_creation_win_powershell_run_script_from_ads.lucene,sha256=COkSTZbykNaCX_Hnvs1x55a6h2ZYpjAhPbDtylfvUvs,201
src/rules/windows__process_creation__proc_creation_win_powershell_run_script_from_ads.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_run_script_from_input_stream.eql,sha256=5lS6KJ90Vf-oQQnbm7pf6SaHDPJEwryckadvzu-bY3Q,209
src/rules/windows__process_creation__proc_creation_win_powershell_sam_access.eql,sha256=FNsR5kJAZEwzKFWsJ7vnV7LtkzBnIyRDKjcs-LiwCtc,222
src/rules/windows__process_creation__proc_creation_win_powershell_script_engine_parent.eql,sha256=fKjS3lC4SPQDq6F0v8yNJ7EPrq7bvubspwhFXk7mXE8,215
src/rules/windows__process_creation__proc_creation_win_powershell_service_dacl_modification_set_service.eql,sha256=AmNwDtmsguarwtRwegIaAOfkMpPZujGlltMGh35BJAk,331
src/rules/windows__process_creation__proc_creation_win_powershell_set_acl.eql,sha256=vMJwoGrsgxrvCS4jXuH6KpSMXsz6rMYg9zhRVVFojfE,265
src/rules/windows__process_creation__proc_creation_win_powershell_set_acl_susp_location.eql,sha256=k7_M9M7Aqye2rh7Q4_BX9UwXkZGFqjxLfhE7MoKB864,417
src/rules/windows__process_creation__proc_creation_win_powershell_set_policies_to_unsecure_level.eql,sha256=X24aMmONtOGHCbrDZsYLbW_kJRLPicyg8IltsomZcsM,1031
src/rules/windows__process_creation__proc_creation_win_powershell_set_policies_to_unsecure_level.lucene,sha256=EJhrQt-B4OTxRhwmHa7vQ-CSN4aG6p2c3WbZ3e6HqkM,1016
src/rules/windows__process_creation__proc_creation_win_powershell_set_policies_to_unsecure_level.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_set_service_disabled.eql,sha256=6fbw5YW0qDG-MsY-RFwXk0if0hrEPNR-eZKxjiBh4Yk,248
src/rules/windows__process_creation__proc_creation_win_powershell_shadowcopy_deletion.eql,sha256=9Nyzo5oOC5-X8cyaF0ZaBoNljAs5oqdI2UbzpN3vMfQ,261
src/rules/windows__process_creation__proc_creation_win_powershell_shadowcopy_deletion.lucene,sha256=QxFWwpYLPKbe5URD0kpDkMnfCt973vE_jTD3-9hNueM,239
src/rules/windows__process_creation__proc_creation_win_powershell_shadowcopy_deletion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_snapins_hafnium.eql,sha256=9izllP-zan1Z0DB2IpsWzPwPuKOIm0hSPRC1-rk4SxE,513
src/rules/windows__process_creation__proc_creation_win_powershell_snapins_hafnium.lucene,sha256=tuEwqBC0tcH41h5hwsEvuyex-XsPdw7GdCklaE0a5JE,490
src/rules/windows__process_creation__proc_creation_win_powershell_snapins_hafnium.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_stop_service.eql,sha256=uHfaQ5kqkGSI_ELdYc1cPOaEoFm7cLJ9OhkJBRQV6Ds,191
src/rules/windows__process_creation__proc_creation_win_powershell_susp_download_patterns.eql,sha256=y3aAZhJU8Sd42-MYYpBoIqpK5oBFJCau0xOou0fP88o,362
src/rules/windows__process_creation__proc_creation_win_powershell_susp_parameter_variation.eql,sha256=CO9mQkw8THdU7yQ2ku87b7CuHEkc7TjqE9K2wQHKdT8,2008
src/rules/windows__process_creation__proc_creation_win_powershell_susp_parameter_variation.lucene,sha256=O1AnsBdRpdllw_C8jCYsqtKwjUgcQoNTmOhMzvIgBPo,2318
src/rules/windows__process_creation__proc_creation_win_powershell_susp_parameter_variation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_susp_parent_process.eql,sha256=PUWsjhwjzNcsEcyPa42GXQokkQ7JCxcAaskfO0HewoE,815
src/rules/windows__process_creation__proc_creation_win_powershell_susp_ps_appdata.eql,sha256=tBzaE80eMTZK__z9YLrDBPxpSB6RZadW0X32ydsQFYk,241
src/rules/windows__process_creation__proc_creation_win_powershell_susp_ps_appdata.lucene,sha256=MbkjlvRwRjR3_mUoqhwNJzcH4789qmjuzdqYG0omWdY,213
src/rules/windows__process_creation__proc_creation_win_powershell_susp_ps_appdata.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_powershell_token_obfuscation.eql,sha256=HL-LtjCLbzEaNFKHRHNKLnmW_ss7OzB-eMzYKzxWrNw,786
src/rules/windows__process_creation__proc_creation_win_powershell_uninstall_defender_feature.eql,sha256=Uo9fifkL2Qj_CdMtPJwg6G6-fNCZnPWaFt41keBQ6To,332
src/rules/windows__process_creation__proc_creation_win_powershell_user_discovery_get_aduser.eql,sha256=TahAxzZcHVLw9OhbQDJzLuML9d3zFzIYfxo6a_NvCBQ,341
src/rules/windows__process_creation__proc_creation_win_powershell_webclient_casing.eql,sha256=GTb-4ozJTws5LHDedMxUwddFCbSKUaQxnIRKgCxV2p8,3662
src/rules/windows__process_creation__proc_creation_win_powershell_x509enrollment.eql,sha256=YvjKGZ4NzK8FpuqWxqowttWasiQgKp0jjPCSJLWE27Q,117
src/rules/windows__process_creation__proc_creation_win_powershell_xor_commandline.eql,sha256=zK0h7t9wSLZOpehNRbxoDL6ItDUwhkiX9HLRHedBNQo,411
src/rules/windows__process_creation__proc_creation_win_powershell_zip_compress.eql,sha256=owvxDdwYfs5pnd2_1KziKaiAG7fFWrcgc-gnEasdI8M,225
src/rules/windows__process_creation__proc_creation_win_presentationhost_download.eql,sha256=2iAkGMrJd6uFnnNaUhHU22BrdBDlMo63YkoIS9TaOU0,186
src/rules/windows__process_creation__proc_creation_win_presentationhost_uncommon_location_exec.eql,sha256=0mfWivowlg70caK61iLcoAgG2ot6z2pKBvxI5-BakHA,233
src/rules/windows__process_creation__proc_creation_win_pressanykey_lolbin_execution.eql,sha256=XIOO09o22IkPxY5TQu74hPUaCjr7ZWt44I-UXtara0E,79
src/rules/windows__process_creation__proc_creation_win_print_remote_file_copy.eql,sha256=yIhi0phFEq5L-WVQ6vYhK5KdZJCkHNz7j8xhXLNGw7E,193
src/rules/windows__process_creation__proc_creation_win_protocolhandler_download.eql,sha256=C5Rb-Qu54_rDTuJJqF2i1CugXCZi9fLlHSNoPPCDxUk,184
src/rules/windows__process_creation__proc_creation_win_provlaunch_potential_abuse.eql,sha256=Nj4IyVaR44QRNCBkXcvNnMBki0TwOMHiLLwyh1Pb3vE,455
src/rules/windows__process_creation__proc_creation_win_provlaunch_susp_child_process.eql,sha256=Wn8mmF0JooBxbfuK9cidwCeqCGFgflZeH9v_Uzlw-wg,449
src/rules/windows__process_creation__proc_creation_win_provlaunch_susp_child_process.lucene,sha256=nyBAw22opJaJecRHdNId3CNdMaTzhl6_TkjNH4dZ5dE,424
src/rules/windows__process_creation__proc_creation_win_provlaunch_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_psr_capture_screenshots.eql,sha256=Fb9NSuPAIJN8xMNpDxrH22rr_nkiVgd50R8rascWanE,100
src/rules/windows__process_creation__proc_creation_win_pua_3proxy_execution.eql,sha256=xbeTuAU5COIDXsb2ItHnNquypmuMf0q2xhnANgwicfc,148
src/rules/windows__process_creation__proc_creation_win_pua_3proxy_execution.lucene,sha256=6zwI5Atsmt3HXtvadD0_2rbnDynRFJR2QnXiQeAuIig,141
src/rules/windows__process_creation__proc_creation_win_pua_3proxy_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_adfind_enumeration.eql,sha256=B_kyqKB0T5x-pUU-6Gqva8J1PmrnBHB0lt1TNEFXiz0,294
src/rules/windows__process_creation__proc_creation_win_pua_adfind_enumeration.lucene,sha256=i8E4lCxet0rStgmNn-OGppOvsEsbOPm1BGRV6XpN94I,276
src/rules/windows__process_creation__proc_creation_win_pua_adfind_enumeration.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_adfind_execution.eql,sha256=DX6W297JJhEnF5ciOk4MZyfsrBJlu6zN0jx1HZwOlPM,496
src/rules/windows__process_creation__proc_creation_win_pua_adfind_susp_usage.eql,sha256=8T5v3a5phKtAS-lFeGzZjU7TzdD6vVsiMq3W4RttQbw,359
src/rules/windows__process_creation__proc_creation_win_pua_advanced_ip_scanner.eql,sha256=RgW6PpTqmeHM5LcIYOeuBY59xXb7sgtpGbmjG2nG4w4,238
src/rules/windows__process_creation__proc_creation_win_pua_advanced_port_scanner.eql,sha256=d-U-g3TxabixWNeYURoEqAaurnRlg6_EYEbVVfSD9nY,244
src/rules/windows__process_creation__proc_creation_win_pua_advanced_port_scanner.lucene,sha256=1vWiy4J37JdS1dDQ585xuND0m-uBw6BBGqJiiPWRd4A,228
src/rules/windows__process_creation__proc_creation_win_pua_advanced_port_scanner.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_advancedrun.eql,sha256=28tdOyyNLrw12Pg17iQmiGVeeI7O8Ksi2kYkXrt7PZQ,266
src/rules/windows__process_creation__proc_creation_win_pua_advancedrun_priv_user.eql,sha256=Cy0OfWlNzNvUDfdS8uLtWyTQoQzpFhH0wLZH6I-t8rY,265
src/rules/windows__process_creation__proc_creation_win_pua_advancedrun_priv_user.lucene,sha256=VMcKRCW7fctZwjvfSF14w29i-nmuYrg2VRAZoYVFCJY,257
src/rules/windows__process_creation__proc_creation_win_pua_advancedrun_priv_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_chisel.eql,sha256=wDKgKbM-7NE-9r1BWU4xYCZ4GR4VkpcmNjKjk-nQz_c,236
src/rules/windows__process_creation__proc_creation_win_pua_cleanwipe.eql,sha256=Wcgw9HBD_6cq7UV7fIyx5wNFTyuWwv63AFdhomXZN5U,349
src/rules/windows__process_creation__proc_creation_win_pua_crassus.eql,sha256=DR4W2QiVXh4q0lpESBs__Ou95n54nXWNiYjNv92UQis,131
src/rules/windows__process_creation__proc_creation_win_pua_csexec.eql,sha256=fzk66qPCgivaP0L96AjgRn88hTb8O0g4j3-xwlkdqhc,80
src/rules/windows__process_creation__proc_creation_win_pua_defendercheck.eql,sha256=vsVEmMjRA1X5QxhQn9760_S5dihv46fSJbwKQEqCHYk,94
src/rules/windows__process_creation__proc_creation_win_pua_ditsnap.eql,sha256=cR4GEDRkLFkENt6Y2Jc-mucP76QDjhabhNSGRnbTwwk,86
src/rules/windows__process_creation__proc_creation_win_pua_frp.eql,sha256=6KNCqXd98I4i5A2YpDiC6ZJExW4xfE4d0PBd6sLF5qk,314
src/rules/windows__process_creation__proc_creation_win_pua_frp.lucene,sha256=PJoFUYtQMR23tw4B0yQmU87pZ1UnstilfDfj_3zCDWc,289
src/rules/windows__process_creation__proc_creation_win_pua_frp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_iox.eql,sha256=ztEtB4r15Vu4nbcMrU7iGiJUQP6tE-LXb4Uo4m48I2Q,358
src/rules/windows__process_creation__proc_creation_win_pua_iox.lucene,sha256=ymyWTQLtAsidooZX_N-iii-RSqYq2TBeLZS5wdM0XrQ,349
src/rules/windows__process_creation__proc_creation_win_pua_iox.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_mouselock_execution.eql,sha256=qPlNBUbHMzY8GX-PMtPTHil9F0diYIecV3G_Ha46N7M,118
src/rules/windows__process_creation__proc_creation_win_pua_netcat.eql,sha256=j0l7QPZGXeiBeVflsWBnahIJwKz-6YQeosyKbuqgsko,267
src/rules/windows__process_creation__proc_creation_win_pua_netscan.eql,sha256=UYGs0j0WQn065KZzCMZRwKSX0A3vYW-XLVJ3cxBDfMc,148
src/rules/windows__process_creation__proc_creation_win_pua_ngrok.eql,sha256=KdBV5lIqjl6RlTIvg2SA3qBWfiNpjEHF5dZ1Y1IQs1o,445
src/rules/windows__process_creation__proc_creation_win_pua_nimgrab.eql,sha256=3gA8SEPmpptjeYaQmumkg6XThCv0pk3GQmRmLlAYe4c,248
src/rules/windows__process_creation__proc_creation_win_pua_nimscan.eql,sha256=kp6-WqLlSZYgW5b9HeY_3hYtxErpgMEcOff1DXLVWs4,221
src/rules/windows__process_creation__proc_creation_win_pua_nircmd.eql,sha256=LYOGhQ6_nyBrYWnfdEhTHGt8ab0fafZ7VdegyxxfVwA,318
src/rules/windows__process_creation__proc_creation_win_pua_nircmd.lucene,sha256=EL1aXZ_bXxZNrnkdMWmyKPNP9eDjCnrYmuvQum_kgb4,296
src/rules/windows__process_creation__proc_creation_win_pua_nircmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_nircmd_as_system.eql,sha256=2p0oaRg4S_aLvUGvqw8-2dXVw8ZzDYtF2F-JyaT3trI,49
src/rules/windows__process_creation__proc_creation_win_pua_nmap_zenmap.eql,sha256=4uiXOekz218EhKrzbtfSBmFLxMYHksJF04K7dVyrNuI,140
src/rules/windows__process_creation__proc_creation_win_pua_nps.eql,sha256=NXCGkuxiJEIQJUH0J4siByQhEe4ErwEPVdMmuy0Jf_I,408
src/rules/windows__process_creation__proc_creation_win_pua_nps.lucene,sha256=bi944ifQy2K6rC98-yARZHRK7V1PlgpZQzKcQ63jIfE,395
src/rules/windows__process_creation__proc_creation_win_pua_nps.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_nsudo.eql,sha256=NqT3E5pDYnkmlFt1r6AXY-SFJz9pkllRIPMKEPGUQp8,369
src/rules/windows__process_creation__proc_creation_win_pua_pingcastle.eql,sha256=3_asHXe2BxlIq1ONAfo-KUigjbOBpM83Lmt6fmb7FG4,7975
src/rules/windows__process_creation__proc_creation_win_pua_pingcastle_script_parent.eql,sha256=VhHwhqoQHOpr5ekdQohaANmVERwbHgjjZgqz3pHI-mU,1611
src/rules/windows__process_creation__proc_creation_win_pua_pingcastle_script_parent.lucene,sha256=Tzw-qrOD65f8Nhz-weYNPGCZoB-B7b07f2ZSKvsBWKk,1613
src/rules/windows__process_creation__proc_creation_win_pua_pingcastle_script_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_process_hacker.eql,sha256=Bihe9keDiOM580OqudwnznbeWsVZDVrM2GtEJ57LQw0,727
src/rules/windows__process_creation__proc_creation_win_pua_process_hacker.lucene,sha256=q8JA3BQBg6bBgY_nTcfbJiKd1MXAS-tqVstNXaSbZNY,704
src/rules/windows__process_creation__proc_creation_win_pua_process_hacker.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_radmin.eql,sha256=4I2hgvQIVN-VPdbpQqFRYi31DpiCw35nPw92dNV5sN0,133
src/rules/windows__process_creation__proc_creation_win_pua_radmin.lucene,sha256=bKpJ2shXIkZPUAMyfEnmT_wOHNmzVl3vGi_wQY9WA1g,119
src/rules/windows__process_creation__proc_creation_win_pua_radmin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_rcedit_execution.eql,sha256=7YYOc8K56tUMxrL5AP-7fnb2sFDwt_ip44G1S0_kK9s,350
src/rules/windows__process_creation__proc_creation_win_pua_rclone_execution.eql,sha256=oeKdOW-pn580JeYpVW5ZhWgd_rH1QHqI2VP6U0qMFYY,483
src/rules/windows__process_creation__proc_creation_win_pua_restic.eql,sha256=2QNerbAjioPI5DmmPh1Ab5FDnEqK1awiqh94l2QRFZo,456
src/rules/windows__process_creation__proc_creation_win_pua_runxcmd.eql,sha256=WaBxDAkU4PR8rqeaIAblBqnfYTMcWXKlhy1O_n1sLh4,118
src/rules/windows__process_creation__proc_creation_win_pua_seatbelt.eql,sha256=LudF_BMvg35rfwIE7v6eX_jccEPhS0L12NimGMJwQBE,652
src/rules/windows__process_creation__proc_creation_win_pua_seatbelt.lucene,sha256=Jehpmbx-94CQnBrhy9gYY0HVXhqUTdLMlma-YTQp21Y,654
src/rules/windows__process_creation__proc_creation_win_pua_seatbelt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_system_informer.eql,sha256=fw85uk73j1v-MR4sZ-iarGNYukNmkFS3MIT1DMuf4Tk,444
src/rules/windows__process_creation__proc_creation_win_pua_system_informer.lucene,sha256=msSwZYe9nKnCB7mRZxasXzwBXGZaI_ElG3iHH1YblMw,424
src/rules/windows__process_creation__proc_creation_win_pua_system_informer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_trufflehog.eql,sha256=ZuPrh8wNu8Xpwri8dxDHF2Au8zhpWq_SzsTWwLQmDFU,262
src/rules/windows__process_creation__proc_creation_win_pua_trufflehog.lucene,sha256=jp0uRDcDs6CL1G6eSEleSBGXgKnGxvXdcfvcIbTjnD0,265
src/rules/windows__process_creation__proc_creation_win_pua_trufflehog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_pua_webbrowserpassview.eql,sha256=dm_sgqm_pSXvqRNg77bBis4ajs27QtE_dgRnN4eol3g,113
src/rules/windows__process_creation__proc_creation_win_pua_wsudo_susp_execution.eql,sha256=0MLtTnDLU6sNPLYHYr3Y0d1JmNhb3vPs4vdaYDDw_2Y,314
src/rules/windows__process_creation__proc_creation_win_pua_wsudo_susp_execution.lucene,sha256=7r4SLmSs0ntrx7klET2IEh-zpC2mhMvRtnFb1bqcrtA,301
src/rules/windows__process_creation__proc_creation_win_pua_wsudo_susp_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_python_adidnsdump.eql,sha256=I98xOfTMX2gynvAEBk0328lAPdikNoPvLogLi1MIbts,85
src/rules/windows__process_creation__proc_creation_win_python_adidnsdump.lucene,sha256=247Gh-a86CSh0gKsF-pfb-8OF0520z_6OZwIxpMAFdk,71
src/rules/windows__process_creation__proc_creation_win_python_adidnsdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_python_inline_command_execution.eql,sha256=yIPZs1A5kpQ5FOX_U2czftuLFocwiVQqlSwJENPueAE,1045
src/rules/windows__process_creation__proc_creation_win_python_pty_spawn.eql,sha256=POR4uuQA7ssAnMgmP1aRSje-eoAkSKxmRFPLEBB6FgA,216
src/rules/windows__process_creation__proc_creation_win_qemu_suspicious_execution.eql,sha256=QF3LXLTtv9dLz5YpQqbUcmhvhtYO9JDbLvB-fd-opgc,323
src/rules/windows__process_creation__proc_creation_win_query_session_exfil.eql,sha256=DPOVBJlWQr3z4XcPygUyJQa8K5CTpQAgHAEAlAETYvA,128
src/rules/windows__process_creation__proc_creation_win_quickassist_execution.eql,sha256=xOn8M864rT768vGNUdUMuyOtxX8DN5LciYMENedvj4E,50
src/rules/windows__process_creation__proc_creation_win_rar_compress_data.eql,sha256=1zwoLI6wfJX7VOn20GV1YZz-7G3F-0YNG5tda8hdpaM,75
src/rules/windows__process_creation__proc_creation_win_rar_compress_data.lucene,sha256=D-ER89q4v9Mf5TC-S2jXMpzh28MShSF0VVaQid6MCUs,63
src/rules/windows__process_creation__proc_creation_win_rar_compress_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rar_compression_with_password.eql,sha256=_P3-EgaZ-F0a7_8etcGrnMcJWl8PFHRn3LXxir8C9GM,92
src/rules/windows__process_creation__proc_creation_win_rar_susp_greedy_compression.eql,sha256=cOTdBtkSdpi0v2q_mcyAOXnFz48uz63OwmMuSbuBywY,399
src/rules/windows__process_creation__proc_creation_win_rasdial_execution.eql,sha256=ohaYWPOR_xHTlQZdEK-fwacPh8mYmRw5U5D5Hut5drw,44
src/rules/windows__process_creation__proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.eql,sha256=VcqZK6xiRZXbK6ElSSJmVaxouYC_o9QT-LOD1jJS_Xc,308
src/rules/windows__process_creation__proc_creation_win_rdrleakdiag_process_dumping.eql,sha256=2bapuhJei5Uo5faIBWcKYUEXtHjuyWjCykVUndXLA_M,432
src/rules/windows__process_creation__proc_creation_win_reagentc_disable_windows_recovery_environment.eql,sha256=sGF65qCrdzDsND9A6Hm5unTGI1jneGX2f7MI6kjb66g,205
src/rules/windows__process_creation__proc_creation_win_reg_add_run_key.eql,sha256=L97SYCJwQXw1-26fVqzCbC0R-d1frIrGshZbIX-3R4w,348
src/rules/windows__process_creation__proc_creation_win_reg_add_safeboot.eql,sha256=My80G7TBwNtcI5-mUbHrYrTPCtKaOlDatdBupbW4jSc,220
src/rules/windows__process_creation__proc_creation_win_reg_bitlocker.eql,sha256=ihoUlN0YXFEcXCKG8R0NYgsQbtcnXXAjRRXduc_msmQ,400
src/rules/windows__process_creation__proc_creation_win_reg_credential_access_via_password_filter.eql,sha256=f7W1lSUIRSKbi-GBM27J9nG325lHLLl76sKRj7fAU_g,157
src/rules/windows__process_creation__proc_creation_win_reg_credential_access_via_password_filter.lucene,sha256=aJ1nnOmOXKTLeB_jcpGdK_Kq-N5QAS9RFXtsQS_fX9A,142
src/rules/windows__process_creation__proc_creation_win_reg_credential_access_via_password_filter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_defender_exclusion.eql,sha256=t0W66HnK8-70BaPBVMCpK0E5XOcxmvLzUA7NPdE5J3E,411
src/rules/windows__process_creation__proc_creation_win_reg_delete_runmru.eql,sha256=c7icdzaRMF01pdDWFScgFCP2zK1hqi3PZ2qN13bKMO8,217
src/rules/windows__process_creation__proc_creation_win_reg_delete_runmru.lucene,sha256=DpTAmTQZbQZtIAD4Gq_Lg-QFqKlomw55YP30Ym-HNs8,200
src/rules/windows__process_creation__proc_creation_win_reg_delete_runmru.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_delete_safeboot.eql,sha256=ias4a6_HRdMa3cKHPWwCFOK6tCulDzY2yUdYKz2K_as,201
src/rules/windows__process_creation__proc_creation_win_reg_delete_services.eql,sha256=czNjZWsYGToZhhPrjbP4EVtLI-6BZgi_kN0kB1u8X10,191
src/rules/windows__process_creation__proc_creation_win_reg_delete_services.lucene,sha256=wEX8jX4geyVRIUX9HlxTtTzDvZzHgIio7dwEqYGyXrI,175
src/rules/windows__process_creation__proc_creation_win_reg_delete_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_desktop_background_change.eql,sha256=pmQFi-sVqjoV0eO7psidrW-GVGkLXkZY-EIKuCZZ-Ag,521
src/rules/windows__process_creation__proc_creation_win_reg_direct_asep_registry_keys_modification.eql,sha256=YU8ldNvSYRClk0ue8kjuNFuHoV0_jzUgAsMF66kzMEc,719
src/rules/windows__process_creation__proc_creation_win_reg_disable_defender_wmi_autologger.eql,sha256=S-0T7QIzbMWWMGfXPmW1i8PRO_3JNuajESPq-Uu8iKQ,353
src/rules/windows__process_creation__proc_creation_win_reg_disable_sec_services.eql,sha256=9TRrcYh4JVzKXEAmVtNHzwKyrBCYYhBmwbUyXsojA6A,392
src/rules/windows__process_creation__proc_creation_win_reg_disable_sec_services.lucene,sha256=SyAvDV580ULMGl53rwk23SIvI96guSVsfT5h9zsPM68,368
src/rules/windows__process_creation__proc_creation_win_reg_disable_sec_services.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_dumping_sensitive_hives.eql,sha256=WZJh6F_tOjjhKL4pUUK5G0ktJr3D2696lGjXxH_TWwo,480
src/rules/windows__process_creation__proc_creation_win_reg_dumping_sensitive_hives.lucene,sha256=EhINKRTwLU3eth2SU_fAbIpfx-sIbX1Hcj5X1cyoZsA,450
src/rules/windows__process_creation__proc_creation_win_reg_dumping_sensitive_hives.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_enable_windows_recall.eql,sha256=ZI6gqK7jayrlXDdlPQIp8-M1wJCY5ZIfkRtwSA3UqXc,286
src/rules/windows__process_creation__proc_creation_win_reg_enable_windows_recall.lucene,sha256=XoTauV5tY6vKcJQ0AAq0rT9ZHMeM056Ll7ea5S9k860,258
src/rules/windows__process_creation__proc_creation_win_reg_enable_windows_recall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_enumeration_for_credentials_in_registry.eql,sha256=1NbjYDS0mUy_W9SV0NAUf8DIqiSlEBLRfVZZ0_j9D70,396
src/rules/windows__process_creation__proc_creation_win_reg_import_from_suspicious_paths.eql,sha256=ajXopvg1_HR-KAggPWrXMpizV_d_gZBuRoPjepwgRgg,288
src/rules/windows__process_creation__proc_creation_win_reg_import_from_suspicious_paths.lucene,sha256=jKENIw9sTxKjnvGYWaGJICsLQyTcG4iKENT7X9aM-ec,269
src/rules/windows__process_creation__proc_creation_win_reg_import_from_suspicious_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_lsa_disable_restricted_admin.eql,sha256=0keDZefzWzOTGJZhfcGqg8Rrumb2U6HKPJF3-BkJx88,129
src/rules/windows__process_creation__proc_creation_win_reg_lsa_ppl_protection_disabled.eql,sha256=vyjb4-1BbB2Dm4-lnOFw0OTw8BYqRsE5jBR4i3tJnpo,273
src/rules/windows__process_creation__proc_creation_win_reg_lsa_ppl_protection_disabled.lucene,sha256=4FThRJPN5imw15iYjl-NXER1eD6GMwoXUDoVVQk_GuU,260
src/rules/windows__process_creation__proc_creation_win_reg_lsa_ppl_protection_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_machineguid.eql,sha256=DSV5S0gQHD5KxvcCFpwUbu25J02vLzOGueuznbariE0,181
src/rules/windows__process_creation__proc_creation_win_reg_modify_group_policy_settings.eql,sha256=rVqwcidOXZjP--oCaXl8EUYRZsfgWaSeh-4Prf4N0wg,377
src/rules/windows__process_creation__proc_creation_win_reg_nolmhash.eql,sha256=BpjM6Hm25oqD58gDd9qM22Cv6oRjHScJ83wi6gVINDY,147
src/rules/windows__process_creation__proc_creation_win_reg_open_command.eql,sha256=SO1XyYhIpK8WjMTH7EKgutT0oPpfTWbASVpALDaWDEg,596
src/rules/windows__process_creation__proc_creation_win_reg_query_registry.eql,sha256=XJF6s45DXzu61_jj7prLr6ghWQLq-VHHaI8WytV6HBY,352
src/rules/windows__process_creation__proc_creation_win_reg_rdp_keys_tamper.eql,sha256=eZILZTUaascYdLcfMye1Rau6cy28jXLGrMaLE8LjghI,753
src/rules/windows__process_creation__proc_creation_win_reg_screensaver.eql,sha256=8iWj_lGa71uBwesBdsQR-6MHTLFz6eCwwz-G2IanCdU,814
src/rules/windows__process_creation__proc_creation_win_reg_screensaver.lucene,sha256=UGmbPrSOeUL6yTKGA9hx8s4TMEPvKSDWTrrS-00Iptc,790
src/rules/windows__process_creation__proc_creation_win_reg_screensaver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_service_imagepath_change.eql,sha256=m0Ory-7B24ModQU3t1slsl7h9zojO8_3PLQTcyd9hrE,275
src/rules/windows__process_creation__proc_creation_win_reg_software_discovery.eql,sha256=lVdYpdNozGTauCsls9Wic7WMz3W1MZ51hHB0i3kJYTw,192
src/rules/windows__process_creation__proc_creation_win_reg_susp_paths.eql,sha256=PK-IO_s2kMB2RlEG1iHtfdtdL4duTNCFYbi0HjTDnTM,431
src/rules/windows__process_creation__proc_creation_win_reg_volsnap_disable.eql,sha256=fE8OLuigJOdUtZ0819ujabRoRhmTG_xSOd4Z5m395pg,98
src/rules/windows__process_creation__proc_creation_win_reg_windows_defender_tamper.eql,sha256=ZKUw_B27AGCtnmtne4Pt8859FSTX-FB_xwreWZ1EC3c,1368
src/rules/windows__process_creation__proc_creation_win_reg_windows_defender_tamper.lucene,sha256=ePbLiGgn1oySweoFUVYb4_kzYjJBc0Q8_4A1-F3Kquo,1333
src/rules/windows__process_creation__proc_creation_win_reg_windows_defender_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_reg_write_protect_for_storage_disabled.eql,sha256=zGlR3nC63XBUA2g4yf7tiOerBiVHS1D5aquKQ-y1yGQ,186
src/rules/windows__process_creation__proc_creation_win_regasm_no_flag_or_dll_execution.eql,sha256=rd_ka81EKTKLdWAGBm3PpXOeVBWlEcAa7Wv0uS46iYk,186
src/rules/windows__process_creation__proc_creation_win_regasm_regsvcs_uncommon_extension_execution.eql,sha256=EUv3wlQPcLNxQrl116H1Gc97KIfNp_VJUEMyhhUjUHQ,241
src/rules/windows__process_creation__proc_creation_win_regasm_regsvcs_uncommon_extension_execution.lucene,sha256=mWGKlrMr3NrChWq3OCHG7RsnaRRlnj1iU7LYfrdg95Q,207
src/rules/windows__process_creation__proc_creation_win_regasm_regsvcs_uncommon_extension_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regasm_regsvcs_uncommon_location_execution.eql,sha256=7RMg_ECAcBnPByp5QeQwfHWFh1W4trGcOGMAwahdMmM,328
src/rules/windows__process_creation__proc_creation_win_regedit_export_critical_keys.eql,sha256=2tWG89DbtdP0a6abjpsffQQib0g0RKZAdN_XedVMwSM,323
src/rules/windows__process_creation__proc_creation_win_regedit_export_keys.eql,sha256=iR1fIFIvoN7DQjAWKneqf-9SRzaQl8GHlMNv4bmiNX0,333
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys.eql,sha256=elcNnwRhnYynb9nkHgcE4C7Q2OJcfEEiZLXkhWOT-xo,531
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys.lucene,sha256=QhFI0WUMxrY9lNGoXNasvjSsamXNGvLPlrCJi8vrgP0,541
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys_ads.eql,sha256=nIORmyH-LaEinqbkxst_czfbwaSC8XcN2Iw0vGEuLw0,521
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys_ads.lucene,sha256=wDhOFAr2KDmXKAzRaz_fvpy0QZupDIBAtB1ybku2rgU,528
src/rules/windows__process_creation__proc_creation_win_regedit_import_keys_ads.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regedit_trustedinstaller.eql,sha256=Y8VUJmYTsz4494wyzK3sMDShzq5wGH_I-ekNo7H-sIg,136
src/rules/windows__process_creation__proc_creation_win_regini_ads.eql,sha256=DlZXBtp1-cznTuTG_JceZWu04rprHo6s4-BIXsd-9uI,191
src/rules/windows__process_creation__proc_creation_win_regini_execution.eql,sha256=3jLaiPv7RNix9KKDOL-esude4VyVL9IzjumJ1tYmi_k,197
src/rules/windows__process_creation__proc_creation_win_registry_cimprovider_dll_load.eql,sha256=sjsyHtg_sS7oAZz8MJ9AZa32cooC2UEThZyj-tDSALo,129
src/rules/windows__process_creation__proc_creation_win_registry_enumeration_for_credentials_cli.eql,sha256=lziuoPT5N7yzm7YgH4e8-xoTkNjaDJH3gbIn7JE0I_o,900
src/rules/windows__process_creation__proc_creation_win_registry_export_of_thirdparty_creds.eql,sha256=gTPy7-uvMu7FTyDu1wWL0DpsSmmg9vjQH7rYuubEsO8,937
src/rules/windows__process_creation__proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.eql,sha256=vwAhGF7ceQaaTsh5v3k3di3Q9SKjGl4K_GmDMIMBfHk,184
src/rules/windows__process_creation__proc_creation_win_registry_install_reg_debugger_backdoor.eql,sha256=lPA_wqAx2ueGp9wQZ7JX_JyIdWM0gpIjvRIunMc0ORo,256
src/rules/windows__process_creation__proc_creation_win_registry_install_reg_debugger_backdoor.lucene,sha256=GrZzy2BI_y4rJ6yv3Y2ZjyhU4Oan-Zna6OHD4_lJQ5U,239
src/rules/windows__process_creation__proc_creation_win_registry_install_reg_debugger_backdoor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_registry_logon_script.eql,sha256=Va1SMX7BiHluHTQVC7LvhCZnSuSXRBD6LD4xGLDRL4Q,58
src/rules/windows__process_creation__proc_creation_win_registry_new_network_provider.eql,sha256=XEUDgzhgTYkdnZ9SuubwotldX-TaCBG2fCt6zDjFOa8,121
src/rules/windows__process_creation__proc_creation_win_registry_new_network_provider.lucene,sha256=TB-DCpxDv6oIXXHDiZE59IDgfppHxglMbNNK2lt2kSM,107
src/rules/windows__process_creation__proc_creation_win_registry_new_network_provider.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_registry_office_disable_python_security_warnings.eql,sha256=XXR8tinewk-PiHUk90NSTfqgrz5jgniMkL6QilL0vgM,189
src/rules/windows__process_creation__proc_creation_win_registry_office_disable_python_security_warnings.lucene,sha256=o2s1kBfH30-wfIzMmVmYKZ3Dfw4dAL4F6ec9uRGyGk4,172
src/rules/windows__process_creation__proc_creation_win_registry_office_disable_python_security_warnings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_registry_privilege_escalation_via_service_key.eql,sha256=X_hELK7-RuquGLxbiBBDSKQZtvDmo9JT9l37PyQ8VI0,248
src/rules/windows__process_creation__proc_creation_win_registry_provlaunch_provisioning_command.eql,sha256=1C0vujMDgvLoZfo6ih0fygHUL_eA1eO9W0cOaXlCYoU,80
src/rules/windows__process_creation__proc_creation_win_registry_set_unsecure_powershell_policy.eql,sha256=Or4--aMqjq8B9XWUNs7ib6wnwkzlGKanfZ9Q_rhfZ6I,242
src/rules/windows__process_creation__proc_creation_win_registry_special_accounts_hide_user.eql,sha256=BYE_J1I_iAZiEjMO0vYKq8OTP9P0uKk_-aBZ9T8YMVQ,259
src/rules/windows__process_creation__proc_creation_win_registry_typed_paths_persistence.eql,sha256=dy77Y_PR56utCRf4Pbt8NDtU76jRoe6CFryIzmKHgpA,104
src/rules/windows__process_creation__proc_creation_win_registry_typed_paths_persistence.lucene,sha256=LH4pVCDUKC0Uk9A0wlqanCNHstTTcICh6iwFi_TQrMA,92
src/rules/windows__process_creation__proc_creation_win_registry_typed_paths_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_flags_anomaly.eql,sha256=Md1ftpAtW2VT7mCoT9GOf0p2Fh9N7Hwz2SX7xrBya6U,231
src/rules/windows__process_creation__proc_creation_win_regsvr32_flags_anomaly.lucene,sha256=qgFIoxgpk-r7biz0U8smueubBAivrk6RLHSyhXm1XgU,227
src/rules/windows__process_creation__proc_creation_win_regsvr32_flags_anomaly.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_http_ip_pattern.eql,sha256=wWwbugOpynV_oP0nlHaDraUbeFMdSu3OU6xL7olNOtU,797
src/rules/windows__process_creation__proc_creation_win_regsvr32_http_ip_pattern.lucene,sha256=qboPX3aKRg0Pzjt5wq3CghdPXqpjafXgWPYsQpZROLQ,991
src/rules/windows__process_creation__proc_creation_win_regsvr32_http_ip_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_network_pattern.eql,sha256=7YEZWQLMWrlpbHSYYLonSNNJiaKYeGoTBZuoB9Kjhuo,202
src/rules/windows__process_creation__proc_creation_win_regsvr32_network_pattern.lucene,sha256=FrxUk4l8nxsU1u6HFh__yTapLMDhbP8T0KhSf86Nvj8,176
src/rules/windows__process_creation__proc_creation_win_regsvr32_network_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_remote_share.eql,sha256=ECPjcJVey9DWpRGUgSmZHPPWt4FaLqL5YQa-lPgttyM,132
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_child_process.eql,sha256=eWsH6QkudCkm7GbxI9QaW1z1lMVuETle73C159sZAQM,412
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_child_process.lucene,sha256=kY5HagttFoP2CELOxEkSHb2P9EPRkHULvYrGmID7_Xg,393
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_exec_path_1.eql,sha256=BC-p1clwEgiiCWxjwvOQytH2gUURjVFnK0U_EFxk4Hs,266
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_exec_path_2.eql,sha256=5VXpTydaVcejk1N2PLIPH04mGbo3jMebq3AqYM0sJ2Q,1190
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_extensions.eql,sha256=xLvzsv0VvfmBLMgxn8h9v3DdZu7FanRW5ZiPIoanQLA,323
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_parent.eql,sha256=hR-1lD1ZZqwlQuEJi4gVu5H-RYqRpQKxBaOCC3xTrKE,364
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_parent.lucene,sha256=ZYIQr98u-KAuxUFUwHfqm01VfD7FTI2o0krLhcQ7Buo,345
src/rules/windows__process_creation__proc_creation_win_regsvr32_susp_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_regsvr32_uncommon_extension.eql,sha256=D7pMIz2zjgg586zfEBziOMxxAX4j4joQQ-nYJzRu8oA,341
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk.eql,sha256=nGklbtxeDnYiuqTijVbwMxMTZjtVmtn7h7yNPxSLsJ4,191
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_piped_password_via_cli.eql,sha256=G4gB96H1BaN0f8few6NENvZfOSpofx2FnejxDyNMFjE,123
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_revoked_cert.eql,sha256=6E0Nd04qRoZFD5peR2342k7z1dlY_-lc-LXOXRCuytA,362
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_silent_install.eql,sha256=pft42lV8K9r4gYRU13IVnsRLrM9FRwKHcU7AutQiIDM,129
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_silent_install.lucene,sha256=Kd4bfvamHhIT2sQrZNlrUDR80bm9sIMQz6siudPPdY0,121
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_silent_install.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_anydesk_susp_exec.eql,sha256=zIt6WoaQTwik_0cx5rskc5_ZP9MDFpDbn5OtbJjbxsg,309
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_gotoopener.eql,sha256=fa1um8V_7v1I-vszf6e2qIRvmKRou1YyqBWu_KeWOYs,121
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_logmein.eql,sha256=-LcUazwnP8OR-xylaYrv8V4L7vfFfpclQFmlPPANf-8,127
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_logmein.lucene,sha256=tT1bTqYfck7QrRErFmhJj-aqaTwALiq6QlqGOe25pzw,112
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_logmein.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_meshagent_arguments.eql,sha256=rOu3vFOQdLRVn7veGJBQyKtVx0URMfX9av4fTmkGHxg,53
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_meshagent_exec.eql,sha256=yNoQWzmLb45qgdM5xMAHoZzy9FfuwQCe3oipEnTh0Z8,137
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_netsupport.eql,sha256=4kqnFYN2YTB1yBLjBNBvHxHKgrpu63NG8NubeTJGvLc,203
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_netsupport_susp_exec.eql,sha256=3Ur_gwpDrPGsRfGn-YBfUDjfXXDBZhyfIxdQccXHTd0,314
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_renamed_meshagent_execution.eql,sha256=jN4gSzdk5BkSg-5C0dchfnbXdqATnK-HtMFuuChLjFw,150
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_rurat_non_default_location.eql,sha256=l742JCCjCL2L_ZbymVhnfn_7wx8PEjzjnkWXirhd_AE,244
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_rurat_non_default_location.lucene,sha256=NB_uW9nzJca9mdXsIsRtlywgPmPooC_LQ93MWNPm7ME,226
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_rurat_non_default_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect.eql,sha256=g1T9PZ512ZjhyJ2Bo-lHLdObQdF9cnQNlBEjtezo2GI,142
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.eql,sha256=FGfBIBGvaYuQPbSi1HdReTnSG8fl_y83nsso3ju_mHg,182
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.lucene,sha256=TJP8xj4ExTdCKuA4NALF1-PapASxH0ny5pAzIlHEqjE,172
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_remote_execution.eql,sha256=EOVCxDRF71OtxP8rYsnZEn4oHlbWGkh2em9rKQofORQ,206
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.eql,sha256=eF0ZlIfvetDW3szEl-yVy9NF8F_uFutzMwimfe4LaUg,325
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.lucene,sha256=4qkOUPsdsYAIjR0qUn3_g6-iUgeSZyTNlvxQGmn_ojE,304
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_screenconnect_webshell.eql,sha256=rms1QG5FwScSPriiqfamfIo-RvJtgBFkxSetgd2p-00,127
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_simple_help.eql,sha256=D5yQLrRmtV6XeqEr15iCwnQEbyHSpzsGp99KodKIQio,147
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.eql,sha256=H5LpjPHBc6qpfNGwbNaa74VgxzNPvFtOo-IZAMnYdPI,261
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.lucene,sha256=80-8cYeW2m5W1rpBk7EbB14xcWRw4FaOB7460r3_SkI,252
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_teamviewer_incoming_connection.eql,sha256=Qmrt4VjjNrLc-0Y-YpmNHnvWy25UosUSVoMKNZ5IQC0,186
src/rules/windows__process_creation__proc_creation_win_remote_access_tools_ultraviewer.eql,sha256=55kx6EHFt21Hj9S4fxFY2Uhs-3RkxYQRIKFrnRLc2ZU,145
src/rules/windows__process_creation__proc_creation_win_remote_time_discovery.eql,sha256=iyI9xAonWH3aFQTSYK2mDNySWeyeHfdoTIklU-8NQAg,174
src/rules/windows__process_creation__proc_creation_win_remote_time_discovery.lucene,sha256=QN9zvj0FIlMV-VQXaZaW4nxGpcmI81iyejV1NgRPz9c,150
src/rules/windows__process_creation__proc_creation_win_remote_time_discovery.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_adfind.eql,sha256=o-s0ZjptC3CkSs43gu9Shs5dF8xHXfL9hngn8HUY3Ic,857
src/rules/windows__process_creation__proc_creation_win_renamed_autohotkey.eql,sha256=6U2a2Xa4fRvtDNId5UUSkDSNydEvUSxmKWbXJSCI9hk,520
src/rules/windows__process_creation__proc_creation_win_renamed_autoit.eql,sha256=FXTZ5WuqUSIwuv5nz4L89xx1Y3kUhC4N1qJun4DSNGQ,463
src/rules/windows__process_creation__proc_creation_win_renamed_binary.eql,sha256=PLf2DWwaa4lU5B6BtunIbNO0lynjCQsNn4d0mBo0yAA,381
src/rules/windows__process_creation__proc_creation_win_renamed_binary_highly_relevant.eql,sha256=jnO2NYsLEv8zlhXFXWSr1OqUDhiklO02cnPx1oxqMdQ,870
src/rules/windows__process_creation__proc_creation_win_renamed_boinc.eql,sha256=pfNJtEbI6mRJr6sozt0Bi1sQvWwV1TKVaRjdHjQzJ9w,96
src/rules/windows__process_creation__proc_creation_win_renamed_browsercore.eql,sha256=oSa0zHY3_EkEp50c9xHgONn4R5sMbG4pvK2Ee7rraQM,108
src/rules/windows__process_creation__proc_creation_win_renamed_cloudflared.eql,sha256=peBGUcV7EI46AC3ElHTJiW17yTk67wJMNeIkb-8_6yw,3509
src/rules/windows__process_creation__proc_creation_win_renamed_createdump.eql,sha256=xb4cweQdlDWuTwSI0OQOWeNnPSelzwLRgddsT4bimzc,333
src/rules/windows__process_creation__proc_creation_win_renamed_createdump.lucene,sha256=mfm0aGgtC4iRFBEZgx_kmFY2kRl8VtIq2I2byjMtQ5k,321
src/rules/windows__process_creation__proc_creation_win_renamed_createdump.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_curl.eql,sha256=XeJP2ZuGNMDbpuBNqcosMBGapIxk3o8OJhFSVaEMDI8,141
src/rules/windows__process_creation__proc_creation_win_renamed_dctask64.eql,sha256=54SmfsOU1ciwad7zZNx5-ObMFqvR1hj6_WfcnlM8yN0,275
src/rules/windows__process_creation__proc_creation_win_renamed_dctask64.lucene,sha256=i1ONsfxjxQ4LZlbv8WfJyp1FLgwQcNSRq81nfsjC4TA,259
src/rules/windows__process_creation__proc_creation_win_renamed_dctask64.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_ftp.eql,sha256=oDK44-eD2f0L1mr4p21R_zWTf_iPTcakhn9hwd0Kzf4,92
src/rules/windows__process_creation__proc_creation_win_renamed_ftp.lucene,sha256=MPPuU6VArTK50m7_Qy3U_8u7UDaWzKPGMZSlK4YCLIk,78
src/rules/windows__process_creation__proc_creation_win_renamed_ftp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_gpg4win.eql,sha256=IaMU4sL5anaTSls2jokUcEq8W_q0B1DXxnRQfDcR80U,117
src/rules/windows__process_creation__proc_creation_win_renamed_gpg4win.lucene,sha256=0XsPHir5JrF4tc5bOQwAB2QVjdiC3uqS7jlE-_6ejOE,97
src/rules/windows__process_creation__proc_creation_win_renamed_gpg4win.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_jusched.eql,sha256=Oftsr0cyxsXy_yPwRdVIvBnn2pZTOpureqaOeLNz7Ao,142
src/rules/windows__process_creation__proc_creation_win_renamed_mavinject.eql,sha256=8s5E9ZA_SX5TC2fYBiidyHfYKNviGyZyzfYX6vOqpU8,169
src/rules/windows__process_creation__proc_creation_win_renamed_megasync.eql,sha256=zaLsGZzdpz5UjokcNe_vPdq91DLb3DdnUYCgCEIOwqs,102
src/rules/windows__process_creation__proc_creation_win_renamed_msdt.eql,sha256=kzALlR1ASPo3XZntyt6bo17m_6t9Q3QUzwCS9WGLG6Q,94
src/rules/windows__process_creation__proc_creation_win_renamed_msteams.eql,sha256=Fyr7Vz9TEFi8QBC3R15hJd4J2QAAuaZwhfBpm2qPh5g,149
src/rules/windows__process_creation__proc_creation_win_renamed_netsupport_rat.eql,sha256=lknENytMIRAcLJFRWSLuNXI8giAPXp6N9w_ZPB1N3o4,231
src/rules/windows__process_creation__proc_creation_win_renamed_nircmd.eql,sha256=cejWCRsx4qx-DV6Vb4WB5gOpMj4-VlJ6V46wdnz8BmA,126
src/rules/windows__process_creation__proc_creation_win_renamed_nircmd.lucene,sha256=aXn_KNYn5mCPO4ycwvfm7ySJxjvaedmz3-SB8KLLiK4,106
src/rules/windows__process_creation__proc_creation_win_renamed_nircmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_office_processes.eql,sha256=AmL3O7bkW03chdhOjkrNmEj85zo8UJ5LPvgPUYxpwEA,600
src/rules/windows__process_creation__proc_creation_win_renamed_paexec.eql,sha256=e4tf22Q7pwN1EiP77lW5TPjBj0S02gkMtPPyvlR-Loo,436
src/rules/windows__process_creation__proc_creation_win_renamed_pingcastle.eql,sha256=UvLdxfA-bDOO6I7DATBVSy-5_H5IZ-fp_y3zHQlSHI4,897
src/rules/windows__process_creation__proc_creation_win_renamed_plink.eql,sha256=p0LiaduhQFml2x-zXj0g1g5KG5FiYA0vWTaAFDek3xw,204
src/rules/windows__process_creation__proc_creation_win_renamed_pressanykey.eql,sha256=1-vpghXHAU8EGwIhCAxTKRvw55OIcrV-OtP1wIzkLAs,152
src/rules/windows__process_creation__proc_creation_win_renamed_rundll32_dllregisterserver.eql,sha256=9R2LXDsIOpm_as5XTVEULHBkK1dfS_5BDKWHeIYfPcI,100
src/rules/windows__process_creation__proc_creation_win_renamed_rurat.eql,sha256=Me54OhotwLL-DR0g7H8YlYBTJ73rzLgmEo5a9nqztEg,125
src/rules/windows__process_creation__proc_creation_win_renamed_rurat.lucene,sha256=d1eFcwXpvEm5SIvPwca3PzWG5svo27erfai_TyuWtto,106
src/rules/windows__process_creation__proc_creation_win_renamed_rurat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_schtasks_execution.eql,sha256=AscLWhcJ2CZ_bZvaweuKHZO_ErasE9rlWvuLTybEJR0,1346
src/rules/windows__process_creation__proc_creation_win_renamed_schtasks_execution.lucene,sha256=K3hxV83_MqUp6hYOB8_aPuRiJXQPAYqrt6gyacSHJEQ,1378
src/rules/windows__process_creation__proc_creation_win_renamed_schtasks_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_debugview.eql,sha256=3dzKmJUQIXVH5v2VmU7ZB3JJOapD_lnP_UBJNfcDjNI,150
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_procdump.eql,sha256=8Yzaha7zTO-yhAgNVSQ_b4cNAziyOrbAtN560e3WrlY,447
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_psexec_service.eql,sha256=TzFwHf8qFjHiHjCeV7BvuSsGi_FSuXlRBtJWdDFpS6E,112
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_sdelete.eql,sha256=X0SSn_3iTEF_Hr_M5pjK1S-VjnOMfKsNRIaHDvJ1KqY,130
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_sdelete.lucene,sha256=wwt8FfPt1izeileV_NSET5LUJ15zqfcPweDhOrF1Nbs,110
src/rules/windows__process_creation__proc_creation_win_renamed_sysinternals_sdelete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_vmnat.eql,sha256=fjz13kpLOAveqSZ1mRQe_vJTz_J9ouZiD9ZDIIbRqrY,94
src/rules/windows__process_creation__proc_creation_win_renamed_vmnat.lucene,sha256=4W5_aXN5SrDmMPVMG5kFbrs-JxkP8u6zNahbl1DnwHc,80
src/rules/windows__process_creation__proc_creation_win_renamed_vmnat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_renamed_whoami.eql,sha256=ascUUgcMx0JEr0csMRYzPHiohSVlfMzIQydWzDLWHf4,98
src/rules/windows__process_creation__proc_creation_win_rpcping_credential_capture.eql,sha256=zhxqHBApZJP9Hc6NJBPHF0sAh10CJHXayoS9QHTjVZI,410
src/rules/windows__process_creation__proc_creation_win_ruby_inline_command_execution.eql,sha256=p4fKvFNtJnY16sA_TuADHpwIBX6JEqPv5Re2ZutEsHk,122
src/rules/windows__process_creation__proc_creation_win_rundll32_ads_stored_dll_execution.eql,sha256=cP1qBEobnr7RqjYG9gluBSQ17_DJXP7WUrC_iZywcqg,360
src/rules/windows__process_creation__proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.eql,sha256=Y9KV3HNwswg_EYdfrXcjF9pelF4sciou3W7WtfbqErE,270
src/rules/windows__process_creation__proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.lucene,sha256=mAsxY3sjd2r2cyUyynLIWm0-RyrH_t2KPWXc0MHi8uU,248
src/rules/windows__process_creation__proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_inline_vbs.eql,sha256=jvUGIbWhwXAizsoyZF0SsV494GmnDLyOk3QQ1SEHQGc,164
src/rules/windows__process_creation__proc_creation_win_rundll32_inline_vbs.lucene,sha256=Ot2EzWIwP-GNe-XE2aP7l1jrSIIqrIn27aR3R1Mn5OY,146
src/rules/windows__process_creation__proc_creation_win_rundll32_inline_vbs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_installscreensaver.eql,sha256=GWw_-wsIIBAvgeD7Q0-ejanqMW5joQ2eVq1KbN3vvNk,145
src/rules/windows__process_creation__proc_creation_win_rundll32_keymgr.eql,sha256=zQdecvOZ8P1egrOYAPCcEBa8Md7kmh4UHPv8I2LjZ84,177
src/rules/windows__process_creation__proc_creation_win_rundll32_mshtml_runhtmlapplication.eql,sha256=LzgpW3vheDhoAWGNpRDRFke-btgjCVIsUUnUGPUgpEI,147
src/rules/windows__process_creation__proc_creation_win_rundll32_no_params.eql,sha256=2ATmHh9AzS4MQCKFcQr3924_vETI_2lniMaNPGU2dtk,187
src/rules/windows__process_creation__proc_creation_win_rundll32_ntlmrelay.eql,sha256=OtSwHJjYoTkz6lJu_ZMQH_blGBos0Oo90exfGl37ALE,289
src/rules/windows__process_creation__proc_creation_win_rundll32_obfuscated_ordinal_call.eql,sha256=YJ4SU1ttVjNa54_oiv92h-otbn3ATiOGJz7xwyTKshg,212
src/rules/windows__process_creation__proc_creation_win_rundll32_obfuscated_ordinal_call.lucene,sha256=vYcsxi_sADtH5MvD2N0uZQLI8mlH-d2jVtfsq6Zm-Q4,190
src/rules/windows__process_creation__proc_creation_win_rundll32_obfuscated_ordinal_call.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_parent_explorer.eql,sha256=j3BCJws7aH1DZi70Iwn7kvIoWle0B39EOpXYLTjgsYs,271
src/rules/windows__process_creation__proc_creation_win_rundll32_process_dump_via_comsvcs.eql,sha256=a41FCTKe2v3hDGYnr3isvJAb7ikWSzhHPAXl3WGPSvs,479
src/rules/windows__process_creation__proc_creation_win_rundll32_registered_com_objects.eql,sha256=aZ4oe9EnLxtr926UihMQUQDmGbqIVJe7Xjf6Fa9Sty0,227
src/rules/windows__process_creation__proc_creation_win_rundll32_run_locations.eql,sha256=sX-nxMUl5qKpS65WdD5YHq8Oie8fagMmKdrRdWlTg9s,326
src/rules/windows__process_creation__proc_creation_win_rundll32_setupapi_installhinfsection.eql,sha256=Pl3wR12YCjjOx3nhBG6ov9nnDAATWNjou6cKH5tVNw4,200
src/rules/windows__process_creation__proc_creation_win_rundll32_shell32_susp_execution.eql,sha256=YINOOmBYRqErtWWqqrslR0jEohf5yt37x9mhJaUFc-g,329
src/rules/windows__process_creation__proc_creation_win_rundll32_shelldispatch_potential_abuse.eql,sha256=HbRO7LnVrBFxgLib984---B5bCDERFjeZIh3bZxA4E8,147
src/rules/windows__process_creation__proc_creation_win_rundll32_shelldispatch_potential_abuse.lucene,sha256=RjoX2o3L-xYmzIKsk7Z7gfa0VQPCusvfybDw4SO0lTY,131
src/rules/windows__process_creation__proc_creation_win_rundll32_shelldispatch_potential_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_spawn_explorer.eql,sha256=Pg5d9rFpfoEbiG-6e-6c381Jrg-u7lC7ybAeL0s5HvU,168
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_activity.eql,sha256=bmk594DDc2EB4OMd1Y55tI_gO_xst88oVTxbiollUqc,2511
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_activity.lucene,sha256=8DHmP0YlPhOPh9w1KzFZ8swQObiLYYFltY6QCmWjQXM,2399
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_activity.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_control_dll_load.eql,sha256=Pago2MqSCYRhFSvNF4YZBleCuwKOpkX9TXynOX88oDE,203
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_execution_with_image_extension.eql,sha256=VOJJ3bd1fltl8uKCSEsB_2DiRbRGiTjKgW1GSnlJlII,273
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shellexec_execution.eql,sha256=AQBDuuCUGnWDa4QKpYvzdANAqQ1p1ig1oyAT1pwFgvI,213
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shellexec_execution.lucene,sha256=Bq4-uMuPIuiIdUKv7yn3Bz0c-uhPrUP9k6ECuOBq0FQ,194
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shellexec_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shellexec_ordinal_execution.eql,sha256=E4v1HX6oNsIh5QjfS9Is3W8H_9IoFRDrZ__hhf8bZMQ,658
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shimcache_flush.eql,sha256=EyW4L1xPa6q-WISh5yHphtn_3dsijLDGbIQ-MgxIXhA,308
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shimcache_flush.lucene,sha256=ypbEWE9mCsh7zlriGMtROe8o5VX6gM7mbOaI2G2tPHY,274
src/rules/windows__process_creation__proc_creation_win_rundll32_susp_shimcache_flush.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_rundll32_sys.eql,sha256=sHW6dHIiTX5jBvqD2jXAKNhK2yJKK2OuX3IvIHIF6IA,104
src/rules/windows__process_creation__proc_creation_win_rundll32_udl_exec.eql,sha256=YaCZaz5xgquHI9DO73SbtpKnevoUC4DyGZBPxkW4Qlw,317
src/rules/windows__process_creation__proc_creation_win_rundll32_unc_path.eql,sha256=SMw7q7xPZVqwUh7WC4jFO3x-xa2yiW8fpOTg6yGkpxQ,167
src/rules/windows__process_creation__proc_creation_win_rundll32_uncommon_dll_extension.eql,sha256=gLERG39WWBUTo4hhcav8rpWcP2znB7HDKnTLKWNpB5M,1146
src/rules/windows__process_creation__proc_creation_win_rundll32_user32_dll.eql,sha256=Za_KZjQywMsARTCPr9SseM6K_GftpG471BoP2Q9_LBk,226
src/rules/windows__process_creation__proc_creation_win_rundll32_webdav_client_execution.eql,sha256=5i7Xz-ySse_UbK2_AgFHk06LULmrIVaFhwqOQ_skITk,221
src/rules/windows__process_creation__proc_creation_win_rundll32_webdav_client_susp_execution.eql,sha256=_-cE31yx5zeN0u60785NT4GjyD43ywRY25ogvuZbvVI,710
src/rules/windows__process_creation__proc_creation_win_rundll32_without_parameters.eql,sha256=eQBZwh4RTDYOkpB-Rt0anXbhv-yc83so_LKA3J04-hA,66
src/rules/windows__process_creation__proc_creation_win_runonce_execution.eql,sha256=gTEEk44271EnrVMPDT0NAX-NrsIe0b7Bfae4i-uqEaM,162
src/rules/windows__process_creation__proc_creation_win_sc_change_sevice_image_path_by_non_admin.eql,sha256=hjxVAu8Xl0rZtgvXryS6jSrk_NmNwth3adrhdJiUQJo,266
src/rules/windows__process_creation__proc_creation_win_sc_change_sevice_image_path_by_non_admin.lucene,sha256=tyZI63mVp4sJS7sm066jv7RvjaU2i59v_mbZA0rcZAE,241
src/rules/windows__process_creation__proc_creation_win_sc_change_sevice_image_path_by_non_admin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_create_service.eql,sha256=nIF6UFhzkRSTEoamRcbA37cjwsD8lLtZbLToLEGHMPE,298
src/rules/windows__process_creation__proc_creation_win_sc_create_service.lucene,sha256=C09_TvbsU2-sgMoJ4AiBKtsT81g8aXUIUHhVHEuK2rs,279
src/rules/windows__process_creation__proc_creation_win_sc_create_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_disable_service.eql,sha256=Q6S2WdCQz6MLFj1ywj6PGHk71rCTn3yqxlfc5xSkhK0,222
src/rules/windows__process_creation__proc_creation_win_sc_new_kernel_driver.eql,sha256=krH7pbuJl3wO1-j47dhmR0GNbbcncOjtQ_BVmGNdDHM,726
src/rules/windows__process_creation__proc_creation_win_sc_query_interesting_services.eql,sha256=SGw3VHhIxXM0kLpPUZi2nBhxLb9_00jZdB_mniTA4F4,161
src/rules/windows__process_creation__proc_creation_win_sc_sdset_allow_service_changes.eql,sha256=AmidaeiSqWBHXyTlxPfheXwD0cs_O-Ci1fx78HsQ_3s,327
src/rules/windows__process_creation__proc_creation_win_sc_sdset_allow_service_changes.lucene,sha256=AUWH-iwPXO9ZK5v1n9RbZcTlC_iJiSTihjskZbNbhPc,301
src/rules/windows__process_creation__proc_creation_win_sc_sdset_allow_service_changes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_sdset_deny_service_access.eql,sha256=mcAaCXVbWtb_w_sCZ_aANeWCgjmuOhGngLZ2CJULmSQ,233
src/rules/windows__process_creation__proc_creation_win_sc_sdset_deny_service_access.lucene,sha256=Nvhm4Ut8w3pWuy_mSEaQey6cJXJHNXn2YoAiA-4Wv0A,207
src/rules/windows__process_creation__proc_creation_win_sc_sdset_deny_service_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_sdset_hide_sevices.eql,sha256=v6-CRkMNus3HafbjIG8e08RwSwX7G0k5czLp0C_wpZA,162
src/rules/windows__process_creation__proc_creation_win_sc_sdset_hide_sevices.lucene,sha256=L-88r8zjKlACqDTpOXH0jWuXbJMIAwlhBn605v6KyXk,144
src/rules/windows__process_creation__proc_creation_win_sc_sdset_hide_sevices.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_sdset_modification.eql,sha256=-6EYLrVruizdv--Mqh5RofVSZCyhuQIt08YUSVop7lI,120
src/rules/windows__process_creation__proc_creation_win_sc_sdset_modification.lucene,sha256=1OXd6_hUFAOjMBTnsupI2FSMQw0gH-HrSdJm8RY64_o,104
src/rules/windows__process_creation__proc_creation_win_sc_sdset_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sc_service_path_modification.eql,sha256=Q2i1rIKHtbIbF9AdayFeciGmdEx2RZ1vrHvj8S3ZbdI,504
src/rules/windows__process_creation__proc_creation_win_sc_service_tamper_for_persistence.eql,sha256=-QDOT84PNlyW2e8mxe1EMZELHp1FAJWF8xpBsc0Pyhk,624
src/rules/windows__process_creation__proc_creation_win_sc_stop_service.eql,sha256=jAO5VfHw0FFpiZRJqx3bLIKRjcTg9dTIUglcq9tsxQ8,121
src/rules/windows__process_creation__proc_creation_win_sc_stop_service.lucene,sha256=iBd6iYtnqld5dYJ0mMhXyA7MGjHFWIULJjE2Mbp9GbE,107
src/rules/windows__process_creation__proc_creation_win_sc_stop_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_appdata_local_system.eql,sha256=9b_Bi4KUVi0BeH3-pGnIwBCeIyh6T1jDTO42d_RhLK0,510
src/rules/windows__process_creation__proc_creation_win_schtasks_change.eql,sha256=7yMBqSVUx3ZmUMBh_cW8EcCB5tyloh80cvuJ5Db9Ipk,776
src/rules/windows__process_creation__proc_creation_win_schtasks_creation.eql,sha256=2eMdlN-fo-C0QpVdn-blta1NGvyolGU8uR1_wARYe0w,528
src/rules/windows__process_creation__proc_creation_win_schtasks_creation_temp_folder.eql,sha256=5MtDHtd7Z1Hl1wKtUS04dpNXpom2AbLIXerujs6Wy7Q,165
src/rules/windows__process_creation__proc_creation_win_schtasks_curl_and_powershell_combo.eql,sha256=H2izZX_shinc5vh6kLa6rfOBL_8ZND7NJPh6MvZIsgo,305
src/rules/windows__process_creation__proc_creation_win_schtasks_delete.eql,sha256=kM2KNWoY0529v8WUHgt2D-sYbNP1CjXNkq7oqyKNEi8,374
src/rules/windows__process_creation__proc_creation_win_schtasks_delete_all.eql,sha256=QnegGKBMmGNTWym8jl3bx7rkRXID3XAwNoO06HVlVqU,157
src/rules/windows__process_creation__proc_creation_win_schtasks_disable.eql,sha256=crwPxwIzc6TFDai1KILzqAIXJI-vOLrvU9bEa5BUtOw,474
src/rules/windows__process_creation__proc_creation_win_schtasks_env_folder.eql,sha256=8T-ZLtBthg3A5JEoip_Y9YFl7XfTEP9Cp__g_JyVA-s,1378
src/rules/windows__process_creation__proc_creation_win_schtasks_folder_combos.eql,sha256=-hTGJ-VhC1-1BjrSXTcxqi2mQAyBtVQhVNYHbgkh-Zc,361
src/rules/windows__process_creation__proc_creation_win_schtasks_folder_combos.lucene,sha256=PBx2jbScM6MjcTiCOfXbDi_WM9eBZV13yxfXLI-QLs0,351
src/rules/windows__process_creation__proc_creation_win_schtasks_folder_combos.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_guid_task_name.eql,sha256=rtvir1pBBUogEME7y9zwkGq-7Mn6I9T-TjCT5dwq5Wg,216
src/rules/windows__process_creation__proc_creation_win_schtasks_one_time_only_midnight_task.eql,sha256=IZFLfr9E15x5Xa9bV63uC5hv4ewei8SzRzYCWJmKyjY,318
src/rules/windows__process_creation__proc_creation_win_schtasks_openssh_tunnelling.eql,sha256=FBHjufBkIGW4ZCc3NKwjlxBsVpRtzt-n0Guufp0NPps,319
src/rules/windows__process_creation__proc_creation_win_schtasks_openssh_tunnelling.lucene,sha256=kwqmbqNq2JBFdUkBYjRvmXg8vw8q6GrKHtK41jw0tG0,301
src/rules/windows__process_creation__proc_creation_win_schtasks_openssh_tunnelling.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_persistence_windows_telemetry.eql,sha256=CZkQBSgO4dKR_aSGLZ4uyH5GT8nS4uNIBXSr85SRQJ4,222
src/rules/windows__process_creation__proc_creation_win_schtasks_powershell_persistence.eql,sha256=KujAkOmuLh5hl2ghFIrUT7Y-oLpyaEU7jRhFUKoaklE,271
src/rules/windows__process_creation__proc_creation_win_schtasks_powershell_persistence.lucene,sha256=kDUpCAm4tcl5YQEGfEppyScyyAGWs1UROROm7-vui-w,263
src/rules/windows__process_creation__proc_creation_win_schtasks_powershell_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_reg_loader.eql,sha256=OfazjSmBY_g76eCQHS38Bwpi2NdIf0KUUuSH8dwOIK8,367
src/rules/windows__process_creation__proc_creation_win_schtasks_reg_loader.lucene,sha256=ayUfjStxXcMp6uC9vwr9WlXI_wxYC-cq2aaeH8JTNv0,335
src/rules/windows__process_creation__proc_creation_win_schtasks_reg_loader.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_reg_loader_encoded.eql,sha256=Y5CoxQqKd-tRO1dIjUDSaGRgFXyWuHmOxBtwSlygDog,359
src/rules/windows__process_creation__proc_creation_win_schtasks_schedule_type.eql,sha256=UcbLv1iHqk_BGylZqqF8_OUAPa61hEZFrZnfBCwhXAE,267
src/rules/windows__process_creation__proc_creation_win_schtasks_schedule_type_system.eql,sha256=wezciYrMB1IyQc0GBS93rgKgH-P6y0V-gtlhN7GMbyI,259
src/rules/windows__process_creation__proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.eql,sha256=gt0viYCFbQebec2OF2wANVwKPMdts9aJ-dIBID6N0Mk,924
src/rules/windows__process_creation__proc_creation_win_schtasks_susp_pattern.eql,sha256=ITEW-ix_UuxeUBieucU7AWyWp34sD8Ae6f1nztkBcM4,771
src/rules/windows__process_creation__proc_creation_win_schtasks_susp_pattern.lucene,sha256=P9Cd7-z20S5n74iFox_g8ilZ95hqH9E0CwkdlS2h0Kk,765
src/rules/windows__process_creation__proc_creation_win_schtasks_susp_pattern.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_schtasks_system.eql,sha256=pwfzeFgIFPMw1RpsRSQyKZgdDPmYh7AyG-CGXpVxV5w,776
src/rules/windows__process_creation__proc_creation_win_schtasks_system_process.eql,sha256=kvYdSe6VzscvcPph2nClSiqxe19bardg0DVTxH8tHTs,480
src/rules/windows__process_creation__proc_creation_win_scrcons_susp_child_process.eql,sha256=rD7maPk6e0qqNJvMur6T1L6esu1rTek_xJtNZs9tz3Y,302
src/rules/windows__process_creation__proc_creation_win_scrcons_susp_child_process.lucene,sha256=FngU6KwKC_qlULN2wIy5bpi-nzHMuhrJLvuJ8j-6Mns,282
src/rules/windows__process_creation__proc_creation_win_scrcons_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sdbinst_shim_persistence.eql,sha256=vGs6vOuJMeAqwj4ESQ_wlJDZ-iveY-YNbSebWG_ydqw,336
src/rules/windows__process_creation__proc_creation_win_sdbinst_susp_extension.eql,sha256=SuY85gcY3wCVM9dRsi0_ze0Krd_mA8d02LLop2jX_Vc,344
src/rules/windows__process_creation__proc_creation_win_sdclt_child_process.eql,sha256=YZAYazrrPUAJbg6npGM8C32HVMScp4A-KQeyHbwzId0,51
src/rules/windows__process_creation__proc_creation_win_sdclt_child_process.lucene,sha256=OhAQQ9zr4fnO-IBffvDICVH8PukalB3C0aE00Cdg9qQ,39
src/rules/windows__process_creation__proc_creation_win_sdclt_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sdiagnhost_susp_child.eql,sha256=1bZze4hkB24OSqPFlI_dGb0NbmzWPVLax3vHxPXdm0k,454
src/rules/windows__process_creation__proc_creation_win_secedit_execution.eql,sha256=Hx2QkvoNayunq7fc35hLUbDI2DxHN_Cb85izMYDbqAs,240
src/rules/windows__process_creation__proc_creation_win_security_susp_node_js_execution.eql,sha256=waeisR4T9y81gIAHjGE9xrN_Vy5nu5SwEAGxKcgjNr0,154
src/rules/windows__process_creation__proc_creation_win_servu_susp_child_process.eql,sha256=g_TAVaUvLhBaGFGaV-cPWZrSG-4Oh-UHEfebUmkioyU,346
src/rules/windows__process_creation__proc_creation_win_setres_uncommon_child_process.eql,sha256=9JONrCX5Pj9Jz4okRJraScn0FWM7uFA7pfrsEeP_B6M,204
src/rules/windows__process_creation__proc_creation_win_setspn_spn_enumeration.eql,sha256=DBk29KSDmYtEx6KmQEVgU0m1bg3_QDpsqpqvl3u5k08,252
src/rules/windows__process_creation__proc_creation_win_setup16_custom_lst_execution.eql,sha256=-AvrSwbSv1CuA50RC8aHQPRETTcO8FH3M5KTqMwWl1A,164
src/rules/windows__process_creation__proc_creation_win_setup16_custom_lst_execution.lucene,sha256=TARMrcZx_alsEtEFV-VzLfHLIPJ-rKErXcRGFwfZuHo,154
src/rules/windows__process_creation__proc_creation_win_setup16_custom_lst_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_shutdown_execution.eql,sha256=KBq2_8ZEf6NaOF7Cr_u5E2CkC17O3sV5WACmq59Mo_Y,99
src/rules/windows__process_creation__proc_creation_win_shutdown_logoff.eql,sha256=CDcLwbebJaMcd2bSRraAMwMkUipN51483xTRDkf3on0,79
src/rules/windows__process_creation__proc_creation_win_sigverif_uncommon_child_process.eql,sha256=kWBkTt4H9LrK22WWb22Rww4kKOFfYtHOy3KCnaFdCPs,170
src/rules/windows__process_creation__proc_creation_win_sigverif_uncommon_child_process.lucene,sha256=wT1Cg8M_H6hBuqZBqKQAmeDFmV8aEVLM_6RXGZfHEPw,152
src/rules/windows__process_creation__proc_creation_win_sigverif_uncommon_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sndvol_susp_child_processes.eql,sha256=0dQBYzDMy9dbTGnDfN7slEL1Q07fi98EM9ddbhH-ofM,159
src/rules/windows__process_creation__proc_creation_win_soundrecorder_audio_capture.eql,sha256=xiXbXVCU835S_8KO8lVGMXrCN6QsBpcPVX93IwnPsgU,87
src/rules/windows__process_creation__proc_creation_win_speechruntime_child_process.eql,sha256=-siZ3kHNNf4NQDZ5eKNji6UQefBcqzwjNAUXAleEuxc,59
src/rules/windows__process_creation__proc_creation_win_speechruntime_child_process.lucene,sha256=LQFt-6LL2ZujDZ5lReDBDaFQF3dE1X9rUvuvhsm4mzQ,47
src/rules/windows__process_creation__proc_creation_win_speechruntime_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_splwow64_cli_anomaly.eql,sha256=aQ9_JMLH57Gu8bNLlPyOon3Snw7K3UtWicbDhheDxRY,88
src/rules/windows__process_creation__proc_creation_win_splwow64_cli_anomaly.lucene,sha256=OskbDNnFlRonfrVVd6Y4rTv0q7VTko_5eRlhxA2vQlc,74
src/rules/windows__process_creation__proc_creation_win_splwow64_cli_anomaly.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_spoolsv_susp_child_processes.eql,sha256=TGXH_O_3qHeN1JJf5O9zTbYKl-l-Q-u9nRj0TC1BC3U,1142
src/rules/windows__process_creation__proc_creation_win_sqlcmd_veeam_db_recon.eql,sha256=ebbkgeKU9AD7tUvNl568pv3yF8dMz6lISXOGVLc8ouM,279
src/rules/windows__process_creation__proc_creation_win_sqlcmd_veeam_db_recon.lucene,sha256=yF4fC1OGPIfRdSlp33mWsuRxDAHwbNCuSW2CaQTDGj0,256
src/rules/windows__process_creation__proc_creation_win_sqlcmd_veeam_db_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sqlcmd_veeam_dump.eql,sha256=zFuAaowK0HmBZWNwbinrIxpDvaRRy0pljQrnq2YzWsE,179
src/rules/windows__process_creation__proc_creation_win_sqlite_chromium_profile_data.eql,sha256=2znULPBfHpA0lUKiBE5P3KLYffmj5HQt8uLZuTg_PA8,309
src/rules/windows__process_creation__proc_creation_win_sqlite_firefox_gecko_profile_data.eql,sha256=HbYW8GnLd0w8XiqX8QCZutc5olFVrBmsvIMrRPs0Sjg,179
src/rules/windows__process_creation__proc_creation_win_squirrel_download.eql,sha256=O63ssGJdlQ4_c9DskfcDvar0IBvcF-yLyku0D0k6E2g,200
src/rules/windows__process_creation__proc_creation_win_squirrel_proxy_execution.eql,sha256=hW_v5vOcU6mcRt7pSqbwKlAbTeE3UMhT9n1hXAvIL98,1123
src/rules/windows__process_creation__proc_creation_win_squirrel_proxy_execution.lucene,sha256=vZDlkBfffppG-Yd5B5OCd8zCiLdvKvO_fSjpN8wsb0M,1067
src/rules/windows__process_creation__proc_creation_win_squirrel_proxy_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ssh_port_forward.eql,sha256=YIPyFgsfHY4QNTRJ4YeeGShOSnMzUjv08NvGpve51ok,130
src/rules/windows__process_creation__proc_creation_win_ssh_proxy_execution.eql,sha256=tQYuvCpSRbsD2wgpjKngnLxCt8LBNmyOlZJPh8ETpZc,754
src/rules/windows__process_creation__proc_creation_win_ssh_proxy_execution.lucene,sha256=ne796hbaHZfl_SV0xUP_HLNLDF6p4H7E8gPTMeByc2I,739
src/rules/windows__process_creation__proc_creation_win_ssh_proxy_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ssh_rdp_tunneling.eql,sha256=jb9CbVX_f5ZBCCJv6uKSLjHVZU6CnOqOVNFnaq3XdAQ,77
src/rules/windows__process_creation__proc_creation_win_ssm_agent_abuse.eql,sha256=LCpJz60BsG5eAXz8ySwtO9kaTCUGMLydXgE6ZmuIkr4,205
src/rules/windows__process_creation__proc_creation_win_stordiag_susp_child_process.eql,sha256=LOBMctYV5O_glQe5-YuLgedOgZLhvkvM8zEN14DN1Tw,243
src/rules/windows__process_creation__proc_creation_win_stordiag_susp_child_process.lucene,sha256=P35jpXkQ2pTlyfy29aH_uVs-059uJAAWrQZ8Y9Pp02o,217
src/rules/windows__process_creation__proc_creation_win_stordiag_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_16bit_application.eql,sha256=HyyjeHMueMT7FsJOgJsGI-T9buK5FiVMamNfMh2IneY,70
src/rules/windows__process_creation__proc_creation_win_susp_16bit_application.lucene,sha256=YohZzdkET4rp7FAUiAGXgZmXVyNYLfBp5R0IvWfKlT8,52
src/rules/windows__process_creation__proc_creation_win_susp_16bit_application.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_abusing_debug_privilege.eql,sha256=xFyKBHOMPx2fiBLVbUmN4poUAP3uWe9der3693QF06o,489
src/rules/windows__process_creation__proc_creation_win_susp_add_user_local_admin_group.eql,sha256=EpR6a_04wOrtiNaYa38qN9VyvwEqqGcyaGbIl6PDb1Y,253
src/rules/windows__process_creation__proc_creation_win_susp_add_user_privileged_group.eql,sha256=1kF9hLJVppkAQluRT8mnjXCxafek6WasejklnJxKDdk,262
src/rules/windows__process_creation__proc_creation_win_susp_add_user_remote_desktop_group.eql,sha256=4YKjt_i62OefIF-Jd6C2iU6Fo2s-L04uBjgjlGmfSGE,311
src/rules/windows__process_creation__proc_creation_win_susp_alternate_data_streams.eql,sha256=w049PfQVYLGeSP8FwcOPMN16xUikgBW1pqdRxwH5JQs,473
src/rules/windows__process_creation__proc_creation_win_susp_alternate_data_streams.lucene,sha256=HSc3wDEgLc84vq49MxIk7CvhxaW2Rl5P-IHz9Qljpnk,460
src/rules/windows__process_creation__proc_creation_win_susp_alternate_data_streams.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_always_install_elevated_windows_installer.eql,sha256=LpT4-WPN1CSz6zjN9_6h8Mi43hkBQS0GRzrzPEsMGqk,833
src/rules/windows__process_creation__proc_creation_win_susp_appx_execution.eql,sha256=A3fmrv_GVg9M29xkX7Sp-oMp9zjsswgtbJdpSGLrdd0,709
src/rules/windows__process_creation__proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.eql,sha256=Qk3Ra9nFU-7kLcAhkaQbnoxSBnwFNrEHZxEPf7Ovxfk,111
src/rules/windows__process_creation__proc_creation_win_susp_archiver_iso_phishing.eql,sha256=GLIfIh49G9Ifkjc024pTL6o3D6p5rIZG7iyaVNTOGJI,181
src/rules/windows__process_creation__proc_creation_win_susp_automated_collection.eql,sha256=5NOIGNS-FIfPp0lArz4_ewDy1OJ8UrFdNPPypu3y5wk,343
src/rules/windows__process_creation__proc_creation_win_susp_bad_opsec_sacrificial_processes.eql,sha256=Yp66sifl8z1-axYDos0W-vLN9Y20-1zDUlgA23KhPxE,941
src/rules/windows__process_creation__proc_creation_win_susp_browser_launch_from_document_reader_process.eql,sha256=A7pC7JS1OAOAtfcDFvo733RylPlMSOYyCSbSSAGESJE,522
src/rules/windows__process_creation__proc_creation_win_susp_child_process_as_system_.eql,sha256=nuE6fUemRmchHRrLA56VTyKt_C-q8X-Lb6u9sQTtDCs,442
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_escape_char.eql,sha256=hnfHhBtnIP2SikB1qGBcGtWDMspu93Al5ED2w05dhOA,67
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_escape_char.lucene,sha256=xNMuFivySStBN3q18wgKXaCZJkRFDboMTJ5_lfpNtW4,52
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_escape_char.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_unicode_img.eql,sha256=4ekJ7B01yODTc5Ilu6F5iA6Ii1uOOtAe3mEvOtS5lxQ,422
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_unicode_img.lucene,sha256=6qHvnJAVY9triD3CM1-hIBJ-tEz6M0tdyfkEzeU_mfI,388
src/rules/windows__process_creation__proc_creation_win_susp_cli_obfuscation_unicode_img.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_clickfix_filefix_execution.eql,sha256=spV1GFiFKWHBwG74NBd2pfN0-0pUeq9W04TDaw8I8I8,340
src/rules/windows__process_creation__proc_creation_win_susp_clickfix_filefix_execution.lucene,sha256=fKkqN-GbNOyY7gUo7ghc9Thn3FnNhvwOUYFok2MSXLo,319
src/rules/windows__process_creation__proc_creation_win_susp_clickfix_filefix_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_clickfix_filefix_whitespace_padding.eql,sha256=PdRFKu9ry5SGg5lo8e4kiYReVuYiin1U25aRZejl8Us,631
src/rules/windows__process_creation__proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.eql,sha256=4vL3RUHADhxgI1UXTitzpAonwSB7vQoukmyRvtrEOW8,317
src/rules/windows__process_creation__proc_creation_win_susp_commandline_path_traversal_evasion.eql,sha256=xQxKXqRTeLXeOdqy7KgTLiaxr2BRXQOcjIHVKD60L7s,355
src/rules/windows__process_creation__proc_creation_win_susp_copy_browser_data.eql,sha256=MP5D2L_AflWVKwzqhKNzPee9w1_6onyZqty0b-JC5YA,1146
src/rules/windows__process_creation__proc_creation_win_susp_copy_browser_data.lucene,sha256=1HYcMBrQKQJm5dW1rXaT88_hyeGKXyu0srepyxS3C6o,1150
src/rules/windows__process_creation__proc_creation_win_susp_copy_browser_data.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_copy_lateral_movement.eql,sha256=jWT-EIZCHhoLL-dB-6vnHdcv7CZHMSoSnHpbKYOBs4M,645
src/rules/windows__process_creation__proc_creation_win_susp_copy_system_dir.eql,sha256=CO2kt69cmrCTcLZ8G-ahIqYboO8t4fqyvqZmIr1IV5g,868
src/rules/windows__process_creation__proc_creation_win_susp_copy_system_dir_lolbin.eql,sha256=e75fboPsT7xEylRRQjoyDydrSCtzx8krMyZiCRbSRfs,656
src/rules/windows__process_creation__proc_creation_win_susp_crypto_mining_monero.eql,sha256=yJkgfrmyXvvwTc4o6vbMwZGQrYyro9EWu9XiyQY3YFE,474
src/rules/windows__process_creation__proc_creation_win_susp_data_exfiltration_via_cli.eql,sha256=PJP2I--opTxqcnMCLjUEh3G5CL38tY6XgrOesWe3Jl0,1114
src/rules/windows__process_creation__proc_creation_win_susp_disable_raccine.eql,sha256=Udzv1m6zExhn4ZwCcml_ccs0poiDLlRq4x9PsIP_TJk,339
src/rules/windows__process_creation__proc_creation_win_susp_disable_raccine.lucene,sha256=sQKfqIfHmBKr_u-x_VwI6S_N8Kq8dNUBqwBol9ovq5M,318
src/rules/windows__process_creation__proc_creation_win_susp_disable_raccine.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_double_extension.eql,sha256=EgeNrDGqOkexQSv5heRMxAsVwzlrWnuSDEDcs0a1RmU,914
src/rules/windows__process_creation__proc_creation_win_susp_double_extension_parent.eql,sha256=Bn7GnzAW0RCsAi4kBv89C8aQdYUJDk5JI179Eo8FGgI,565
src/rules/windows__process_creation__proc_creation_win_susp_double_extension_parent.lucene,sha256=wGwG2qmbYoKvyZs3kkwRY_ZW0k_pmGHyi-liq4fBhz4,539
src/rules/windows__process_creation__proc_creation_win_susp_double_extension_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_download_office_domain.eql,sha256=iY55rQvDGIeGaYGgIDGhQwV4HmNkjo2xKQVbc9TMmSU,366
src/rules/windows__process_creation__proc_creation_win_susp_dumpstack_log_evasion.eql,sha256=Wp4ifvPxZtH6AXmfJhQucTM6DfkqKTMRnVebm03gZWw,94
src/rules/windows__process_creation__proc_creation_win_susp_elavated_msi_spawned_shell.eql,sha256=uq7OFFV8EJ41dUdXflJnZAgAXwbXdcTuE4B6XV7XGbs,308
src/rules/windows__process_creation__proc_creation_win_susp_electron_app_children.eql,sha256=lGeoLMJGuY95bWsy3EGiqSkRQG0VbSPpsAkxWkQPLEY,669
src/rules/windows__process_creation__proc_creation_win_susp_electron_app_children.lucene,sha256=4NgsEjFo4ZW2OceyyqTdz6FtuBN4EYyu5j9Xy2YZrws,632
src/rules/windows__process_creation__proc_creation_win_susp_electron_app_children.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_electron_execution_proxy.eql,sha256=cgfWoSWWmvLZWHIeAuTkhetHqYjKb-_tZ-2mikhTueI,601
src/rules/windows__process_creation__proc_creation_win_susp_electron_execution_proxy.lucene,sha256=RFUIThEt4NNKxJM-lzuVB9wlDYwfzhT6IVFgmaiivVU,582
src/rules/windows__process_creation__proc_creation_win_susp_electron_execution_proxy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_elevated_system_shell_uncommon_parent.eql,sha256=RVYaf7_pcM2Ms0NhKPTvZLr3HWx9A39HB6pIvoENi4c,1083
src/rules/windows__process_creation__proc_creation_win_susp_embed_exe_lnk.eql,sha256=UOSxrQ9U4kfcqmlnoTfn9w8cVzqfQA356X1c789KZyI,196
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_1.eql,sha256=dSTDG88J9abumnxpiNL9UCoRmiZ4nYEr7iBOZxVbshs,15786
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_1.lucene,sha256=nzWQyIhug8B6SCNkDsJUW045-7UGyjFVdayGzcHX12I,15768
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_1.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_2.eql,sha256=8D63SMx7K2d1vx0dY2TWxObQ70YNE1zQH2kXd4hWvh4,18511
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_2.lucene,sha256=634rOBjMuHmk1Gl2R68tWo2edNIU8nUmO4wWOeAz70s,18493
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_2.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_3.eql,sha256=7PFWgy8OAGFY8-9ZMpUOw-S8xXetBhEf8nsjm63-xB0,10598
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_3.lucene,sha256=AyfS90v-P2LG0HUkVAmHRqi9eCII1-Mww1QMoC8WU04,10580
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_3.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_emoji_usage_in_cli_4.eql,sha256=S1YrO7P_dgDYlSh5sjaffwy9LuD_QaOVtORxSn4SFzE,14552
src/rules/windows__process_creation__proc_creation_win_susp_etw_modification_cmdline.eql,sha256=418Yx3ZbfYtcarzCBwn-Eu52EKcEI_eerTU60SZrsR8,84
src/rules/windows__process_creation__proc_creation_win_susp_etw_trace_evasion.eql,sha256=QX3t09nfpOWxnZsZYMeVAfJNuSlCgKNuFknrVdalBXY,611
src/rules/windows__process_creation__proc_creation_win_susp_etw_trace_evasion.lucene,sha256=Niu2hEjAIyMlFV3eFRGEUCGWY4GG8DgNoxPf2ytmVG8,582
src/rules/windows__process_creation__proc_creation_win_susp_etw_trace_evasion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_eventlog_clear.eql,sha256=SPaxsVdajEdWjLQRlR7R5D-Rwopn_ScArJomMWI-WrA,905
src/rules/windows__process_creation__proc_creation_win_susp_eventlog_content_recon.eql,sha256=kyAbWobOwYiiOVDqGqv9C2sQ-phJw6-X_PzvHvkVtU0,1603
src/rules/windows__process_creation__proc_creation_win_susp_execution_from_public_folder_as_parent.eql,sha256=Rw4_6FA4x2jwgIqSJuUxAcWO0jk5sclNVrDq4QAT-tU,414
src/rules/windows__process_creation__proc_creation_win_susp_execution_from_public_folder_as_parent.lucene,sha256=6eVrlZRKGYUesZ0HRpJyOGHkpOjCaLHgD6c-U5r6ODU,387
src/rules/windows__process_creation__proc_creation_win_susp_execution_from_public_folder_as_parent.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_execution_path.eql,sha256=AxYVBzdfN1r0ZA5KgjdWP7cHgkpFBmyq7fTuLkz0Gro,725
src/rules/windows__process_creation__proc_creation_win_susp_file_characteristics.eql,sha256=QyIZ_OU5-Fbiura2C0jFGGF-QV_QtXCZXdbE0Yy8T38,237
src/rules/windows__process_creation__proc_creation_win_susp_filefix_execution_pattern.eql,sha256=v8VzPQXvzJ9Aya16OnsFDXifpoGWeSgGQ_ocQPtKU9E,624
src/rules/windows__process_creation__proc_creation_win_susp_gather_network_info_execution.eql,sha256=gTJhhRInwz40HTHCZlJhJ6lRo9C01UGoOyXfnaRrjn0,131
src/rules/windows__process_creation__proc_creation_win_susp_hidden_dir_index_allocation.eql,sha256=CK6WYEWddLpZDNXiuLJG5gVDIPnqEpwQ1vAU409YUlQ,55
src/rules/windows__process_creation__proc_creation_win_susp_hiding_malware_in_fonts_folder.eql,sha256=XZDl-RRpg5jAVMVYrLzpjrK7lXAiXXgPkp1qmyHtOGg,369
src/rules/windows__process_creation__proc_creation_win_susp_homoglyph_cyrillic_lookalikes.eql,sha256=ZjHLae3PAAGYjYR04c51BMvDFrdaEKeC8z5jQshFEdc,457
src/rules/windows__process_creation__proc_creation_win_susp_image_missing.eql,sha256=mI2ZUjpUvVEAFJgFAdqlH8Uk3IXJhCf9Qr29rv6z5_c,317
src/rules/windows__process_creation__proc_creation_win_susp_inline_base64_mz_header.eql,sha256=h9xDeBWxq_17qJmrHeHfW-xyZr8OVSJZTXmhlUDZBYs,148
src/rules/windows__process_creation__proc_creation_win_susp_inline_node_js_execution.eql,sha256=VDRc2T6SLlIOo9g1FlB074TLpbPXnL479vdnNbDGHSc,330
src/rules/windows__process_creation__proc_creation_win_susp_inline_win_api_access.eql,sha256=rBC7DfzZoMJXm6HXI6KvD9yM22ZeERQuMj_h3tl_xwI,1250
src/rules/windows__process_creation__proc_creation_win_susp_jwt_token_search.eql,sha256=bUarTOogJrg5q2CPIOwn0aYOvGnWmTzLg449jmhhiXU,267
src/rules/windows__process_creation__proc_creation_win_susp_lnk_exec_hidden_cmd.eql,sha256=gOx5a4QHAdOLS9tu1oCz49BhuK6pk6r3HCzlMH7TRUA,365
src/rules/windows__process_creation__proc_creation_win_susp_lnk_exec_hidden_cmd.lucene,sha256=SrglKff-Oe18KmCelf3Y2YGh7P9mxWcoIZmTbBMbsAY,369
src/rules/windows__process_creation__proc_creation_win_susp_lnk_exec_hidden_cmd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_local_system_owner_account_discovery.eql,sha256=S81w3M_0BPWuZM1GikfNh9aqMEC2rNjbRvT5-lP00XI,820
src/rules/windows__process_creation__proc_creation_win_susp_lolbin_exec_from_non_c_drive.eql,sha256=S7eg3WczUi7UXFrFUnGf3mBE0qj3k7ASOEzgbu7f0pE,489
src/rules/windows__process_creation__proc_creation_win_susp_lsass_dmp_cli_keywords.eql,sha256=y2MaPhzkHC2yxoglxbhACwxSt_l5kZU2rjf5WP15B7c,395
src/rules/windows__process_creation__proc_creation_win_susp_ms_appinstaller_download.eql,sha256=jRaMCLQCzZu_YmIdSPSF0Z7sqcZ4kx-6q42-EaEtb2Y,96
src/rules/windows__process_creation__proc_creation_win_susp_network_command.eql,sha256=H0h0dgpHy2XqnHgJjz41nNI2a4UuMACgmHzUFyVr8s8,526
src/rules/windows__process_creation__proc_creation_win_susp_network_scan_loop.eql,sha256=dgPPEO3BdqxLQUwdE4nlXQAu7CCkJ2scWLLyw8jvxdM,122
src/rules/windows__process_creation__proc_creation_win_susp_network_sniffing.eql,sha256=cIX-9BqeA8DeUC1VYKe7hXpmynq_tvXqbyPvLtr3WZ4,118
src/rules/windows__process_creation__proc_creation_win_susp_no_image_name.eql,sha256=dCScRZ6LtwgYe6AQgAjFACKstJG4afq_A1TX7MNWXeM,39
src/rules/windows__process_creation__proc_creation_win_susp_non_exe_image.eql,sha256=Wr5Tk_9Ay_XSGWIPDUu8jE1Nfmw8f3o2tKiQdjdEpSk,1396
src/rules/windows__process_creation__proc_creation_win_susp_non_priv_reg_or_ps.eql,sha256=YVVNIR-e0uNsP9DY7LUmeYIyifS-yio2HJyJCjWpsOo,418
src/rules/windows__process_creation__proc_creation_win_susp_non_priv_reg_or_ps.lucene,sha256=f9uHz8-591yoj5ruJ0-fPDIoYFtvm8JC6LNRoQ2UGUk,384
src/rules/windows__process_creation__proc_creation_win_susp_non_priv_reg_or_ps.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_ntds.eql,sha256=hqT6Lh-EimxRVEScndZVkxy26Tg0hPEHboRsknFxTf8,839
src/rules/windows__process_creation__proc_creation_win_susp_nteventlogfile_usage.eql,sha256=kGp_ZroH-jsSjElnO7FIc-9EyJbvqqj1CRCviUPYFug,289
src/rules/windows__process_creation__proc_creation_win_susp_ntfs_short_name_path_use_image.eql,sha256=_a2C93mcqhEcNOYf9vsB-VpAvGlepHaPbzYl2919QsY,595
src/rules/windows__process_creation__proc_creation_win_susp_ntfs_short_name_use_cli.eql,sha256=kwUIjn5pTQko8xGwo-y4M7ddLeOahXtRxEYa4bn07f4,413
src/rules/windows__process_creation__proc_creation_win_susp_ntfs_short_name_use_image.eql,sha256=y27Cu1jtk3Ufg_H-fyH3aDBg6XWcA1LPTZ_hDsWZ8yQ,554
src/rules/windows__process_creation__proc_creation_win_susp_obfuscated_ip_download.eql,sha256=jjB6VR4yR92vjYDXESO_ooNyWdmig7p5dfAI8FPGzjc,1326
src/rules/windows__process_creation__proc_creation_win_susp_obfuscated_ip_via_cli.eql,sha256=RNngwasPaE9cPc93uuNFSawATpQZt1M0t19RPKcnJB4,1227
src/rules/windows__process_creation__proc_creation_win_susp_obfuscated_ip_via_cli.lucene,sha256=s7u2g8oTOQKq-Dht80TK9WEI7pXvfPCf1e9nhzyVhQ8,1408
src/rules/windows__process_creation__proc_creation_win_susp_obfuscated_ip_via_cli.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_parents.eql,sha256=AjoJXO4VQTEh92HSJUm5GWupaUyUkUNozSWbudI5_vE,450
src/rules/windows__process_creation__proc_creation_win_susp_powershell_execution_via_dll.eql,sha256=NZrmYO3Wr2Pla0ujV-bqMjkJa6jh-iModZK-4b7TxrA,419
src/rules/windows__process_creation__proc_creation_win_susp_priv_escalation_via_named_pipe.eql,sha256=D7T201mdZ6tfdHkXdQc8htseH5cAoulcMpgXSfWPaO8,253
src/rules/windows__process_creation__proc_creation_win_susp_private_keys_recon.eql,sha256=ixGgH5oVQ_W6TFElRjcZAqKETMATcMi0wKZJlRUKGQw,534
src/rules/windows__process_creation__proc_creation_win_susp_privilege_escalation_cli_patterns.eql,sha256=N8pWpRidjFbcUFFs-iiGOyi-tBNIGeNgDN31oidySOQ,358
src/rules/windows__process_creation__proc_creation_win_susp_privilege_escalation_cli_patterns.lucene,sha256=WzVcjprluFGDWN3kXD3HHOHrVc149W2D6H9HUAJg69k,387
src/rules/windows__process_creation__proc_creation_win_susp_privilege_escalation_cli_patterns.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_proc_wrong_parent.eql,sha256=fRiDgHob-UBR2C94bXLJ7gRc21Moyl2X5BYp0D62vPg,626
src/rules/windows__process_creation__proc_creation_win_susp_progname.eql,sha256=L3vfLsRo6FGvzRnKyHKTVGDvwBbC8mK_-CUoVJNXq10,798
src/rules/windows__process_creation__proc_creation_win_susp_progname.lucene,sha256=QWSjcXdv2ztr1UEkLnaHMkd-OxwL8TCdodGFywFaoLo,766
src/rules/windows__process_creation__proc_creation_win_susp_progname.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_recon.eql,sha256=h7hVjgsq3DwMXVFBj7wwNJjueCYmwGIZmi95SuzpbY8,250
src/rules/windows__process_creation__proc_creation_win_susp_recycle_bin_fake_execution.eql,sha256=bXxfWLqCdJ8EhjJ-IxpNntmOVgB_ULIhlg9Q0LHjxQE,75
src/rules/windows__process_creation__proc_creation_win_susp_recycle_bin_fake_execution.lucene,sha256=lQkU8D0IrA7mZb4XXO6g1EUV1wOjSU73EqWZid0YH1c,57
src/rules/windows__process_creation__proc_creation_win_susp_recycle_bin_fake_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_redirect_local_admin_share.eql,sha256=AXR7hHfseHr73bYlvCuhKG2l3_T8HPARmPmbLC0MJbc,123
src/rules/windows__process_creation__proc_creation_win_susp_remote_desktop_tunneling.eql,sha256=A9I-OZUSIy1G_dJ2vHK5QEROQN2R8LLAFBZifxVRYmo,128
src/rules/windows__process_creation__proc_creation_win_susp_remote_desktop_tunneling.lucene,sha256=uJIX9jRhb4ZgXF69R7pKiNs7N6IlOpOg85wZm6E0ZOs,124
src/rules/windows__process_creation__proc_creation_win_susp_remote_desktop_tunneling.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_right_to_left_override.eql,sha256=Xwqyd2hrf5RwNaJGcnzP4Y4_Gc22JGEvO0qWTNTWU04,65
src/rules/windows__process_creation__proc_creation_win_susp_right_to_left_override.lucene,sha256=NX1qhsEZGD7q6z0MB4Y66ImLr7qeWAkBkbE52ms8xvk,50
src/rules/windows__process_creation__proc_creation_win_susp_right_to_left_override.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_script_exec_from_env_folder.eql,sha256=EStZjL1ZLzvWb6z9mM8T7cfW7E9P4O9Crd-jUmYXEOk,761
src/rules/windows__process_creation__proc_creation_win_susp_script_exec_from_temp.eql,sha256=DnZyvLI1SmDAaydOUVkFJ6QeZY7uWxBIitCHmq4k4BQ,527
src/rules/windows__process_creation__proc_creation_win_susp_sensitive_file_access_shadowcopy.eql,sha256=QIoKW10KlwZHWlR3VvFvYsVFaGgcnhBAAzTHNvTGQQE,166
src/rules/windows__process_creation__proc_creation_win_susp_service_creation.eql,sha256=oIXywPy8QeDgYQuqHVhzl22e7_IOHReobE4cKxCQp7Y,560
src/rules/windows__process_creation__proc_creation_win_susp_service_creation.lucene,sha256=RqxjVrp6qXFlE8khxzAhgqwrCTg-PsdG-9ymC2UEdjw,545
src/rules/windows__process_creation__proc_creation_win_susp_service_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_service_dir.eql,sha256=it2Npww6_tbZrnO7bYYYiirFwpEqSfePLNNNfOKhxmM,369
src/rules/windows__process_creation__proc_creation_win_susp_service_dir.lucene,sha256=IRKKHdcEKC3MRiscEhygMR73yepIJ1MjSfhXIFoKfog,345
src/rules/windows__process_creation__proc_creation_win_susp_service_dir.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_service_tamper.eql,sha256=AnEaEp12coHYYzM4BLDqynjWBiSVxyoRAnz5wDBgA6E,4547
src/rules/windows__process_creation__proc_creation_win_susp_shadow_copies_creation.eql,sha256=t5LqZgl02paoe8K864NxDhHnUo4Fex_v0L1MTlaUJys,284
src/rules/windows__process_creation__proc_creation_win_susp_shadow_copies_deletion.eql,sha256=dqWsUluPs4C9LdVGr8SrqZFgRmcyiLCDKZ0TG3VkWlE,764
src/rules/windows__process_creation__proc_creation_win_susp_shell_spawn_susp_program.eql,sha256=cDNLaN-DVryfs2bAvjZYRmeoWfLykL6WDaXYsDD_15A,1177
src/rules/windows__process_creation__proc_creation_win_susp_sysnative.eql,sha256=CQaZ2KqM5xTsm6qXXPRP-eiKA-lQyLzXdb7A6lijK2k,578
src/rules/windows__process_creation__proc_creation_win_susp_system_exe_anomaly.eql,sha256=sLr0alKFLkPoXRJpHi5UdAjeWU5esbPNoVHLHubUUi8,1921
src/rules/windows__process_creation__proc_creation_win_susp_system_user_anomaly.eql,sha256=bthu__Wl3QcVlhoe0Zi_EDBKRb1naxlnM2Zw41bG3ng,1682
src/rules/windows__process_creation__proc_creation_win_susp_sysvol_access.eql,sha256=ihB7NVazriU1n3Xs-3l_MPNF2b0fx_K4eII84qVUbBA,86
src/rules/windows__process_creation__proc_creation_win_susp_sysvol_access.lucene,sha256=xRlTP-aFLBbOjDniXsHxmEW5o78QmoJ4fmangRu5oB8,72
src/rules/windows__process_creation__proc_creation_win_susp_sysvol_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_task_folder_evasion.eql,sha256=0OH4717mrP9kwbfLbrnMe-PnQLCQngcgL39M8XKB4Ls,199
src/rules/windows__process_creation__proc_creation_win_susp_use_of_te_bin.eql,sha256=jViV27f371jz4fy9C6RG9c4tJ7PLLqujwBPwG7HnJgA,126
src/rules/windows__process_creation__proc_creation_win_susp_use_of_vsjitdebugger_bin.eql,sha256=fPT_PGWNSTWwzCgW3grUdqpB_TE8wbZLzjLjctSQp3w,151
src/rules/windows__process_creation__proc_creation_win_susp_use_of_vsjitdebugger_bin.lucene,sha256=TIM0pqJE3plRgV2BCqs-mYTwDSOxzCWu7oU72SxbLBY,131
src/rules/windows__process_creation__proc_creation_win_susp_use_of_vsjitdebugger_bin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_userinit_child.eql,sha256=7NKioTYgVjned-A-UME0DiUhTOs_8TR3OfPJSFh63oo,318
src/rules/windows__process_creation__proc_creation_win_susp_velociraptor_child_process.eql,sha256=JxqRddHK_hTBvwDTMk0ArjG0sgjCq7IjhDsI4cJXf8s,501
src/rules/windows__process_creation__proc_creation_win_susp_weak_or_abused_passwords.eql,sha256=t6dfNTqBsVLJiujgEEJguMAku8DHHwo41csjBUiT0i8,160
src/rules/windows__process_creation__proc_creation_win_susp_weak_or_abused_passwords.lucene,sha256=CR74thO8WiYgYLU4szoCaKx_Xzkip76h_XTIHUG6Bf4,143
src/rules/windows__process_creation__proc_creation_win_susp_weak_or_abused_passwords.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_web_request_cmd_and_cmdlets.eql,sha256=aqVDYW20uQy5JjKCtPWslUVddi8mZ2mRhwcdbH-dYQ0,241
src/rules/windows__process_creation__proc_creation_win_susp_web_request_cmd_and_cmdlets.lucene,sha256=irsqOQU1TO9JGspDEjMFBjsZHGsjoxkIZPSg6VKNBEg,236
src/rules/windows__process_creation__proc_creation_win_susp_web_request_cmd_and_cmdlets.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_susp_whoami_as_param.eql,sha256=bhUIFg8IxB0zAhZdRowLDFvqYKM7T6NTtfw1VKuHAkY,47
src/rules/windows__process_creation__proc_creation_win_susp_workfolders.eql,sha256=K82oeUIjpVU4reNGCjrMjbmvWhAr89sF5ECCLtwhaWc,165
src/rules/windows__process_creation__proc_creation_win_svchost_execution_with_no_cli_flags.eql,sha256=6VZpLEZDSYoFjGWk7Vf2qaHbb4EnaqYEdNLDkXlBKw4,245
src/rules/windows__process_creation__proc_creation_win_svchost_masqueraded_execution.eql,sha256=Iv5jFbEvKWf11eG0Wi9PAowmjJYiWqeZjqr6AYtctxY,209
src/rules/windows__process_creation__proc_creation_win_svchost_termserv_proc_spawn.eql,sha256=onQbzbMENAfyAfvp-WFYQdlnLFAgpbYOsGQInp4OaaE,347
src/rules/windows__process_creation__proc_creation_win_svchost_uncommon_command_line_flags.eql,sha256=D7NzJNzuev3ljqUg6O8RPglJELMG61zCCNOrR2XQFJE,488
src/rules/windows__process_creation__proc_creation_win_svchost_uncommon_parent_process.eql,sha256=x9h3R8XWWkT-pLYJc3BLNbE0OVQ5QlTs4feTG2k8fqk,322
src/rules/windows__process_creation__proc_creation_win_svchost_uncommon_parent_process.lucene,sha256=U4hxWG2ihMFxEnn-BYOxbJfFmGX651gWXCxLRIWOX44,300
src/rules/windows__process_creation__proc_creation_win_svchost_uncommon_parent_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_accesschk_check_permissions.eql,sha256=89v5l35XdFyWvL-LluODEAPbalkGEazu4Z6xv1uNSwY,306
src/rules/windows__process_creation__proc_creation_win_sysinternals_accesschk_check_permissions.lucene,sha256=GQ22nuEV3Mz8lzKVQg3jlVwPj3ZlwKu1yWhd79kk93k,280
src/rules/windows__process_creation__proc_creation_win_sysinternals_accesschk_check_permissions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_adexplorer_execution.eql,sha256=b0DCnJrUDR8bZJUAHgJjVVv5AFiB4l1KMk7clq8_vRU,303
src/rules/windows__process_creation__proc_creation_win_sysinternals_adexplorer_execution.lucene,sha256=emQjqfSnhSbI7t7p10tuv16ejyCZr2p4C30v4-Kd1m8,280
src/rules/windows__process_creation__proc_creation_win_sysinternals_adexplorer_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_adexplorer_susp_execution.eql,sha256=DsA2T-1vwyLoIjeGr_3k-KaX9juIzwE3X_dJ265A0DQ,415
src/rules/windows__process_creation__proc_creation_win_sysinternals_eula_accepted.eql,sha256=FVHIlxdp2UoG48jPWfrjywRuGV0ihyOWLdXeXIkQE9s,134
src/rules/windows__process_creation__proc_creation_win_sysinternals_livekd_execution.eql,sha256=NkifNb4UsH2KHTodwSWs7itOYn_zCO0sXbXNCxonmjI,120
src/rules/windows__process_creation__proc_creation_win_sysinternals_livekd_kernel_memory_dump.eql,sha256=rlDTVp-sxeeg6jHQhLAMjh_5sWUnaMhdNg8w8Fz-o8c,205
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump.eql,sha256=FqlK0GKKN5qDmOaISFfv0pppGrk5-y60_zm2JUAvOUM,76
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump_evasion.eql,sha256=cvpdZGn-4dw47qWYzCRen_T90o4NcbVe905-LoRHTpo,295
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump_lsass.eql,sha256=Pp3TQNR1UbKTTIG3nfQEHTutcSH-AdrFcrmQ-q7nSao,353
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump_lsass.lucene,sha256=ZqOK1_E9oAhu0MDNOUBqeCRCW7q4NEIM_PhcgV6l3A0,350
src/rules/windows__process_creation__proc_creation_win_sysinternals_procdump_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_execution.eql,sha256=3un454UY6sH4Ewdu5DEX-C9rHuH7N-RiVQDsBcMkKOU,89
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_execution.lucene,sha256=JyfxTI8giIy5rdzgsSI6R4AuEPIsJoSogYX3_oCKOp8,75
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_paexec_escalate_system.eql,sha256=vN1O48_Ghaq_uNyVihgDiRHTWv_onQc1RXBI0Zh_rDQ,3775
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_paexec_escalate_system.lucene,sha256=FFcp63_cstH7U7iF7us1NKKUYg51ISDndvhOjGoLYho,4291
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_paexec_escalate_system.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexec_remote_execution.eql,sha256=JxD1R5BZ3qeNOBhVpZP3y549H45daslUVIMpeInehAs,218
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc.eql,sha256=4blUZjxDsJdlFJKTGZqt8x4-sYaCLO2DNolcyZpfV9U,105
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc.lucene,sha256=fLG_LHkBt6UfqR13M2CUolrjHGy6XZj-BahwkvDK06E,92
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc_as_system.eql,sha256=vUrkmxbrM6smGO3WvOR1i8RRCvQOHIbnar0mt20Ll8U,112
src/rules/windows__process_creation__proc_creation_win_sysinternals_psexesvc_as_system.lucene.err,sha256=0-bKl361-nFbZoYXZ_ysWNysKMsKTsDTDBpJIGW9Slg,2466
src/rules/windows__process_creation__proc_creation_win_sysinternals_psloglist.eql,sha256=txtda2w82SgIcIquPrGcAjIEgUK2AkhOQUMB-LKd9eY,624
src/rules/windows__process_creation__proc_creation_win_sysinternals_psservice.eql,sha256=YOWYz25tZDO43QZ-S5cXE17Fx_hmhrkYSKHYweA9C5k,129
src/rules/windows__process_creation__proc_creation_win_sysinternals_pssuspend_execution.eql,sha256=bO_VEJODKn4eXkl8pdbf_CKPAl-wEQgkpBSeB-ZKdDE,129
src/rules/windows__process_creation__proc_creation_win_sysinternals_pssuspend_susp_execution.eql,sha256=Ok_1XUEZ0tGGaAOHG1toaeO_XaRDVg1SIwzMs7pCMnE,172
src/rules/windows__process_creation__proc_creation_win_sysinternals_sdelete.eql,sha256=kzcFQs4tIQALXRKpeBYqfMFnwhytutNEjtwLG6dPask,131
src/rules/windows__process_creation__proc_creation_win_sysinternals_sdelete.lucene,sha256=NDoTuodE6qKHOmLCodjehUXzCZ46wHxA6djwEFxMnBk,119
src/rules/windows__process_creation__proc_creation_win_sysinternals_sdelete.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_susp_psexec_paexec_flags.eql,sha256=DDM6ZNezq18mNlWe30Js5eCrtbihOB_e3pvJzhvssMA,3781
src/rules/windows__process_creation__proc_creation_win_sysinternals_susp_psexec_paexec_flags.lucene,sha256=FsWg5-13rxxBu4LFIDzmsOl-bws9ZdB46nH_eN9vkIA,4297
src/rules/windows__process_creation__proc_creation_win_sysinternals_susp_psexec_paexec_flags.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_sysmon_config_update.eql,sha256=I8e_mkcIJRCatFpMIFIrqsiBjM2gWysNP1mu2ClX-X4,206
src/rules/windows__process_creation__proc_creation_win_sysinternals_sysmon_uninstall.eql,sha256=NktfULOApI1ems5q0zWZjAdKJ6qOXxk9cCrTRWxiZCs,206
src/rules/windows__process_creation__proc_creation_win_sysinternals_sysmon_uninstall.lucene,sha256=znr4_5PUosFkDNtUO97u7VwJuuZ5uBd5gpAklmxYDTE,182
src/rules/windows__process_creation__proc_creation_win_sysinternals_sysmon_uninstall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysinternals_tools_masquerading.eql,sha256=hlbz9BEL2T2Q2zqs6mB-m8_4Tp7ZQRscnyap5NpVN78,4379
src/rules/windows__process_creation__proc_creation_win_sysinternals_tools_masquerading.lucene,sha256=e5YZE8rpYuiMe36U3ae7KfLSilrXy0jYRAtzHW-RMtk,4352
src/rules/windows__process_creation__proc_creation_win_sysinternals_tools_masquerading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_sysprep_appdata.eql,sha256=UJ-JMOvq2kZTGMHu8lruN8rkZWRLa2qjbxRj1_NbsJ0,86
src/rules/windows__process_creation__proc_creation_win_systeminfo_execution.eql,sha256=zHHRtCddrfsykhGn0t6JucMTHuGEnOLs5TvHB8Pq0tI,96
src/rules/windows__process_creation__proc_creation_win_systeminfo_execution.lucene,sha256=Ep9YUFJUyJ2owUuXeI2zafHDUmrz0Dctkl2ShSGI8iU,82
src/rules/windows__process_creation__proc_creation_win_systeminfo_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_systemsettingsadminflows_turn_on_dev_features.eql,sha256=jV_78y5pX2aVIJhc4cJfgWS2xfpk6RH6v58wt7k__cI,260
src/rules/windows__process_creation__proc_creation_win_systemsettingsadminflows_turn_on_dev_features.lucene,sha256=RGYK3YwUQ60o5ZvGrXfC97_GYlhLuRnD-rEEYQSxOhQ,236
src/rules/windows__process_creation__proc_creation_win_systemsettingsadminflows_turn_on_dev_features.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_takeown_recursive_own.eql,sha256=H2Yb-mLLIhy1Kd7mMA_lldARRs7_sjP6PLYu3rdjhVU,113
src/rules/windows__process_creation__proc_creation_win_tapinstall_execution.eql,sha256=jARSpGY7AgPs4L0iTuxhZr3KvkxJ_6rEg8QssHweJh8,376
src/rules/windows__process_creation__proc_creation_win_tapinstall_execution.lucene,sha256=csiMQAZ7HQxXgoDcFxH0D1kOV1Hpx12B_SiHDOUYX4g,372
src/rules/windows__process_creation__proc_creation_win_tapinstall_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_tar_compression.eql,sha256=ysNV31sGgLEzPt8vyChXi7Uqv0raFn-Q8z2nPQvw-ss,144
src/rules/windows__process_creation__proc_creation_win_tar_extraction.eql,sha256=aMvGNtF_uMUXlGQXn889Rq8BRB-l13xGEeJA9kVr_rg,118
src/rules/windows__process_creation__proc_creation_win_taskkill_sep.eql,sha256=cVEIjK0hpp3h1NOSnKD1HtOWakgSCwYLGc0iYYE60OE,155
src/rules/windows__process_creation__proc_creation_win_tasklist_module_enumeration.eql,sha256=-W9rl0CPyZrkxk5MQj6Ksda8m9G0KNOaYgcqqLUklRo,218
src/rules/windows__process_creation__proc_creation_win_taskmgr_localsystem.eql,sha256=rsimz7Je2CMZhZ4DbIc1jrFV7egu7sCsWFrg7BhkYiY,94
src/rules/windows__process_creation__proc_creation_win_taskmgr_localsystem.lucene,sha256=Vgd-8ZPZSATRdsKfez1_94uDe1DJpB6iGUnnT77FA-c,74
src/rules/windows__process_creation__proc_creation_win_taskmgr_localsystem.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_taskmgr_susp_child_process.eql,sha256=sQJzOsrOmXKm7OHrzBhjSXfMbKxZRVE2xzjS3Q-KYNU,200
src/rules/windows__process_creation__proc_creation_win_teams_suspicious_command_line_cred_access.eql,sha256=CDNQv6A4r3bkRFZvH_EL1zid9sOKVUPXfNG9sCNHPc4,192
src/rules/windows__process_creation__proc_creation_win_tpmvscmgr_add_virtual_smartcard.eql,sha256=2Oifu8GMkuzkCUCMQeJH74Fnij5B4M_5uRTPUu3rGho,136
src/rules/windows__process_creation__proc_creation_win_tpmvscmgr_add_virtual_smartcard.lucene,sha256=8-Os3We3WKu-2dvB9EF-jPK4pJ9mT3ruJN49qZMZlIg,120
src/rules/windows__process_creation__proc_creation_win_tpmvscmgr_add_virtual_smartcard.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_tscon_localsystem.eql,sha256=JpQyuAunEWzEYU6A833xmP2dvNhX1IktiXY3T36NRzQ,92
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_redirect.eql,sha256=Dv4NUBhbQGqNH8Q0GKUqB-KV6A-fMN2a1s-GZSAtarg,51
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_redirect.lucene,sha256=_g-kiF33RrfvCy3IK5fsWsCC3QpNYKnfnXMa0YQe33s,43
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_redirect.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_session_hijacking.eql,sha256=SJettKcI2T9_bod_j67EpTyFS_JIclkS4osE9NP0NsM,163
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_session_hijacking.lucene,sha256=ZCG1aXgFUjWbhH9rvtmaDCWUs10vJzOAPAMmLMgQeJQ,144
src/rules/windows__process_creation__proc_creation_win_tscon_rdp_session_hijacking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_changepk_slui.eql,sha256=YG_qXk969-YRYFzSYAcr1ekIlH3g0Bg-kxdvu7tHQTs,187
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cleanmgr.eql,sha256=izBQ4vsxAo2az_HyhVZJNB1NaJXgojMiCOxMGvBVQEw,269
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cmstp.eql,sha256=OMgJE3bFPNetbWwSyWbqLObFs1SwFZKKHTK2Nz9ZO5M,177
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cmstp_com_object_access.eql,sha256=WOlPzZ2luDwO1xnPijcn-ul4KzN44clg1gH11OIKK6Y,470
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cmstp_com_object_access.lucene,sha256=FWXdUC6H7S9Ql6_BcSCohj4D32dTakw830EmG0GpvDE,493
src/rules/windows__process_creation__proc_creation_win_uac_bypass_cmstp_com_object_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_computerdefaults.eql,sha256=2tBDX4eEuXA_8rfXLhupiWTLc-veQvlHZQnHyHjYmKo,266
src/rules/windows__process_creation__proc_creation_win_uac_bypass_consent_comctl32.eql,sha256=gXyhcevIMekFe6RF6fxToWcUAWSWBKow8WCLTg5R-hg,190
src/rules/windows__process_creation__proc_creation_win_uac_bypass_consent_comctl32.lucene,sha256=fIpLjxBO0CyrqOpRlKJ_JHVWxVDtOg6zkr92-Fe4geE,174
src/rules/windows__process_creation__proc_creation_win_uac_bypass_consent_comctl32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_dismhost.eql,sha256=qQs861pOcfsfENiq5JmaHfIDEULIAA4DyItKforCQ00,256
src/rules/windows__process_creation__proc_creation_win_uac_bypass_dismhost.lucene,sha256=D3BqNfLYbEU3SJEBBAgqkOEFo0CXVjosMl5RYq84Tug,239
src/rules/windows__process_creation__proc_creation_win_uac_bypass_dismhost.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_eventvwr_recentviews.eql,sha256=ZHwqTLEK3-eyzsNejTVX22JcfWFXk9eTAgDSXnZwHwI,133
src/rules/windows__process_creation__proc_creation_win_uac_bypass_eventvwr_recentviews.lucene,sha256=4AOfiiDmLNMzyPZlnzdbKbL1e51d10ZqpD8mbW_T9Xs,116
src/rules/windows__process_creation__proc_creation_win_uac_bypass_eventvwr_recentviews.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_fodhelper.eql,sha256=v0YQt89sAkXhASURBaYImnsXLbPbZeZCPuMC8H90OZE,55
src/rules/windows__process_creation__proc_creation_win_uac_bypass_fodhelper.lucene,sha256=L5vMDEnb6ISQLvoBmq9cVeHt1MSKCD5ApzmNfjMaenM,43
src/rules/windows__process_creation__proc_creation_win_uac_bypass_fodhelper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_hijacking_firwall_snap_in.eql,sha256=IAW3cJwsjDYBoAWezznT65qUNZb0Q4AAJHhQYKFnXVc,141
src/rules/windows__process_creation__proc_creation_win_uac_bypass_hijacking_firwall_snap_in.lucene,sha256=v5dhaTW8_OsC3EtNfiUHxfGoU4rRavgB25hUgLr5_Cw,125
src/rules/windows__process_creation__proc_creation_win_uac_bypass_hijacking_firwall_snap_in.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_icmluautil.eql,sha256=hj8ISi5L9s4QBm9WNoTx65TS-f10DZGrxExcrypbVUg,303
src/rules/windows__process_creation__proc_creation_win_uac_bypass_idiagnostic_profile.eql,sha256=sbnYqBC02vUb_FQrieeKBOP4wPdRdfV9sncSwLDQyIA,236
src/rules/windows__process_creation__proc_creation_win_uac_bypass_idiagnostic_profile.lucene,sha256=srQTDI-jAMI3H5yed4inLiLY8LhiB-L35H4P1jlhBJE,229
src/rules/windows__process_creation__proc_creation_win_uac_bypass_idiagnostic_profile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_ieinstal.eql,sha256=u24drb0Ac7-eXL1K_Pt4F9kkfBA45Q-wsH6p26d93K4,239
src/rules/windows__process_creation__proc_creation_win_uac_bypass_msconfig_gui.eql,sha256=1B2rqkHJoNdw7KxzF6hdXINiLiQ5-jZk6DsU8Sgze1g,240
src/rules/windows__process_creation__proc_creation_win_uac_bypass_msconfig_gui.lucene,sha256=onHN6aL07gMwvnYQs-EQs0MstW6C8zDWk6cMZfu9iOk,227
src/rules/windows__process_creation__proc_creation_win_uac_bypass_msconfig_gui.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_ntfs_reparse_point.eql,sha256=_dq3I9IKSsup7KBigREfMgcUP9LesYTxT-QMquwJS9I,665
src/rules/windows__process_creation__proc_creation_win_uac_bypass_ntfs_reparse_point.lucene,sha256=aF0Rc-CS3r_WiVnD9pxPln37MHIh75B3bSx-FzSE52M,656
src/rules/windows__process_creation__proc_creation_win_uac_bypass_ntfs_reparse_point.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_pkgmgr_dism.eql,sha256=JPS3UyKtYH5CJHKWYnn-24uKmmKRBfMtjy85hJN8EvA,185
src/rules/windows__process_creation__proc_creation_win_uac_bypass_sdclt.eql,sha256=rBRrkJ2gExVgoBfrDgDTptiQDW4GjvijOdfTqHtOeP8,112
src/rules/windows__process_creation__proc_creation_win_uac_bypass_trustedpath.eql,sha256=q1oUuyp4H_lKMh7wCSFaSMttyu08j4v39QNBuoHZOe4,94
src/rules/windows__process_creation__proc_creation_win_uac_bypass_winsat.eql,sha256=c__OiQJj_aWNfHe_PogDVKwfVgb2bjoSpH_ro2xeP3w,251
src/rules/windows__process_creation__proc_creation_win_uac_bypass_winsat.lucene,sha256=VT0r_EJBLR6I6HIVdN8V15F4mvJDkfrObc_HemYlVRg,237
src/rules/windows__process_creation__proc_creation_win_uac_bypass_winsat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wmp.eql,sha256=JQa_jiNNKCsIkIwntPMuAkzLoJvLKCdx9eJtx5lHq0c,347
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wmp.lucene,sha256=xK3Xkl2ciA_VQVgNOTETeX05b9t-mF_q8sCmp0DCijw,339
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wsreset.eql,sha256=xoh8SdWObWvZCX3Jfa-rkpiOcCaD794hG3hjkoajUDc,148
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wsreset_integrity_level.eql,sha256=vPbnf51m34Z7oXtVE3oNJKiuULVWD9roFWWHb3bDp9M,142
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wsreset_integrity_level.lucene,sha256=EKlfp2Q_IzZJpPDEnnsmJGwoCGfcAtnOWKM5-NDbV98,128
src/rules/windows__process_creation__proc_creation_win_uac_bypass_wsreset_integrity_level.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_ultravnc.eql,sha256=1xqJmEriVeQfOjoTDYBwRqPyjHqt78vAMwxf9fyNiZ4,170
src/rules/windows__process_creation__proc_creation_win_ultravnc_susp_execution.eql,sha256=Yw15SUyObWTnmMGOZQ-J8cgweQaYf2YD6Wtc99CA-Fc,124
src/rules/windows__process_creation__proc_creation_win_uninstall_crowdstrike_falcon.eql,sha256=k0bJY4cnE1cGIJ5MCE5UqTqbfSu6-0mx1FHiFNa0IrQ,133
src/rules/windows__process_creation__proc_creation_win_userinit_uncommon_child_processes.eql,sha256=B9yhpdBaCaE_MKxJcXCcZ9T7WVyTZ9YJoBXSuqYuT40,765
src/rules/windows__process_creation__proc_creation_win_vaultcmd_list_creds.eql,sha256=e_wBRZRcMN3He_xHlK6z3R_Z3AXvBK1fAzvoPuUIJRk,138
src/rules/windows__process_creation__proc_creation_win_vbscript_registry_modification.eql,sha256=ObkAEqAjMvMycfyuLfPSE63bmnMQ6J-DyRDLBepE4cI,130
src/rules/windows__process_creation__proc_creation_win_verclsid_runs_com.eql,sha256=_tlaqLjCYh0wTfGmOmYp8DYbwX-XCG7XWPYpOaqdTFU,337
src/rules/windows__process_creation__proc_creation_win_verclsid_runs_com.lucene,sha256=OZ2_5_gZsBVRDpM1oTmMHiIPcvPB2iysJMUVLrBj41U,327
src/rules/windows__process_creation__proc_creation_win_verclsid_runs_com.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_virtualbox_execution.eql,sha256=EuJ0CU0Yy2HfPxCpDENb_z3_NGaYl3Z29aCj-dTNTHQ,158
src/rules/windows__process_creation__proc_creation_win_virtualbox_vboxdrvinst_execution.eql,sha256=kNm4Dsjs3M3_qMCp0r7kloWERot4XZVgn1TRq3MiDLg,128
src/rules/windows__process_creation__proc_creation_win_vmware_toolbox_cmd_persistence.eql,sha256=VuhXgFIbJ7PKKITJNRAxuBaheITAjR3pXlQqXa79U6Y,183
src/rules/windows__process_creation__proc_creation_win_vmware_toolbox_cmd_persistence_susp.eql,sha256=LdNVeOCZHrQi1_scHzuZh_MD1i6Ud9O-Oxf-2rwNbRo,358
src/rules/windows__process_creation__proc_creation_win_vmware_vmtoolsd_susp_child_process.eql,sha256=ClXbCLVoqIaqVqBOu4ubkJEqJh093nRg1xlLYIB9hLs,855
src/rules/windows__process_creation__proc_creation_win_vmware_vmtoolsd_susp_child_process.lucene,sha256=cvJfCdDw-pk5Rk-yGyrEo-O362cp3jAVt3i_KphCoWo,827
src/rules/windows__process_creation__proc_creation_win_vmware_vmtoolsd_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_vscode_child_processes_anomalies.eql,sha256=TS9DcNVKv9uavKEcuxWzqGMO6S6ITVoYs7lVBBQWilA,517
src/rules/windows__process_creation__proc_creation_win_vscode_tunnel_execution.eql,sha256=F5DMtm88ecl9ZpZbmNCFfRQFlm7MTaImWDAsbku70x0,445
src/rules/windows__process_creation__proc_creation_win_vscode_tunnel_remote_shell_.eql,sha256=cpDf5WO4H8K-8bWfPJbim3Scm_ueu2Op7GJrgAnZgYw,374
src/rules/windows__process_creation__proc_creation_win_vscode_tunnel_renamed_execution.eql,sha256=JVSWcew59Uod2LXUwk2KAU5blXofWVB2u1F4klL-VMA,773
src/rules/windows__process_creation__proc_creation_win_vscode_tunnel_service_install.eql,sha256=C8V9l2DFZbzkKKx_GjP38bDFFTKmDceOHchkdOGj4I8,170
src/rules/windows__process_creation__proc_creation_win_vsdiagnostics_execution_proxy.eql,sha256=johjMEF8eL9iSljKAI-tqp85coR1N5VFv1nDA-Lqpi0,206
src/rules/windows__process_creation__proc_creation_win_vshadow_exec.eql,sha256=38-ewg32n7TfkO83po6DB4vRpi4RCL1Tbhsi9dqLdVU,130
src/rules/windows__process_creation__proc_creation_win_vslsagent_agentextensionpath_load.eql,sha256=4mR1E8vs1L-SPkPG9MVV58NYSVqhruvV2Zh13DgFA5g,176
src/rules/windows__process_creation__proc_creation_win_w32tm.eql,sha256=Aq-AMgbSRia7sEuAIneOD9Ikh6Z9R-R6VoG_8fRkDMk,292
src/rules/windows__process_creation__proc_creation_win_w32tm.lucene,sha256=_eusLAjgRWgZn037LuX-VQQI0m3BddX9zwZGViRXDQA,276
src/rules/windows__process_creation__proc_creation_win_w32tm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wab_execution_from_non_default_location.eql,sha256=ZSQL0jM4bmbA8M5XQ-AcI85HarupvTJVrpwZUPvqXAE,212
src/rules/windows__process_creation__proc_creation_win_wab_unusual_parents.eql,sha256=uez0AD232eBxLv3u_P1Bv_7f3yJLgimq6Ksmh2T539s,234
src/rules/windows__process_creation__proc_creation_win_wbadmin_delete_all_backups.eql,sha256=qnp8A5Wf00ulrsMX5sOrQPCLcxvN3qdt8VJw2jhw3iY,215
src/rules/windows__process_creation__proc_creation_win_wbadmin_delete_all_backups.lucene,sha256=_iLhps_ehuwSzBnvZmf9naAy4qPZj6keNlcaDZudY3s,196
src/rules/windows__process_creation__proc_creation_win_wbadmin_delete_all_backups.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wbadmin_delete_backups.eql,sha256=Eg5Q-0Y6HCDGTS8k1jj7Av58SjFX21ff-1S5qIBDqyk,222
src/rules/windows__process_creation__proc_creation_win_wbadmin_dump_sensitive_files.eql,sha256=tuFTUzowYFHGAzwNeuZ2bM2VQkTMFmLVcusSPRSkeEQ,282
src/rules/windows__process_creation__proc_creation_win_wbadmin_restore_file.eql,sha256=Ge57Ch_HW-MIy1jJpdablKuYZvbqdc2aV-9ggwy_VTU,223
src/rules/windows__process_creation__proc_creation_win_wbadmin_restore_sensitive_files.eql,sha256=jb493MV94RZEHVmnNbu7guKw_xNkDFAfFf2on3NT8eg,355
src/rules/windows__process_creation__proc_creation_win_webdav_lnk_execution.eql,sha256=X4qnSH9EuU2JpBnQi47Ed4r2SBDhxhnLckW3IYEgrdY,231
src/rules/windows__process_creation__proc_creation_win_webdav_lnk_execution.lucene,sha256=ib0dQQGkEzaY6BM7aKDfOwUt5iVqo5JAaTUJFD4Xv64,209
src/rules/windows__process_creation__proc_creation_win_webdav_lnk_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_webshell_chopper.eql,sha256=wK-EYMRyDhbqBPlqM3X0IWyczSUFYpwwzByuRX5qSdk,250
src/rules/windows__process_creation__proc_creation_win_webshell_hacking.eql,sha256=fBsUOsismsgjxdHyZXclkBtjioE3yRR8eu2ZI1OrADg,1293
src/rules/windows__process_creation__proc_creation_win_webshell_recon_commands_and_processes.eql,sha256=1sDEVm4aUxRshmTdqVxHhAlDWrkboymsZAiLvYLtgaw,1669
src/rules/windows__process_creation__proc_creation_win_webshell_susp_process_spawned_from_webserver.eql,sha256=8G4sEs9CADn5docGh8rnSaBEPFbijqcgRBDzcuB5ZDw,1385
src/rules/windows__process_creation__proc_creation_win_webshell_tool_recon.eql,sha256=ecOPJCQHoiaW8O5QkLw1duHXE5fDw-H7Mg0Vk9UAm3c,586
src/rules/windows__process_creation__proc_creation_win_werfault_lsass_shtinkering.eql,sha256=lNZupOXo5TmOl0vSKft1XAR4_Xx0yc088ZpUIxG_dy8,395
src/rules/windows__process_creation__proc_creation_win_werfault_reflect_debugger_exec.eql,sha256=XfjpPuIpRcte-dWt_1NTukpqxMiRRdwf5XF_C6hDxfg,132
src/rules/windows__process_creation__proc_creation_win_werfaultsecure_abuse.eql,sha256=n1-_xpg3_vfHwDlBTuojIJXbUGSBMUsuOcVFMJwN_wI,370
src/rules/windows__process_creation__proc_creation_win_wermgr_susp_child_process.eql,sha256=zF8UmZv7xwBoMqtcsiFsIIN0d-xRPrkZ1DgivkrB6wE,610
src/rules/windows__process_creation__proc_creation_win_wermgr_susp_exec_location.eql,sha256=jqbcJ33fhofGaNd-m_VDNIWBmiVrnbMg7nED8sGWmis,162
src/rules/windows__process_creation__proc_creation_win_wget_download_direct_ip.eql,sha256=ZE51QZQrfDlCAykVYmlJSS4W6CuDtvDwElWBwyl-FTc,731
src/rules/windows__process_creation__proc_creation_win_wget_download_susp_file_sharing_domains.eql,sha256=uN9N4CfRGl21UR2DrxJo_vWnjSbKOOYz2otYgG1bwC8,1218
src/rules/windows__process_creation__proc_creation_win_wget_download_susp_locations.eql,sha256=AiNfD7TAcAsqWBdPaD_ZxRsha8GsNHi_jwAGKKTuG_o,884
src/rules/windows__process_creation__proc_creation_win_where_browser_data_recon.eql,sha256=-eZKIB7ue4QG1CnEUtmnyQZCqm6KK6x5SrqeOaIiRa4,314
src/rules/windows__process_creation__proc_creation_win_where_browser_data_recon.lucene,sha256=Ftk8W59gT93HuXYnuu08ITbg3-sxRjon8jvCgS_ZRow,293
src/rules/windows__process_creation__proc_creation_win_where_browser_data_recon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_whoami_all_execution.eql,sha256=Qe9dqnhDGOUUp8trio4fELjTeHQDvlai7Gxs4V0Czus,186
src/rules/windows__process_creation__proc_creation_win_whoami_execution_from_high_priv_process.eql,sha256=bIU-47uB104QzbyXfhK6rC7FOzUiXsOj104_iZ8nExY,163
src/rules/windows__process_creation__proc_creation_win_whoami_execution_from_high_priv_process.lucene,sha256=v8JOk1yDb5noidnczdxdhUIvb4777dJoSIp_7NYv3_g,141
src/rules/windows__process_creation__proc_creation_win_whoami_execution_from_high_priv_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_whoami_groups_discovery.eql,sha256=BR4iOW1H15OI1Da16NJcXHtx6LbtDkPZk-fpFwB3Moc,155
src/rules/windows__process_creation__proc_creation_win_whoami_output.eql,sha256=q9gARncawri8u3K6pGmn1sGhVl1tmW5TYA-xUj6DEMU,194
src/rules/windows__process_creation__proc_creation_win_whoami_parent_anomaly.eql,sha256=2jwlRZnhKQ2C802Y-j1MzJB6k3m09nhAggirtuJk0gE,453
src/rules/windows__process_creation__proc_creation_win_whoami_priv_discovery.eql,sha256=RJRJCoqMXv__P18x69LMhGMEodVhoxjzZxw89bhWtW0,151
src/rules/windows__process_creation__proc_creation_win_windows_terminal_susp_children.eql,sha256=x3WwwxQ2xzhHhpXm9Bt_6DIt4KJqQzvv97VtrCQncao,956
src/rules/windows__process_creation__proc_creation_win_winget_add_custom_source.eql,sha256=VmZwse6gjaFDL2rG9Pv07yNJYOy0vm8elird6FT9YY0,166
src/rules/windows__process_creation__proc_creation_win_winget_add_custom_source.lucene,sha256=T-SxisRpSkDtrSDiehlDMUHxsSLEBR5O1ISs3NqvSCc,150
src/rules/windows__process_creation__proc_creation_win_winget_add_custom_source.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winget_add_insecure_custom_source.eql,sha256=FRZaQW07mHAgbi5gU3B5JPk4O5QyWScYbVu-1l3Iioo,203
src/rules/windows__process_creation__proc_creation_win_winget_add_susp_custom_source.eql,sha256=NI6eahC0Zo7OfG9XLfGWUmnyuWOOJfp4Ir0FE-jDyfY,299
src/rules/windows__process_creation__proc_creation_win_winget_local_install_via_manifest.eql,sha256=4833hG6s6s7MNUtSu3bLUs8_cGWF1q_QQrwh89Bz8RA,210
src/rules/windows__process_creation__proc_creation_win_winget_local_install_via_manifest.lucene,sha256=OF8w8burDr019KBFO44pKnVkHoELk_AFsaUbBtDNgmQ,186
src/rules/windows__process_creation__proc_creation_win_winget_local_install_via_manifest.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winrar_exfil_dmp_files.eql,sha256=YUEnnhgm_3LirIBx29qnaYqozyPtP778gBmimNq5Ubg,182
src/rules/windows__process_creation__proc_creation_win_winrar_exfil_dmp_files.lucene,sha256=UAbwzD5u8gYafnG4FcSy3UYK4l9K-czQp_SVjq4_YvM,156
src/rules/windows__process_creation__proc_creation_win_winrar_exfil_dmp_files.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winrar_susp_child_process.eql,sha256=f6kSM1oouRRDmOg8ZmBXIeVj1QLKA17_gwaU6QJQuzo,384
src/rules/windows__process_creation__proc_creation_win_winrar_susp_child_process.lucene,sha256=x_YTewnPxKQUlr74CV1ZF6B3lmj_Mtv7-DNMBpStKNo,356
src/rules/windows__process_creation__proc_creation_win_winrar_susp_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winrar_uncommon_folder_execution.eql,sha256=tH12mLTqmLGtPfcowTR-NLcjsasKI49ylm-0a2cYqBk,332
src/rules/windows__process_creation__proc_creation_win_winrm_awl_bypass.eql,sha256=Ey580b8PqzKyDAVJaUsVMhkJ2EksSP2-At-qf3W8Mrw,249
src/rules/windows__process_creation__proc_creation_win_winrm_awl_bypass.lucene,sha256=gjPLju3H9DiZZebh-Tffeog4d-toBjmiih4dwgyEyws,227
src/rules/windows__process_creation__proc_creation_win_winrm_awl_bypass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.eql,sha256=SzqxyPHTuXwstNZumRxf-2R3VJRUP_-W9RvemQ4NjAw,228
src/rules/windows__process_creation__proc_creation_win_winrm_remote_powershell_session_process.eql,sha256=P-Z1xcvRtRJlJBRxI9ODykrR7XyUD7hbt76qSjU4xjk,100
src/rules/windows__process_creation__proc_creation_win_winrm_susp_child_process.eql,sha256=HhWZeXkrW9zlbOt-YUi4q8Dv2zusFnObi3rHN5d9dwI,256
src/rules/windows__process_creation__proc_creation_win_winrs_local_command_execution.eql,sha256=VP1MHS0YmXhGAQ9U70y20gufSAEEwPFxc24jTkwns04,1177
src/rules/windows__process_creation__proc_creation_win_winrshost_command_execution.eql,sha256=IddIuLXeOt5M70MPIvt2A87SoIOqa4OCYYJaEoPE3zM,121
src/rules/windows__process_creation__proc_creation_win_winzip_password_compression.eql,sha256=rh-Y9LyjjwBDRVliH8WhBG299kT599grNrpEus2-I58,164
src/rules/windows__process_creation__proc_creation_win_wlrmdr_uncommon_child_process.eql,sha256=htEyOphClv4ZMeOErEcv0rw3gtywJ64-23hs8tUIBio,844
src/rules/windows__process_creation__proc_creation_win_wlrmdr_uncommon_child_process.lucene,sha256=Bo1NX261QtssONXTO1C3ceetOEP6Ljwf3jl2WN_1WNc,819
src/rules/windows__process_creation__proc_creation_win_wlrmdr_uncommon_child_process.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmi_backdoor_exchange_transport_agent.eql,sha256=Z6cAiP9LQZmDv0owXUKXi1mUMWw2G5yE1irxAafzA9Y,251
src/rules/windows__process_creation__proc_creation_win_wmi_password_never_expire.eql,sha256=4GSf5mIer4f38D5iZrAEFVFrw90LkSFAjTgK0h03CPA,247
src/rules/windows__process_creation__proc_creation_win_wmi_persistence_script_event_consumer.eql,sha256=1RxlX5uhkfuPHhJOuxYvN3GsoKdNb44zv_1He5qvd-Q,139
src/rules/windows__process_creation__proc_creation_win_wmic_eventconsumer_creation.eql,sha256=d-33SsOcxxS03STeQ5qnCsl1zlSeRa3ljjv79ZXTHS4,99
src/rules/windows__process_creation__proc_creation_win_wmic_eventconsumer_creation.lucene,sha256=LVS5JbgLv1P-5GiN6RkCFOdHAgLmydk2jcfoUe3LzTs,87
src/rules/windows__process_creation__proc_creation_win_wmic_eventconsumer_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_namespace_defender.eql,sha256=-NU_ilwwDjvcdqnumF3GsOcpigwZUUw5JKW_shnpu9k,166
src/rules/windows__process_creation__proc_creation_win_wmic_process_creation.eql,sha256=RzkdQrfw9qO17vrkfnYWlDn-N2qElZ17VpKUgrOJpLs,198
src/rules/windows__process_creation__proc_creation_win_wmic_recon_computersystem.eql,sha256=rDz7JZVtAi7eGIOq_huQZVhRHfa8dBXdM0AAbR_bJCE,133
src/rules/windows__process_creation__proc_creation_win_wmic_recon_csproduct.eql,sha256=1DzSmUiV6I0YtFVK_Zh6exmJirkcYjYXLhkDomhYWOo,128
src/rules/windows__process_creation__proc_creation_win_wmic_recon_group.eql,sha256=qx2JdWUKMU5jUXPk4DMvmxsnwo8NrUWrbSIkyiYCZ5A,125
src/rules/windows__process_creation__proc_creation_win_wmic_recon_group.lucene,sha256=FUOyCMQoZJVnJ3534fxaUagAU-EnOLunAj1cPZqBrWE,110
src/rules/windows__process_creation__proc_creation_win_wmic_recon_group.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_recon_hotfix.eql,sha256=kGyY5fmTLH4eNsf8jZT6dj96FLlVuAwhPbsya-AgKMU,123
src/rules/windows__process_creation__proc_creation_win_wmic_recon_hotfix.lucene,sha256=TAiOK-dgAszr00Jehu7loXyue6XJyN3cAID2Bc9fGhk,108
src/rules/windows__process_creation__proc_creation_win_wmic_recon_hotfix.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_recon_process.eql,sha256=Qc6pWtGxEdk3dN_-FKCqo9XDxs983qh0nN09KDFqkiU,206
src/rules/windows__process_creation__proc_creation_win_wmic_recon_product.eql,sha256=N-Y-Kbs-TDpMYfQno3pEdFl3wlkdxDaS4Z9Ggia7aUo,198
src/rules/windows__process_creation__proc_creation_win_wmic_recon_product_class.eql,sha256=HJj7FtSRwmCS9KkLlvPkvrGH2vuF8JXD9RT2avAEKE8,190
src/rules/windows__process_creation__proc_creation_win_wmic_recon_service.eql,sha256=73xs4BcgNCtEiJC-LETKkLsTfLvFDXuNTAgyYdh_Hog,126
src/rules/windows__process_creation__proc_creation_win_wmic_recon_service.lucene,sha256=GJ4XokCNxqEDqEbIRLHgGV9Bqha6HEqdkxpZZpoUsok,110
src/rules/windows__process_creation__proc_creation_win_wmic_recon_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_recon_system_info_uncommon.eql,sha256=QJdDYmvNZVFc0NGtv946lEJrDqKwGrwpbYQLv9CQhys,259
src/rules/windows__process_creation__proc_creation_win_wmic_recon_system_info_uncommon.lucene,sha256=RxJ-ubTTTCViiSmX3zEYKEmihYd_FGs5cjZQe2zVJ5Q,241
src/rules/windows__process_creation__proc_creation_win_wmic_recon_system_info_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_recon_unquoted_service_search.eql,sha256=mS5DfyIRFec-vZLH6201pBoBxq8D70rk_3mqYid51RM,199
src/rules/windows__process_creation__proc_creation_win_wmic_recon_volume.eql,sha256=S0iZE0MCI2z_IPpSdfZ-AIQQUms-VzvsASdrTsTlRUM,316
src/rules/windows__process_creation__proc_creation_win_wmic_remote_execution.eql,sha256=Z3pz1okzw0Ijs3KxLUqwNljf2NyQQF9dZFgCX8Nl_uE,259
src/rules/windows__process_creation__proc_creation_win_wmic_remote_execution.lucene,sha256=qDa98wisxuA7uZTd-gJ1J7InwMmzRgWDyMN37TRzazM,236
src/rules/windows__process_creation__proc_creation_win_wmic_remote_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_service_manipulation.eql,sha256=gczIGbf16qyPMG8wptFOvJXD14OOQYLNrqCtOzvlrqo,237
src/rules/windows__process_creation__proc_creation_win_wmic_service_manipulation.lucene,sha256=MUijNz_w4SA7Pxty0de9QKph4VF6BFgqRw8UDWFAWbQ,215
src/rules/windows__process_creation__proc_creation_win_wmic_service_manipulation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_squiblytwo_bypass.eql,sha256=InU97aZfWMrUl38UqVfNfAzgltGgPaPvtrlekXgprbM,337
src/rules/windows__process_creation__proc_creation_win_wmic_stdregprov_reg_modification.eql,sha256=Drrg-bWUabJaNpKEm-lA5xXtg-tyZc2WNcUl-ke0QfU,165
src/rules/windows__process_creation__proc_creation_win_wmic_susp_execution_via_office_process.eql,sha256=zEXo_idbDKL_7s4gba3LZaxA5kMe_bXPyeksr9FndtY,549
src/rules/windows__process_creation__proc_creation_win_wmic_susp_process_creation.eql,sha256=PAh9cIA_YcON-VkYbp5o3FlOTPGcCFgCDQDvZj9WqNM,521
src/rules/windows__process_creation__proc_creation_win_wmic_susp_process_creation.lucene,sha256=UuvB4C7XoK_W1FXModoRgR9zRfYeSTnH9l7oF8FJjTQ,518
src/rules/windows__process_creation__proc_creation_win_wmic_susp_process_creation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_terminate_application.eql,sha256=3dyv1GeKvyf7qRCGhawF4ifBX5I3aMXqsoVKXm23P_o,164
src/rules/windows__process_creation__proc_creation_win_wmic_terminate_application.lucene,sha256=UpJP9TMntVFv2P6EEfOwBM85h7SEtm3Q3RWMEjH6jc0,146
src/rules/windows__process_creation__proc_creation_win_wmic_terminate_application.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wmic_uninstall_application.eql,sha256=OASN_nMM_cJ5uIJuOGhReYxvoA7UY7DbnVxSYD-J0D0,164
src/rules/windows__process_creation__proc_creation_win_wmic_uninstall_security_products.eql,sha256=QRtznDffj9U--q4T9HZIuL2J2e4e-VqJg_WTDCZMDMM,1316
src/rules/windows__process_creation__proc_creation_win_wmic_xsl_script_processing.eql,sha256=nNA1YuOK_EsK9DBtnnYU98kIDMI2VSPIHtk4obfPIds,345
src/rules/windows__process_creation__proc_creation_win_wmiprvse_spawning_process.eql,sha256=6ssQKp7ybrsTNwFTc-VUif-HlnKgtYb6K19Ukf6lXnM,325
src/rules/windows__process_creation__proc_creation_win_wmiprvse_spawns_powershell.eql,sha256=AINn51K9OlxSHO1-G6X_lB6Og-ZQGddhdzShAlT13iI,196
src/rules/windows__process_creation__proc_creation_win_wmiprvse_susp_child_processes.eql,sha256=fuZg6niN6-DiLe7L6wiYAOH9P1E8LzzHVA600vJ9e04,565
src/rules/windows__process_creation__proc_creation_win_wpbbin_potential_persistence.eql,sha256=ez2avFS7i3_D2kNar_cE8B-Rn8AytzxNUtJijqn4pEI,65
src/rules/windows__process_creation__proc_creation_win_wscript_cscript_dropper.eql,sha256=Zwmjcd_Iqw0sVgvUsugOAHGEzA2XzijbT3tHOo-ZDVc,303
src/rules/windows__process_creation__proc_creation_win_wscript_cscript_susp_child_processes.eql,sha256=qIaJaDSYUJS5PvKgZQEdBBxuw5mPSaz1t0-K74yasjU,518
src/rules/windows__process_creation__proc_creation_win_wscript_cscript_uncommon_extension_exec.eql,sha256=eoye99U1lMAemhUJkSzmTrCNw4QpqMWrJQchuSA3EdY,293
src/rules/windows__process_creation__proc_creation_win_wsl_child_processes_anomalies.eql,sha256=qK25JP3jYtwE3ADpCJR77XGITSnjCCFZbGXsQWtMN8Q,423
src/rules/windows__process_creation__proc_creation_win_wsl_kali_linux_installation.eql,sha256=Fd6_ZRoZbEPET7tgVOluqfI_y5xAPyUQe779EX8jXcg,178
src/rules/windows__process_creation__proc_creation_win_wsl_kali_linux_installation.lucene,sha256=xf3LgUX6rV-cepvpad4NvYsrGM68LIjWAVo4gflMEDs,161
src/rules/windows__process_creation__proc_creation_win_wsl_kali_linux_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wsl_kali_linux_usage.eql,sha256=ZBexeQHAwIe_TXwdV0bKiWWRBFwKw1QAjArPlrRWBak,643
src/rules/windows__process_creation__proc_creation_win_wsl_windows_binaries_execution.eql,sha256=F0sY7mznApBZZs23zQpPOavQhCIDUbQcB0Fu-dw6adc,156
src/rules/windows__process_creation__proc_creation_win_wsl_windows_binaries_execution.lucene,sha256=GZzTHbVJpW15dj04EHnCr6xaQPOMvysIZqdF4tis0bE,158
src/rules/windows__process_creation__proc_creation_win_wsl_windows_binaries_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wuauclt_dll_loading.eql,sha256=V5DiVGT2daluspyoCExkT4i1HroPXN64wzXWh3eaego,608
src/rules/windows__process_creation__proc_creation_win_wuauclt_dll_loading.lucene,sha256=pvEW9OXPbOz3-EzQyutxLOHSpBPhuXscC_54344NCJ0,590
src/rules/windows__process_creation__proc_creation_win_wuauclt_dll_loading.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wuauclt_no_cli_flags_execution.eql,sha256=xDghGdhYsuGc8mPGflru7vFhw3y3j0UugcFcyEgZjo0,157
src/rules/windows__process_creation__proc_creation_win_wuauclt_no_cli_flags_execution.lucene,sha256=oOd8MtyDX-8dgGA85j78gQG685QlWYRWb9BmRfeBhws,135
src/rules/windows__process_creation__proc_creation_win_wuauclt_no_cli_flags_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_creation__proc_creation_win_wusa_cab_files_extraction_from_susp_paths.eql,sha256=jr31Hvvs31U-cgR2g0XrrW9SiOe_WJOm0komPncyF2w,211
src/rules/windows__process_creation__proc_creation_win_wusa_susp_parent_execution.eql,sha256=NxCIzehUjmNXgWEYv3LlTCyOYTzyNyTXjCQkPszWZDA,612
src/rules/windows__process_creation__proc_creation_win_xwizard_execution_non_default_location.eql,sha256=WwW0sxcZAEcojM1tm6A_CDxlFyInw_Irznx4_lb9Ly8,212
src/rules/windows__process_creation__proc_creation_win_xwizard_runwizard_com_object_exec.eql,sha256=sQeQPQfejMSkMYq-sjSjjEai1slkTcWBBctnYoSmZxY,213
src/rules/windows__process_creation__proc_creation_win_xwizard_runwizard_com_object_exec.lucene,sha256=xMWXgTmc0ybAPH8krGgiaZwObXxQX5ahT_nJ2VP5zcc,251
src/rules/windows__process_creation__proc_creation_win_xwizard_runwizard_com_object_exec.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__process_tampering__proc_tampering_susp_process_hollowing.eql,sha256=-td8JmtpHRqXhPzhuGDoaLt0ZYoPLtjI9Ed4WbTQJHk,400
src/rules/windows__process_tampering__proc_tampering_susp_process_hollowing.lucene,sha256=ZGEe1ygi01AP8W0IFfp7w89Z9dNZ8lYMpcRcq8_n_z8,385
src/rules/windows__process_tampering__proc_tampering_susp_process_hollowing.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__raw_access_thread__raw_access_thread_susp_disk_access_using_uncommon_tools.eql,sha256=StLsf8HFni7iy9F3A7UPEPXHEFl3eydy68NIfIvIGsk,1465
src/rules/windows__registry__registry_add__registry_add_persistence_disk_cleanup_handler_entry.eql,sha256=hhBDL0LI4dVvVkab7Ks0FZe7G8sQBwLIM758ofdFhZg,1085
src/rules/windows__registry__registry_add__registry_add_persistence_disk_cleanup_handler_entry.lucene,sha256=a0xmnueuoneB6WuLqeGMHkiyx0MZhXLpNJhbg4h9AIQ,1128
src/rules/windows__registry__registry_add__registry_add_persistence_disk_cleanup_handler_entry.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_defender_context_menu.eql,sha256=h2fhTNMjg3nx58A1lBzkRwkB5cpuedaPeOn3rjz73gg,290
src/rules/windows__registry__registry_delete__registry_delete_defender_context_menu.lucene,sha256=SGxDUk-nGXBfjWiglnwugI7-kUZVsLEdqAvTs_tI128,279
src/rules/windows__registry__registry_delete__registry_delete_defender_context_menu.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_enable_windows_recall.eql,sha256=m7LieHU5T0CtgYDIHY44SpxM6I2cHpFUXLGiqBslpZA,128
src/rules/windows__registry__registry_delete__registry_delete_enable_windows_recall.lucene,sha256=bEyiEhCeuudXRQPoIbzl2ZgMyeU-YiSwHrcLI2h_DlQ,114
src/rules/windows__registry__registry_delete__registry_delete_enable_windows_recall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_exploit_guard_protected_folders.eql,sha256=1jYsCuEcBGyqifogeESPlAY0IDbq36pN8PAjG-GoHII,188
src/rules/windows__registry__registry_delete__registry_delete_exploit_guard_protected_folders.lucene,sha256=_4K8NciJjJf_0uAYWKoy28-LgXQ1wXPhjLS2MAeX18Y,180
src/rules/windows__registry__registry_delete__registry_delete_exploit_guard_protected_folders.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_mstsc_history_cleared.eql,sha256=2Hy6KVWogwsEdimNoFkGXxBqH6D9mhb2Gl-EQ4WU9Jg,239
src/rules/windows__registry__registry_delete__registry_delete_mstsc_history_cleared.lucene,sha256=7-W3wTL2JOEDvBo1ZKegEVRdoRLhsHC-CoA9zdsIBFs,225
src/rules/windows__registry__registry_delete__registry_delete_mstsc_history_cleared.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_removal_amsi_registry_key.eql,sha256=rxrb1-6ljLHoePEM4pjXfDzw1EtfkoeND1ulZtpyUdk,347
src/rules/windows__registry__registry_delete__registry_delete_removal_amsi_registry_key.lucene,sha256=wNMGdAhk0hOfK7-oMHI29rC5BCn3JOJsME005jggh98,342
src/rules/windows__registry__registry_delete__registry_delete_removal_amsi_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_removal_com_hijacking_registry_key.eql,sha256=kVmvLlIt2_qemWOPRvwOAd444lXmeoCSNP2FJPOI2sc,1904
src/rules/windows__registry__registry_delete__registry_delete_removal_com_hijacking_registry_key.lucene,sha256=fdbAnqO6tLLXtMu8vAh-sg2HHPdHyDSZZtAe0BLXBlE,1844
src/rules/windows__registry__registry_delete__registry_delete_removal_com_hijacking_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_runmru.eql,sha256=HSAoUzj7H3H7CnlXLXXfYdyo5MN3YTPAwcy6ZI_nR2M,92
src/rules/windows__registry__registry_delete__registry_delete_runmru.lucene,sha256=N6x0LVDE_snZKTvxEvPrmc1pevxHtRY7QN-0IB-sRoM,80
src/rules/windows__registry__registry_delete__registry_delete_runmru.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_index_value_removal.eql,sha256=kjL1Sf52vItB1mtYiqJjvhRTLI2o0c7lIO8dvn_uADw,134
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_index_value_removal.lucene,sha256=VeYeKgYi4FtqD_EuQrTzac84wWyvBbEtv3VI_so7IkU,121
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_index_value_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_sd_value_removal.eql,sha256=9QieZViu0WV8FqJQKU6TmeQmWokkvb81yuSvoWdIEe0,131
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_sd_value_removal.lucene,sha256=7mRhgT3HRoVoIZRQMd5NocUeXYThEDxzK9sADFR68Dg,118
src/rules/windows__registry__registry_delete__registry_delete_schtasks_hide_task_via_sd_value_removal.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_add_local_hidden_user.eql,sha256=rjMAfMBmeDaug5TgiKBPy1OKvIwjHMKxxCPp9KI-dXc,144
src/rules/windows__registry__registry_event__registry_event_add_local_hidden_user.lucene,sha256=Jgu0OLHPzk4jptLa7v25y2cdYJECcm31g5V7RYn0UaI,130
src/rules/windows__registry__registry_event__registry_event_add_local_hidden_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_bypass_via_wsreset.eql,sha256=NtAzKAghsStAwjLdfBeLqieqj5Lpp_EYRKJBWLSdmrY,88
src/rules/windows__registry__registry_event__registry_event_bypass_via_wsreset.lucene,sha256=Rqnh0ZE0ySkYAWHGeeuKrLGRv6SJm3hohGZrXMep7Nk,76
src/rules/windows__registry__registry_event__registry_event_bypass_via_wsreset.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_cmstp_execution_by_registry.eql,sha256=V6j7lWjzAobnFPpZP3hWjymfcA6a8WGi92oXMA7dXZM,42
src/rules/windows__registry__registry_event__registry_event_cmstp_execution_by_registry.lucene,sha256=VpnzZ6nlsn-2HmpOoyeMkuUeSpvcIQsdkwFpYth_tTE,30
src/rules/windows__registry__registry_event__registry_event_cmstp_execution_by_registry.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_defender_threat_action_modified.eql,sha256=NuZyY2ZgK4wgMwqPh8_konx6T6S6VYfoqoc4HrVECeM,239
src/rules/windows__registry__registry_event__registry_event_defender_threat_action_modified.lucene,sha256=5dxcq1YsdnaKPkKL6iUNEzJF5rdjOF4NvQxXCAaEu-c,218
src/rules/windows__registry__registry_event__registry_event_defender_threat_action_modified.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_disable_security_events_logging_adding_reg_key_minint.eql,sha256=c6uzYcSF1QAMeTLdhzMvXviAkxTpBdM8CkbCuIzwt80,201
src/rules/windows__registry__registry_event__registry_event_disable_security_events_logging_adding_reg_key_minint.lucene,sha256=777O0z0Bz9yzN1EnLQhJDtALRywvFZylijr1zQ8uMVs,185
src/rules/windows__registry__registry_event__registry_event_disable_security_events_logging_adding_reg_key_minint.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_disable_wdigest_credential_guard.eql,sha256=D4rl6z20SN8GckIcKKTw_njJiLPtYzkTcxca5sVew0g,48
src/rules/windows__registry__registry_event__registry_event_disable_wdigest_credential_guard.lucene,sha256=xDFi0SFo6LmuvVRRlsji9ShHEFYD7dpExPYw0DMMNPE,36
src/rules/windows__registry__registry_event__registry_event_disable_wdigest_credential_guard.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_esentutl_volume_shadow_copy_service_keys.eql,sha256=nMdIT03jzIxcdVwCbm2H6dk3Q5fqGsapBit19mMv6x4,186
src/rules/windows__registry__registry_event__registry_event_esentutl_volume_shadow_copy_service_keys.lucene,sha256=rJTgyPg2jLNnLYgsNw65k2k9x5P3B7tYZK6rIXawkHs,170
src/rules/windows__registry__registry_event__registry_event_esentutl_volume_shadow_copy_service_keys.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_hack_wce_reg.eql,sha256=JQ6qHkhsgEXcTMuixCJa_C1P29BDMhhs3bDg4VaO6d0,56
src/rules/windows__registry__registry_event__registry_event_hack_wce_reg.lucene,sha256=J_0uCgi6n6AVgHvWzXw-qlBkgP2Mv9AZt6VaM6idr90,44
src/rules/windows__registry__registry_event__registry_event_hack_wce_reg.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_hybridconnectionmgr_svc_installation.eql,sha256=Dk3VxmX0ChAFk_brraWVUfitTq7rnjKb8hXCOU2J9jU,189
src/rules/windows__registry__registry_event__registry_event_hybridconnectionmgr_svc_installation.lucene,sha256=JdQfQYtkTNrOwFJ1lw5fLC7tXQcnI870Re0wQWFVRas,173
src/rules/windows__registry__registry_event__registry_event_hybridconnectionmgr_svc_installation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_mal_azorult.eql,sha256=BkZxqFhWmkodSxlbfFoHms2ttO4N3MuWVlL6_AAbpk8,121
src/rules/windows__registry__registry_event__registry_event_mal_azorult.lucene,sha256=wgGGAERMtwlhIZgXcZdejRzJu_QzO-EnwgDXd4a35kI,99
src/rules/windows__registry__registry_event__registry_event_mal_azorult.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_malware_qakbot_registry.eql,sha256=csM3tav1JaX0_fTRrZB_q7V5qurkZvHYa2YkCuJNE4g,56
src/rules/windows__registry__registry_event__registry_event_malware_qakbot_registry.lucene,sha256=_hDse9Sb42nAFE3b1TFJm8vpnHKVsbzOEv-vPSUolR8,44
src/rules/windows__registry__registry_event__registry_event_malware_qakbot_registry.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_modify_screensaver_binary_path.eql,sha256=YL-GCHK37ALM0-jExkZ6qN7hgtG3Kgo0mFzrbcRV1yU,142
src/rules/windows__registry__registry_event__registry_event_modify_screensaver_binary_path.lucene,sha256=NPgZ8WLHJpFjg2S-C040pYpJEeuzq1cY3hRDnUv_Z8Y,123
src/rules/windows__registry__registry_event__registry_event_modify_screensaver_binary_path.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_narrator_feedback_persistance.eql,sha256=4A7z0UwKBBn4P_ZoYnjHbxfOWA0YjAanNcfjfYtNWSU,245
src/rules/windows__registry__registry_event__registry_event_narrator_feedback_persistance.lucene,sha256=8wlPycHw7tSYiByj0kV7whbIlziFR3GChR_fwKnpxIU,231
src/rules/windows__registry__registry_event__registry_event_narrator_feedback_persistance.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_net_ntlm_downgrade.eql,sha256=DZw3Bgo0_2835XjtH21YmAHgzeAV8jq_x-UQg3vdjTc,478
src/rules/windows__registry__registry_event__registry_event_net_ntlm_downgrade.lucene,sha256=vQOQYGlxXKLffZgVaChB5S8nPh97CVDYA_cDfRt5EiY,461
src/rules/windows__registry__registry_event__registry_event_net_ntlm_downgrade.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appcertdlls_registry_key.eql,sha256=GaXPSW1vFu5u_llPcW4qET3U_HRXPjBuNqIJUf0Szsc,198
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appcertdlls_registry_key.lucene,sha256=X8Zx2Kzln3zJRtF3vVrrCSP2mo14rtaaf5ZX9lgsEkg,186
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appcertdlls_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appinit_dlls_registry_key.eql,sha256=030k4T798e9N0GOxouZ6YLus2QEhUY29OgNYMIbhXpY,453
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appinit_dlls_registry_key.lucene,sha256=_vSwgNEPvEnAwKz-ux4VZ4_uY6lnWj93r08jJ-OhSbE,431
src/rules/windows__registry__registry_event__registry_event_new_dll_added_to_appinit_dlls_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_office_test_regadd.eql,sha256=8UWsDg9WbPh1FNfiU5SfYSYmh5HA_YdQufFwTrBy8fk,78
src/rules/windows__registry__registry_event__registry_event_office_test_regadd.lucene,sha256=dz8e19LerTtm9t4vedZiUqsogRrC1n_VXsELg0eGlZE,67
src/rules/windows__registry__registry_event__registry_event_office_test_regadd.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_office_trust_record_modification.eql,sha256=xsK6Sv5dElleL65EtP33gQwKtEmMa3MIzIGLdrgfCOs,72
src/rules/windows__registry__registry_event__registry_event_office_trust_record_modification.lucene,sha256=xQSFvyuq0VCU8PIhZiUe9CyqkiU0ql3EceDi4eTECs0,61
src/rules/windows__registry__registry_event__registry_event_office_trust_record_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_persistence_recycle_bin.eql,sha256=tZ7uV4dqKQ1e7UqYyKQs9KNIA9SIqLAAxQXhmCntS8g,294
src/rules/windows__registry__registry_event__registry_event_persistence_recycle_bin.lucene,sha256=01rnr3qxCi0yfY5aPeE2kI5rKRlOqZ7D-4o3ftR41Y8,290
src/rules/windows__registry__registry_event__registry_event_persistence_recycle_bin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_portproxy_registry_key.eql,sha256=4CAcYP1Xtac27b29zTPL1tnShl_VDIvlmeKrlwD-puo,64
src/rules/windows__registry__registry_event__registry_event_portproxy_registry_key.lucene,sha256=3Gi8VgPFBi8_cQhYJ1eRDEojaqAn4X7jADs0xehNi6s,52
src/rules/windows__registry__registry_event__registry_event_portproxy_registry_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_redmimicry_winnti_reg.eql,sha256=0acP-HeDIL4jj9TNI1qm-wLa3t1eEko3EXYY5Uv1_fs,70
src/rules/windows__registry__registry_event__registry_event_redmimicry_winnti_reg.lucene,sha256=z932umfZMvGEMgP13upgA1CvUIh8zp9aNMG7__8mCco,58
src/rules/windows__registry__registry_event__registry_event_redmimicry_winnti_reg.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_runkey_winekey.eql,sha256=fSnF1fBwPo9Osten3t1nZk5UWIejxM1WfSPVE7crvmI,89
src/rules/windows__registry__registry_event__registry_event_runkey_winekey.lucene,sha256=BY_q06ypOi4Li3UadOCfxlLDfpCGI_3VivucyvrtkTM,78
src/rules/windows__registry__registry_event__registry_event_runkey_winekey.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_runonce_persistence.eql,sha256=07db4R2ivleop8jnGDrwTdQCqtU2qm1g-_8CiQg_Cv0,619
src/rules/windows__registry__registry_event__registry_event_runonce_persistence.lucene,sha256=GIad5zbUJBF4MhbRLtLCF2sU0tfQnAcyZS3NSt85Ib8,635
src/rules/windows__registry__registry_event__registry_event_runonce_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_shell_open_keys_manipulation.eql,sha256=DtzuWy4HlYY6e4q0WlviCwJ6pzy2BiIlpyN6f4hC02E,502
src/rules/windows__registry__registry_event__registry_event_shell_open_keys_manipulation.lucene,sha256=LG58bXSJbgTVF9PuU3V5s0JbFMQVcEggToQ2dw4g9ms,482
src/rules/windows__registry__registry_event__registry_event_shell_open_keys_manipulation.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_silentprocessexit_lsass.eql,sha256=GcZIw8ZHQcb6l9KcttffchQfijFnLA5rBwmSbuWmkZQ,96
src/rules/windows__registry__registry_event__registry_event_silentprocessexit_lsass.lucene,sha256=1X8qhJDa8x6Fuak8AtxUfd_WY0-ftWtCkq_0a7G7UgE,85
src/rules/windows__registry__registry_event__registry_event_silentprocessexit_lsass.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_ssp_added_lsa_config.eql,sha256=5l0VwJie3y2Drp4w8yml4152ZEnhQT-7etSz2_PE6Y8,233
src/rules/windows__registry__registry_event__registry_event_ssp_added_lsa_config.lucene,sha256=BGCRWG9HQT_IKipZ5T5e0PikDMjrzkm3NHfuhTZmn-8,211
src/rules/windows__registry__registry_event__registry_event_ssp_added_lsa_config.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_stickykey_like_backdoor.eql,sha256=tWLMG0a5qrMLt_B-9K68kycrHx29b5JgMYXwosRUlTs,890
src/rules/windows__registry__registry_event__registry_event_stickykey_like_backdoor.lucene,sha256=Rd_lw1FiJzW13Zjs02954NQI_Fq3s6lfKphAaHmvYwY,904
src/rules/windows__registry__registry_event__registry_event_stickykey_like_backdoor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_atbroker_change.eql,sha256=7WJ4R2llR9nzKV8sXPg24yG7zb8vqp9FB8TIpn_OVek,537
src/rules/windows__registry__registry_event__registry_event_susp_atbroker_change.lucene,sha256=tZj0WwQ9ZHUXJ-kNYkEsLuPRUvLZcFUBLW3ZEGNZlf0,517
src/rules/windows__registry__registry_event__registry_event_susp_atbroker_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_download_run_key.eql,sha256=Eq4w36r66VzKvPjX9IK9JrBTe2UWBGJLy5G1jymI_dE,490
src/rules/windows__registry__registry_event__registry_event_susp_download_run_key.lucene,sha256=-GDOwF-J_A4TNCfqvVkPsF8E9QBmcCTkxHj_mf9O1HM,469
src/rules/windows__registry__registry_event__registry_event_susp_download_run_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_lsass_dll_load.eql,sha256=Ans5sULwDYu6pwCE0egDzDH-mvIpCtiS-ejuHj6byu4,333
src/rules/windows__registry__registry_event__registry_event_susp_lsass_dll_load.lucene,sha256=ZrzkpMkpHKxqJoosvEEuzt_HfX4_HNwwNX8uP4vVwdM,306
src/rules/windows__registry__registry_event__registry_event_susp_lsass_dll_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_mic_cam_access.eql,sha256=vRplP7G4yK8vAX07KKg8gsWmPttN9M2ud2Sx_2lbmBU,355
src/rules/windows__registry__registry_event__registry_event_susp_mic_cam_access.lucene,sha256=ECbk-8VkapUBFaPPFM7EeUvVjJp40Y625kGPI1j6FCM,331
src/rules/windows__registry__registry_event__registry_event_susp_mic_cam_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_event_susp_process_registry_modification.eql,sha256=6ahARYBBoye9NefKMNKxJPJxf9TcgOQQzijZYR6-X7Q,88
src/rules/windows__registry__registry_event__registry_event_susp_process_registry_modification.lucene,sha256=4cRQcPUi__SCd2-BQkwgycR1SOqi4MqOVbmuwtYX4Fg,70
src/rules/windows__registry__registry_event__registry_event_susp_process_registry_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_event__registry_set_enable_anonymous_connection.eql,sha256=4YrcoBslsg-etE7DIC5Cnkct8ZbS1WFuliJR05wPUfI,128
src/rules/windows__registry__registry_event__registry_set_enable_anonymous_connection.lucene,sha256=FRpGHQhHPEO9Ndbq3wXzJNW3qvEj86yn_iwC5bCgTcM,117
src/rules/windows__registry__registry_event__registry_set_enable_anonymous_connection.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_add_load_service_in_safe_mode.eql,sha256=qyf9YKGnM_ZHqieGm16e7-EyqvJd2TS-WF8HjvI9lyE,914
src/rules/windows__registry__registry_set__registry_set_add_load_service_in_safe_mode.lucene,sha256=woRcBl0m5mduIhgoCYDomRpKYdHII75y3c7pPPiJSmc,887
src/rules/windows__registry__registry_set__registry_set_add_load_service_in_safe_mode.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_add_port_monitor.eql,sha256=pgAyJjnOFCCPWif_3jVb3pxD5WM-_DA7g7HANjb0Y40,535
src/rules/windows__registry__registry_set__registry_set_add_port_monitor.lucene,sha256=MExA7d3nShAEflJO6ukofE36OntWhbpuachzOlkCYio,504
src/rules/windows__registry__registry_set__registry_set_add_port_monitor.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_aedebug_persistence.eql,sha256=G-PvUziSBGi7qBZUTZSI1odC1fIEZsFZmvW75AY4Mk0,242
src/rules/windows__registry__registry_set__registry_set_aedebug_persistence.lucene,sha256=oMNY8_uthBPMbJ3IA3-Xu0I5Twhxx6YMs1UVDfd2XIA,237
src/rules/windows__registry__registry_set__registry_set_aedebug_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_allow_rdp_remote_assistance_feature.eql,sha256=vx9jgT6qwt3HOM7Jt-QYtakpWFG45s2EFzUOFJLCmks,147
src/rules/windows__registry__registry_set__registry_set_allow_rdp_remote_assistance_feature.lucene,sha256=Lp2cvY2_cAlR6BwATE9dRx9WvYvbmImBZanW38SOOb4,137
src/rules/windows__registry__registry_set__registry_set_allow_rdp_remote_assistance_feature.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_amsi_com_hijack.eql,sha256=kkRckmQjsPlLcNCHdeQ-ABNxHFr068leGIho1KqTnn4,169
src/rules/windows__registry__registry_set__registry_set_amsi_com_hijack.lucene,sha256=NrCEIjwyCyphY3zs8k0a1lxMyXON2QocEoHbTmzyS2E,163
src/rules/windows__registry__registry_set__registry_set_amsi_com_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_classes.eql,sha256=2UTqQtP8uXNFXyl6ajTCsoHJo6FKaRVuJ5Ce3zj6Gv4,1153
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_classes.lucene,sha256=C9c-orl4WaexUJUqP5m4UbreqT0e12wcO3LvNZ0bpa4,1162
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_classes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_common.eql,sha256=QSJGrNVzQtSOEyKxFR2HAD74bu4aLE3WY1Vd_L2srss,2520
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_common.lucene,sha256=pLvTmyNumqrv5BVS-sgjyz78fTvyuC_8sk0RJByo614,2559
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_common.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentcontrolset.eql,sha256=e2DxINzm8-3f8WHOm0D6HBRU7-e10ukW7WNlc0V_E7g,1191
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentcontrolset.lucene,sha256=hcuH2POjzDJ4uuboT03rz5G27OioFERonx_6rAkEisE,1149
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentcontrolset.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion.eql,sha256=EK9B7nG_qvcyoZBkDE3kpFm0cfU1lbALgR10hQ28wnY,6974
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion.lucene,sha256=7xzPQdh-mm5M_ywrgQAh17WgmYR9XYfUQz3QAPjTfGc,7046
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion_nt.eql,sha256=WCmjf5vMQPkhXl7ctC6mqrSkuXrLbtZmsbgHjHHuFFQ,3054
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion_nt.lucene,sha256=Y62dFR_hW1P6znzdBBAVBRJp4WJT02HC3iOjcsFYXq4,3014
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_currentversion_nt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_internet_explorer.eql,sha256=Yj-2ySrlqjNwbqmPo4xKAhLYRvYsfokovKKlCKsZ_Lg,651
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_internet_explorer.lucene,sha256=8fRU5Jme-nAQQhkLDHl5f7CIxKStCJF0o2sCgMl_IHQ,636
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_internet_explorer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_office.eql,sha256=AnnxHzRRX6uXbFp5Cv23SpvVv6NVdLj_IkTXENl7sdo,2180
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_office.lucene,sha256=uWgGQZUMokJ7gWIgcuDZqdtswx9DJZXHolSgkvw7fuU,2137
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_office.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_session_manager.eql,sha256=rBXKwUnkBnd3xTWBlbOh1970RPZQv5ElTiBXFcGfVk8,269
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_session_manager.lucene,sha256=1ZH2H5No-upS8biQv7s5m7UYbuXtOWgu4coEPKFDu_4,250
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_session_manager.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_system_scripts.eql,sha256=kaZFy0joIsK4eJUIWGMy7IaW6m8P5gtijwF8I03_lTE,217
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_system_scripts.lucene,sha256=3IaBAaKjckJA9cWJvsF7lGPcXopN9B4Z4vWj77KEuFs,197
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_system_scripts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_winsock2.eql,sha256=AUS0U9T2TrQVduUUmrK09Ro3PgpbgePPHSW4xFAdecQ,366
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_winsock2.lucene,sha256=-hdrV_mjYtrUgsh09VH_l6Jx6Mx-pjPidqtGpFnzeU4,344
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_winsock2.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node.eql,sha256=qvPQKS79KkmKKlc31MVZoC6dH7ip7wrqMDet7bS3ESY,3894
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node.lucene,sha256=ym2AuyMKIiGLJcqi7OPIinNTVSwcRgP6obLzuXZ-g38,3884
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_classes.eql,sha256=P--zesbKqSuMzFMpLL4ILcGvZ8OBBcpnqkxtneXTK3s,727
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_classes.lucene,sha256=D8Be9N6oKtz8WD5efilmTj5VfdaoN-06zEOoeHXRtRM,731
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_classes.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_currentversion.eql,sha256=W3ycOJamipv0Zh52-Zi_Aq-GBei9mshk8H5SqP6rrK0,384
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_currentversion.lucene,sha256=Z_rtI-AH0AjRIxr6SsBhjJ8ORjrRg3-dlagx1uLhNY0,371
src/rules/windows__registry__registry_set__registry_set_asep_reg_keys_modification_wow6432node_currentversion.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_db.eql,sha256=z9iiMrnbqvKuxjOzfVI-2FQZDElHOeu0PiNVBaVdFd8,68
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_db.lucene,sha256=s2Wvxmg7C7vPD_A5PV3cEss5UGBJGgq-23uOTo7fYRM,56
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_db.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_vbscript.eql,sha256=kcL_YIIj_sr66ek5FUpQiBvLxYFkdbqG0qQ4oOxox8w,107
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_vbscript.lucene,sha256=JlLm0f9oNeiJKYBi7MFFNb8Efouyy8TeDZ-Uj5C2vC4,93
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_vbscript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_wmi_query.eql,sha256=NpuJ3VCoRk6MeN5gbyHw_SsUUFaFUda2NALaw_cXi6o,107
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_wmi_query.lucene,sha256=iBH2HVSCc06HAIKEmeiW9uE9qUPVG8SZevnjykyiUlI,93
src/rules/windows__registry__registry_set__registry_set_bginfo_custom_wmi_query.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_delegateexecute.eql,sha256=Z6UYFC9IWeVrHbHMyOobBgux3IKrz_FPWOXhCPfQ02k,100
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_delegateexecute.lucene,sha256=CkYWQsSNj1TaG7ES8JtdaAmMvwKlbaQMln8GIvlCuLQ,88
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_delegateexecute.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_eventviewer.eql,sha256=uGPCgzjvOpA1leazH6wKIVYXO6JwfqBsR5T2j9yp2ao,158
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_eventviewer.lucene,sha256=KiO_6Pry76cL3I6QDnmuZa9phCcB8Ulr8Z0SYUBFOBs,148
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_eventviewer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_silentcleanup_task.eql,sha256=dPVtrfRpperdO9_Y3Fj53LRa8eH4BaAVZZOsTCKdm9A,100
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_silentcleanup_task.lucene,sha256=7D6ncR7mog6K7mdEYZ0JQ5pavFDB9Ri4kv095gnNqyc,86
src/rules/windows__registry__registry_set__registry_set_bypass_uac_using_silentcleanup_task.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_change_rdp_port.eql,sha256=UKh2Jg_fIBXEA-gZpK8T_CUmGOV3fP4-qkC85XVpsxg,145
src/rules/windows__registry__registry_set__registry_set_change_rdp_port.lucene,sha256=WjTtPICuINVyC6DlkiMZR6GcN28Wwdvj1IfOVwLjago,136
src/rules/windows__registry__registry_set__registry_set_change_rdp_port.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_change_security_zones.eql,sha256=Y5k2xiGAkMjxwwvdkENdA1RVYLeqEH3mOl7fAhEZ4mk,213
src/rules/windows__registry__registry_set__registry_set_change_security_zones.lucene,sha256=L2gb1nRt0dNvjef8F4NNfvIfAixVTpexwu4rCCzs_3g,202
src/rules/windows__registry__registry_set__registry_set_change_security_zones.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_change_sysmon_driver_altitude.eql,sha256=MyOg_GytxvMCOASCeVp6CqlS26ptlehzaYSVAlRrbFM,100
src/rules/windows__registry__registry_set__registry_set_change_sysmon_driver_altitude.lucene,sha256=o9KuJ5PZFFIEYrlf8pfjaEVuO-g_FMS3PPFxUC_VCvQ,87
src/rules/windows__registry__registry_set__registry_set_change_sysmon_driver_altitude.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_change_winevt_channelaccess.eql,sha256=5SCmV5d19cQQDzlJHcZCXcB__6jzrmlzlHdkjqG1G2c,386
src/rules/windows__registry__registry_set__registry_set_change_winevt_channelaccess.lucene,sha256=yLica9aUPCdzWBup-Fj-UJ4S4E96_DswPmpikM7xxDY,366
src/rules/windows__registry__registry_set__registry_set_change_winevt_channelaccess.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_chrome_extension.eql,sha256=DJHkZFxloI8bfOJ1uy-LuD2eCDW3PrIXVm5E_iyllTA,4167
src/rules/windows__registry__registry_set__registry_set_chrome_extension.lucene,sha256=ftg6wLXpszySeLau-GXkaCVxmRropwNt3vf2J21wqY8,4145
src/rules/windows__registry__registry_set__registry_set_chrome_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_clickonce_trust_prompt.eql,sha256=Z8WdWj-o06My105f3kSZ4x0xUCljmWwWll-8-1A4bI4,265
src/rules/windows__registry__registry_set__registry_set_clickonce_trust_prompt.lucene,sha256=fuKi_H0eTHYIQFybMaTmerQ0xKONmdlYMgmPyqmH_HY,243
src/rules/windows__registry__registry_set__registry_set_clickonce_trust_prompt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_cobaltstrike_service_installs.eql,sha256=O8VRlsuS_zZUC7MBu20gwpjdcbKpGxiTzfiDUCTxFUM,359
src/rules/windows__registry__registry_set__registry_set_cobaltstrike_service_installs.lucene,sha256=1nOGVkrtyBYRsQI5sfDPghHhpgJW57rR68G7Siqlpas,333
src/rules/windows__registry__registry_set__registry_set_cobaltstrike_service_installs.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_comhijack_sdclt.eql,sha256=tCP_P8W0oEznMA5-QP-Jqww9lysMofihHG3D6zHgK0c,95
src/rules/windows__registry__registry_set__registry_set_comhijack_sdclt.lucene,sha256=fIK9r50OKVib45JMgLb9kc1DyVLS-vbxu2PqPLCOQSQ,83
src/rules/windows__registry__registry_set__registry_set_comhijack_sdclt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_crashdump_disabled.eql,sha256=ib5a_P_SY8xyDQ_UzIsFTLbHGJeQKcEaSqwy6ViYmvs,128
src/rules/windows__registry__registry_set__registry_set_crashdump_disabled.lucene,sha256=wWH6pklxGIQXFUrvrJDiSNgwmaGz4I8bOZF9QmBbnaI,117
src/rules/windows__registry__registry_set__registry_set_crashdump_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_create_minint_key.eql,sha256=hONxcqOx-ji9MGRvUQifsyL26CLwzcnQKczuoOH9bNk,86
src/rules/windows__registry__registry_set__registry_set_create_minint_key.lucene,sha256=b0on7xD5KH0MtnVmtwc2hYGGJbqTY7hMO6sg8rGRN7Y,76
src/rules/windows__registry__registry_set__registry_set_create_minint_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_creation_service_susp_folder.eql,sha256=g7nkw6wtWtmzF8EJrysAQK5li47V3hlkCl8rsvybB_U,829
src/rules/windows__registry__registry_set__registry_set_creation_service_susp_folder.lucene,sha256=8Afx5O_lvLjjDN8eVCQ57IouDvxFy86r53YDCHW6oMY,788
src/rules/windows__registry__registry_set__registry_set_creation_service_susp_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_custom_file_open_handler_powershell_execution.eql,sha256=jxNGQNfq7zwAa4KN2ZIT3GBKoXyUOA4ew-Ow3GNGdDc,140
src/rules/windows__registry__registry_set__registry_set_custom_file_open_handler_powershell_execution.lucene,sha256=irL_B1YuhX8CbiWqRrTf5VzupG0hahQYVl5jTskILCg,125
src/rules/windows__registry__registry_set__registry_set_custom_file_open_handler_powershell_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dbgmanageddebugger_persistence.eql,sha256=Es4nJLtAXhZAtMmlTPIWw1hvAHdWH2bMeWpltwkei98,198
src/rules/windows__registry__registry_set__registry_set_dbgmanageddebugger_persistence.lucene,sha256=ZZSFQCmLNsd5feN174eBwUROdjUFLtwtpn3uu1zItSU,193
src/rules/windows__registry__registry_set__registry_set_dbgmanageddebugger_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_defender_exclusions.eql,sha256=-I4NV1ObB9JIPw4bwi2FYwRzRO7B254wH8eEWgI9xjg,70
src/rules/windows__registry__registry_set__registry_set_defender_exclusions.lucene,sha256=9a3YDMO2Nlpz2w_UcUosD58w74E8IY3gXceudvfqdFU,59
src/rules/windows__registry__registry_set__registry_set_defender_exclusions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_desktop_background_change.eql,sha256=uUXUzDAS3t5FPcktrTGkxGDcRx0C6dQYyuzIcXLsC6I,755
src/rules/windows__registry__registry_set__registry_set_desktop_background_change.lucene,sha256=I6QCoBI15Qds5o86vZUk4alTQt43fZ3uvwEBte_u8rA,725
src/rules/windows__registry__registry_set__registry_set_desktop_background_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_devdrv_disallow_antivirus_filter.eql,sha256=KRANCntXS3p3cyxvnwtUJqF9taUbUdRHQ4xnjZCxCvI,130
src/rules/windows__registry__registry_set__registry_set_devdrv_disallow_antivirus_filter.lucene,sha256=0hLC3gobqvebPYWd1df15Xp02Kpx2twWntHkXibiQfw,119
src/rules/windows__registry__registry_set__registry_set_devdrv_disallow_antivirus_filter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.eql,sha256=lzjZamhs9-UgMt1KMqIFiJaVdKJPKa9KtW5C5zJo_cI,295
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.lucene,sha256=knAQUSwgnC7YnHff0fepmxmE85mGi8jvNm6gckhSGGE,278
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.eql,sha256=l_hc3QBp5G-Ngw1JgRYlBlbxlaRkB650KRH8fBbm-Ik,123
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.lucene,sha256=bxvMcyDqgp8K43Cip_4h7_DDppdbVhx_4QhFQXc9WR4,112
src/rules/windows__registry__registry_set__registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dhcp_calloutdll.eql,sha256=vxzQjGGHE75MMyW8uV6isJzu73STL9tW6AlO242Gkhk,138
src/rules/windows__registry__registry_set__registry_set_dhcp_calloutdll.lucene,sha256=YFz0GGTlsz79fkIt441wxRU5citZe5KHFxsMxp7IgNA,120
src/rules/windows__registry__registry_set__registry_set_dhcp_calloutdll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_administrative_share.eql,sha256=XDsdpq4vPAd12-0xsEyq0i09-wtFoQ0DAFwmSgXvtJg,185
src/rules/windows__registry__registry_set__registry_set_disable_administrative_share.lucene,sha256=UOnoBXvsjbWZ9SMLN3sLrQ0e8dwrCDlIVv7AsNYrw90,166
src/rules/windows__registry__registry_set__registry_set_disable_administrative_share.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_autologger_sessions.eql,sha256=2lR-Gg_wVvh2kEZXMEG8gdNjKQiBVnXXrdp7OozHiyI,621
src/rules/windows__registry__registry_set__registry_set_disable_autologger_sessions.lucene,sha256=59DUH0vcsO6GEyDo3LVh7c6Zp3W0DJl_sghoJnz_96Q,587
src/rules/windows__registry__registry_set__registry_set_disable_autologger_sessions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_defender_firewall.eql,sha256=TXOGbhp_4Z_D9919fiSpLEId8_He3Umld1zEvNrh3oU,171
src/rules/windows__registry__registry_set__registry_set_disable_defender_firewall.lucene,sha256=YgBrrsG6DzK0qEBxUfZPxY0IQvAcywVRntc2z8Wh6q8,158
src/rules/windows__registry__registry_set__registry_set_disable_defender_firewall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_function_user.eql,sha256=MZh0jID2nerA0wmQwxDigtZKmj6vTsJO1jLW0V6dSIo,1654
src/rules/windows__registry__registry_set__registry_set_disable_function_user.lucene,sha256=kC0zeNcYRyWu4g7QjPqtk38Dd_Ps1ENGi1ZJ4ZwvzM0,1631
src/rules/windows__registry__registry_set__registry_set_disable_function_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_macroruntimescanscope.eql,sha256=S9kSQ3z82ufHVzf4qBEUCkxUGF9z0LQOOypvmYuZAwQ,222
src/rules/windows__registry__registry_set__registry_set_disable_macroruntimescanscope.lucene,sha256=gu_AI3CKH23SQfZLhR7_Omb31YqE5Hztz-mNXcIB0xw,205
src/rules/windows__registry__registry_set__registry_set_disable_macroruntimescanscope.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_privacy_settings_experience.eql,sha256=UYMOfVxZYCBuoUr0D3i6J6A3nuqadn5v2UI-4s0zezU,151
src/rules/windows__registry__registry_set__registry_set_disable_privacy_settings_experience.lucene,sha256=ZIFP1zPbaF_d92vDWjJQU5QGHumVQiRNCkvVdqcKbP4,140
src/rules/windows__registry__registry_set__registry_set_disable_privacy_settings_experience.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_security_center_notifications.eql,sha256=74Gg4meEYvzoLDH2izipJ0t-z4jGwr_zyWuUo361L0Q,145
src/rules/windows__registry__registry_set__registry_set_disable_security_center_notifications.lucene,sha256=nTwM0ZPkGi52Oh-x4L1Y17i3ceOHlHGBRjDf-TPNzLE,134
src/rules/windows__registry__registry_set__registry_set_disable_security_center_notifications.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_system_restore.eql,sha256=oaHeliiLcdFgpzEFoG7iscmpn_yWmy64NW94HLzc7ZY,257
src/rules/windows__registry__registry_set__registry_set_disable_system_restore.lucene,sha256=N1D477rdFCM-HO86oc2lIzUNOoSB_Zmz4U5ZkLrOByg,234
src/rules/windows__registry__registry_set__registry_set_disable_system_restore.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_windows_defender_service.eql,sha256=qRBk5gCLpTNPREurUGiz3YjdHbOuihowRZF0hmcxcX8,107
src/rules/windows__registry__registry_set__registry_set_disable_windows_defender_service.lucene,sha256=ptGAhY-fyfb705FmxCF9Nq7FeiMA_SkWMg73lS0vUrc,96
src/rules/windows__registry__registry_set__registry_set_disable_windows_defender_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_windows_event_log_access.eql,sha256=5pX3S3S2Y0C3u8TExC2IGhjw21BPE75kDLAcZYSa7ro,666
src/rules/windows__registry__registry_set__registry_set_disable_windows_event_log_access.lucene,sha256=9hQjIyYbvrm_QMoF_mH3cy7yLQ_9q3XVmWC-Z3Adrso,637
src/rules/windows__registry__registry_set__registry_set_disable_windows_event_log_access.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_windows_firewall.eql,sha256=RIXQohI1eqv58DtZKwQhWIeABdNx53e4_BGXQupIPdA,254
src/rules/windows__registry__registry_set__registry_set_disable_windows_firewall.lucene,sha256=rZrhQ5WRU4Z_3lvUsIspGQyyVrZyff7L2qVwGOro7Io,237
src/rules/windows__registry__registry_set__registry_set_disable_windows_firewall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disable_winevt_logging.eql,sha256=46miBMYmHkaSJI8y1b1raOCWkn1S5KtuG_d86rlWVVY,1165
src/rules/windows__registry__registry_set__registry_set_disable_winevt_logging.lucene,sha256=8_JDCXuCfyh4MGgZjha0h1EIoiSSK_absspw36rXQwQ,1150
src/rules/windows__registry__registry_set__registry_set_disable_winevt_logging.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disabled_exploit_guard_net_protection_on_ms_defender.eql,sha256=tFVRiAHuFHGZGlV1WcoeklrYvcw7_Tqq05xvv2BY_eY,204
src/rules/windows__registry__registry_set__registry_set_disabled_exploit_guard_net_protection_on_ms_defender.lucene,sha256=mvYQ9RZR0jhgsHgsbvGvz4ZS0Kaq-dNHoov-TjyvPg8,199
src/rules/windows__registry__registry_set__registry_set_disabled_exploit_guard_net_protection_on_ms_defender.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disabled_microsoft_defender_eventlog.eql,sha256=hDClo-9uIDNghmWRG7gRRSwVTtTymcJOn_jhHAPWkeI,191
src/rules/windows__registry__registry_set__registry_set_disabled_microsoft_defender_eventlog.lucene,sha256=lwEq5V2sgZKHg0A1dZTbugL0YUt2bKxkCOFXus_MpDQ,184
src/rules/windows__registry__registry_set__registry_set_disabled_microsoft_defender_eventlog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disabled_pua_protection_on_microsoft_defender.eql,sha256=ciA8qWDAGre5JapYkkAJNBZ3Tx7LAILs2bHip_inI_k,134
src/rules/windows__registry__registry_set__registry_set_disabled_pua_protection_on_microsoft_defender.lucene,sha256=qO7EQi4R2yGjSGbUxwrVMEh4pFazIl10Hk0U0j17yRs,124
src/rules/windows__registry__registry_set__registry_set_disabled_pua_protection_on_microsoft_defender.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disabled_tamper_protection_on_microsoft_defender.eql,sha256=yTDTM2kF2vsbMblb4PasASG_OFqgI8c_YAM7P9I-dF4,344
src/rules/windows__registry__registry_set__registry_set_disabled_tamper_protection_on_microsoft_defender.lucene,sha256=KbAAGps1bV0Mxam28_cWwQml2satCbZWZDlE7M8yba4,333
src/rules/windows__registry__registry_set__registry_set_disabled_tamper_protection_on_microsoft_defender.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disallowrun_execution.eql,sha256=nCnAvxeh05PISkeBvoAJHkbHghiUWyC2uWdhYgRYBC0,156
src/rules/windows__registry__registry_set__registry_set_disallowrun_execution.lucene,sha256=XMWL3lmOgn5bIj1CSFO8v0rncmWfBX1FEmWKM34m2ow,145
src/rules/windows__registry__registry_set__registry_set_disallowrun_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_disk_cleanup_handler_autorun_persistence.eql,sha256=p6M7K-KrLPUtx3FgSZxtW9PTwEeRGwkj0zbbzWBJUzc,486
src/rules/windows__registry__registry_set__registry_set_disk_cleanup_handler_autorun_persistence.lucene,sha256=czJyxLSO1nKQogV7KojfMnN79g5TtBKCFBZjIxSeAeA,458
src/rules/windows__registry__registry_set__registry_set_disk_cleanup_handler_autorun_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dns_over_https_enabled.eql,sha256=d_sz8YRNJhePSt54sAhKKFU5nKdADkdU84xO1-gaw0U,384
src/rules/windows__registry__registry_set__registry_set_dns_over_https_enabled.lucene,sha256=bp8YvtbGcVU3BhMqgzBjj8YA_dzHcsUgaBGfroRBpIQ,368
src/rules/windows__registry__registry_set__registry_set_dns_over_https_enabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dns_server_level_plugin_dll.eql,sha256=0vfCEQC45O9QS5PG50NCqC0Il04NsfKD1XkXl8TDBxg,77
src/rules/windows__registry__registry_set__registry_set_dns_server_level_plugin_dll.lucene,sha256=TK-GSNlwfuYd78bPNmWZctv98j2g1v_CpK9eWYPfa9c,65
src/rules/windows__registry__registry_set__registry_set_dns_server_level_plugin_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dot_net_etw_tamper.eql,sha256=7I5gGR4xmDMUx5uuTeGKvIBvSqILOb7hsOdxlo6gioE,269
src/rules/windows__registry__registry_set__registry_set_dot_net_etw_tamper.lucene,sha256=cTwg3QTlcduMm2JNVZlDSpY2beAF35Dx7hDNOnw53-I,245
src/rules/windows__registry__registry_set__registry_set_dot_net_etw_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_dsrm_tampering.eql,sha256=Re39aY0a1bt6FeDm9TxjvXbSyFX2LLEFQ6iMGeZ7nTc,123
src/rules/windows__registry__registry_set__registry_set_dsrm_tampering.lucene,sha256=2pDpgGgzxVbvFj5uVtU7IIARVSEQBcrfgKpSYl64VCM,112
src/rules/windows__registry__registry_set__registry_set_dsrm_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_enable_periodic_backup.eql,sha256=vfQ_BUqbI1me0zDZ9mQDvx5V3SoNsDY9qN6JwbgWtN4,150
src/rules/windows__registry__registry_set__registry_set_enable_periodic_backup.lucene,sha256=a9TMjQp6abeg1CA8GXSJM1Up3v5nHhf9INBjhs2jQpE,141
src/rules/windows__registry__registry_set__registry_set_enable_periodic_backup.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_enable_windows_recall.eql,sha256=30YIW9bnbNSxBq84gii7wosfyRA7FdCAMkK5k-svsK8,153
src/rules/windows__registry__registry_set__registry_set_enable_windows_recall.lucene,sha256=0308_O-LepilTCiJ_kglLuFgPUQSmCVcd-BY3JvYS1E,142
src/rules/windows__registry__registry_set__registry_set_enable_windows_recall.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_enabling_cor_profiler_env_variables.eql,sha256=eMo11bC60mhXH3n1RHGLhrGpRIq4phyfOCtsfXzrPI4,155
src/rules/windows__registry__registry_set__registry_set_enabling_cor_profiler_env_variables.lucene,sha256=pap7JUN7PoAPE6uzUIAywFUIDw6IzuNmPjk57vjV6eA,135
src/rules/windows__registry__registry_set__registry_set_enabling_cor_profiler_env_variables.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_enabling_turnoffcheck.eql,sha256=Ch7qU32CxKNwab4oh314Nc2lgqY67p3Ud_h-qdQPyts,144
src/rules/windows__registry__registry_set__registry_set_enabling_turnoffcheck.lucene,sha256=Sx46wOmZb-kjCCG01h4UUdf0QbkrUckyRhMpQwPFXR8,133
src/rules/windows__registry__registry_set__registry_set_enabling_turnoffcheck.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_evtx_file_key_tamper.eql,sha256=sUsidc4WWFd8w0nSQ8CIHo11p1uS2IkqI8ptIccZMmE,173
src/rules/windows__registry__registry_set__registry_set_evtx_file_key_tamper.lucene,sha256=bTrcD0wdQ2Jm0NxakwlTnGbpQddFu4jisCItYCpL6MU,157
src/rules/windows__registry__registry_set__registry_set_evtx_file_key_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_exploit_guard_susp_allowed_apps.eql,sha256=FnlZywoIM-PLGLFZzDEealW-VJm-H0i2B26oFspa8xI,278
src/rules/windows__registry__registry_set__registry_set_exploit_guard_susp_allowed_apps.lucene,sha256=D7GT1zlk3k-TguPcJ82uS8ci02izaBdtLKY11UBjtYY,264
src/rules/windows__registry__registry_set__registry_set_exploit_guard_susp_allowed_apps.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_fax_change_service_user.eql,sha256=DmSzugrT8wArj34A1FKp6yBwHlUwVpB0BfMTvulGf2Q,140
src/rules/windows__registry__registry_set__registry_set_fax_change_service_user.lucene,sha256=1mk0Ya_YTntFUqBS_2MP59ZmgaySYZz-sxglstPBRJ4,126
src/rules/windows__registry__registry_set__registry_set_fax_change_service_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_fax_dll_persistance.eql,sha256=uOInY-BAz9Y_rkacUasZPZH5M-w6XrxWDMtIOv44L58,183
src/rules/windows__registry__registry_set__registry_set_fax_dll_persistance.lucene,sha256=LfaMxL6jspBXE4EG-Lw-E3eVaJaQ6XL7Y5pyE4aflhs,168
src/rules/windows__registry__registry_set__registry_set_fax_dll_persistance.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_file_association_exefile.eql,sha256=hjwp5CaiueFCvvCzrAmkIa45mRfqqpdOJFypM3aKfcQ,79
src/rules/windows__registry__registry_set__registry_set_file_association_exefile.lucene,sha256=ShbnOcmSWKx3bn6cvYuIz6QMMFHqstUGKmpb1Sd8GVI,65
src/rules/windows__registry__registry_set__registry_set_file_association_exefile.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_filefix_typedpath_commands.eql,sha256=N1dLP2h6DS8gcdAuBXwohSXePzystTn-HnnwowlyUJM,669
src/rules/windows__registry__registry_set__registry_set_filefix_typedpath_commands.lucene,sha256=k8Pr7TQ-LMtwtOaJl7un-OkBPa72FBVL1IW17NlSKzQ,638
src/rules/windows__registry__registry_set__registry_set_filefix_typedpath_commands.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hangs_debugger_persistence.eql,sha256=w5FFkGac15YFCbssQDyRIRoD5hot6CYfqDrIbNXqa-o,101
src/rules/windows__registry__registry_set__registry_set_hangs_debugger_persistence.lucene,sha256=Pt8rJctQkektZu3OlAo0mCmfp3R7F8NN77Vyg8aUBo4,91
src/rules/windows__registry__registry_set__registry_set_hangs_debugger_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hhctrl_persistence.eql,sha256=WZEdnC3DuJ1wDib6fib14FoRtg3QqHrK0cvz5alfy3Q,175
src/rules/windows__registry__registry_set__registry_set_hhctrl_persistence.lucene,sha256=NjfIFqVIOXk2BzOo3UnGAmDUeoospVsJFv4HgvMW_C0,170
src/rules/windows__registry__registry_set__registry_set_hhctrl_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hidden_extention.eql,sha256=EAU7GQNqkS1IBL5NFfl7OIH3Xzc8l4BFNWbvRbdGwrI,308
src/rules/windows__registry__registry_set__registry_set_hidden_extention.lucene,sha256=g2lyuQKWUlRX_f6DwrS5ZbbfP0KWNOtRt_Z-78bBYq8,296
src/rules/windows__registry__registry_set__registry_set_hidden_extention.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hide_file.eql,sha256=wdP2Xp162osJH-7bXxeRTTVaBedDSZP4NHO6GivqZ8M,231
src/rules/windows__registry__registry_set__registry_set_hide_file.lucene,sha256=BZrysns0fNzoXGI6cmNA9cOPSM68Ij9cLPaWkgJWtbU,214
src/rules/windows__registry__registry_set__registry_set_hide_file.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hide_function_user.eql,sha256=lesLlKD4BUt7_gjBSe9j35hLWf0w63awXNoJUr38HRY,747
src/rules/windows__registry__registry_set__registry_set_hide_function_user.lucene,sha256=aqLHlK2qa0dwRT_wLRNlE-alJXNCLbqzlJgTIwCcsbk,723
src/rules/windows__registry__registry_set__registry_set_hide_function_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hide_scheduled_task_via_index_tamper.eql,sha256=qy7fibooJzEkOVfhgLt7XFooGz__NOmRDmf1kHEhDW4,187
src/rules/windows__registry__registry_set__registry_set_hide_scheduled_task_via_index_tamper.lucene,sha256=BmASCeqjxbLjkODd7EoWevt80Ip74KCOmBi0HSNlhqY,175
src/rules/windows__registry__registry_set__registry_set_hide_scheduled_task_via_index_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_hvci_disallowed_images.eql,sha256=qWvFD8Smc307O5gCKbGFj58rbByglq7Cwl1KWa_UP58,88
src/rules/windows__registry__registry_set__registry_set_hvci_disallowed_images.lucene,sha256=MqhL-P8sYW6l8It0t4uCfCTcj2IlXqstSGVyfQZj1xk,74
src/rules/windows__registry__registry_set__registry_set_hvci_disallowed_images.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_ie_security_zone_protocol_defaults_downgrade.eql,sha256=6ek0Pk9mTXf2RtJxwXtQ60VZ51XDXnA9Yx1BDsL75V8,214
src/rules/windows__registry__registry_set__registry_set_ie_security_zone_protocol_defaults_downgrade.lucene,sha256=92ThdKGOGuth3xrJ5NBY8Eqe3XFTDyoIIwlmG1KiAFQ,196
src/rules/windows__registry__registry_set__registry_set_ie_security_zone_protocol_defaults_downgrade.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_ime_non_default_extension.eql,sha256=V4YFqz5PuxqZ2VXotvUevhKS9WrAQ_uBABYEe16GeEQ,134
src/rules/windows__registry__registry_set__registry_set_ime_non_default_extension.lucene,sha256=sxvImOCmBopb7ZS6ATAqMNSstQ7dVhHBl0C20l2t-W4,120
src/rules/windows__registry__registry_set__registry_set_ime_non_default_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_ime_suspicious_paths.eql,sha256=8xd0OjrFTQ-Fu6ti8jG7V6Jdv4vbitnlusJC66mR3Ms,553
src/rules/windows__registry__registry_set__registry_set_ime_suspicious_paths.lucene,sha256=1-rjzZ1FSUP4bFDWsSIKuG__tEoNmH6EtWnjOtqIRaI,528
src/rules/windows__registry__registry_set__registry_set_ime_suspicious_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_install_root_or_ca_certificat.eql,sha256=2XeUQAanw_FtJI0WznglqEXrKGd4CmlId8SOxhtTUV4,765
src/rules/windows__registry__registry_set__registry_set_install_root_or_ca_certificat.lucene,sha256=OZR2EhRxBorZtNlIHm6VT5G0VbslzkwrMB9HNCE8Qok,744
src/rules/windows__registry__registry_set__registry_set_install_root_or_ca_certificat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_internet_explorer_disable_first_run_customize.eql,sha256=mwlilMcaOkluOSG0PzmzzWJeHtyR7kREMVdYpmCbAOY,664
src/rules/windows__registry__registry_set__registry_set_internet_explorer_disable_first_run_customize.lucene,sha256=TJ20pTGk1ztsD8fW0BQMOhKwVQScoLpRLMXmbkg8V6I,648
src/rules/windows__registry__registry_set__registry_set_internet_explorer_disable_first_run_customize.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_legalnotice_susp_message.eql,sha256=Khk52JbJb-HljljPnQJlUfkFBDLbvGXNY5zFZYIsbwA,297
src/rules/windows__registry__registry_set__registry_set_legalnotice_susp_message.lucene,sha256=RPZho6Hr9O-weF4r8ljiODtRC39GDkiY4SPPHYQ2ZYA,272
src/rules/windows__registry__registry_set__registry_set_legalnotice_susp_message.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_lolbin_onedrivestandaloneupdater.eql,sha256=V1jtWEAFDs3AxEZHLIaoTJKnnnCY_Qm51B969kjmxZs,108
src/rules/windows__registry__registry_set__registry_set_lolbin_onedrivestandaloneupdater.lucene,sha256=dEPzwNVT4kPDAYSX88sb82Agmawmo93tVySPC51fQns,96
src/rules/windows__registry__registry_set__registry_set_lolbin_onedrivestandaloneupdater.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_lsa_disablerestrictedadmin.eql,sha256=_4AYlAlMcOt-DbHoozsxj3KADcg4dfwPUvNmuwKVr2s,91
src/rules/windows__registry__registry_set__registry_set_lsa_disablerestrictedadmin.lucene,sha256=h7nLhsXREH7_PnGLYfDYwvT0YxBpO3dCs1VT9hiDWQk,79
src/rules/windows__registry__registry_set__registry_set_lsa_disablerestrictedadmin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_lsass_usermode_dumping.eql,sha256=HECbXc2lz2JPudnvZdzeK1MVBqmKl1gZm1LJE5HaLWg,261
src/rules/windows__registry__registry_set__registry_set_lsass_usermode_dumping.lucene,sha256=MUj4bZT2A2hxtXwCfQcZRyMNzb1SC6Qh4ddEbF_PfGY,248
src/rules/windows__registry__registry_set__registry_set_lsass_usermode_dumping.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_net_cli_ngenassemblyusagelog.eql,sha256=2-GS_OhbS8Gq_oz48v3gUQsZvIMNYbuZKjCBOYMn74A,84
src/rules/windows__registry__registry_set__registry_set_net_cli_ngenassemblyusagelog.lucene,sha256=jPd7iZbvA59l401LD3OFVuFfGBdLJguFujHiZh_BYjw,72
src/rules/windows__registry__registry_set__registry_set_net_cli_ngenassemblyusagelog.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_netsh_help_dll_persistence_susp_location.eql,sha256=0EutnVlnyfqmpWZBOidDdM6Eg23w9cBwyYqcXgK4SpA,586
src/rules/windows__registry__registry_set__registry_set_netsh_help_dll_persistence_susp_location.lucene,sha256=WULxv0K9pOy9Q5RS9PvV2BHZFt4mjaY76xygq1QRLG8,558
src/rules/windows__registry__registry_set__registry_set_netsh_help_dll_persistence_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_netsh_helper_dll_potential_persistence.eql,sha256=_AS5u8gjTmZJJZE2vRxSPw1u9ylG3d7hpTeYCtPq5qU,252
src/rules/windows__registry__registry_set__registry_set_netsh_helper_dll_potential_persistence.lucene,sha256=MB1bFLc4LbumSl-r2tKT2TeGzbcWT8A8eNkaykqIJ8g,229
src/rules/windows__registry__registry_set__registry_set_netsh_helper_dll_potential_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_new_application_appcompat.eql,sha256=HRq6DObdAZGkgGUR_FzhtAnm-VRLcE4jtx2jOu_kbSo,78
src/rules/windows__registry__registry_set__registry_set_new_application_appcompat.lucene,sha256=y40bndYvNX2ANREKB_GlZK1F4q0PdBqgr-1S23f1PGE,67
src/rules/windows__registry__registry_set__registry_set_new_application_appcompat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_new_network_provider.eql,sha256=_PGCiGlrIxjZBFmTyZY7K_waRwRiNfWImOmEsDLitnc,420
src/rules/windows__registry__registry_set__registry_set_new_network_provider.lucene,sha256=8CJ2Kx9838WDz32cCLjHDXJlkcFsQEAi80BS4eaZieA,397
src/rules/windows__registry__registry_set__registry_set_new_network_provider.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered.eql,sha256=1tLAJANpnB9TTuZ5VnBiqAVjREfGtZYidq9EA356-YI,483
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered.lucene,sha256=GNayuOOH8HQAz4E26zVKOJZhxdENViRzTs5rv-UrVSs,460
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered_susp.eql,sha256=OVxeBVPH8-r7jRBQcy4Y5-aYliD27Vja-U8wP1gia7I,979
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered_susp.lucene,sha256=przGzsM4Ln8E4VYlQ791X6Bou7LEZM-V-SGghVaNLlU,971
src/rules/windows__registry__registry_set__registry_set_odbc_driver_registered_susp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_access_vbom_tamper.eql,sha256=5HJOaTQuEcVUsCwvtCgMznoDocgbqyb7ZP34S0v6UW0,101
src/rules/windows__registry__registry_set__registry_set_office_access_vbom_tamper.lucene,sha256=Bs8CdjFCR2jRzODxFn7IRhGMft-qxPFBHXGFQLmZXU8,90
src/rules/windows__registry__registry_set__registry_set_office_access_vbom_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_disable_protected_view_features.eql,sha256=QutKXcN-e9yWx9VfBillnR-mA-f26jfgudj4IXjhzwk,471
src/rules/windows__registry__registry_set__registry_set_office_disable_protected_view_features.lucene,sha256=id49kx6MbwopTpbp4E-1MvIcipR74opsR4tm73u6TLQ,443
src/rules/windows__registry__registry_set__registry_set_office_disable_protected_view_features.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_disable_python_security_warnings.eql,sha256=D9L_uNk0TH9ki676w8tuYWZLUdyI4L0FRlZlee86nhI,163
src/rules/windows__registry__registry_set__registry_set_office_disable_python_security_warnings.lucene,sha256=2OMnc21MGlCy61d7zrESTQYx1TrS5lNIJDAPeIjxjxk,150
src/rules/windows__registry__registry_set__registry_set_office_disable_python_security_warnings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_enable_dde.eql,sha256=RZbpCmMINVYMM3ycNS3LUz-2jAItqEvm_FuWt7p9ctw,310
src/rules/windows__registry__registry_set__registry_set_office_enable_dde.lucene,sha256=jPngHdwXoietu0kSiK-WlNfxX_Du_M4Su6SYz4K9t0U,289
src/rules/windows__registry__registry_set__registry_set_office_enable_dde.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_load_macro_provider_on_boot.eql,sha256=fCvZaqHPkrrThUyVlQBdRDhtDO8YWT5o3Zr-YS43xSQ,107
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_load_macro_provider_on_boot.lucene,sha256=iE6zRygXC-d0sGt7dVRJwppAClwRA65RyRRcgisw4G8,93
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_load_macro_provider_on_boot.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_macro_execution.eql,sha256=eWzFp-U7bqIay6T7lGnskRd2YTuGot-bFTX1_bU_F0M,99
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_macro_execution.lucene,sha256=d9zF-TvE6587Oz1Qj89mQqyjW5sKyontR13fRu6hAiU,85
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_macro_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_unsafe_client_mail_rules.eql,sha256=OIx91E8x0Fr_eiwq7IsOhxgqjxoF_mkIhYjZl_py5Gw,127
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_unsafe_client_mail_rules.lucene,sha256=qDmBT0daCfKRMGdNCRfhOtxfzPd4GNulXwUWkjiv8c4,116
src/rules/windows__registry__registry_set__registry_set_office_outlook_enable_unsafe_client_mail_rules.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_outlook_security_settings.eql,sha256=u5-HdiVmHM8H63_tpd9w_2xtOnQ6RkrjYeUB7swc5iI,102
src/rules/windows__registry__registry_set__registry_set_office_outlook_security_settings.lucene,sha256=nsMVN8lOBQUzJ7JqdAp23rABASkNsral-_NfZa8j9bA,88
src/rules/windows__registry__registry_set__registry_set_office_outlook_security_settings.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_trust_record_susp_location.eql,sha256=MaLOgUBYVxY3CXGXbJlXRgc-SSZ61MoHcKe0R9x4z98,246
src/rules/windows__registry__registry_set__registry_set_office_trust_record_susp_location.lucene,sha256=pb8AqnzgyW0sifMLTB9hWsStnFUYr1pDd0ln_5CxVpU,255
src/rules/windows__registry__registry_set__registry_set_office_trust_record_susp_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_trusted_location_uncommon.eql,sha256=P0RUumAWOdL-QkBShukEBZcmjsHjObrkN_Sv9ADBN_g,799
src/rules/windows__registry__registry_set__registry_set_office_trusted_location_uncommon.lucene,sha256=D7-h85K7WKZlFurj9lxxHZybx0r6fI7vQ9Ra-agTL3E,797
src/rules/windows__registry__registry_set__registry_set_office_trusted_location_uncommon.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_office_vba_warnings_tamper.eql,sha256=rSiKWxbdcFVDDwPHLH4YjduAk3MWEqWp8phCPSQQ198,102
src/rules/windows__registry__registry_set__registry_set_office_vba_warnings_tamper.lucene,sha256=aLx3NYfSsdH3wDhraCW0Fycel7VQm9in3k9_OY713qY,91
src/rules/windows__registry__registry_set__registry_set_office_vba_warnings_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_optimize_file_sharing_network.eql,sha256=ZOCguWacptvLImmDkTG11-Gav0XCgV2wPOqhWU2fJAM,74
src/rules/windows__registry__registry_set__registry_set_optimize_file_sharing_network.lucene,sha256=19w3f0Pwo6aLhpuFIUqv8skXCvSCjhS4y8lxCjT7Gfg,62
src/rules/windows__registry__registry_set__registry_set_optimize_file_sharing_network.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_amsi_providers.eql,sha256=udu5ha3keVuAhWRPwqYQaMJgw0GvtXtGhDFw8JDQhb0,720
src/rules/windows__registry__registry_set__registry_set_persistence_amsi_providers.lucene,sha256=RvBkrWPICsJ2TXxNigLarO34bwGl9oMCHXJl5_m2PAo,710
src/rules/windows__registry__registry_set__registry_set_persistence_amsi_providers.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_app_cpmpat_layer_registerapprestart.eql,sha256=pFoqfl_IE5_KjjpOlnzLJHThYY4A62bpQowxeh7NzBY,156
src/rules/windows__registry__registry_set__registry_set_persistence_app_cpmpat_layer_registerapprestart.lucene,sha256=09huSYS9gztlLGEjv6Cqt_rN0UfC9mEwxDE3hFdVtm8,143
src/rules/windows__registry__registry_set__registry_set_persistence_app_cpmpat_layer_registerapprestart.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_app_paths.eql,sha256=Ia0RWMeOhNvJZAv_yVGDSZWzgxYueJBbO9dE-hHKn_o,431
src/rules/windows__registry__registry_set__registry_set_persistence_app_paths.lucene,sha256=_Xmu5oe5Q9k5Pm20fI1oxseENhNuyfOgM_s4r0PrhqI,407
src/rules/windows__registry__registry_set__registry_set_persistence_app_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_appx_debugger.eql,sha256=i3h_MVlQc5pCki7csjrTyqIBk4NcFUJYqcktSHqKLDw,246
src/rules/windows__registry__registry_set__registry_set_persistence_appx_debugger.lucene,sha256=bjIGa-HlIrhYXj2MBP2FfGGzo2zH1oGcRcFx8Vuvg8o,230
src/rules/windows__registry__registry_set__registry_set_persistence_appx_debugger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_autodial_dll.eql,sha256=F8PNqtEcErcc42f5hlsRhUz1jFn3WDnWX3ChQ3jqQ90,74
src/rules/windows__registry__registry_set__registry_set_persistence_autodial_dll.lucene,sha256=tMHjSu_KSRh4BZYfldwtWHjtdo7HL-YQel1QDvIX82I,62
src/rules/windows__registry__registry_set__registry_set_persistence_autodial_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_chm.eql,sha256=OeZ2OMqcShpa8MGmVaU8rNSTqqjQqic8VZqOXNJtddI,152
src/rules/windows__registry__registry_set__registry_set_persistence_chm.lucene,sha256=S0VXFyclp4sCDt_SX7OzL35ZYs7gwKxiYxIdX2eeHYM,136
src/rules/windows__registry__registry_set__registry_set_persistence_chm.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_com_hijacking_builtin.eql,sha256=SJMSnQwUHduqdUPmPBcRUlumquq_-qITh_Hs0lqxBqc,1554
src/rules/windows__registry__registry_set__registry_set_persistence_com_hijacking_builtin.lucene,sha256=m-6rfA0jlmH1aGtbTI3MQn9UtdWIVAp-E-EPPws0xkU,1603
src/rules/windows__registry__registry_set__registry_set_persistence_com_hijacking_builtin.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_com_key_linking.eql,sha256=nrA1E_S2AT0Aqfl8DpQ1jWz0ZwPzMKn1k8ULjabQm0o,171
src/rules/windows__registry__registry_set__registry_set_persistence_com_key_linking.lucene,sha256=yzAnzTl4LcGwCtlJdQvxmRognLC8DVkRT4vBy-DDT9k,154
src/rules/windows__registry__registry_set__registry_set_persistence_com_key_linking.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_comhijack_psfactorybuffer.eql,sha256=bpimDLbuRao9iG4yE59zf3ikQ4d00iu23_xVuGn2B94,222
src/rules/windows__registry__registry_set__registry_set_persistence_comhijack_psfactorybuffer.lucene,sha256=EP3XSqf-nClMVIgkn21mdQkaJ6arsv0N9JNzGNJ8Iig,211
src/rules/windows__registry__registry_set__registry_set_persistence_comhijack_psfactorybuffer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_custom_protocol_handler.eql,sha256=D5_WoQiNc5AcYlxR71yK0oXiqOSe_5ZEcbcA4stjeBE,258
src/rules/windows__registry__registry_set__registry_set_persistence_custom_protocol_handler.lucene,sha256=zKEFKgBCwC9h08u3gjDOWkY-4B-f_MCgv0ug_Q4v-XI,246
src/rules/windows__registry__registry_set__registry_set_persistence_custom_protocol_handler.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_event_viewer_events_asp.eql,sha256=TrrBqCpCmQPDjkVq6WJVKFfuIClpNXSXTwA394_qbn0,846
src/rules/windows__registry__registry_set__registry_set_persistence_event_viewer_events_asp.lucene,sha256=P4ykjEMvxLN9GAqag_TKw8pWdGqEtvpY8DE6-8xlWcI,837
src/rules/windows__registry__registry_set__registry_set_persistence_event_viewer_events_asp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_globalflags.eql,sha256=BTHf_n-cg3LuP11xIZK0yBnqsOLuJhlsObCElEzpLT0,339
src/rules/windows__registry__registry_set__registry_set_persistence_globalflags.lucene,sha256=_BgHU4PYgui2weaY-u1D3-dPKn4wkcZad68KAuQF7Y4,316
src/rules/windows__registry__registry_set__registry_set_persistence_globalflags.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_ie.eql,sha256=b9Vt3u_ew13XAAgsAt9ujvlGSrM42xHLFChZgvLU1iY,524
src/rules/windows__registry__registry_set__registry_set_persistence_ie.lucene,sha256=g54POIv3acFzD23wqdC2ZZxvvvOxFmebTkJ55qbNVqY,501
src/rules/windows__registry__registry_set__registry_set_persistence_ie.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_ifilter.eql,sha256=LWqAO-k-imqEuP4NB5yDJD2znYnZg8RQfoYLkzffMzU,1894
src/rules/windows__registry__registry_set__registry_set_persistence_ifilter.lucene,sha256=wEwIlGnOEQQ8WJAfnCQFiejlOxHwUkRw_di3Xa60_-k,2042
src/rules/windows__registry__registry_set__registry_set_persistence_ifilter.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_logon_scripts_userinitmprlogonscript.eql,sha256=V8syNmcv8kvXKi8NVt1c5T2ZhrgSzKB-ebO2vfF5mD8,51
src/rules/windows__registry__registry_set__registry_set_persistence_logon_scripts_userinitmprlogonscript.lucene,sha256=RSXfC5kOowkTxKhGX_okjRXFjoC54TliWtLXhgR4J1g,39
src/rules/windows__registry__registry_set__registry_set_persistence_logon_scripts_userinitmprlogonscript.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_lsa_extension.eql,sha256=1_VzrznhQMXpoVo-6nP9mqnm0w7xuIbFHwe2TpE9Kvw,105
src/rules/windows__registry__registry_set__registry_set_persistence_lsa_extension.lucene,sha256=5CBSiKqu1Lg-74gL3ERznA3xn7xfeL93s0UzO0XXv3A,93
src/rules/windows__registry__registry_set__registry_set_persistence_lsa_extension.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_mpnotify.eql,sha256=2UXtXPJv2F8OIkvd9oHSUr1-iTRrkvPhiGYP5PJYPqI,98
src/rules/windows__registry__registry_set__registry_set_persistence_mpnotify.lucene,sha256=1n1gZjqUvLdUolNZAJLg9hEFn5ybtXRKEAQkvJLQ73U,87
src/rules/windows__registry__registry_set__registry_set_persistence_mpnotify.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_mycomputer.eql,sha256=rNUHRzr3JUf-vhcpp402-DNo07HDaCeTdxapaz2C2UY,118
src/rules/windows__registry__registry_set__registry_set_persistence_mycomputer.lucene,sha256=p_jqhG9RuiuJBg9q8pfeLNhFi9ej_lO50C0c3AY4APE,106
src/rules/windows__registry__registry_set__registry_set_persistence_mycomputer.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_natural_language.eql,sha256=tYHsE7NvPruA5mAkXYpLSMpFksKrKDoW_xBEftI9cHk,213
src/rules/windows__registry__registry_set__registry_set_persistence_natural_language.lucene,sha256=izeChwD2y7buOeJvW8g3K0xdExk2BzuFbO4RBKvHxQ4,193
src/rules/windows__registry__registry_set__registry_set_persistence_natural_language.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_office_vsto.eql,sha256=9mFOsvDSgrgQm0d9Eb3YTic2CCsAd9jJfA1PnBVLTgk,1757
src/rules/windows__registry__registry_set__registry_set_persistence_office_vsto.lucene,sha256=HzXJ3o3m_Esuy0XfGQJp1Tbz62cwJvjX1JwH4LIQv4M,1735
src/rules/windows__registry__registry_set__registry_set_persistence_office_vsto.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_homepage.eql,sha256=gJta45GVnzZTWyRgCHrQvGI_ln5yYAa2fQ2qeCNSXsA,130
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_homepage.lucene,sha256=y0pHT1-lHhkh4FFOYZNxlKEyJm1jU2Z1z4mxiQG3xPM,114
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_homepage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_todaypage.eql,sha256=Zt4jnQ6Bm4Md_vMzcJ8t0mPtbtUpOs3EwlIu_03rxC8,472
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_todaypage.lucene,sha256=BJDIXDXLBqxE3nwvDRxdv55I1xMZFlwyj1rjLzDvA4g,447
src/rules/windows__registry__registry_set__registry_set_persistence_outlook_todaypage.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_reflectdebugger.eql,sha256=PwXCNuGQybe1ZA51bl8ctQ3fX6hVoZaHZ0Wb3EuDUBw,97
src/rules/windows__registry__registry_set__registry_set_persistence_reflectdebugger.lucene,sha256=qknRN7Lh1byQVHTl6bV8xecKVmDo3ezpWN6QbUDUlpQ,87
src/rules/windows__registry__registry_set__registry_set_persistence_reflectdebugger.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_scrobj_dll.eql,sha256=6INlOzV62sHDElnQYUsQEv6wjT9pdD4tAFxJnRxWJMY,119
src/rules/windows__registry__registry_set__registry_set_persistence_scrobj_dll.lucene,sha256=uH2Ik1xS4lQR9Ajx_9BpNF5kqnPoP6ZR15yZbEiWtHk,108
src/rules/windows__registry__registry_set__registry_set_persistence_scrobj_dll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database.eql,sha256=9-lHZua814M2bpSVT_jnNSW84C2q99ST74ugO7LZ8cw,311
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database.lucene,sha256=rutGxfpCqO_5LPx5BCvF3-NVm4VsaXeF1Zhp1rBM74o,296
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_susp_application.eql,sha256=iq8IzlCHq4pNaUa9OlwLup98uTiTcHy9wwBQruWh4DE,319
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_susp_application.lucene,sha256=xEIMAPMhSRR2BwgZbB1wqjBCzbwTna4dc4M_ihj2Tug,300
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_susp_application.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_uncommon_location.eql,sha256=eHKEqt-34wq5ZFB1WHkALOMNxII7eq0DPunbu5Gxz28,217
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_uncommon_location.lucene,sha256=ndzeb9-5r9tG1fnULnSJWqYNqT3mWJn--h5xYKne7wM,203
src/rules/windows__registry__registry_set__registry_set_persistence_shim_database_uncommon_location.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_typed_paths.eql,sha256=pT84siAWZ3f0nnBqA_nxt2N-k1o0HEoCVvqpWClC1Rc,204
src/rules/windows__registry__registry_set__registry_set_persistence_typed_paths.lucene,sha256=l4k-yJknijaH3KQI5Hg1StJ8Zjj6NYKiEfmUvEd9Fvw,186
src/rules/windows__registry__registry_set__registry_set_persistence_typed_paths.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_persistence_xll.eql,sha256=3TEX40qf5MdB22R8ltJ9rdpUAKep1C7PpDwhm59pRlY,170
src/rules/windows__registry__registry_set__registry_set_persistence_xll.lucene,sha256=alEpR9Ya89cvH76FcXeBI8B-XpBZcoCuZ-QK5tq4Md8,154
src/rules/windows__registry__registry_set__registry_set_persistence_xll.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_policies_associations_tamper.eql,sha256=o-PI5xEpvEhSHknFUUTnEHRN0yHavPlwA1Pk2tX5PFI,389
src/rules/windows__registry__registry_set__registry_set_policies_associations_tamper.lucene,sha256=FU-9TXlPtOhCdu_dC-6mlhydZs3nn0FcHxl2PW0b-vk,366
src/rules/windows__registry__registry_set__registry_set_policies_associations_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_policies_attachments_tamper.eql,sha256=Dex-7JF9TPo1-vYBwj_PzKZtGACOa_bLq9trwlpiHbc,390
src/rules/windows__registry__registry_set__registry_set_policies_attachments_tamper.lucene,sha256=pMDRpRkUBSbmLQGRPL4sgJNRVYIC08TaMTmrcIO7pao,375
src/rules/windows__registry__registry_set__registry_set_policies_attachments_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_potential_clickfix_execution.eql,sha256=twZnJrycGxeJe8BDq67FRbYyP6D9C0MteAs8P84H2b4,648
src/rules/windows__registry__registry_set__registry_set_potential_clickfix_execution.lucene,sha256=jbWuCJJA9_LPxGJYQRH4ws2rsFk7DCMPAd-T6HHlLgE,619
src/rules/windows__registry__registry_set__registry_set_potential_clickfix_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_as_service.eql,sha256=SuDpycojtqFZbx6BjXINtq8rEbrL4o2_AiXb6zVqJdA,138
src/rules/windows__registry__registry_set__registry_set_powershell_as_service.lucene,sha256=tEzlCFqxfycZ831B2xbUOqep4V-CxOxX31CvQ71KnYI,116
src/rules/windows__registry__registry_set__registry_set_powershell_as_service.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_enablescripts_enabled.eql,sha256=lUdDzqfKKEWeSuiw1IzS7W77JhRV9g236U_oSArVH1w,136
src/rules/windows__registry__registry_set__registry_set_powershell_enablescripts_enabled.lucene,sha256=Xd_B2zUOjb7q2ZwEGd-tmfKey3lmBKUzJGOMRrB9aK4,125
src/rules/windows__registry__registry_set__registry_set_powershell_enablescripts_enabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_execution_policy.eql,sha256=fs7X9bQ7wnz80FtBYlN5QbumlGNP7Nuup68pdTgHwzM,314
src/rules/windows__registry__registry_set__registry_set_powershell_execution_policy.lucene,sha256=tXWFpfZlII7KznD-mYXlOfPpxvI98aarQRAhbiZkdog,282
src/rules/windows__registry__registry_set__registry_set_powershell_execution_policy.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_in_run_keys.eql,sha256=qwtcZIF5CNxfKyziPpdjtboYgoK2EzNs0q3tAN9py_A,672
src/rules/windows__registry__registry_set__registry_set_powershell_in_run_keys.lucene,sha256=vRFgpVDgAdQrIFyjjhFk96Dooorq3dnXRDR4hIfOZ2o,685
src/rules/windows__registry__registry_set__registry_set_powershell_in_run_keys.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_powershell_logging_disabled.eql,sha256=kcmnjrQuTxNOMdi5Fi3kGDIkDa9oLgGXlhvORTFgASA,442
src/rules/windows__registry__registry_set__registry_set_powershell_logging_disabled.lucene,sha256=Wh_oj8R_TAu9vI1sC_wk9E2rExtEpk8dPRa_CkUzwMM,417
src/rules/windows__registry__registry_set__registry_set_powershell_logging_disabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_provisioning_command_abuse.eql,sha256=3nVRpdaFA3tIY71vj-pV04A51YxHADgKaWd2dTSX9xY,75
src/rules/windows__registry__registry_set__registry_set_provisioning_command_abuse.lucene,sha256=_fTow8lXs4XFIlTbplAEHCTvLluIKcnULUqtPyC3hzU,63
src/rules/windows__registry__registry_set__registry_set_provisioning_command_abuse.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_execution_via_eula.eql,sha256=oW4tlA-iLHiJpaVEsyo6N0r1HH64L_6aF0ZCgTEK1K8,42
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_execution_via_eula.lucene,sha256=8S8AjkGB46RSzQz0rUiX_-6NZ7XZy5u0GLVmm3Ax7Yk,30
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_execution_via_eula.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_renamed_execution_via_eula.eql,sha256=i0BiHx8EcQxkXwi6WCr_l_VWWKmdWtHpa73FCq4-7hg,773
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_renamed_execution_via_eula.lucene,sha256=VTME-QmzNFoLPhjlP4htcUPbOHNq7sLYNxgMKOi1Qv0,748
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_renamed_execution_via_eula.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_susp_execution_via_eula.eql,sha256=0ZVpL4YXtV0PDiMkAPSgP1nGb2eObG6_rHJ1Uynx6cg,252
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_susp_execution_via_eula.lucene,sha256=gJX0DklRGJPdiCYm5pQRvcvoS0SwlMCSptQmefyb1t0,235
src/rules/windows__registry__registry_set__registry_set_pua_sysinternals_susp_execution_via_eula.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_renamed_sysinternals_eula_accepted.eql,sha256=2FIfnkUpsNjacCqwNEbGvdO7PQ0AiI-bERwgupX5Skc,649
src/rules/windows__registry__registry_set__registry_set_renamed_sysinternals_eula_accepted.lucene,sha256=MtE7Ys-MSNKuLz6As-20nkKjTlftWdIImnZiSdwgVM8,627
src/rules/windows__registry__registry_set__registry_set_renamed_sysinternals_eula_accepted.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_rpcrt4_etw_tamper.eql,sha256=eXw5d_wN_dqZEltypk7deG7XrneGwx0AKeoMFwe4Crk,160
src/rules/windows__registry__registry_set__registry_set_rpcrt4_etw_tamper.lucene,sha256=TAIqEAXEU6eTRlgEJZJI7mTmU2ktuYjEUmGqecymo_k,147
src/rules/windows__registry__registry_set__registry_set_rpcrt4_etw_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_runmru_susp_command_execution.eql,sha256=4mdULI9qNkRLo49sG76wU4VqFmQ7adc_xFjFjuwlwuU,420
src/rules/windows__registry__registry_set__registry_set_runmru_susp_command_execution.lucene,sha256=6FAch846SLY_3vgvK5ji42K7HVZLxW4DVhd04EgcUUQ,399
src/rules/windows__registry__registry_set__registry_set_runmru_susp_command_execution.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_scr_file_executed_by_rundll32.eql,sha256=9pFfV9XsIgpV_emURq9SV_uMIq8U5-A5cAHPaoChIzc,249
src/rules/windows__registry__registry_set__registry_set_scr_file_executed_by_rundll32.lucene,sha256=oOALBwfDQ4_4LNLpP4pBltQ6rK7Lw9__C7YD-LvKswY,228
src/rules/windows__registry__registry_set__registry_set_scr_file_executed_by_rundll32.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_sentinelone_shell_context_tampering.eql,sha256=xH9c-MiUg-7lD8_Tu11zRXrIobIJ0tjdZLAoUHDIMkE,399
src/rules/windows__registry__registry_set__registry_set_sentinelone_shell_context_tampering.lucene,sha256=4gRP9LNs4nN1gRoP8DilzO0_ems64R6kofNBjPzHP74,385
src/rules/windows__registry__registry_set__registry_set_sentinelone_shell_context_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_servicedll_hijack.eql,sha256=BidBljZe7A5KspAXqoyrvComDw8IHSWZcat0KevrVPg,622
src/rules/windows__registry__registry_set__registry_set_servicedll_hijack.lucene,sha256=epT8wNeZn2YHPF0uw4xFxxSda9vUKK_1MgVv4Ff3_2U,594
src/rules/windows__registry__registry_set__registry_set_servicedll_hijack.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_services_etw_tamper.eql,sha256=gjwIbb1B7euRzTYC420-x4_dtpNPImQK96IZMp7X6DY,166
src/rules/windows__registry__registry_set__registry_set_services_etw_tamper.lucene,sha256=q4GYfBJ4159oOd4La7rlGcfw66bLZ1zeiGe-JgeeWig,156
src/rules/windows__registry__registry_set__registry_set_services_etw_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_set_nopolicies_user.eql,sha256=rn2U3gQ7oGx0vEvjbdS9gkUkbmGwS_77Jf3ox5JhyWA,905
src/rules/windows__registry__registry_set__registry_set_set_nopolicies_user.lucene,sha256=vqQxOx69WitphUmTvVyhddWUX2i40xhD821Z1C5MB4M,888
src/rules/windows__registry__registry_set__registry_set_set_nopolicies_user.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_sip_persistence.eql,sha256=qRMXYqWU0xJ_81ima_4wK9PPcD_XakD5Ql-t_xQKUSo,574
src/rules/windows__registry__registry_set__registry_set_sip_persistence.lucene,sha256=5xOOLbDTy8eJF-XLFFoQfMMqFYXoaETKkqLWtoEygeE,536
src/rules/windows__registry__registry_set__registry_set_sip_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_sophos_av_tamper.eql,sha256=hd11mdkSm9NRIQ9QiEUjx8B9nbKBlAtSCxAgFTCBJYY,275
src/rules/windows__registry__registry_set__registry_set_sophos_av_tamper.lucene,sha256=BPtu8u3r5Zvv5sIUNtwCNh7yhP0ST-ZjGewUV2U7rCM,262
src/rules/windows__registry__registry_set__registry_set_sophos_av_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_special_accounts.eql,sha256=s9G68vQDJ9KZozQlubg5yrpI_KbCpURW_zoas0LbPLY,166
src/rules/windows__registry__registry_set__registry_set_special_accounts.lucene,sha256=He6y814soBNjyU9_YJyxu_y8vnOvLxM5Xdw5V5aQ8yk,156
src/rules/windows__registry__registry_set__registry_set_special_accounts.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_suppress_defender_notifications.eql,sha256=LLQlPtj088rp8vrxDN_dAyUFNw0QP5Xl1UW7ioL1RIg,167
src/rules/windows__registry__registry_set__registry_set_suppress_defender_notifications.lucene,sha256=9FjyrKP9HLjm9NOILtPhbi8I_U81f4AEPTM2Zs19JdY,158
src/rules/windows__registry__registry_set__registry_set_suppress_defender_notifications.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_keyboard_layout_load.eql,sha256=QmlnfX8iyFVv-V5UaggmrLt3Fgs14r7I_cDQLNxkIgw,184
src/rules/windows__registry__registry_set__registry_set_susp_keyboard_layout_load.lucene,sha256=ZX4K86MqCZa86xWQdbz4Yk1eCfdKlghS_RGj6Ox5j54,160
src/rules/windows__registry__registry_set__registry_set_susp_keyboard_layout_load.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_pendingfilerenameoperations.eql,sha256=kZgQt8NsCx3BbxL7wpz931sg9GXnc_a2DV2tbFDxqDE,212
src/rules/windows__registry__registry_set__registry_set_susp_pendingfilerenameoperations.lucene,sha256=qA8gv0H6OqN0_ETrFUuYYgJExweF207Nf3qcDL2zdFk,191
src/rules/windows__registry__registry_set__registry_set_susp_pendingfilerenameoperations.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_printer_driver.eql,sha256=KmNeSbwS5L8OUK_2d3S9TuY_yWz7InfkaQ6ObgYA5s0,332
src/rules/windows__registry__registry_set__registry_set_susp_printer_driver.lucene,sha256=p4pdzOMLAEhU4eb859QzacGKz9rSJOXEfdG8HA0h6ic,318
src/rules/windows__registry__registry_set__registry_set_susp_printer_driver.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_reg_persist_explorer_run.eql,sha256=ahcH2c2OujUE9AVMN1kYjlubfgtIGH4_TL0A2o5-4jw,284
src/rules/windows__registry__registry_set__registry_set_susp_reg_persist_explorer_run.lucene,sha256=MpBVCKgDgjS1B7ErPSmErWcwltuX9mh6ZFuCsIWmSwo,270
src/rules/windows__registry__registry_set__registry_set_susp_reg_persist_explorer_run.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_run_key_img_folder.eql,sha256=yYBxN69UquFoUAwne2f6cxWaVc1WIwedFRJIi7w3b2E,1419
src/rules/windows__registry__registry_set__registry_set_susp_run_key_img_folder.lucene,sha256=B1ES5l_PfAshTGl3eXvJTLO34f7OkTd8RP3bkmFYpms,1380
src/rules/windows__registry__registry_set__registry_set_susp_run_key_img_folder.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_runmru_space_character.eql,sha256=0P-d9L9ATxmugaPy2ojuihJBBw9dAacD1txFofDqldI,681
src/rules/windows__registry__registry_set__registry_set_susp_runmru_space_character.lucene,sha256=IHIwKzy5xJgWgJUMdTWfg1maWMfzHfqctQKUVrVFFsE,671
src/rules/windows__registry__registry_set__registry_set_susp_runmru_space_character.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_service_installed.eql,sha256=G2j31R5CnvDEIz8dv8AgBHHHT_hHUeUE8VjtJDANAnw,396
src/rules/windows__registry__registry_set__registry_set_susp_service_installed.lucene,sha256=0v5PnNyJtL0zyDYWhw3gyvONJVunPUsdSvhZQzIiD_s,368
src/rules/windows__registry__registry_set__registry_set_susp_service_installed.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_typedpaths_space_characters.eql,sha256=XnICa2PCCRWfyaDc2juokx90z9rSrEoPHzhh0iCUAsw,689
src/rules/windows__registry__registry_set__registry_set_susp_typedpaths_space_characters.lucene,sha256=3ryzlbdT3llSmtgXjqdsmTwXFwrHGz_XQ8cvC-ovljk,679
src/rules/windows__registry__registry_set__registry_set_susp_typedpaths_space_characters.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_user_shell_folders.eql,sha256=aIDEwsodJP2IXh9o5mDxBpw-HKWLKboLrJAPUn1WUtc,132
src/rules/windows__registry__registry_set__registry_set_susp_user_shell_folders.lucene,sha256=widM-w_p-IyaAZGelnoSfiYIewEzT98tVkT-AdquQ6w,120
src/rules/windows__registry__registry_set__registry_set_susp_user_shell_folders.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_susp_wfp_filter_added.eql,sha256=eo5wgaNr9tiw3Ep3t9obW7UZnEf1hlt-ybq6AcQcBrI,189
src/rules/windows__registry__registry_set__registry_set_susp_wfp_filter_added.lucene,sha256=wPdAkBVmhcSbha-pHlwdVBx2chQOvgQWIPXgu4Nzbm0,171
src/rules/windows__registry__registry_set__registry_set_susp_wfp_filter_added.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_suspicious_env_variables.eql,sha256=Y9nNp4eVinlG6lP1l0ktDT0881dxl5_SSdY7sN6gi2w,608
src/rules/windows__registry__registry_set__registry_set_suspicious_env_variables.lucene,sha256=qEfMH4d-m2qwoXTpfHyqnuSpN1384XYD1-kZVnPFuWA,573
src/rules/windows__registry__registry_set__registry_set_suspicious_env_variables.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_system_lsa_nolmhash.eql,sha256=c4XRotvPWgXEm_e6pFX0VH33LoURuXUkPsjF7Z3l2NE,128
src/rules/windows__registry__registry_set__registry_set_system_lsa_nolmhash.lucene,sha256=qTDt7tgZA83Q2nRskkkqXsJjfHgQzPDW1OJ8flp2aR8,117
src/rules/windows__registry__registry_set__registry_set_system_lsa_nolmhash.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_taskcache_entry.eql,sha256=ZWHK_UPA-bqc0J60n4fnm2x-w0FvAhcnhhNkdTfC9hw,2287
src/rules/windows__registry__registry_set__registry_set_taskcache_entry.lucene,sha256=_JS-atAuMjDbCLGAPcipEYex3vxGBIGZV6WQgoLAK6Y,2273
src/rules/windows__registry__registry_set__registry_set_taskcache_entry.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_telemetry_persistence.eql,sha256=0SmsnkkwswG9U5e6WEj1Pe4984K4MEXR93g_Z1TwuZY,430
src/rules/windows__registry__registry_set__registry_set_telemetry_persistence.lucene,sha256=1Yx1d9ZKo5wI8wV5XuK_9lxHZI_K1SO0xiVVKZTOKUA,401
src/rules/windows__registry__registry_set__registry_set_telemetry_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_terminal_server_suspicious.eql,sha256=3djlWq2SH4yO8_So7Te8OVgD2GtfT83XY4m31RZcO-U,162
src/rules/windows__registry__registry_set__registry_set_terminal_server_suspicious.lucene,sha256=ShR2FY1zPGZ3poHBR9z4g_uA7b9kWc2LRrRPrpFUKiE,145
src/rules/windows__registry__registry_set__registry_set_terminal_server_suspicious.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_terminal_server_tampering.eql,sha256=8rWebGdcyVJdPQF6sVO9JLjfQzbngn-ya7z0g_mel5M,973
src/rules/windows__registry__registry_set__registry_set_terminal_server_tampering.lucene,sha256=q4HvFZ9kbp2Y_ITvXR1_VXN3ftCVWFaaExv1EhWdqok,946
src/rules/windows__registry__registry_set__registry_set_terminal_server_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_timeproviders_dllname.eql,sha256=r0_skbs9QkQubvEMuEqRaOH70UbZby_fKzTJLwkkRAA,266
src/rules/windows__registry__registry_set__registry_set_timeproviders_dllname.lucene,sha256=M5RCuB9vb2JUdQ1QOy1scnquZLVbAlJn6wJqI40B6xE,245
src/rules/windows__registry__registry_set__registry_set_timeproviders_dllname.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_tls_protocol_old_version_enabled.eql,sha256=-jDFauWZNqNn7A5oVI-NTbQ9DvPBG834jnqsIZ9hwX8,245
src/rules/windows__registry__registry_set__registry_set_tls_protocol_old_version_enabled.lucene,sha256=UmJ8_7iyET0T0K7VpaAxKJgvHwNAY5TJVz2vJjlHXSg,228
src/rules/windows__registry__registry_set__registry_set_tls_protocol_old_version_enabled.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_treatas_persistence.eql,sha256=ioP70HemM6-xgk5B5ANix61YlO6cdtVsdSGzUExBens,545
src/rules/windows__registry__registry_set__registry_set_treatas_persistence.lucene,sha256=hRlOePx-lrd9ih8VzH21bLs4q0A2evmvEit55WBbHeg,529
src/rules/windows__registry__registry_set__registry_set_treatas_persistence.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_turn_on_dev_features.eql,sha256=xla8-Z5OjAMo8Z5EoQXDg4ylonvTPyaKwhGiSVpgptY,278
src/rules/windows__registry__registry_set__registry_set_turn_on_dev_features.lucene,sha256=zfpeaki-HHGLJEgYv24XTFkv_jz587I5BbZ2Zmo9Nz4,253
src/rules/windows__registry__registry_set__registry_set_turn_on_dev_features.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_bypass_eventvwr.eql,sha256=Sm8La_QWcNolj2i1oAQswUF2IhHWQkshjxNnKrU5Wqs,59
src/rules/windows__registry__registry_set__registry_set_uac_bypass_eventvwr.lucene,sha256=obM48ze8oeKHTykDF4jKuMoKsv0-T24fOIk-R9r9ir8,47
src/rules/windows__registry__registry_set__registry_set_uac_bypass_eventvwr.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_bypass_sdclt.eql,sha256=Uv_qHy7NapPcw6NiJGn4jIC_RNn8zF3ollrTBiEaOOg,314
src/rules/windows__registry__registry_set__registry_set_uac_bypass_sdclt.lucene,sha256=Vaq2fWTJuHp7rv6zn_4-_oQ3WHBzpEYlDcDMa_4OeI4,315
src/rules/windows__registry__registry_set__registry_set_uac_bypass_sdclt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_bypass_winsat.eql,sha256=3-GJuAu3FcAsa0IGeSSUbOMGur7Eqm27fqx_zrPfNCY,237
src/rules/windows__registry__registry_set__registry_set_uac_bypass_winsat.lucene,sha256=0VYLy4XCRUD3UZaHYdhWDq3IyRqHiLVG1Oi2QyGuwSQ,221
src/rules/windows__registry__registry_set__registry_set_uac_bypass_winsat.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_bypass_wmp.eql,sha256=qbNkSCCyXo1MKqkrE-blkfsFuP-70n1zV17yJ23fF4E,219
src/rules/windows__registry__registry_set__registry_set_uac_bypass_wmp.lucene,sha256=ulOQceYsH82tdkzelD_-FUeC-agBnZN6InVS1Ukrd0Q,212
src/rules/windows__registry__registry_set__registry_set_uac_bypass_wmp.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_disable.eql,sha256=VaNw0G-ABCYOsQMpysCJNmO44-IxRJe8Z-CboBhY_iA,145
src/rules/windows__registry__registry_set__registry_set_uac_disable.lucene,sha256=llqeCpyXnHy2w8AhxS4LO2sWm6g0HJGIgAtbJp4EcEg,134
src/rules/windows__registry__registry_set__registry_set_uac_disable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_disable_notification.eql,sha256=8iJQrNxYK1-clwQpBKQMRxakQN4_tcjaTcP0-6WRX_o,126
src/rules/windows__registry__registry_set__registry_set_uac_disable_notification.lucene,sha256=zDOr9M5jYu6eETCMUmLAt-3LCn4_jv7JjvLqzVauQB4,116
src/rules/windows__registry__registry_set__registry_set_uac_disable_notification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_uac_disable_secure_desktop_prompt.eql,sha256=eKAmJxBt7LnhOk2UgoQnxucJvl9X7jvHtkh4MVAPJ4o,157
src/rules/windows__registry__registry_set__registry_set_uac_disable_secure_desktop_prompt.lucene,sha256=BcCLhUTgWj0KmZCdDyANrN3DCwdtZQxjt_-vIfjIcEQ,146
src/rules/windows__registry__registry_set__registry_set_uac_disable_secure_desktop_prompt.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_vbs_payload_stored.eql,sha256=utKqJ9pLb4mhwmaliLMceVObozexkr_VTOYXi4LsE-Q,642
src/rules/windows__registry__registry_set__registry_set_vbs_payload_stored.lucene,sha256=pzMvNbzmHnSW-IMcRAoIvdawRg-HwXbtyZ4hdtZ6b0Y,617
src/rules/windows__registry__registry_set__registry_set_vbs_payload_stored.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_wab_dllpath_reg_change.eql,sha256=V8xe9Mp5lgGl0n2jb-NkRvxaYSaYgXncqCNqrQpzQJ4,141
src/rules/windows__registry__registry_set__registry_set_wab_dllpath_reg_change.lucene,sha256=Uzhn6Zeqb_7xDPE1wBqVtjlnUos3SuQv4JBRqGG5VIA,127
src/rules/windows__registry__registry_set__registry_set_wab_dllpath_reg_change.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_wdigest_enable_uselogoncredential.eql,sha256=xu2jcvUGtFaj4rF_8C-lBg9p_a1ITqybwY74Pc1qrcg,106
src/rules/windows__registry__registry_set__registry_set_wdigest_enable_uselogoncredential.lucene,sha256=o9DKoSB_iYil04g0xGbNRsQ9s4FSKh-VzGmTy9Zp9eE,95
src/rules/windows__registry__registry_set__registry_set_wdigest_enable_uselogoncredential.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_windows_defender_tamper.eql,sha256=HWptkea1Vl6I8DfaHvAAhBFen0pF61QXzwY1fjehnpQ,1164
src/rules/windows__registry__registry_set__registry_set_windows_defender_tamper.lucene,sha256=7MGMlRIR8It_Xx7Tt-OlRwSx-9laIIdv3-k63VtcKbs,1143
src/rules/windows__registry__registry_set__registry_set_windows_defender_tamper.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_winget_admin_settings_tampering.eql,sha256=Nv_obmv8zT2123k09Gi-vv7Yk3AsmRNsb9tcloSi9n0,131
src/rules/windows__registry__registry_set__registry_set_winget_admin_settings_tampering.lucene,sha256=jZzLdG6nhbQu8pXcIcmvDM54bCYgST-BUl2mP8VT3ns,115
src/rules/windows__registry__registry_set__registry_set_winget_admin_settings_tampering.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_winget_enable_local_manifest.eql,sha256=lS_n08xsMZk8Ctdtzs6ogiErkLN7VZRVsY-oyZ8CHR4,119
src/rules/windows__registry__registry_set__registry_set_winget_enable_local_manifest.lucene,sha256=KMFRrstlIQEZ11HZ-ljxHGEkHYU3Z5Kg5pUlWN-MdL8,108
src/rules/windows__registry__registry_set__registry_set_winget_enable_local_manifest.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_winlogon_allow_multiple_tssessions.eql,sha256=e1_xGiHTJkCsVruTah8_HvbaKkrbd0IKVh-mRGZW6Y0,154
src/rules/windows__registry__registry_set__registry_set_winlogon_allow_multiple_tssessions.lucene,sha256=DMJqszpw_hEbaKNMrAITVAvRno6cvnmdEdOKgKsDhXY,144
src/rules/windows__registry__registry_set__registry_set_winlogon_allow_multiple_tssessions.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__registry__registry_set__registry_set_winlogon_notify_key.eql,sha256=vzhBhPxbF-7yEjkmFtCXjEZZqv5urbaallU2jtyBf1c,140
src/rules/windows__registry__registry_set__registry_set_winlogon_notify_key.lucene,sha256=HEWBaHkMDzQ4JJ0xx4zX_J7GjqZncJtt48G-SI9nvOo,127
src/rules/windows__registry__registry_set__registry_set_winlogon_notify_key.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_config_modification.eql,sha256=23RJnUxhW3oNx1sUPywwLd5pLxZ5UUj24zO9Rk-ifR4,84
src/rules/windows__sysmon__sysmon_config_modification.lucene,sha256=FyQCm1Y7hfjyf64rxoAsT12l1x6jYg1X69lOcyLeBko,73
src/rules/windows__sysmon__sysmon_config_modification.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_config_modification_error.eql,sha256=JhOLKu32v37GQa522ZpQE7H1b1McDZUN6CtUqqzt0Mw,493
src/rules/windows__sysmon__sysmon_config_modification_error.lucene,sha256=Kvj2KdyWdpNftPq6UsUHcCOVn9NXTKF6F86QyTs6-2E,504
src/rules/windows__sysmon__sysmon_config_modification_error.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_config_modification_status.eql,sha256=RIeYp9zSD-T29oNA3UivVWvFhO0F_iwycDEhSvJXVXc,123
src/rules/windows__sysmon__sysmon_config_modification_status.lucene,sha256=g893PkVvTfStzt4AaOBuTlN0VszsGaSXPQTSUCCHPv0,112
src/rules/windows__sysmon__sysmon_config_modification_status.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_file_block_executable.eql,sha256=lLexBcRjjuu0ecK7syQtlxyt80t_lNi00mVcz-_HXeI,84
src/rules/windows__sysmon__sysmon_file_block_executable.lucene,sha256=fH0POscFFu2a_NygkAK6nrNQi8mJKs0ssc6EZnCBAic,73
src/rules/windows__sysmon__sysmon_file_block_executable.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_file_block_shredding.eql,sha256=H01Z6Johtcwljq0u07GECURzKoU1jPl7otQe9Nrk63o,84
src/rules/windows__sysmon__sysmon_file_block_shredding.lucene,sha256=tDv7JLKctmiYgXMRpCyBoAbg0hTNXo2Nga_WH57Mlek,73
src/rules/windows__sysmon__sysmon_file_block_shredding.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__sysmon__sysmon_file_executable_detected.eql,sha256=O4zn-QI28JVWu8yPItP7DEkZPyds5-OM1Zt-FMeKpXk,84
src/rules/windows__sysmon__sysmon_file_executable_detected.lucene,sha256=XpeCcEKv9L8wR6c1wWhnKXS9Tl4oW9kQmnwkwGyf7B4,73
src/rules/windows__sysmon__sysmon_file_executable_detected.lucene.err,sha256=cv0sYjVbsTn1h7ShIaEPhzK9-zRPVMz8remvZ_XWgWU,20
src/rules/windows__wmi_event__sysmon_wmi_event_subscription.eql,sha256=MJIc453qvvBqE_m9lJfFxs60xjFHT7TP7sr9OgLOSSs,46
src/rules/windows__wmi_event__sysmon_wmi_susp_encoded_scripts.eql,sha256=Owfog7xMP3DZvw194Ku3zYBG3k03hwVVHkQ-A0vbMlU,510
src/rules/windows__wmi_event__sysmon_wmi_susp_scripting.eql,sha256=Aqm6fJhG0yD49eAjYm2LUCH6E_zyHbQHKPgACVJ1b9M,423
src/detection-rules/hunting/README.md,sha256=J08JuZnAVzFttqj_FxrNxziJtEaRaqjg7J-2rA68V-M,10918
src/detection-rules/hunting/__init__.py,sha256=1jOKw_YxwyKjF-TPLEx38sWW7wvWpvU0QmFeYMvlfGU,242
src/detection-rules/hunting/__main__.py,sha256=x6cDT67yspV7Mt_4Xh7C39CoKwLUf9aVJYnsFIzMeqc,10841
src/detection-rules/hunting/definitions.py,sha256=OvFTQ8-dUki8szAyuGkCtk5HqboW4I_7_dDYlHakImU,2386
src/detection-rules/hunting/index.md,sha256=Kra7hv0bC1uigQjjPsihi1FIZ7zobq4GZpC2wPnuBoQ,17494
src/detection-rules/hunting/index.yml,sha256=kyZTYFXyVM8KrDk5q4Jd9baOwFx9dQYljsqXWI_zg2k,29276
src/detection-rules/hunting/markdown.py,sha256=qD4sSU6tA_YD4482rboTob7zr2WCj-bMQS3e4C6w8EA,6846
src/detection-rules/hunting/run.py,sha256=gRn9r7Xgm1k-KRrlgsX1M90nBhWQRvNdAPUgWucAigA,3216
src/detection-rules/hunting/search.py,sha256=My3MHdY7aBKsGAh9InKB5eDaO0Yi2BUgmMd18DaF28s,9588
src/detection-rules/hunting/utils.py,sha256=EB6n0bPH4VY7zEqXmX9A8mVv-zYFwqq74C7tCS2V8iM,4679
src/detection-rules/hunting/aws/docs/ec2_discovery_multi_region_describe_instance_calls.md,sha256=qbtcrSUbAFJoSvpBUcdLsPTYwiGbNVD0bf7g5XNweHg,2320
src/detection-rules/hunting/aws/docs/ec2_high_instance_deployment_count_attempts.md,sha256=uTPm5QtS9D6RxyNTh6_lcnS-QAKvJ-uVT2QLJM_M47I,2446
src/detection-rules/hunting/aws/docs/ec2_modify_instance_attribute_user_data.md,sha256=nh0CHX0O9-txl996UNXT4i45PXqy1GNIyNeZ8hZKD9s,1970
src/detection-rules/hunting/aws/docs/ec2_suspicious_get_user_password_request.md,sha256=MsA-UWJFujejKH3Qc2dDg1EjXzlT698v6xKuu3kYtLM,1997
src/detection-rules/hunting/aws/docs/iam_assume_role_creation_with_attached_policy.md,sha256=aqBrK9iGu2qeUW7aZSAp2VUELhdgKviUBOb4PYl2vSs,2082
src/detection-rules/hunting/aws/docs/iam_customer_managed_policies_attached_to_existing_roles.md,sha256=gGiHXqYnHNJtQvMlCW6ZxGL5bmuI-wyd8ah-IAX75vs,2204
src/detection-rules/hunting/aws/docs/iam_unusual_access_key_usage_for_user.md,sha256=yM7g43SoT_4Ooc3U0_ALSyA-iH-wK0Ci0Fk85OUt0XM,3271
src/detection-rules/hunting/aws/docs/iam_unusual_default_aviatrix_role_activity.md,sha256=8gMJKf6ptVsg2FU5lDkEebz9o9ulKs1z-28v3b-BX70,2057
src/detection-rules/hunting/aws/docs/iam_user_activity_with_no_mfa_session.md,sha256=g_enW8bKuM4y4XUi9ZMpNq27kpY2Gvlv4xJLTTboWDg,1771
src/detection-rules/hunting/aws/docs/iam_user_creation_with_administrator_policy_assigned.md,sha256=mEl2eGL4yiOcQo0WO97BBTgwQe5jnUV8_X9rVV4wltY,2056
src/detection-rules/hunting/aws/docs/lambda_add_permissions_for_write_actions_to_function.md,sha256=MbprzSsn1Po4VKUO3NreG9gZ2vsCpprEXYyUwLRTZoM,2276
src/detection-rules/hunting/aws/docs/multiple_service_logging_deleted_or_stopped.md,sha256=TZ6Lql0oIB00Q60AdTt6jpSvUzeXCYze19WIr7e5ovY,2379
src/detection-rules/hunting/aws/docs/s3_public_bucket_rapid_object_access_attempts.md,sha256=f-Djw26A8dt81rjmo2nSyGnbAwsr_S_gSXUqQ3-9Hwc,1807
src/detection-rules/hunting/aws/docs/secretsmanager_high_frequency_get_secret_value.md,sha256=0bEIOFMtR_R9XPNUa_F4_0QwzHlMfTP19V0NVOWh29A,2409
src/detection-rules/hunting/aws/docs/servicequotas_discovery_multi_region_get_service_quota_calls.md,sha256=wtJrtKL8Q-_9wdtrtM2rsOK_IcyqsGHjpDrzmWd6sdk,2996
src/detection-rules/hunting/aws/docs/signin_single_factor_console_login_via_federated_session.md,sha256=zNwgRWAQdcIbLdcY_rxEV-ji3957CwQR5nGHpJPqmdo,2074
src/detection-rules/hunting/aws/docs/sns_direct_to_phone_messaging_spike.md,sha256=8nrUOGdMkG52I6bA7WETHA0u621Jvy73sxiOnDCZyeg,2308
src/detection-rules/hunting/aws/docs/sns_email_subscription_by_rare_user.md,sha256=JZhnguOHB4EuBKsXcEuKasw_3t-rewCmpjOAdf7vl78,2069
src/detection-rules/hunting/aws/docs/sns_topic_created_by_rare_user.md,sha256=nrogtwckNTDckrQn422gaBmWq9XJelZ6gbVZ55msYgg,2036
src/detection-rules/hunting/aws/docs/sns_topic_message_published_by_rare_user.md,sha256=29EDTXE6gni-9_fWgjdumgRfcTcD0EsDtsi_lBkw2Rg,2021
src/detection-rules/hunting/aws/docs/ssm_rare_sendcommand_code_execution.md,sha256=uV3ovmGY-bRLOnnz5JjBNyq9koj3KAzEiIQukKOEIqA,2198
src/detection-rules/hunting/aws/docs/ssm_sendcommand_api_used_by_ec2_instance.md,sha256=HBmrkb5NaIS6FrT6VJL-5_lFZ0vKSKbdpYzx8-z91pA,1414
src/detection-rules/hunting/aws/docs/ssm_start_remote_session_to_ec2_instance.md,sha256=2edp8T9wsRh_cAl7pIBMDMiFSHWDA9K4trZuFV3ZbIQ,2159
src/detection-rules/hunting/aws/docs/sts_suspicious_federated_temporary_credential_request.md,sha256=dJ_afo1FFvWRQZf64S-7ICJl90fhGRsfUGOq0FLzyL0,2619
src/detection-rules/hunting/aws/queries/ec2_discovery_multi_region_describe_instance_calls.toml,sha256=RvXAHwY6XDYzJYTjMxWK461mD6VHuEAdTI8QgX5U4M8,2041
src/detection-rules/hunting/aws/queries/ec2_high_instance_deployment_count_attempts.toml,sha256=0QL6oc7qDsy8ztH1EWmjQ73fdZlBKAARqHkh6NpgpjQ,2175
src/detection-rules/hunting/aws/queries/ec2_modify_instance_attribute_user_data.toml,sha256=X6sogSJKCP5PKIWjAL8jwPHfw8MnyZYZB52zuM1dixA,1678
src/detection-rules/hunting/aws/queries/ec2_suspicious_get_user_password_request.toml,sha256=PYabJ50wvpUgvkXeXALrzu8W8JqdSu9gRMWz8rN_OW0,1734
src/detection-rules/hunting/aws/queries/iam_assume_role_creation_with_attached_policy.toml,sha256=qsE7XqdntbsiVVmvVtsHUFC10RL5S1Kk3Q5lDd7Tksw,1808
src/detection-rules/hunting/aws/queries/iam_customer_managed_policies_attached_to_existing_roles.toml,sha256=WltnHliT1ekQsPAy-YdO58NQU0DjcR30ZhPVXZExgmM,1907
src/detection-rules/hunting/aws/queries/iam_unusual_access_key_usage_for_user.toml,sha256=BJpEZaeHM3CPaYIDv6IULvhIe_nN8XBvKuW1pVQJppI,3009
src/detection-rules/hunting/aws/queries/iam_unusual_default_aviatrix_role_activity.toml,sha256=dQe_GrG3AcWBWmGqmRF32UaGmoruF5Seopm78vdDBm4,1791
src/detection-rules/hunting/aws/queries/iam_user_activity_with_no_mfa_session.toml,sha256=ObjZCTOAuLXyXbqSV_8l8SZNTHBKRlGyjAL5p6WjoTs,1510
src/detection-rules/hunting/aws/queries/iam_user_creation_with_administrator_policy_assigned.toml,sha256=eDgwcGpujX3CPQVg3QGBqtNCJFY6NXoKt7IWDxeKFSM,1724
src/detection-rules/hunting/aws/queries/lambda_add_permissions_for_write_actions_to_function.toml,sha256=KFt-pP52qnT8E1GhLx4PPFePxfcQwxE1zx6dj_DmgOc,1988
src/detection-rules/hunting/aws/queries/multiple_service_logging_deleted_or_stopped.toml,sha256=I8R3NArCICHquJXj549kVK3uplNatZ-c6Dxn-4cIKdE,2111
src/detection-rules/hunting/aws/queries/s3_public_bucket_rapid_object_access_attempts.toml,sha256=vrZ3Qw1WIRykQVQzGG5WJ1o_t37qJinAUING15ZUlpE,1535
src/detection-rules/hunting/aws/queries/secretsmanager_high_frequency_get_secret_value.toml,sha256=ufDFhLQXj4SmSqzhd3zUTtE0aJsuTv4C7dwyd3LapDI,2108
src/detection-rules/hunting/aws/queries/servicequotas_discovery_multi_region_get_service_quota_calls.toml,sha256=OZjBzR4bx7EWxfCUcMwk-I1mORdCchPoGwT57ojJPPU,2708
src/detection-rules/hunting/aws/queries/signin_single_factor_console_login_via_federated_session.toml,sha256=6AnZPFQDO8oRbZro26iti67BaUTTy3cV73_8AXD9nUE,1775
src/detection-rules/hunting/aws/queries/sns_direct_to_phone_messaging_spike.toml,sha256=vWracb71w1u9TUM6YiSiS2dW4MJy4kr6oAgE46AmCx4,2214
src/detection-rules/hunting/aws/queries/sns_email_subscription_by_rare_user.toml,sha256=m-BPeel6Ra2O16gkmrBirUGDF3BihF7Ww4Jrt0daBKg,1859
src/detection-rules/hunting/aws/queries/sns_topic_created_by_rare_user.toml,sha256=Hlw_GAamslwfiBzHrPRQT9MN3t3ah0cK8OIglbWqQOQ,1887
src/detection-rules/hunting/aws/queries/sns_topic_message_published_by_rare_user.toml,sha256=0_7wPXs3O_IG9gI_X9eVEy9vUXcAvUqfE_4lOZhCQ4I,1814
src/detection-rules/hunting/aws/queries/ssm_rare_sendcommand_code_execution.toml,sha256=g8b8aL2bedoC1OwQMHCNNbRTf2vrEixnn7nNMyZaONo,1931
src/detection-rules/hunting/aws/queries/ssm_sendcommand_api_used_by_ec2_instance.toml,sha256=EmUS-yEWE1HS0d-5sdYr-WagVaf82uwSmL55nuT-g_8,1152
src/detection-rules/hunting/aws/queries/ssm_start_remote_session_to_ec2_instance.toml,sha256=huA7mDEimsfNRiYAwXKIapqCkB1ReNSHZZ1bX4zfxDQ,1914
src/detection-rules/hunting/aws/queries/sts_suspicious_federated_temporary_credential_request.toml,sha256=G1pgJqF9ulZPu_oPqfR9fUrYI3HNP4D_nON69zSVSpI,2327
src/detection-rules/hunting/azure/docs/entra_authentication_attempts_behind_rare_user_agents.md,sha256=uzb6QbIAutcwIfpicQt5GceBPJjWfYblT7iJ-vuP1HU,5020
src/detection-rules/hunting/azure/docs/entra_authentication_attempts_from_abused_hosting_service_providers.md,sha256=Y2kDlZQtHBlNU0I6HPCMg_9HEB61E6CLiDnIYNezZr8,5924
src/detection-rules/hunting/azure/docs/entra_device_code_authentication_from_unusual_principal.md,sha256=O3qM5xTU7_f0p1YX8Y3iEIEPhSSHhg1JU0rmCZ6061Y,4068
src/detection-rules/hunting/azure/docs/entra_excessive_non_interactive_sfa_sign_ins_across_users.md,sha256=Xx2Cja0VYM0_o6Iljia_TdBFNmxWDPzjTie1zJE9FiA,4139
src/detection-rules/hunting/azure/docs/entra_rare_actions_by_service_principal.md,sha256=0p4djDxUNwI43dkawrhI1rpbXpocGdVvd6CLTP-wUn8,4223
src/detection-rules/hunting/azure/docs/entra_service_principal_credentials_added_to_rare_app.md,sha256=DujDm0Hg26Av3lS9LYdFOEemAgvEjW3e0ZDua4LhPVE,5357
src/detection-rules/hunting/azure/docs/entra_suspicious_odata_client_requests.md,sha256=zN0Hi1zB1sgTuyK35V3bMTLhUGedOI1l1FQO-K3L76s,4754
src/detection-rules/hunting/azure/docs/entra_unusual_client_app_auth_request_on_behalf_of_user.md,sha256=ZmgEvaSF_qUbmrPqsgUxZN-I5nrYFW_PSquuEQ7HhFU,3797
src/detection-rules/hunting/azure/queries/entra_authentication_attempts_behind_rare_user_agents.toml,sha256=gAlT4M8aU2JO8S2qc5iZKZw_1zTR54pY5f32MRLax3w,4705
src/detection-rules/hunting/azure/queries/entra_authentication_attempts_from_abused_hosting_service_providers.toml,sha256=q9ci3ixhaUCnPXPT4i5LYKsAHKvZUn9dSl1Y8GliLJk,5661
src/detection-rules/hunting/azure/queries/entra_device_code_authentication_from_unusual_principal.toml,sha256=znR-AE9ulMOU5Hii-c4DosrrKjdjFXj6RvoZYl2fg2E,3779
src/detection-rules/hunting/azure/queries/entra_excessive_non_interactive_sfa_sign_ins_across_users.toml,sha256=MEhJBXL9KlehZFxpr5qgYMRtyrjOkyoqvbwsTLvcZac,3829
src/detection-rules/hunting/azure/queries/entra_rare_actions_by_service_principal.toml,sha256=snWuywwt59QodUUpZyzhoiV19eiRgdnkIH1Mdg9t1o4,3921
src/detection-rules/hunting/azure/queries/entra_service_principal_credentials_added_to_rare_app.toml,sha256=bfGgYGpp_7HbYvS_vb1kqm5bBKRsCTY32LZHQrF3dEI,5100
src/detection-rules/hunting/azure/queries/entra_suspicious_odata_client_requests.toml,sha256=u7QBTObf7FOZeE4oHiLTK1rv6dm93Vs9IB2ByC1U0MM,4343
src/detection-rules/hunting/azure/queries/entra_unusual_client_app_auth_request_on_behalf_of_user.toml,sha256=TaIoJk9ByJqE5_Y8CIO2EHg_ziGVXEieAzSU1I13hUA,3466
src/detection-rules/hunting/cross-platform/docs/potentially_spoofed_microsoft_authentication_domain.md,sha256=Jw0MA4QYWF0rm9aHpaDF-3FOw2hs_9r9kAxy96m7r0k,3794
src/detection-rules/hunting/cross-platform/queries/potentially_spoofed_microsoft_authentication_domain.toml,sha256=X4BzmTYXRijvlDP0KYKWZ2fb3kUB7Lu0p60_8IckDWQ,3296
src/detection-rules/hunting/linux/docs/command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.md,sha256=B3J0IB4oEOXE7_slzV0MFd7REUuiWd1ERdm5nRkcpRg,4487
src/detection-rules/hunting/linux/docs/command_and_control_via_unusual_file_downloads_from_source_addresses.md,sha256=1rk4RK8gXtlk92eXqsdwPCA1mZrM_5j4VLd1atvbnvE,1788
src/detection-rules/hunting/linux/docs/defense_evasion_via_capitalized_process_execution.md,sha256=RCD2YfQIGGf7g_2xkQEY6-wrsux7xb1IC30CZTc3bUA,1754
src/detection-rules/hunting/linux/docs/defense_evasion_via_hidden_process_execution.md,sha256=DcFGnx0Vgz8KXwxrZoIfo_fRsy2XJpOWf4fkekm2PTo,1548
src/detection-rules/hunting/linux/docs/defense_evasion_via_multi_dot_process_execution.md,sha256=FD1-Bzh-dsWmmZdjeWA84hDmL_k28So28xw4m9NUN4c,1512
src/detection-rules/hunting/linux/docs/excessive_ssh_network_activity_unique_destinations.md,sha256=P2LlTizWaCd7W5sdzETzE0Fa4U5sp1Sa7KNacKTb3bo,1755
src/detection-rules/hunting/linux/docs/execution_uncommon_process_execution_from_suspicious_directory.md,sha256=PzhuiPSMSkLdo1HkLCn_IdKsmddi5g2HKS6Wx1MhhGc,2649
src/detection-rules/hunting/linux/docs/login_activity_by_source_address.md,sha256=_f7Igg1ZvqP9Wz9VTBBjRjsEej3bqYgtVwyaq5lCzfY,2078
src/detection-rules/hunting/linux/docs/low_volume_external_network_connections_from_process.md,sha256=9N-GfOpE5O6cWEBNB60GDk7hzkTD0qDIPr-4X03JPfA,3244
src/detection-rules/hunting/linux/docs/low_volume_gtfobins_external_network_connections.md,sha256=31nb8PhzKxQyoVgdWUleF8qAK5PUcqjy280vUeUW_MU,2554
src/detection-rules/hunting/linux/docs/low_volume_modifications_to_critical_system_binaries.md,sha256=qSsNxrIQNHYnWzkXRMX22iHk4fIIY5kDjg0j1TkuJBQ,2408
src/detection-rules/hunting/linux/docs/low_volume_process_injection_syscalls_by_executable.md,sha256=hahKwxTcEGjJEAv3_NAkA8XaOR2sZ6ymgQ9YOBf8H-0,1575
src/detection-rules/hunting/linux/docs/persistence_general_kernel_manipulation.md,sha256=f6mMFnZQ2zzw1oeGELAGLHVjUHVgd1ixS0YBPvz__tM,3860
src/detection-rules/hunting/linux/docs/persistence_reverse_bind_shells.md,sha256=6Vk_keCLklBBgL0TtrqNYVyyywDDLQPckfFqd1hCXxM,2007
src/detection-rules/hunting/linux/docs/persistence_via_cron.md,sha256=tJ8Y4L4eKKy3zMkowN8zULmV2lUw68MqeWLVgx5TeOY,4310
src/detection-rules/hunting/linux/docs/persistence_via_desktop_bus.md,sha256=urRY5tBHGRXAbFV4M_YDmcEIHUTcfpdv6MUTJRQuTRo,4215
src/detection-rules/hunting/linux/docs/persistence_via_driver_load_with_low_occurrence_frequency.md,sha256=Lc8F5nXUDlEZ6FdtdvIULMtWoRxGJJSdEGZCbGdY4Os,1999
src/detection-rules/hunting/linux/docs/persistence_via_dynamic_linker_hijacking.md,sha256=aE7dZv-xtrAMsuUWqkr5W18sOFuXN2UYQnkkpE-icd8,4063
src/detection-rules/hunting/linux/docs/persistence_via_git_hook_pager.md,sha256=7QbJF_R9957cEztw6_px34_C9AJ8CHvRT0524lGSEUo,3642
src/detection-rules/hunting/linux/docs/persistence_via_grub_bootloader.md,sha256=kT98EdohVZKqTfbRJxjvNuuUtW4gal4MCc7BsZKO-2c,4592
src/detection-rules/hunting/linux/docs/persistence_via_initramfs.md,sha256=WqmeeZWO-f4eGcsqpch_HmjkjBeq-4QfqSrN0XIRF9k,3733
src/detection-rules/hunting/linux/docs/persistence_via_loadable_kernel_modules.md,sha256=cUF5IqNuNxg2OpiWxVSgtDijcUa3up-Ml9EsMfJDBFs,3569
src/detection-rules/hunting/linux/docs/persistence_via_malicious_docker_container.md,sha256=5n2C6FZeRoppBv_k3KvXs4pLYe4uvljbSFP_vHJMF8g,3172
src/detection-rules/hunting/linux/docs/persistence_via_message_of_the_day.md,sha256=6Js3xJ01Mamu2HRHZcQfeAGms45XT8gGk9ETgjWlZGE,3257
src/detection-rules/hunting/linux/docs/persistence_via_network_manager_dispatcher_script.md,sha256=gmJHrSnpjnDt0WrDsGqheXSmFxmlAEbhlfoUQiHp9kA,3753
src/detection-rules/hunting/linux/docs/persistence_via_package_manager.md,sha256=RKAibNEmClp9WVzSUU4fVwum6Hs7C77LFjXHUsAW7nk,3934
src/detection-rules/hunting/linux/docs/persistence_via_pluggable_authentication_module.md,sha256=Pp14ttejXVIJS1n6MS_zQ4e1tvfxEyG6zVSbZ-CX6Co,3563
src/detection-rules/hunting/linux/docs/persistence_via_policykit.md,sha256=IMWV67B_FWY9iYFBeokD9PBBTN8K83ON8ddwZctw5xc,3466
src/detection-rules/hunting/linux/docs/persistence_via_rc_local.md,sha256=h-qtjs3nNeXDq64bnH3VThtIJGxfX2F9sC5iK4Bzklg,3478
src/detection-rules/hunting/linux/docs/persistence_via_rpm_dpkg_installer_packages.md,sha256=GQwUTwU2VZh-pBmBAZx1bVMjRtA7-LyfLXyzyW2zZBQ,3694
src/detection-rules/hunting/linux/docs/persistence_via_shell_modification_persistence.md,sha256=Mqq0zgSy6d0c56eTspO-cakBYnPEtd7AhFMqQQgihdU,4542
src/detection-rules/hunting/linux/docs/persistence_via_ssh_configurations_and_keys.md,sha256=Rxd9rbUQvN7KA3ETLo4cAX7oA7nsGkfjfqw8QX285Pk,3478
src/detection-rules/hunting/linux/docs/persistence_via_systemd_timers.md,sha256=lTbq2FbFeEduwZzy17m_-nRJGrX3PPlDNNlkaMBwnBA,7196
src/detection-rules/hunting/linux/docs/persistence_via_sysv_init.md,sha256=yi7LLcVULfnpG5siIf3nYJMP4NTnwy7I0e76kAUaEg0,3400
src/detection-rules/hunting/linux/docs/persistence_via_udev.md,sha256=G-8_I-f74OxwMAseHnsWuCxkuVN6BsN_awklprVEuqM,4025
src/detection-rules/hunting/linux/docs/persistence_via_unusual_system_binary_parent.md,sha256=IHbY9wwjkIK4C19JTLwoiiRiRNzcO4ZvrGR4GeZWNbs,1930
src/detection-rules/hunting/linux/docs/persistence_via_user_group_creation_modification.md,sha256=k2LKo6EhsoDescISwuxaRn7iv4Q7CSfZJd-QIeEvmZ0,1905
src/detection-rules/hunting/linux/docs/persistence_via_web_shell.md,sha256=fF-fd0BFvRDy5ceAo4KkBYFMLNFeEAxPaz8cVu8Y07E,2721
src/detection-rules/hunting/linux/docs/persistence_via_xdg_autostart_modifications.md,sha256=tVAaTb0T_T9ETm9twnV704ppazlSd0672cDXm0nQ88I,5312
src/detection-rules/hunting/linux/docs/privilege_escalation_via_existing_sudoers.md,sha256=wS1zpnIPEGTwrcUvlKTgAnIfYyKWqbA8A7QxfsDovD4,1209
src/detection-rules/hunting/linux/docs/privilege_escalation_via_process_capabilities.md,sha256=jIAuXYpUkafwJ8PTv94n02gDz4gKro6yF7v8Szh3eSg,3039
src/detection-rules/hunting/linux/docs/privilege_escalation_via_segmentation_fault_and_buffer_overflow.md,sha256=ksoknDh4UiD18-xqesdXkft-DH_LOzoG0LvZGAod5X0,2992
src/detection-rules/hunting/linux/docs/privilege_escalation_via_suid_binaries.md,sha256=24jsOiKcfzzX4UiVJpWQv31MWZ5mZWECltWuT-bC_A0,2162
src/detection-rules/hunting/linux/queries/command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.toml,sha256=mAbfB7icGpGSW5E-jJE7JfHn_aMbQsaHYZM0vcswbBM,4113
src/detection-rules/hunting/linux/queries/command_and_control_via_unusual_file_downloads_from_source_addresses.toml,sha256=ZlFRUR2llCAgzBjLZ-qCDtwkMMduKUxl2bBv9Tnv7zI,1468
src/detection-rules/hunting/linux/queries/defense_evasion_via_capitalized_process_execution.toml,sha256=aqrM0sE9abWqAbLrZNh0uQH5LdKqIjVLlh83FeA_6l8,1447
src/detection-rules/hunting/linux/queries/defense_evasion_via_hidden_process_execution.toml,sha256=dLAcQ4lsD83r-ms91PEG9LYhr4lj-qvdlbGWqYKBHS0,1267
src/detection-rules/hunting/linux/queries/defense_evasion_via_multi_dot_process_execution.toml,sha256=8DquyDIdl60zsgqpgkv9D1l_UIXEUieNiECTNa2qkLE,1194
src/detection-rules/hunting/linux/queries/excessive_ssh_network_activity_unique_destinations.toml,sha256=G9T1zx_X8SdR2_Lgyv73zuTITVa-qbXI4OE3XDZCrwU,1439
src/detection-rules/hunting/linux/queries/execution_uncommon_process_execution_from_suspicious_directory.toml,sha256=vRR_JLIg5jjtfiDZXdeHdZEW4xYAR1PNJRlSzVNiG-g,2235
src/detection-rules/hunting/linux/queries/login_activity_by_source_address.toml,sha256=GXU928tIs9KrUOuByCxBnNGx5W5ZwXhbN7Wm1aeYB4U,1813
src/detection-rules/hunting/linux/queries/low_volume_external_network_connections_from_process.toml,sha256=3bVjM3xdMpNDqIAmK8gFgNSgWqrrj1dxmoiqa9iLVQY,2908
src/detection-rules/hunting/linux/queries/low_volume_gtfobins_external_network_connections.toml,sha256=PzLoT_ZigQDHTVDdkL2MhFom443W-VISgQyjF4qcLMo,2254
src/detection-rules/hunting/linux/queries/low_volume_modifications_to_critical_system_binaries.toml,sha256=VjjDZ46RUH_eRY8SP_BaCYMReYKignmrWQ22sCpoSLA,2081
src/detection-rules/hunting/linux/queries/low_volume_process_injection_syscalls_by_executable.toml,sha256=ZfRMKegUofjSzdgQSvLmD7q0XCdeeZhSGILSYrpAL3g,1244
src/detection-rules/hunting/linux/queries/persistence_general_kernel_manipulation.toml,sha256=xyHvUaI1M9DIKbrg8ugBdpF_kipY3UE8SfnBS2xGPBo,3620
src/detection-rules/hunting/linux/queries/persistence_reverse_bind_shells.toml,sha256=WyQCyABAr8kGx9ZJWY221yov1FjahTAZwxugkZVgTQc,1781
src/detection-rules/hunting/linux/queries/persistence_via_cron.toml,sha256=HpnED81FVzIEc36tYRhlb03DkL2GPowVaCUOHHwUVbc,4065
src/detection-rules/hunting/linux/queries/persistence_via_desktop_bus.toml,sha256=9Urdlc4VJjjMzFWL35kh30QqIVXaSpW0iDHp0ceN7DE,3989
src/detection-rules/hunting/linux/queries/persistence_via_driver_load_with_low_occurrence_frequency.toml,sha256=Vuh_zYD5pSeDEDECrnkRIf8KBitFXDr8xb079TZTaxA,1687
src/detection-rules/hunting/linux/queries/persistence_via_dynamic_linker_hijacking.toml,sha256=mTt76RtsWrBx43EbZS6DOu-u43T5gqxyYj2jv5DOkco,3823
src/detection-rules/hunting/linux/queries/persistence_via_git_hook_pager.toml,sha256=UQCUJf0qeqjSxFQksKWs6ZVy5WFCqAQcfEL64ki-HUE,3384
src/detection-rules/hunting/linux/queries/persistence_via_grub_bootloader.toml,sha256=OtTnBnUfHJSqFXzp7sXZ6dSOg9CiV2Hi2us30o7bggg,4368
src/detection-rules/hunting/linux/queries/persistence_via_initramfs.toml,sha256=36uaNDFtFpNlbYVMiLPdV1u7PZChmSr-ZHTXex0Odls,3520
src/detection-rules/hunting/linux/queries/persistence_via_loadable_kernel_modules.toml,sha256=jn3gZE5nvArK1bQFB6DyfQk6ZLL1JBbwSt7kZKB8ilc,3329
src/detection-rules/hunting/linux/queries/persistence_via_malicious_docker_container.toml,sha256=MglzSZjjK629Gn6d2Qe-VNH1hMg-lyKXajbBr4gM3v8,2931
src/detection-rules/hunting/linux/queries/persistence_via_message_of_the_day.toml,sha256=_ENLB9p8YpEEJhp7QkxauPvbODN3uQaADA_aHAYormM,2987
src/detection-rules/hunting/linux/queries/persistence_via_network_manager_dispatcher_script.toml,sha256=8S8THy-gCjY-Iqf-aWjZ-39106UlIFoEmEGRt-IDb4E,3492
src/detection-rules/hunting/linux/queries/persistence_via_package_manager.toml,sha256=9nP6-dtd9O4vyAxL1h5DOHM3f6pldRA0kT6Qu286IXc,3659
src/detection-rules/hunting/linux/queries/persistence_via_pluggable_authentication_module.toml,sha256=5nhoC6m-JRwzQP7YuPqC-vx78CntDDyLe8AhFd-mFfs,3301
src/detection-rules/hunting/linux/queries/persistence_via_policykit.toml,sha256=mazz47_4qveQ8-9YWi41sIRb08JY-t3_wqL-7PpyU-E,3256
src/detection-rules/hunting/linux/queries/persistence_via_rc_local.toml,sha256=tm5MChMGyur744qc9EI2pIqYzJNdC9lNJut12DTEntA,3167
src/detection-rules/hunting/linux/queries/persistence_via_rpm_dpkg_installer_packages.toml,sha256=NO0OWU67FGwxReMrQijnMoG36xXYLSEHg2AzBQiHlPk,3460
src/detection-rules/hunting/linux/queries/persistence_via_shell_modification_persistence.toml,sha256=Y_ZjlnOVSFXI3K1wNPZAOq5LgK2TAuyQ7fim8RnPU7A,4259
src/detection-rules/hunting/linux/queries/persistence_via_ssh_configurations_and_keys.toml,sha256=aoUAf-vPuYHV68dHn8oaejYElNjkORYhQ_I3r1obN44,3171
src/detection-rules/hunting/linux/queries/persistence_via_systemd_timers.toml,sha256=GgE2IsQlNOvGpOZmMLQtdxVTPQROwgjSo7L1lxKKHSY,6921
src/detection-rules/hunting/linux/queries/persistence_via_sysv_init.toml,sha256=raU2i8bWEVe9AKr7u9FpyF41CP_in_jc5miWzAH-k68,3193
src/detection-rules/hunting/linux/queries/persistence_via_udev.toml,sha256=zpkf_6O8SFTOSJ87mRzp_Y_m5EWUzPXUeSNrBU5XD1s,3826
src/detection-rules/hunting/linux/queries/persistence_via_unusual_system_binary_parent.toml,sha256=Kr_IjBz4CzRgQsnYlEKUyA0cLLYJM7bpXRQrSFT8zVI,1606
src/detection-rules/hunting/linux/queries/persistence_via_user_group_creation_modification.toml,sha256=U-7gpyP1cLuLHxO19X6OjYJdhN-DXKxbEo6X8md7Yfc,1509
src/detection-rules/hunting/linux/queries/persistence_via_web_shell.toml,sha256=YmTkZaZD-A-87pVGgAkhMTOcNAZ4l5LFR7rN3pkuOpw,2503
src/detection-rules/hunting/linux/queries/persistence_via_xdg_autostart_modifications.toml,sha256=LlFwWDqosgh2XSbvO7z4RCTwwkxLl3Mph9-tmHBwY1o,5044
src/detection-rules/hunting/linux/queries/privilege_escalation_via_existing_sudoers.toml,sha256=RSz9VoQVcUN9QJagbAn2wfU7zzIundkc23tuaEBJeUk,942
src/detection-rules/hunting/linux/queries/privilege_escalation_via_process_capabilities.toml,sha256=bNFaCyXUsonobipEfPsLAbhRK3XVyOTcEeYtI_0Gd0A,2762
src/detection-rules/hunting/linux/queries/privilege_escalation_via_segmentation_fault_and_buffer_overflow.toml,sha256=-Oq_PUzRJ2MqY73HXMymfqdss3tKrqdpH6yxR0ycS3g,2679
src/detection-rules/hunting/linux/queries/privilege_escalation_via_suid_binaries.toml,sha256=KTsssn9MwXNyoKj0ujkemA-ZtNXRJWL6R4McmQrF288,1893
src/detection-rules/hunting/llm/README.md,sha256=qO-qpiU_nFDreSeYai_zEs2BfdGFKGx3Lh2LUWZLT3k,2385
src/detection-rules/hunting/llm/docs/aws_bedrock_dos_resource_exhaustion_detection.md,sha256=AN3cRGz6wN5k6Qcah-HVuAH3Gy8aThO0o8_azcdCozU,2190
src/detection-rules/hunting/llm/docs/aws_bedrock_ignore_previous_prompt_detection.md,sha256=QiyO22p-bh1APcSuh5yj3RFjoTwcoaX2VTqz6gn4uKs,2017
src/detection-rules/hunting/llm/docs/aws_bedrock_latency_anomalies_detection.md,sha256=NvYQPlApPjSMzJIK6UHE1A4R3zsZh62SiqspSDFLmRM,1839
src/detection-rules/hunting/llm/docs/aws_bedrock_sensitive_content_refusal_detection.md,sha256=4u8LVCReN5SwQdEnfbw5JqDbbioaX_xAMOeC77rdEoM,1586
src/detection-rules/hunting/llm/queries/aws_bedrock_dos_resource_exhaustion_detection.toml,sha256=HkQPNP0KlsIZs21ah-8XfN2bavpjDXUCUrNUeiDvTKY,1935
src/detection-rules/hunting/llm/queries/aws_bedrock_ignore_previous_prompt_detection.toml,sha256=PubCy_RStiu7G_zaT7IzhGhChzuwzdkBRd3_ZSLfxMs,1762
src/detection-rules/hunting/llm/queries/aws_bedrock_latency_anomalies_detection.toml,sha256=Vb-g27_Ni-rWSQZ7EJlEGl7Gf7x9ZYc2dycHht4znjc,1613
src/detection-rules/hunting/llm/queries/aws_bedrock_sensitive_content_refusal_detection.toml,sha256=hsItgaj1LOxqUErMkiESvmR8yiXlnwuVmYCO2XiAprY,1338
src/detection-rules/hunting/macos/docs/command_and_control_suspicious_executable_file_creation_via_python.md,sha256=Cz4DYXSi17LYlnt111PlDfYR1_oPJkdepkHQkO0u2_0,1861
src/detection-rules/hunting/macos/docs/credential_access_potential_python_stealer.md,sha256=-cceNY9X8k0hfRyr6VZH6UzZzCajVxg4JGX7KTLZ-zM,1925
src/detection-rules/hunting/macos/docs/defense_evasion_python_library_load_and_delete.md,sha256=Pz8bhx2FfkKkirfw7UrRMrnFrc-NgIBDvUvaZ8LdMEA,1750
src/detection-rules/hunting/macos/docs/defense_evasion_self_deleted_python_script_accessing_sensitive_files.md,sha256=bCAHnwtPgN5QWORpThW9xg3aHFAD7egwqpyJWnVBI1A,1911
src/detection-rules/hunting/macos/docs/defense_evasion_self_deleted_python_script_outbound_network_connection.md,sha256=AuiixirkdDCjrcaABtXF3xVMMpiYBslA9Zrf_SHUuFw,2181
src/detection-rules/hunting/macos/docs/defense_evasion_self_deleting_python_script.md,sha256=07LFOTjMj0qJDR3leiHsawZktIr2VoAbwIS4L_47cDE,1913
src/detection-rules/hunting/macos/docs/execution_python_script_drop_and_execute.md,sha256=PD4SfY77dNDjTwrPZkGY5sL1vrAPSVLVR3eWqSayjWE,1830
src/detection-rules/hunting/macos/docs/execution_suspicious_executable_file_modification_via_docker.md,sha256=XK02K97i2iqGHGKy8FNEhbwsg4Cs-7oOFthDaH6eN3c,1940
src/detection-rules/hunting/macos/docs/execution_suspicious_file_access_via_docker.md,sha256=ZZrG5as-lFowrbUO_nxvJDHKjPxGvAiIFJsAmQUL8SI,1779
src/detection-rules/hunting/macos/docs/execution_suspicious_python_app_execution_via_streamlit.md,sha256=5NTRiP54GJ36u3T6FH-TI077ObLqFuTTFfKEo_TEVGs,2491
src/detection-rules/hunting/macos/docs/execution_unsigned_or_untrusted_binary_execution_via_python.md,sha256=W4wgO88g-hnhoIDmbUjfeCncnx8CgyaZOM1zdBNkQPg,2077
src/detection-rules/hunting/macos/docs/execution_unsigned_or_untrusted_binary_fork_via_python.md,sha256=qgoyqgAZHZDV69-BuvtPJhuW7A4PX66OaM-gJctPhj8,1909
src/detection-rules/hunting/macos/docs/execution_unusual_library_load_via_python.md,sha256=haTxEJ4UgtjsvJoDoyKnixk0Anx9uuN3P9Sk_BEta9Y,1653
src/detection-rules/hunting/macos/docs/persistence_via_suspicious_launch_agent_or_launch_daemon_with_low_occurrence.md,sha256=QnFyjB4rGxZvLJHBonoEg9dxQDqGDUNTZH9CFo5m5ag,1630
src/detection-rules/hunting/macos/docs/suspicious_network_connections_by_unsigned_macho.md,sha256=-vqRrfalZDZFym8T0zKwWmCgqO_0NHQw3CFwDS0lMjA,2641
src/detection-rules/hunting/macos/queries/command_and_control_suspicious_executable_file_creation_via_python.toml,sha256=bd45jDEFXWfhXQgewj2loFkUPxH7JXWSCK2fWykit30,1546
src/detection-rules/hunting/macos/queries/credential_access_potential_python_stealer.toml,sha256=l7qO0v0oFQfUPXrgmaSsqeP-q-tZ8gjOsssUItTkWxc,1644
src/detection-rules/hunting/macos/queries/defense_evasion_python_library_load_and_delete.toml,sha256=vc0BzsTiQ5tB3gwiK-0McslcwBrSpEcZLgZGNmLnnjI,1468
src/detection-rules/hunting/macos/queries/defense_evasion_self_deleted_python_script_accessing_sensitive_files.toml,sha256=o0lr6RDhEzBiSzu9LxUDkcXaN2lQg6x670aylzcFWXI,1537
src/detection-rules/hunting/macos/queries/defense_evasion_self_deleted_python_script_outbound_network_connection.toml,sha256=mZf7XwcLDd8s2hyEpLVHmi5cXt05voFtX1-lAAfpmtE,1804
src/detection-rules/hunting/macos/queries/defense_evasion_self_deleting_python_script.toml,sha256=Yq98HPp4d9X0TtACmT6mU9ExTwTsfg2Xlrsjb3KsItM,1637
src/detection-rules/hunting/macos/queries/execution_python_script_drop_and_execute.toml,sha256=Zhim89Mg3YnBVQzdatF3BO5JMDtPjKajkzwT4BESQcQ,1558
src/detection-rules/hunting/macos/queries/execution_suspicious_executable_file_modification_via_docker.toml,sha256=rnX80gS718Qbx5GYCSJWI5fYxnLkp6wNkxvS2f58oAI,1628
src/detection-rules/hunting/macos/queries/execution_suspicious_file_access_via_docker.toml,sha256=pn7lL0dZ2hRccbfVG1PH7KhsJidEqjpTExsykCW8ysg,1502
src/detection-rules/hunting/macos/queries/execution_suspicious_python_app_execution_via_streamlit.toml,sha256=G0xV3YTmuuAut2rBg-5H_4zo1w4QHv5o2e0B4O1_3Qc,2189
src/detection-rules/hunting/macos/queries/execution_unsigned_or_untrusted_binary_execution_via_python.toml,sha256=RgORoTvoDBdNQIKfvo7hNXBgZPDKEPRoM7WzZwBim6w,1767
src/detection-rules/hunting/macos/queries/execution_unsigned_or_untrusted_binary_fork_via_python.toml,sha256=o6qFqf3MliAYNfO6Ssmh4D0ASQ9nLN3BllsYBUqDIsg,1652
src/detection-rules/hunting/macos/queries/execution_unusual_library_load_via_python.toml,sha256=xtxmBk4y4a6w57gJnOztNeREYsQMidG_XlghwszRVEQ,1423
src/detection-rules/hunting/macos/queries/persistence_via_suspicious_launch_agent_or_launch_daemon_with_low_occurrence.toml,sha256=hP_MnEnpZB5C1DQsTcumR1bU5mmAMNkm2we2uB9LdtY,1137
src/detection-rules/hunting/macos/queries/suspicious_network_connections_by_unsigned_macho.toml,sha256=ZAks7w4WKV7Te981zh5FDOuPj3ipWH6Gx5U0-NU4Rkc,2378
src/detection-rules/hunting/okta/docs/credential_access_mfa_bombing_push_notifications.md,sha256=FRKaYj0KjkattSeUcl8xK62tsrlR6OBFzfplUUt0UGo,1733
src/detection-rules/hunting/okta/docs/credential_access_rapid_reset_password_requests_for_different_users.md,sha256=x0LCt5-SqZBLtM-7NOMKZy1Z4ZTRCMlRozK3gIeEKcM,2135
src/detection-rules/hunting/okta/docs/defense_evasion_failed_oauth_access_token_retrieval_via_public_client_app.md,sha256=vZixfdEKH2PW1XYaZMbsEkAvHW8TsQNfJVSDXn3Mlzs,2328
src/detection-rules/hunting/okta/docs/defense_evasion_multiple_application_sso_authentication_repeat_source.md,sha256=9mF1iPCHerESa8OG5l-M7qUVcpSteoi9Ib_Z6SbiqNQ,2700
src/detection-rules/hunting/okta/docs/defense_evasion_multiple_client_sources_reported_for_oauth_access_tokens_granted.md,sha256=J4OmRBE-deN2LTQhc4iwurY_5pO9asalRrrMZ2bKF5M,2610
src/detection-rules/hunting/okta/docs/defense_evasion_rare_oauth_access_token_granted_by_application.md,sha256=A06aD8UsBA2x1FtcUTHclqqhCi3s-TJEF0wVBpgBtlY,2407
src/detection-rules/hunting/okta/docs/initial_access_higher_than_average_failed_authentication.md,sha256=a-QLrSC_Vkz0vJbp-D0hl5Pppvlgry0mSCUfJME8jjc,2321
src/detection-rules/hunting/okta/docs/initial_access_impossible_travel_sign_on.md,sha256=v8gylVcAlqDwhV0E214bp619LC3TUOQPYkrmxHC_GfY,1845
src/detection-rules/hunting/okta/docs/initial_access_password_spraying_from_repeat_source.md,sha256=uDUqxLi9_81Oo-uikZRq7pa5ZotWtiMZftzy2ykfR7U,1982
src/detection-rules/hunting/okta/docs/persistence_multi_factor_push_notification_bombing.md,sha256=Pzng5xOpfpNj_pZwDAWsrJOhAMQukrzB64jqMcXELBw,1883
src/detection-rules/hunting/okta/docs/persistence_rare_domain_with_user_authentication.md,sha256=ydCdZQwsEgMc1hQTQyL617EJIUjhgiZ8iOzSU6MxVP0,1924
src/detection-rules/hunting/okta/queries/credential_access_mfa_bombing_push_notifications.toml,sha256=8txOPZKqKrilWXQZcivZZbgYHduWiyQlEDJ3w-E_K0M,1481
src/detection-rules/hunting/okta/queries/credential_access_rapid_reset_password_requests_for_different_users.toml,sha256=6kH7_bc8O3ZPp7zRKg3DjPFVMtip0WoKAEp7YB0MmSc,1854
src/detection-rules/hunting/okta/queries/defense_evasion_failed_oauth_access_token_retrieval_via_public_client_app.toml,sha256=10mCbvIius5ge4XJYDbZr4v-0UqHNYD7V2_b9aXQx10,2038
src/detection-rules/hunting/okta/queries/defense_evasion_multiple_application_sso_authentication_repeat_source.toml,sha256=W1eMREAMGKVVgUYtAcVUECW8ZNadDUtlMVyx4HulvZs,2412
src/detection-rules/hunting/okta/queries/defense_evasion_multiple_client_sources_reported_for_oauth_access_tokens_granted.toml,sha256=qOo3M7GuGALAhXhOD1_0GuVq21dDY8VbyEn9s3Ht-tM,2291
src/detection-rules/hunting/okta/queries/defense_evasion_rare_oauth_access_token_granted_by_application.toml,sha256=hWZNSy5hRrPbPPwSilISzu3xzQu7ck-xCgnSqEb0cAg,2120
src/detection-rules/hunting/okta/queries/initial_access_higher_than_average_failed_authentication.toml,sha256=RJ9-rCYFlHP7Fdl7AIcy4VgDhG5XbvqlgzhIOiuAVDM,2044
src/detection-rules/hunting/okta/queries/initial_access_impossible_travel_sign_on.toml,sha256=kmtrt1Ji1uUyY9VSgq8YqcPUVIo00HF5Kyd5jRKcWBA,1597
src/detection-rules/hunting/okta/queries/initial_access_password_spraying_from_repeat_source.toml,sha256=3038rF_l_oooN6To8Yn52GeMxmFuPqbJmhP7qS7yzTI,1735
src/detection-rules/hunting/okta/queries/persistence_multi_factor_push_notification_bombing.toml,sha256=Mn7uJ1nGIvxav71FbzrUnz6ouGV2b0olZMTl2RlKTME,1609
src/detection-rules/hunting/okta/queries/persistence_rare_domain_with_user_authentication.toml,sha256=DpaYwydI4q8T7TsfAPCZpxTUM6-l1bOcYTXycfdarHE,1645
src/detection-rules/hunting/windows/docs/createremotethread_by_source_process_with_low_occurrence.md,sha256=L7DADCc4EiNM98by98OW4fMz5E1c-03cuY-JGSvqWyI,1395
src/detection-rules/hunting/windows/docs/detect_dll_hijack_via_masquerading_as_microsoft_native_libraries.md,sha256=f7sW-fOrB309cv2zdhYHitJtKrAqqD3stL7CrMAGPz0,4307
src/detection-rules/hunting/windows/docs/detect_masquerading_attempts_as_native_windows_binaries.md,sha256=1XELpuds8mUkH0aRpDtd2Ky3nFPUwyrCkbbzey28ygE,2822
src/detection-rules/hunting/windows/docs/detect_rare_dll_sideload_by_occurrence.md,sha256=vHgmPZ1F4AkIo9WRapB92L2I4YdVSxzEFliVPzdbg4I,4719
src/detection-rules/hunting/windows/docs/detect_rare_lsass_process_access_attempts.md,sha256=Zf1LbKn6jDWx7N96t13oQpksGFwIfkzVDtHTpGgUjNM,2934
src/detection-rules/hunting/windows/docs/domain_names_queried_via_lolbins_and_with_low_occurrence_frequency.md,sha256=4SKmvHm3e9aFbi_qGCyeq5F2phf0Yw3HI735nyfeXGk,2043
src/detection-rules/hunting/windows/docs/drivers_load_with_low_occurrence_frequency.md,sha256=7bKxXUry8n-rsXqNU-0mpWeD06sNT0kHhugzwxTLmBA,3103
src/detection-rules/hunting/windows/docs/excessive_rdp_network_activity_by_source_host_and_user.md,sha256=k_uzFcCOWJ3E-FMtVuABs-8waUU-0gvXVC2A-Ys0B8g,2227
src/detection-rules/hunting/windows/docs/excessive_smb_network_activity_by_process_id.md,sha256=Y_YV63jZ7wbvcVNXs5rL_raUvHXO1XCh5zirfPab81Y,1747
src/detection-rules/hunting/windows/docs/executable_file_creation_by_an_unusual_microsoft_binary.md,sha256=8uGpNkPvYOe6Gve-10jU5n4m62pSUm_PooL7zvtlOmA,2360
src/detection-rules/hunting/windows/docs/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.md,sha256=35vm-WdVPD8-tGU2kpxwXjVwDW97E_P406HcO90694E,2453
src/detection-rules/hunting/windows/docs/execution_via_remote_services_by_client_address.md,sha256=BySRzdE41YP_45pOLCjxruwq-3pQK1JmdBRFcg2VVm8,1680
src/detection-rules/hunting/windows/docs/execution_via_startup_with_low_occurrence_frequency.md,sha256=-ytC1vTX5Wzf0XkPcIqdrrpnQMJeXKLfUfe2_BCbVOw,2477
src/detection-rules/hunting/windows/docs/execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.md,sha256=cvIvlZ-9rwJHdejCHrGvrE-LUEOSJTBaKwi2P2Jj0JM,2836
src/detection-rules/hunting/windows/docs/execution_via_windows_scheduled_task_with_low_occurrence_frequency.md,sha256=pan8cDbuWjO1TJvaCussWJLphuBI02a3GSGkO0cBJ8c,1787
src/detection-rules/hunting/windows/docs/execution_via_windows_services_with_low_occurrence_frequency.md,sha256=he4eIOctyeBc-i2wXdBDCwpGHXRMCFQTCrSov4b1e8M,2668
src/detection-rules/hunting/windows/docs/high_count_of_network_connection_over_extended_period_by_process.md,sha256=ykodrQENvfW792RU0CUnzuS_rGgKWKUha6IBbtRadLw,6350
src/detection-rules/hunting/windows/docs/libraries_loaded_by_svchost_with_low_occurrence_frequency.md,sha256=L9VqlHXslIG6_34ZOCQBf5haT3_LTI6u8gs8BfQcW7c,3944
src/detection-rules/hunting/windows/docs/microsoft_office_child_processes_with_low_occurrence_frequency.md,sha256=-D441NHqiORszaz7WXgYMi-7Ex-fHl-tWnbyHU41QkU,2083
src/detection-rules/hunting/windows/docs/network_discovery_via_sensitive_ports_by_unusual_process.md,sha256=awz3z9k8ktbCjpyaEo8KHeU36ZJPIezzt_ubxZ0scXg,2304
src/detection-rules/hunting/windows/docs/pe_file_transfer_via_smb_admin_shares_by_agent.md,sha256=QuMTg-G894CDLR8Q_mnSCPluxmkFwdR9uHVp86ktH7U,1852
src/detection-rules/hunting/windows/docs/persistence_via_run_key_with_low_occurrence_frequency.md,sha256=F7om74Hy9WwG89EO1AF7hpFRd0gi5-5csoLJ6D-ADgs,3551
src/detection-rules/hunting/windows/docs/persistence_via_startup_with_low_occurrence_frequency.md,sha256=Y9lLxlp7kAYGah-qVkHK96gxqP2IPm_nnb5dUJYSvX4,2368
src/detection-rules/hunting/windows/docs/potential_exfiltration_by_process_total_egress_bytes.md,sha256=4wIAVudeeT1pn3ILQHlleTcZOeqoVTIKHj9plzDatC8,2273
src/detection-rules/hunting/windows/docs/rundll32_execution_aggregated_by_cmdline.md,sha256=Y_6GLmjYBvi3VUbncAbSvfMHXrqQI_RsTZQyUR0sTFA,3022
src/detection-rules/hunting/windows/docs/scheduled_task_creation_by_action_via_registry.md,sha256=hdwXAF4Ls7TBAGCXPXgOG5neAo5f3qLdpoyNJ1HeZ74,2112
src/detection-rules/hunting/windows/docs/scheduled_tasks_creation_for_unique_hosts_by_task_command.md,sha256=VaJCAayt9Y-ZeaFLGCweoWC2lti0yPfdvqHwKtMvCGc,2394
src/detection-rules/hunting/windows/docs/suspicious_base64_encoded_powershell_commands.md,sha256=d1PO8wlRsTDmkM5GYvoK-cWmE7bKPTLdxRBNiCjDYHw,2075
src/detection-rules/hunting/windows/docs/suspicious_dns_txt_record_lookups_by_process.md,sha256=Wy8VjrRtLEavg5BD_c6TufEZ1xugwmptPZ77NtmlfB0,1671
src/detection-rules/hunting/windows/docs/unique_windows_services_creation_by_servicefilename.md,sha256=Qedw-fSNJDWA-N_NWK1yNC__7-er8Akxoo4tI-t9YuU,4946
src/detection-rules/hunting/windows/docs/windows_command_and_scripting_interpreter_from_unusual_parent.md,sha256=MxWMruCmtYYp_W97Q7V2MoGqpEzcc9sAp7cIafHjX9g,2010
src/detection-rules/hunting/windows/docs/windows_logon_activity_by_source_ip.md,sha256=2inEbllfSU4qbuzYY-xRCZdhTUe_1deF6h0llpF8tAw,1894
src/detection-rules/hunting/windows/queries/createremotethread_by_source_process_with_low_occurrence.toml,sha256=rt6tg2WVTepv6cFL6X8JA8G0mBWojzO6Bok45KVNb2c,1104
src/detection-rules/hunting/windows/queries/detect_dll_hijack_via_masquerading_as_microsoft_native_libraries.toml,sha256=xXHKoTEbuzCvaHzN5KTO8XuNkMcO2RZRHge0kNmfONY,3932
src/detection-rules/hunting/windows/queries/detect_masquerading_attempts_as_native_windows_binaries.toml,sha256=2CB77RzRgtBqhjrzJvDlVRfmFde2gGIVZDPYY6_sWWI,2552
src/detection-rules/hunting/windows/queries/detect_rare_dll_sideload_by_occurrence.toml,sha256=ClDli7HMB3ojIJAYCCU2akJPeCMyW9sbUGDtS2G4ugo,4391
src/detection-rules/hunting/windows/queries/detect_rare_lsass_process_access_attempts.toml,sha256=UKjrFYg5C_4eR3kW4YqWQvAVjeQRJZ1y8QNO4NHgx_w,2596
src/detection-rules/hunting/windows/queries/domain_names_queried_via_lolbins_and_with_low_occurrence_frequency.toml,sha256=4waBMUkqqNpgs9RkXwkLGPalFWw7Q7mu4NHSeftaLcI,1714
src/detection-rules/hunting/windows/queries/drivers_load_with_low_occurrence_frequency.toml,sha256=IFU1HAth3zTa32oR2qgFIzAAbHUxF5zMzMI2ruTbFJw,2765
src/detection-rules/hunting/windows/queries/excessive_rdp_network_activity_by_source_host_and_user.toml,sha256=6gqrUFDpHoEd5IEixj8Ex312vfqXoFHj7NG6HR8vByw,1869
src/detection-rules/hunting/windows/queries/excessive_smb_network_activity_by_process_id.toml,sha256=rgJl3cxYcCnoTVVVPTpaOmD17N7D0uB1vXNLX9LY44g,1399
src/detection-rules/hunting/windows/queries/executable_file_creation_by_an_unusual_microsoft_binary.toml,sha256=6kAX-ChOKUwrPbQ6-sk5ozwpsn6SNPL4EPbYJkdcjXU,2002
src/detection-rules/hunting/windows/queries/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.toml,sha256=tcz0oMvGIBRWhi16nXkyYehPSFbGGrUaSYE7TK-Q_BM,2162
src/detection-rules/hunting/windows/queries/execution_via_remote_services_by_client_address.toml,sha256=R6yYlsOFQTOxyvRjwWXnItsnwPjv8LtbAwheBglCT00,1276
src/detection-rules/hunting/windows/queries/execution_via_startup_with_low_occurrence_frequency.toml,sha256=2gg0jQ8dFDb1bGoUj40afsn7EwEotHm13_C7uZz_b0w,2151
src/detection-rules/hunting/windows/queries/execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.toml,sha256=XKWlLlaLfni4DGyUSJRAwLndb94cr9-0C_VwzWruom8,2420
src/detection-rules/hunting/windows/queries/execution_via_windows_scheduled_task_with_low_occurrence_frequency.toml,sha256=chcwChCObrFQnWW3lF1w1fR82QuKYGgP4vqgLA02ceo,1384
src/detection-rules/hunting/windows/queries/execution_via_windows_services_with_low_occurrence_frequency.toml,sha256=6CvxPsQpT1a6UNoaa04AIF34exc60O6MuXFxxPbiO74,2229
src/detection-rules/hunting/windows/queries/high_count_of_network_connection_over_extended_period_by_process.toml,sha256=cOZK1UQIpGxPj0A0A3TwQn2O2IQuMfK4C-Y27Rr1YjY,5999
src/detection-rules/hunting/windows/queries/libraries_loaded_by_svchost_with_low_occurrence_frequency.toml,sha256=fJ_8EauC2MForUFNxv37uoR8EbErqkPkL4W6bwXLi2w,3577
src/detection-rules/hunting/windows/queries/microsoft_office_child_processes_with_low_occurrence_frequency.toml,sha256=Vjgvg_jZYwND8_-ETXPDvltUHMcSnJs9O9KWcVEO5fI,1638
src/detection-rules/hunting/windows/queries/network_discovery_via_sensitive_ports_by_unusual_process.toml,sha256=RkZR9gRI6SXbuq70GAD1hiyq1VlCnc-JP9CPartgS0M,1889
src/detection-rules/hunting/windows/queries/pe_file_transfer_via_smb_admin_shares_by_agent.toml,sha256=cUB_ZAdkqk2dbN-u4J7mTTlIoNjENJvG30E7aSsmNTc,1530
src/detection-rules/hunting/windows/queries/persistence_via_run_key_with_low_occurrence_frequency.toml,sha256=1dzS5qw84eDZeT86swgKfm_PGQCug5O7u0bMSYtmqok,3187
src/detection-rules/hunting/windows/queries/persistence_via_startup_with_low_occurrence_frequency.toml,sha256=D7WR2IHYdTzveGEOSpxllLN59dXmG5oi9pu9tW6RRJw,1987
src/detection-rules/hunting/windows/queries/potential_exfiltration_by_process_total_egress_bytes.toml,sha256=ZsDiCshS_1n8CI8h2nksPikd7Eo8p6XVP6FWSqGD_JA,2001
src/detection-rules/hunting/windows/queries/rundll32_execution_aggregated_by_cmdline.toml,sha256=INa1TC6l9xwMyX617x67esC2BFI3fYrax7Sq_hCBY-k,2588
src/detection-rules/hunting/windows/queries/scheduled_task_creation_by_action_via_registry.toml,sha256=4F2WlryA1X4Zeu8MRJVmO4wvEbMmmIJdNbTwuynOFsY,1801
src/detection-rules/hunting/windows/queries/scheduled_tasks_creation_for_unique_hosts_by_task_command.toml,sha256=BRDTZ4PfFAg21IfyecDLVk8pJicX5mIaYChWdmqwCpM,2072
src/detection-rules/hunting/windows/queries/suspicious_base64_encoded_powershell_commands.toml,sha256=6bBYigGyyLcbK0zxVIDu_MBbILprncBn_PXblp6mEhc,1589
src/detection-rules/hunting/windows/queries/suspicious_dns_txt_record_lookups_by_process.toml,sha256=my5lvoQ52WVaX-oCCeBvuEoFrJuBYQuWgQyPhpMOY9E,1321
src/detection-rules/hunting/windows/queries/unique_windows_services_creation_by_servicefilename.toml,sha256=AvachJ3lc4Iw0x_0JTfg9QMW3rtHJ_NMs4x2KHltwIU,4529
src/detection-rules/hunting/windows/queries/windows_command_and_scripting_interpreter_from_unusual_parent.toml,sha256=ulJ0bkhl_3jghi5BtGph2VVl7CQpUc5E0H-4gU3iyaU,1527
src/detection-rules/hunting/windows/queries/windows_logon_activity_by_source_ip.toml,sha256=arboAqC2AoFiOHbJNRGJ2w1SPcl64UuHlpAr39GIpHg,1559
src/detection-rules/rules/README.md,sha256=FsDrLRbMS1GiLtJxKEeB2etL1U0JZ053xE3T28iDNIY,2862
src/detection-rules/rules/_deprecated/apm_null_user_agent.toml,sha256=P1Ob5RxPCMFTR8Z_fRaFpfLNgZmJekBbg1ihzeuHpeY,1466
src/detection-rules/rules/_deprecated/command_and_control_connection_attempt_by_non_ssh_root_session.toml,sha256=L9n522sl79myzYEWozsyKhrtM9oD9n7xlHhsOq_-D-4,3405
src/detection-rules/rules/_deprecated/command_and_control_dns_directly_to_the_internet.toml,sha256=qlYl28lEc69nJXQRHz0Z-nstI8SKLXttlll_4N_rnio,2841
src/detection-rules/rules/_deprecated/command_and_control_ftp_file_transfer_protocol_activity_to_the_internet.toml,sha256=Ch4I743iqDRnHQBDzBJKPMvGxfD9cscKyWkNHkjChEc,2559
src/detection-rules/rules/_deprecated/command_and_control_irc_internet_relay_chat_protocol_activity_to_the_internet.toml,sha256=Owf2oKiHH5RMdHs16mdW5NGlZfqacps7HCUB3NE2WJc,2506
src/detection-rules/rules/_deprecated/command_and_control_linux_chisel_server_activity.toml,sha256=BaEtM6vHm5lT-Q6LjfAGz3Ke-TH3rShJ_0OO8mmYtG8,10398
src/detection-rules/rules/_deprecated/command_and_control_linux_iodine_activity.toml,sha256=ik7mymIg2c2SRv5OG5UqT-rSRKzJmrcwxRTwLAo8tkc,1841
src/detection-rules/rules/_deprecated/command_and_control_linux_port_knocking_reverse_connection.toml,sha256=17PowWGKOMFk8t2VMfTD5IBbPKYYAtAp4RVMyVJnlQY,5148
src/detection-rules/rules/_deprecated/command_and_control_non_standard_http_port.toml,sha256=AI74O9bJme8VnypTjmfu4QQMiZIHPfre2Tk4f5z75u8,7807
src/detection-rules/rules/_deprecated/command_and_control_non_standard_ssh_port.toml,sha256=SlMBF29t6TwpyGCMKrK3WLKnj7Pny0swdvaS46ufHw8,6704
src/detection-rules/rules/_deprecated/command_and_control_port_8000_activity_to_the_internet.toml,sha256=jgENNsuzg4kMtoUEaeBlpqG5F-3eCtwUVBUU4du7cXQ,2010
src/detection-rules/rules/_deprecated/command_and_control_pptp_point_to_point_tunneling_protocol_activity.toml,sha256=uzqvyL_JvKsDojc_TCpVZW_4qUhuJ38kwUbsJwUkn4k,1568
src/detection-rules/rules/_deprecated/command_and_control_proxy_port_activity_to_the_internet.toml,sha256=N123c9tBYL3PqNd2xMKyRTZpkWdX9gQ4p8b2G7Q3N1Y,2443
src/detection-rules/rules/_deprecated/command_and_control_smtp_to_the_internet.toml,sha256=OmyIkHqqO3OdQJLBLARCht0UsqkRlUjOkXUX7lXOHE8,2119
src/detection-rules/rules/_deprecated/command_and_control_sql_server_port_activity_to_the_internet.toml,sha256=KDNeLrIR2fb2FNdMzS4mH_Mw6Ky7EhIttMD57ccXiCI,1916
src/detection-rules/rules/_deprecated/command_and_control_ssh_secure_shell_from_the_internet.toml,sha256=dT3rK50ocmiI9aTi2AO9kK7SgczzjsAxOFswYRynrjk,2757
src/detection-rules/rules/_deprecated/command_and_control_ssh_secure_shell_to_the_internet.toml,sha256=EfQzNOi7HQFnTMZT5QrVj50Sgr6iY6GOYrhLumicXcE,2151
src/detection-rules/rules/_deprecated/command_and_control_tor_activity_to_the_internet.toml,sha256=NF4Fl59KsJLdABK6K5FwmXr1tdu7NXaedQfVnuhTaDw,2329
src/detection-rules/rules/_deprecated/credential_access_entra_signin_brute_force_microsoft_365_repeat_source.toml,sha256=0gn1XEwiyKKC2FAt2-86ONDaxDYB2Hue50-8xstoxd0,6831
src/detection-rules/rules/_deprecated/credential_access_microsoft_365_potential_password_spraying_attack.toml,sha256=ieBRSQIw3hk673O5dGw1hx8_JAklxKCYcicpjYjlTHc,1815
src/detection-rules/rules/_deprecated/credential_access_potential_linux_ssh_bruteforce_root.toml,sha256=t_1U00NJarwzYBhpUkhLxdhiV2ZoPaNUOZWbY3Wq6Dk,3966
src/detection-rules/rules/_deprecated/credential_access_potential_successful_linux_ftp_bruteforce.toml,sha256=5KZIG83OEzbv7XQlFPM2k9HvSTRuO1DK_BPxK52mGn0,9451
src/detection-rules/rules/_deprecated/credential_access_potential_successful_linux_rdp_bruteforce.toml,sha256=IIOsk4fCYS3c7XspD_Cw85mb2TnW8cgftuQYHfDV5r4,9703
src/detection-rules/rules/_deprecated/credential_access_tcpdump_activity.toml,sha256=HjMr6vfU4ptYXikdukMUug9Um8DBKHXRbBwns9RriJw,1662
src/detection-rules/rules/_deprecated/defense_evasion_agent_spoofing_mismatched_id.toml,sha256=lp9561MSJeqCyFJCbkvnqGJrOooZ6wbbnPvGwEHBRqU,5723
src/detection-rules/rules/_deprecated/defense_evasion_attempt_to_disable_iptables_or_firewall.toml,sha256=xmyL9oBeFgVTsQiHxVhe6hGmu1nYihiHP_kb8Rz3j_o,1530
src/detection-rules/rules/_deprecated/defense_evasion_base64_encoding_or_decoding_activity.toml,sha256=sZ_95szs8hOpomQmmlSUVgG96KgfH9C0YRBS5icSmMw,1477
src/detection-rules/rules/_deprecated/defense_evasion_code_injection_conhost.toml,sha256=G6Yz_j7i3ly8I_QxT64BDHoVSIi2aeeVRaZjfIotC68,5188
src/detection-rules/rules/_deprecated/defense_evasion_elasticache_security_group_creation.toml,sha256=Jbig4QsukegVaLhlQJPVk_3YiZ2mC16Z-cA6tFGP8TM,6876
src/detection-rules/rules/_deprecated/defense_evasion_elasticache_security_group_modified_or_deleted.toml,sha256=oCwORGOoEJ5FEtpeejX5ws89GGYnOiBEtBScxq0rW2U,6681
src/detection-rules/rules/_deprecated/defense_evasion_execution_via_trusted_developer_utilities.toml,sha256=0DIN1D3-hRuLx57AlgtkBAOFDQUAEZ_BNMf1TG7rX9Y,1342
src/detection-rules/rules/_deprecated/defense_evasion_hex_encoding_or_decoding_activity.toml,sha256=JtVxnHzgZ_O9fPb5DxmRoiFW-Gxqw7ihShvbv4zorMM,1431
src/detection-rules/rules/_deprecated/defense_evasion_ld_preload_env_variable_process_injection.toml,sha256=N12tqet7lSXN0_AL0_CZAc9bbJlZBSyBZ2YMcjXm_Po,6018
src/detection-rules/rules/_deprecated/defense_evasion_mshta_making_network_connections.toml,sha256=-beMtzmAlThKxAhtC1QrgL6AQt76_S0sCHtgg1NeNJY,1491
src/detection-rules/rules/_deprecated/defense_evasion_potential_processherpaderping.toml,sha256=CrMLt3Zcji5ydCGpt-_p17w8NGWvdpC4i1uQ2vh-Vs4,1842
src/detection-rules/rules/_deprecated/defense_evasion_process_termination_followed_by_deletion.toml,sha256=kjpsgmi8BzvNoQCRJJLy0oW61hhZ26cFzxYazPapoxw,8481
src/detection-rules/rules/_deprecated/defense_evasion_rename_esxi_index_file.toml,sha256=lkVvaepEX8VSY-h1Z5_VDEXeYcpWSE-oTTopcVCKjGo,7730
src/detection-rules/rules/_deprecated/defense_evasion_whitespace_padding_in_command_line.toml,sha256=y1xyhawly-MX1X7wU8r7H33s61qjifj3O7MPD_9qHdg,5213
src/detection-rules/rules/_deprecated/discovery_file_dir_discovery.toml,sha256=x3H7E_TjCpMrByzKuW5gFWFiSy46etE8-wfW2wy8tNU,4102
src/detection-rules/rules/_deprecated/discovery_process_discovery_via_tasklist_command.toml,sha256=xsfztpMiMrhlVsKSJs8jpbpIr-ifl5-kWmYHjXgniSk,1357
src/detection-rules/rules/_deprecated/discovery_pspy_process_monitoring_detected.toml,sha256=aYcip-UzP4DUeQcyKKjuy6P1Nxt5AaocUmbFDnuc9XM,7457
src/detection-rules/rules/_deprecated/discovery_query_registry_via_reg.toml,sha256=yaFFIcpM9z2Z_xFL3zvhHcLyV9RU8BFtJtE_uhVhZko,1134
src/detection-rules/rules/_deprecated/discovery_whoami_commmand.toml,sha256=NEUGhhng629IInRexo-_TVOgkNCVoLvO4uaXJ4tlsqk,1256
src/detection-rules/rules/_deprecated/execution_apt_binary.toml,sha256=FGsJSS6bii45TNR3PfSXcSXmUqRRW4g0Y01xBzzDpEw,1831
src/detection-rules/rules/_deprecated/execution_awk_binary_shell.toml,sha256=jEchJX9Jf9-VQeV1-vssqVRqdQPza-Pcanw-556MCBE,1729
src/detection-rules/rules/_deprecated/execution_busybox_binary.toml,sha256=IITvx4ReXM1up2gjvYa8Aec7QUgeDfILHFHeXC58zrM,1665
src/detection-rules/rules/_deprecated/execution_c89_c99_binary.toml,sha256=5VLXlYDqDHGC7A9hJDtKHai7WMhCzUzF1-lB1MfyY9M,1791
src/detection-rules/rules/_deprecated/execution_command_shell_started_by_powershell.toml,sha256=0SGoxLXFNej0Ffb8VvVq3PCqyvE4Jbay4eC1PifB8FY,1228
src/detection-rules/rules/_deprecated/execution_cpulimit_binary.toml,sha256=Za3MQfcjwp3en5LUJsVZEPZxkv-Em2qjubwTLF5G5as,1792
src/detection-rules/rules/_deprecated/execution_crash_binary.toml,sha256=-wz6LJVZUeuLHLm6ZPEpavzyPZWbX2IQWyhpSg609i4,1606
src/detection-rules/rules/_deprecated/execution_curl_cve_2023_38545_heap_overflow.toml,sha256=zrasn_JYmeB7KA3xDBiFzipxcRYoVJN_L-8TDqosg38,9360
src/detection-rules/rules/_deprecated/execution_env_binary.toml,sha256=2qq_ndk9zYy2_D3bli2eyWzNhSgJw7glh1Zq7r5wTJ0,1666
src/detection-rules/rules/_deprecated/execution_expect_binary.toml,sha256=BIU_NjT5DFy7XrtG7MJJ_zfkL1YkoKIN9bhbmraY7Zo,1856
src/detection-rules/rules/_deprecated/execution_find_binary.toml,sha256=PKvMdNYz4AEJ0ZfZxkwPLbCmQs1OVsBQ5QSZKLD3l8c,1719
src/detection-rules/rules/_deprecated/execution_flock_binary.toml,sha256=cePqGZZf4f9-0GobaxgxMcEByc9I7pTOju6KyakcOq0,1769
src/detection-rules/rules/_deprecated/execution_gcc_binary.toml,sha256=hqaGdpJ0pDyfe9Z3mLb9YQwRiSvAgiKyJbL1TtS6QJ8,1760
src/detection-rules/rules/_deprecated/execution_linux_process_started_in_temp_directory.toml,sha256=Of0Ynl54K-ToNotSxvqmX7ZjEOpHOA4jPJwiTYAWvNs,1495
src/detection-rules/rules/_deprecated/execution_mysql_binary.toml,sha256=DhCMP0edAa6Z22WuHQxlg31aDSFfUWOVvG38eMr85m0,1728
src/detection-rules/rules/_deprecated/execution_pdf_written_file.toml,sha256=y_Z5_xAnD0GP7W-DNFS_GRhkMxjQ8yg44F-SrLqW6WM,6119
src/detection-rules/rules/_deprecated/execution_reverse_shell_via_named_pipe.toml,sha256=ho8lidMGBTNyv3f5AT29uMlDs5PmO_UEhW0EPNLW9QI,2876
src/detection-rules/rules/_deprecated/execution_shell_suspicious_parent_child_revshell_linux.toml,sha256=M6bJXbB1RxvG7sNJifxwfKe8rn2WqRU2LOO1apmj17s,5431
src/detection-rules/rules/_deprecated/execution_ssh_binary.toml,sha256=wRBTyH4Z06Qgf7uSefoQzWzR_yZLZRXrTAqdu00kkcg,1915
src/detection-rules/rules/_deprecated/execution_suspicious_jar_child_process.toml,sha256=g7Y6xvGgfo0MTj6EGYxdDRUtE8VHgTVLnHEU8NSW_w0,5143
src/detection-rules/rules/_deprecated/execution_vi_binary.toml,sha256=rVx9fC5neqddpDzHI3cauhBO0O8eHaW1yeO0GqmPzm8,1693
src/detection-rules/rules/_deprecated/execution_via_net_com_assemblies.toml,sha256=WoQfkdoC-v0pHjs5Z1CSF9JdwbEV-N3yiKzIfcZ05Yg,1517
src/detection-rules/rules/_deprecated/exfiltration_ec2_snapshot_change_activity.toml,sha256=1G5HDecNxC7OnjHHAmJgTABviAJu6m5l8hrd94MErLQ,5984
src/detection-rules/rules/_deprecated/exfiltration_ec2_vm_export_failure.toml,sha256=KGk9FAieIO1d6lNH3b6fBTeWvRrabD22uyL__lW5Tqk,5943
src/detection-rules/rules/_deprecated/exfiltration_rds_snapshot_export.toml,sha256=sWun5b-ABOXGlkaBRRU4D7IAhq0oxcSzRiARSbzyVrs,1587
src/detection-rules/rules/_deprecated/impact_potential_linux_ransomware_file_encryption.toml,sha256=lOEgZWwU381xlheYMvcJFy9gO17FYaWP720PAL9IlUk,4275
src/detection-rules/rules/_deprecated/impact_rds_group_deletion.toml,sha256=mD95apuRrUSCvGO7SUZ8e64qLhoOmAiKB_R_qdV9gtM,6128
src/detection-rules/rules/_deprecated/impact_rds_instance_cluster_stoppage.toml,sha256=7qRnEu_TD9VlHR6kud8vFX5BD2D8I1zOulZCX0zd2Lw,6067
src/detection-rules/rules/_deprecated/impact_virtual_network_device_modified.toml,sha256=C1-KzN13Hafw3A9-Fg-37R4Bd9STq0xPe7i-vBfo69M,6954
src/detection-rules/rules/_deprecated/initial_access_cross_site_scripting.toml,sha256=QzRJdE2DmDPRpcI1GD05Zmv8ouf4zjpWvZFFtp57Nts,1617
src/detection-rules/rules/_deprecated/initial_access_login_failures.toml,sha256=_kOXSQ4PleBgeG68TjvkHXKMUomjZlIqBcP01JwEkPM,1382
src/detection-rules/rules/_deprecated/initial_access_login_location.toml,sha256=tz_uUjcVOnqB1UK96KKBXIbDjYBNfzaWgbis3_6XeSs,1370
src/detection-rules/rules/_deprecated/initial_access_login_sessions.toml,sha256=ANcZlbHYI9rAPIpTOVoBornOTDsvfhgikW-299X-CqY,1358
src/detection-rules/rules/_deprecated/initial_access_login_time.toml,sha256=_kljdiUN-qkj6Cl_sl-1JkYo3pxrfmPDQLWq8v9ndWU,1361
src/detection-rules/rules/_deprecated/initial_access_rdp_remote_desktop_protocol_to_the_internet.toml,sha256=Qwqv0Iuf1XK8f5-qP2KftZBIVXzV7Rwha_8MtLLG3uE,2587
src/detection-rules/rules/_deprecated/initial_access_ssh_connection_established_inside_a_container.toml,sha256=8IRjm-KURyYajs2vbpg_vlAUEQRwlXN5gpA0DlzcVO0,6893
src/detection-rules/rules/_deprecated/lateral_movement_malicious_remote_file_creation.toml,sha256=9psQ-KiT-Mi4cB1RCSHQ-Iy9adDa1vbLqdmG0N3nqh4,1489
src/detection-rules/rules/_deprecated/lateral_movement_remote_file_creation_in_sensitive_directory.toml,sha256=cIF5BJVeQFXhcmk-oKcfIu5re0tjf_klOdBctLEIWXA,1956
src/detection-rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_a_container.toml,sha256=tMNkzlHomJ5txCvbGqU1ee9DtSyhLJM2Nsf3rKkEJaA,7081
src/detection-rules/rules/_deprecated/lateral_movement_ssh_process_launched_inside_container.toml,sha256=GvLLvGW_QVueYL4Ykj8OkA4_KNUhUXtzEuyF3YiK5Jc,8813
src/detection-rules/rules/_deprecated/linux_mknod_activity.toml,sha256=AtOAcnSD1gRdU8oeF1nL7vR-8st7W6Cx_FM9ZqYU5fU,1252
src/detection-rules/rules/_deprecated/linux_nmap_activity.toml,sha256=4krPC1MpI7NrhqLNP_CvUd_WpeI7V4Wb_IFbB8xH7Co,1250
src/detection-rules/rules/_deprecated/linux_socat_activity.toml,sha256=fpPixypMYwHucgfqOZtKJesiqM45VL5AJ3tm3djHPJE,1283
src/detection-rules/rules/_deprecated/persistence_cap_sys_admin_added_to_new_binary.toml,sha256=elaLLLJeNPPC2ysluHFsPWClEWUpkkDu4J84UzJ8SnM,4004
src/detection-rules/rules/_deprecated/persistence_creation_modif_launch_deamon_sequence.toml,sha256=nl0Jd4DRJzV8ZcFDsu1iaFLsQTpK_EXo5281JPx4jnI,7985
src/detection-rules/rules/_deprecated/persistence_creation_of_kernel_module.toml,sha256=28DM-mMhCvG3RwE4aBN9tFNeFebjnkHlxwpCl1fkCgU,1562
src/detection-rules/rules/_deprecated/persistence_credential_access_modify_auth_module_or_config.toml,sha256=8qPbbDdQ3xZLMDVVha2djk1F9qEVnN9jLkTvBtwSOSY,7618
src/detection-rules/rules/_deprecated/persistence_cron_jobs_creation_and_runtime.toml,sha256=9NuZqZnlMzwYsrsHmFaCufJDQ_EvyjmFm1F0pV020zA,1948
src/detection-rules/rules/_deprecated/persistence_etc_file_creation.toml,sha256=aJuHvXlPf_fsjj4kyttJnRq8-7JJgBiZvnDU182TjCI,13625
src/detection-rules/rules/_deprecated/persistence_google_workspace_user_group_access_modified_to_allow_external_access.toml,sha256=YHdUhvXuabDtrsacccM1Js8ZjkslHGFALmVMHwNc56A,3682
src/detection-rules/rules/_deprecated/persistence_kernel_module_activity.toml,sha256=NAumTSTdPVKKxNj_eawEiJj1O7NBc1BWsK95DlnIuuo,1570
src/detection-rules/rules/_deprecated/persistence_rds_cluster_creation.toml,sha256=qSHGYAesdQea2dCWfeBRM4xHwl-b-POpjWht64aO2no,6748
src/detection-rules/rules/_deprecated/persistence_rds_group_creation.toml,sha256=c2M-d7tBZpTZHitlXsObzTNhRlp3WuG2YQ0ojGNOvy0,6138
src/detection-rules/rules/_deprecated/persistence_rds_instance_creation.toml,sha256=V3Pf2qnZ4_JVdgIowqXUhcs39hZ5OxWuIhfDagZDdJ0,5917
src/detection-rules/rules/_deprecated/persistence_redshift_instance_creation.toml,sha256=F89f3HXUsjlkYCYx56zhlCgjybt78tEe28LKeNHAcoU,6164
src/detection-rules/rules/_deprecated/persistence_shell_activity_by_web_server.toml,sha256=1XiZc6_XUztm5qrZuHU01sEh6QAS9TGJ4-SDVR1Vkmo,4985
src/detection-rules/rules/_deprecated/privilege_escalation_gcp_kubernetes_rolebindings_created_or_patched.toml,sha256=FPINRz6iSlfk2sHVKA30AmwBavmIuhKHmxFxms6kFh0,1903
src/detection-rules/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml,sha256=z0OxMwyBUuyP95zI2UFyJTJbPG-DgFxGjLpRP6HWKro,2361
src/detection-rules/rules/_deprecated/privilege_escalation_linux_strace_activity.toml,sha256=jFqD1L6vukg2SZmd_9Dl7BOlyvneLEp73MLrn8sPjKQ,1505
src/detection-rules/rules/_deprecated/privilege_escalation_linux_uid_int_max_bug.toml,sha256=GhGncqe62MCvlD_he-9coa5ZC7Rk_IPmXMHw9bkTsFc,8113
src/detection-rules/rules/_deprecated/privilege_escalation_netcon_via_sudo_binary.toml,sha256=S4Wp681190UbtXAZRfuSVLtZeO9hz2HsdP_rdes23vU,8775
src/detection-rules/rules/_deprecated/privilege_escalation_printspooler_malicious_driver_file_changes.toml,sha256=lpOfEQ3OwDo_dF1nPSHEf8PZOfLsszfNrnDDIRoajHs,1608
src/detection-rules/rules/_deprecated/privilege_escalation_printspooler_malicious_registry_modification.toml,sha256=AlNF4rCdfNWp4xVMpUYEYHtYq1vGiWwb5-9VqY54qKI,1709
src/detection-rules/rules/_deprecated/privilege_escalation_root_login_without_mfa.toml,sha256=6kHzxusnxxfrjOoAVzHg0ar3eiQfLdnoc35nbxqQFjc,5377
src/detection-rules/rules/_deprecated/privilege_escalation_setgid_bit_set_via_chmod.toml,sha256=ByHDIGHwpb4ynYkU_6ZBQKW4Sn5nyPB6yLdtmPcojaE,1779
src/detection-rules/rules/_deprecated/threat_intel_filebeat7x.toml,sha256=PgkZ1AHtQPmjxdB3aoq29HBkSf9Z3hesx-_1S2ptQas,6963
src/detection-rules/rules/_deprecated/threat_intel_filebeat8x.toml,sha256=P2To_aycPXS9uQVquiZWjQpl-XZGY4DUggWiyuwf3qQ,7564
src/detection-rules/rules/_deprecated/threat_intel_fleet_integrations.toml,sha256=apK4wtHuBhL5vRGdIiG5rYIVKca4gYicu3yPdEA9HdU,7588
src/detection-rules/rules/apm/apm_403_response_to_a_post.toml,sha256=ZIpSHsNs0SlFDVlHmZPQIPMXnPPCeMzrN7-o-a5k5r4,5258
src/detection-rules/rules/apm/apm_405_response_method_not_allowed.toml,sha256=2g1rszIMgvs0Zaf0WBQxJbW_yoqr2putP8tDyC7ZJV4,5248
src/detection-rules/rules/apm/apm_sqlmap_user_agent.toml,sha256=jmZAnk7gHPZLC8ZxxDhtE3pRhAszY5Oy3_RvgewE5xI,4897
src/detection-rules/rules/cross-platform/command_and_control_common_llm_endpoint.toml,sha256=AFFEy4nJVERCPFbCKhXIpbrG-McYFktWtVa4C9PrcQ0,6437
src/detection-rules/rules/cross-platform/command_and_control_curl_wget_spawn_via_nodejs_parent.toml,sha256=Ij4_kQEo_1W0dLpTqd6nky9nt4ASvuWbAxN7q_TVmTI,8470
src/detection-rules/rules/cross-platform/command_and_control_genai_process_suspicious_tld_connection.toml,sha256=BJkGwmylXCaOE_IajW-hC_V5XydIpibj2OeSjFvqsy4,6143
src/detection-rules/rules/cross-platform/command_and_control_genai_process_unusual_domain.toml,sha256=04JdQkCFx87g6lTvyyHcgiKV0xp6f9qesOkWJyFfGsM,7270
src/detection-rules/rules/cross-platform/command_and_control_google_drive_malicious_file_download.toml,sha256=Go2LKCxIwI44xq5HVTFMsETaqkvxKt2qA6Vo-F4UDvI,6344
src/detection-rules/rules/cross-platform/command_and_control_pan_elastic_defend_c2.toml,sha256=tItB8IUVDZBpAT1GAN0J_aCs9gI5FCMgJO8Twqeohf0,3069
src/detection-rules/rules/cross-platform/command_and_control_socks_fortigate_endpoint.toml,sha256=Wz70tuaMD1LpVRPa3sOIR5iNCiz_uu97GRz3oxcEgv8,3512
src/detection-rules/rules/cross-platform/command_and_control_suricata_elastic_defend_c2.toml,sha256=7xKh7DlJu5y62E3eECnA3Whf5_798ebp4bB8pDWy1pE,3584
src/detection-rules/rules/cross-platform/command_and_control_tunnel_qemu.toml,sha256=Z7t3HBbflgb8O2fPjeKAJfGmPh8zC8GHJFxD7iBSA2c,4602
src/detection-rules/rules/cross-platform/credential_access_cookies_chromium_browsers_debugging.toml,sha256=wo0aI10tqeIBUOhqFjh0pIfjx21t41haiEXlt6BheZ0,6875
src/detection-rules/rules/cross-platform/credential_access_forced_authentication_pipes.toml,sha256=IHaB480daLcQF6SdhYVjgnUlD_j1oYeY4WhBg9htTRw,6553
src/detection-rules/rules/cross-platform/credential_access_genai_process_sensitive_file_access.toml,sha256=TmesgoSWVdY9JKqR1TtnzOOquqGty2rtlTYPGN-_uic,6704
src/detection-rules/rules/cross-platform/credential_access_gitleaks_execution.toml,sha256=E-7bCwtmpT8HN8WPGr_OL8O7fqtijFB9awu35P4E2xc,6659
src/detection-rules/rules/cross-platform/credential_access_multi_could_secrets_via_api.toml,sha256=I7Y2NNyXxmJargeuW29OVmznV7dD-dDaarQzu5iCk-I,9000
src/detection-rules/rules/cross-platform/credential_access_trufflehog_execution.toml,sha256=lOCdqIIlh7NRHKkfvxHr5crUM4q59aV9OgC9rSckiZQ,6802
src/detection-rules/rules/cross-platform/defense_evasion_agent_spoofing_multiple_hosts.toml,sha256=Wk4Wb3vSXDrURnVl4k7P93b8MONmtN2pJ-tu2x5hLsw,5468
src/detection-rules/rules/cross-platform/defense_evasion_deleting_websvr_access_logs.toml,sha256=I7kDvpYce1Z8NL05OFP9CRr4CtzG6ts5fUh0ZdbM1po,5726
src/detection-rules/rules/cross-platform/defense_evasion_deletion_of_bash_command_line_history.toml,sha256=De4DUjB7zTVkWe5h4cYK07CS6aToewInfpocrv-VGMc,7277
src/detection-rules/rules/cross-platform/defense_evasion_elastic_agent_service_terminated.toml,sha256=Tr0SIEKzfZ83sDDIHz-NjgB0-gZHyQiIwvpRzTNDm5w,7650
src/detection-rules/rules/cross-platform/defense_evasion_encoding_rot13_python_script.toml,sha256=NtNYmX0maYCnSuDFgzqK3ZpKsUleH2X7i5yKS41rmLs,5738
src/detection-rules/rules/cross-platform/defense_evasion_genai_config_modification.toml,sha256=aKsHBd_4qxbYb04A5Si0zvYUzF-Mh1phH3g2ZXPw5Pk,6167
src/detection-rules/rules/cross-platform/defense_evasion_genai_process_compiling_executables.toml,sha256=fQuYQh-ZsEEd_-rhU9LjyJqIgE9Bfe2B32fGbDInBsU,6372
src/detection-rules/rules/cross-platform/defense_evasion_genai_process_encoding_prior_to_network_activity.toml,sha256=OHbyAIm_F6ToK5zRLLlhlKAz7vXRxK3LuMrEqoFXK7Y,7367
src/detection-rules/rules/cross-platform/defense_evasion_masquerading_space_after_filename.toml,sha256=YBU95nKaIVn59rYsR8DA8WRMMwE3VJRfPn4yqYaQFa0,6576
src/detection-rules/rules/cross-platform/defense_evasion_missing_events_after_alert.toml,sha256=HwI4Ihf6bKi6E--LweZgeoFGJrPTkXW_di5ls678kH8,4051
src/detection-rules/rules/cross-platform/defense_evasion_potential_http_downgrade_attack.toml,sha256=7_7EswnRl_hex6HYqweCzoaZW2xWpGyjQ1udyhgSb6g,5713
src/detection-rules/rules/cross-platform/defense_evasion_processes_with_trailing_spaces.toml,sha256=F9yoWyZ4WkYWK3LpUlzcPeuVurt1zkJp-Dus2S9ph2Y,5556
src/detection-rules/rules/cross-platform/defense_evasion_timestomp_touch.toml,sha256=bGrH6kwXC0lrRh-ciWAxTWgc_iu9QDnwqvGnLGFFo9U,8128
src/detection-rules/rules/cross-platform/defense_evasion_whitespace_padding_command_line.toml,sha256=NZ9MmhGVNf_8vENdRO3ft9mX5gp3HBfuq_zp0mOmDD8,5693
src/detection-rules/rules/cross-platform/discovery_security_software_grep.toml,sha256=nq6x0zUvg2hJJzuV1u9YQDc6TNvS-uWAzOjpztXOIeU,6373
src/detection-rules/rules/cross-platform/discovery_virtual_machine_fingerprinting_grep.toml,sha256=qlNGkyDHusBCazwgz2v_uXoibA_0aVp5G1n-bQW-FkM,6206
src/detection-rules/rules/cross-platform/discovery_web_server_local_file_inclusion_activity.toml,sha256=1v68rO8zqrBO_-VtA-pM_Ln6ZK6ZPsvLhi8L4AespoI,10462
src/detection-rules/rules/cross-platform/discovery_web_server_remote_file_inclusion_activity.toml,sha256=D4fjrM-ctCZnGZlbHNnWBxUBs3n4IZ_qXkXIHQwwpMs,7636
src/detection-rules/rules/cross-platform/execution_aws_ec2_lolbin_via_ssm.toml,sha256=gxBewFlj8u7LV6O85N0QUVSS-o9G7arcyKNFNmeX_bk,12107
src/detection-rules/rules/cross-platform/execution_aws_ssm_sendcommand_with_command_parameters.toml,sha256=IZPl492ynOI3w89Uh0zBDVgSei_HIoh4UtGT5Y2sSqE,9419
src/detection-rules/rules/cross-platform/execution_d4c_k8s_mda_direct_interactive_kubernetes_api_request_by_usual_utilities.toml,sha256=Xx1SGfHn45LTXnmiTIEBH0bPur0-vyXAxk5FQY_8qOU,8347
src/detection-rules/rules/cross-platform/execution_d4c_k8s_mda_forbidden_direct_interactive_kubernetes_api_request.toml,sha256=r9R16HeRMwn_UfLgcw8pEiH36r8KPM6iOrXhC-T5V7s,9054
src/detection-rules/rules/cross-platform/execution_d4c_k8s_mda_kubernetes_api_activity_by_unusual_utilities.toml,sha256=cdsxEo07QLnN4S6mZ0jjGlaoLEd-lz6y3voNviBwXBo,9884
src/detection-rules/rules/cross-platform/execution_d4c_k8s_mda_service_account_token_access_followed_by_kubernetes_api_request.toml,sha256=IHCKsoT9HVBecuOrsGJ8jF3UsEIiMWaHokJXuaGVFiU,7795
src/detection-rules/rules/cross-platform/execution_git_exploit_cve_2025_48384.toml,sha256=c-W_WRw-VMMIAc1lxc3n2Jib2oFMTZjMdzVub6pmzKw,6646
src/detection-rules/rules/cross-platform/execution_nodejs_pre_or_post_install_script_execution.toml,sha256=OnEnIYTptrKtir_Smx5RrkefAwAUy18MkXjUX9y7Ypg,5255
src/detection-rules/rules/cross-platform/execution_openclaw_agent_child_process.toml,sha256=G8cQkvox31eCaGjBe-DajGzK_OwwWQlbB3D5yqyPox4,4810
src/detection-rules/rules/cross-platform/execution_pentest_eggshell_remote_admin_tool.toml,sha256=KSq5EvYOMSK02w7hbL3v6LJf7xaYTYRXtcY9ZQrJsGo,5202
src/detection-rules/rules/cross-platform/execution_potential_widespread_malware_infection.toml,sha256=oi_7e1y0axyH7TUHobRHu4Xnfr-n4yuyM_dxx98vOqE,6100
src/detection-rules/rules/cross-platform/execution_privileged_container_creation_with_host_reference.toml,sha256=CBAhMNFwboUAZGoLstOyaziJe-TNIQVzxwHQB06_WJY,9141
src/detection-rules/rules/cross-platform/execution_register_github_actions_runner.toml,sha256=JtcKd6LS3jYqIHRqewQkg3kowGjhmzqE7HlSu8TNuQw,4670
src/detection-rules/rules/cross-platform/execution_revershell_via_shell_cmd.toml,sha256=gWaO0oJM9FUpvcGu8cqjzymHh3iPgs9m-Xjfz9sKflc,5050
src/detection-rules/rules/cross-platform/execution_sap_netweaver_jsp_webshell.toml,sha256=rm4RbPNACwLAJVk3FRIBYCju2rpdpbwIKSenluBG_2s,3905
src/detection-rules/rules/cross-platform/execution_sap_netweaver_webshell_exec.toml,sha256=0hnmJ1W6lByMs8SjM9iHMJlIbQxkkvFIjfCdaoqrH10,4335
src/detection-rules/rules/cross-platform/execution_suspicious_java_netcon_childproc.toml,sha256=6VAeVUKS8iHw5TtWtSJOa45RRb7zQP8GdBxfu77fwZs,7037
src/detection-rules/rules/cross-platform/execution_via_github_actions_runner.toml,sha256=rk4P0UJhizJAvFU5HHeMIS1N3wtXgpEldxDw9vhoEFw,5038
src/detection-rules/rules/cross-platform/execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml,sha256=ZEF9z_NODjgmEItip2BpkooJ9gE_8rOlsJY1Z_Ay_Jk,10074
src/detection-rules/rules/cross-platform/guided_onboarding_sample_rule.toml,sha256=p1GJtIMLs7uK8ueRMlMk5OP-sjUstczOGzDeo-nXdpU,4364
src/detection-rules/rules/cross-platform/impact_alert_from_a_process_with_cpu_spike.toml,sha256=f87WvqYNNegMNwouENCRS_gHCYQvvKGI8Xa-yyXRGPM,6371
src/detection-rules/rules/cross-platform/impact_alerts_on_host_with_cpu_spike.toml,sha256=L0WrE7ikdEPcg5T2tSxZf-FfBlEKEgCjRNSE8ZKqPPg,6511
src/detection-rules/rules/cross-platform/impact_hosts_file_modified.toml,sha256=8xy0zjoIViN181WV8r50mVgWQx61MpdUjdFPt5PCq0k,7990
src/detection-rules/rules/cross-platform/impact_newly_observed_process_with_high_cpu.toml,sha256=nbySkMW6xnEvG9Ra8NrmNyjDxI_81mBfBpShADoaEHk,6120
src/detection-rules/rules/cross-platform/initial_access_azure_o365_with_network_alert.toml,sha256=7xaR8hAVLsnnI5TSm63GeHwoMx8bYkWmiqBIopEnsgw,6880
src/detection-rules/rules/cross-platform/initial_access_elastic_defend_alert_genai_utility_descendant.toml,sha256=E14d1ko-SWLZ-1ONr9uJV3sE3xLdHIHYFSeuISkc5kE,5516
src/detection-rules/rules/cross-platform/initial_access_execution_susp_react_serv_child.toml,sha256=wXZsV0sZhtQhf212EfSYg7M-XGkmfDO_D4QDteL8ZFk,8799
src/detection-rules/rules/cross-platform/initial_access_exfiltration_new_usb_device_mounted.toml,sha256=kGrG8Sn8eHRxpqVikaMpvH7lJ6F7n8rEHiaiiL5AZr4,6092
src/detection-rules/rules/cross-platform/initial_access_file_upload_followed_by_get_request.toml,sha256=K0IPKIhb5kRwGYLfe6Yxq4N9MuqppOWvkMy2T1fgIXo,8870
src/detection-rules/rules/cross-platform/initial_access_fortigate_ssl_vpn_login_followed_by_siem_alert.toml,sha256=NeabQcPixURryNR7v72YOBqPHLtY-5fwtRAaWYbRzmM,3171
src/detection-rules/rules/cross-platform/initial_access_ollama_api_external_access.toml,sha256=SD9gfcj5PFWj-o_ql0ltq33fcalQYvoNPm8XSWqEz1w,3526
src/detection-rules/rules/cross-platform/initial_access_zoom_meeting_with_no_passcode.toml,sha256=Cq9vuF3tyd_Uu2MvCBss_R48NrRBg3vZ5MiY0_rjwdA,5893
src/detection-rules/rules/cross-platform/lateral_movement_multi_alerts_new_srcip.toml,sha256=zU4YTDc1gqCLJo_xJQmmPkYE9Dihdh2skt3N1g2PS14,5123
src/detection-rules/rules/cross-platform/lateral_movement_multi_alerts_new_userid.toml,sha256=TbE0C4ciAfbSRLOvFC1pIBJMbH494kwxZ8kewcWQ3Lg,4391
src/detection-rules/rules/cross-platform/multiple_alerts_by_host_ip_and_source_ip.toml,sha256=H1RCi6kSmmKAgkh4A-9_UH4Mv_ugTetTFIWajD3Iw_o,6378
src/detection-rules/rules/cross-platform/multiple_alerts_different_tactics_host.toml,sha256=YLMtF4Cn35gxcDuWZwXylLQ0a9qvAr2bkdKXFVqotQA,4899
src/detection-rules/rules/cross-platform/multiple_alerts_edr_elastic_defend_by_host.toml,sha256=st7y6zZTVom0_tbTjVFe6RCYc8Vw9DTuUWVfwAHkzuI,6452
src/detection-rules/rules/cross-platform/multiple_alerts_edr_elastic_same_process_tree.toml,sha256=Xxc3Uib6dFHdjzDtPmTvbQ_hw70wFmCXtAxD4Hbw1AE,6086
src/detection-rules/rules/cross-platform/multiple_alerts_elastic_defend_netsecurity_by_host.toml,sha256=Ha-TJGAoBT042heNlF-2jg613GYCFdFUV5CN63HgIwg,7540
src/detection-rules/rules/cross-platform/multiple_alerts_email_elastic_defend_correlation.toml,sha256=_STARjkLdxZsmde29bp5_gBjc3mLbOJImyVv_y8TWcI,4345
src/detection-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_dstip.toml,sha256=g1ZXbL3FMYMFbEOR3FhpvdDnhpkjS7VtA7rOsm-at24,5978
src/detection-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_srcip.toml,sha256=fF5HCLsDBJnXP-VOW8YkL-ZN3ACZi_SnCY5zgLfhwmc,5893
src/detection-rules/rules/cross-platform/multiple_alerts_from_different_modules_by_user.toml,sha256=KxWshFpT9S65iBjtEI4f8oe-Rmf3DpuxWK9lZCIshfs,6748
src/detection-rules/rules/cross-platform/multiple_alerts_involving_user.toml,sha256=Z_uM0At6XArG9gBIwkOIXCeahZ6yB0duPrwVvi-F74w,6419
src/detection-rules/rules/cross-platform/multiple_alerts_llm_attack_chain_triage_by_host.toml,sha256=PRA8dR1XgG-9JIyloZOUNVSPTYVLndxbVpByk8EfI5I,10122
src/detection-rules/rules/cross-platform/multiple_alerts_llm_by_user_entity.toml,sha256=y7DwXJygKmcMIWX8FlbJiORaIhiFnf7RnjNathNEN2U,7014
src/detection-rules/rules/cross-platform/multiple_alerts_llm_compromised_user_triage.toml,sha256=hZQR1PGttzAIUbQ4ftWS8ToJslYYgo-mv6_iwnLLn3s,9917
src/detection-rules/rules/cross-platform/multiple_alerts_risky_host_esql.toml,sha256=lF5UB9p90_nRcrrgrX0XWMfPiA_QTangi5uZ26W6WeM,7148
src/detection-rules/rules/cross-platform/multiple_alerts_same_tactic_by_host.toml,sha256=cpBv2Han6e38_BZ5BbB-EYPFRaRbSpgw_zDDtIA1IuI,6661
src/detection-rules/rules/cross-platform/multiple_elastic_defend_behavior_rules_same_host_prevalence.toml,sha256=nFv3x2wPUs91mKHsDnmQk4s6T0HnuyF01m9iXPwcoEI,4854
src/detection-rules/rules/cross-platform/multiple_external_edr_alerts_by_host.toml,sha256=PwZgbRZ6ioVQr_rdQInPSuRFtxKh5i0UOHdOdxyihJ8,6583
src/detection-rules/rules/cross-platform/multiple_machine_learning_jobs_by_entity.toml,sha256=Lq1XD6rHIiTp97UE2DFmPPPsZTTOQpQBm_H1m_tXFu4,5409
src/detection-rules/rules/cross-platform/multiple_vulnerabilities_wiz_by_container.toml,sha256=8rEWLT0C_KaAkpxH-fL_Npyc_DkUOArAXygiE8iE3o0,5024
src/detection-rules/rules/cross-platform/newly_observed_elastic_defend_alert.toml,sha256=68sekizJQ8awiD7-dppr3u9tR4SUiQok7si0pjLvzdI,5114
src/detection-rules/rules/cross-platform/newly_observed_elastic_detection_rule.toml,sha256=ANj52Vfraz1euwaH8iB0B6gbS37Ev6OYLSYuWK92QuU,4689
src/detection-rules/rules/cross-platform/newly_observed_fortigate_alert.toml,sha256=Seay10XExqKDj1RadkB6vKbvAHj9VxfMaIMlPhrM7dM,4167
src/detection-rules/rules/cross-platform/newly_observed_panos_alert.toml,sha256=MiXF9gau_6Skr5h6ee2RlxEasR9n_o6fVCJyr_xgZN4,3705
src/detection-rules/rules/cross-platform/newly_observed_suricata_alert.toml,sha256=H1frY0PejGIxsADaSShjoE3cHKGGupZLPf8cPx1SG20,3747
src/detection-rules/rules/cross-platform/persistence_shell_profile_modification.toml,sha256=uuE36YDPmpzwIJJNK_SpWik8iyVW2uEZhpng03HqRxM,6274
src/detection-rules/rules/cross-platform/persistence_ssh_authorized_keys_modification.toml,sha256=FJhP1g6eo2-jIGFJ0Zc-JzAAAKnUjMRe4w-2l37A6dM,6945
src/detection-rules/rules/cross-platform/persistence_web_server_potential_command_injection.toml,sha256=38-wDVXItu_Z2fD3joam5w2bfFOtIdNjMoc0vFzzO94,13350
src/detection-rules/rules/cross-platform/privilege_escalation_echo_nopasswd_sudoers.toml,sha256=a_IsO0G6AtUDVfX99o8bfZJ_HZKy1lzpvVfDnNRf8ng,5795
src/detection-rules/rules/cross-platform/privilege_escalation_setuid_setgid_bit_set_via_chmod.toml,sha256=Wy68RM7JJzCwbCaCkjnCxzRkzHK4Mfso47kYPojOSdo,6782
src/detection-rules/rules/cross-platform/privilege_escalation_sudo_buffer_overflow.toml,sha256=fLyvWNm4cO31jemQrIbI4MvYmtamIhPu0bECHVQFTNI,6318
src/detection-rules/rules/cross-platform/privilege_escalation_sudoers_file_mod.toml,sha256=o6AzoqCrjo9aYHdqyyVwZfHrk-mvMe2eulca5X2TmE8,6027
src/detection-rules/rules/cross-platform/privilege_escalation_trap_execution.toml,sha256=p1Urrw1By9lvcKZ5opWe_dsmWmGT9S2Y0ckvjAKmm58,5455
src/detection-rules/rules/cross-platform/reconnaissance_web_server_discovery_or_fuzzing_activity.toml,sha256=hF8EcmhVv6VdsFYjYazZJm0lnANN9ijhgww6kiDfb4M,6729
src/detection-rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_logs.toml,sha256=aLOkJD3O9pyNmsTV54p6ssT77QxiFp_EbyP3A58q4zA,6321
src/detection-rules/rules/cross-platform/reconnaissance_web_server_unusual_spike_in_error_response_codes.toml,sha256=ZkqS9obpaI6_I5HkipG07PDukGcabTlT9UEOjGEc-bQ,6875
src/detection-rules/rules/cross-platform/reconnaissance_web_server_unusual_user_agents.toml,sha256=l__fa7W4qeS75cTsK0l_Dx6WAH3sIfcux6d71Nsu4fc,9286
src/detection-rules/rules/integrations/aws/NOTICE.txt,sha256=J_TLlzy-3FynutCsreov6dyNdxzN0cayBHv4dv9HzbU,1307
src/detection-rules/rules/integrations/aws/collection_cloudtrail_logging_created.toml,sha256=_VwpLKzCq-fzDVO5Zes9fLLPKTrKTrm1UuYhTmEv7_8,5003
src/detection-rules/rules/integrations/aws/collection_s3_unauthenticated_bucket_access_by_rare_source.toml,sha256=sY_eL4UgKuJmHRLVMWOYw8yGJRqkouXkMWAh4MEbUqY,7583
src/detection-rules/rules/integrations/aws/credential_access_aws_getpassword_for_ec2_instance.toml,sha256=Zl483bumOX2jzaim3VBkhMcoJNR3UER6hzujvitdm4s,5986
src/detection-rules/rules/integrations/aws/credential_access_iam_compromisedkeyquarantine_policy_attached_to_user.toml,sha256=Lplp3cPy4uYyYqhxRgLuvMqCWIxae7hjwRgDiPIh3LY,4866
src/detection-rules/rules/integrations/aws/credential_access_iam_user_addition_to_group.toml,sha256=mNBmcwI2RPA5iJFtmxSOu4lE0aZvt8b9Df14sg4WUWk,5336
src/detection-rules/rules/integrations/aws/credential_access_new_terms_secretsmanager_getsecretvalue.toml,sha256=7922yuM0E7qNmC_yVoRO7BtdYJBINPVMNK_wb28rWt8,7727
src/detection-rules/rules/integrations/aws/credential_access_rapid_secret_retrieval_attempts_from_secretsmanager.toml,sha256=HC-z249LyYHOuh32nw9Pwsoe1zCXBKzCtcFPaB1lHrw,6827
src/detection-rules/rules/integrations/aws/credential_access_retrieve_secure_string_parameters_via_ssm.toml,sha256=Ua9zTxlKMh36PzlGiRsU616jdSHmvCBdwyNI_Izzrw4,7589
src/detection-rules/rules/integrations/aws/credential_access_root_console_failure_brute_force.toml,sha256=wS3lqI_Rt0jZebwrlYTHGU66J0ZSUpdzY68qy5rAiKc,7980
src/detection-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_deleted.toml,sha256=1K8FxpOYUiUgTH0Gd7TFjxGqEbTtU12fh5HEsq2Zycg,4668
src/detection-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_evasion.toml,sha256=C6RBbowKJqx_X1AqhLCGTd4alI0uweKbcH94at1GbdI,7453
src/detection-rules/rules/integrations/aws/defense_evasion_cloudtrail_logging_suspended.toml,sha256=014kbRZn_4AMeUxCvYqVinWpFq6BWz5sTivR6s2odY8,4611
src/detection-rules/rules/integrations/aws/defense_evasion_cloudwatch_alarm_deletion.toml,sha256=XQpfU_wXCbSla6-NROB2SEGw2nINlM_POVSNcHY9DMA,8367
src/detection-rules/rules/integrations/aws/defense_evasion_config_service_rule_deletion.toml,sha256=UyfbCn7fz1n_a_7R9Hcq5g_nRmfdFdPs4vchaoADc5c,7666
src/detection-rules/rules/integrations/aws/defense_evasion_configuration_recorder_stopped.toml,sha256=2k_kdJrQLBzL2djgW_etrjs_J0dS_XNx-uUDoUPY0l0,6586
src/detection-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion.toml,sha256=kpkIvqJYuGkTiyFDfA0cKRLY7gSIqF4-QtXJ0FSF6Vg,6273
src/detection-rules/rules/integrations/aws/defense_evasion_ec2_network_acl_deletion.toml,sha256=YXDn4I5d45HvQUlNdQeAt-lHqDPvzLRhjQyQaD6dD5k,6533
src/detection-rules/rules/integrations/aws/defense_evasion_ec2_serial_console_access_enabled.toml,sha256=xeHawgSoBYGU35DHRtPYlhwgU6nOs7PZBLQ5CRU9UPg,6926
src/detection-rules/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml,sha256=2w9jdb3Rg5frCXgCs4BrStJTl87xCHtWTjX87ld6Jn8,7005
src/detection-rules/rules/integrations/aws/defense_evasion_guardduty_member_manipulation.toml,sha256=JjaQhbGI01Q1i1x4KilUPy81-OkVViPWTV7mZeYMxPc,7524
src/detection-rules/rules/integrations/aws/defense_evasion_rds_instance_restored.toml,sha256=c-mIgaaR-D3YDoPnrWxKppwPxJBNjIna1fW9HJyPyDI,8988
src/detection-rules/rules/integrations/aws/defense_evasion_route53_dns_query_resolver_config_deletion.toml,sha256=kUOpdmc_LiQR3ljkEQ_VHdS0rKuwkb2i4ammX5TkZFk,7325
src/detection-rules/rules/integrations/aws/defense_evasion_s3_bucket_configuration_deletion.toml,sha256=N6S5Ls0kY99j_SM_OR504-m36mK03vsHC6DIXguHzCE,8969
src/detection-rules/rules/integrations/aws/defense_evasion_s3_bucket_lifecycle_expiration_added.toml,sha256=UlA_9TDlxr-oGMHHms-iuQ_-O2JR5d5GroXIJGmKchc,9119
src/detection-rules/rules/integrations/aws/defense_evasion_s3_bucket_server_access_logging_disabled.toml,sha256=3ao9gf7QAhzyGwQZgahkmGPgo2QdRcWptj5EnODkUck,7366
src/detection-rules/rules/integrations/aws/defense_evasion_sqs_purge_queue.toml,sha256=JxIIomJopjaukxlBlSzVZ7aWa_i1ZE40U1l9S88Z93o,5930
src/detection-rules/rules/integrations/aws/defense_evasion_sts_get_federation_token.toml,sha256=us3Zz_3pvLvkuiQak3OcPPkZLReUr5AbQ9pOQkzZ8yI,7024
src/detection-rules/rules/integrations/aws/defense_evasion_vpc_security_group_ingress_rule_added_for_remote_connections.toml,sha256=lx3vB9Ntp1ADU73XyzCmYIxRobPe4uU3nch3sZe_D_I,6455
src/detection-rules/rules/integrations/aws/defense_evasion_waf_acl_deletion.toml,sha256=fzgW9tUeQlCvT3_kTqD49BTye2DE5Z6LV-_6fEgYBRM,8586
src/detection-rules/rules/integrations/aws/defense_evasion_waf_rule_or_rule_group_deletion.toml,sha256=ueql6LKFcc2Y5BZMXAGariyBdjqral0ELoVue2LA9DE,7773
src/detection-rules/rules/integrations/aws/discovery_ec2_deprecated_ami_discovery.toml,sha256=Ov8jXYOVucVeAvaxB6i3bZ8BGXiAEKJnZJyxTEBO-h0,6072
src/detection-rules/rules/integrations/aws/discovery_ec2_userdata_request_for_ec2_instance.toml,sha256=dXqlHhBMtxWnzxdXDXLAif09AwgRpDqr8yBc5L05R6g,7131
src/detection-rules/rules/integrations/aws/discovery_iam_principal_enumeration_via_update_assume_role_policy.toml,sha256=GuHUDp2fRTTXdDoRodaU8LMCrpnuWnc9d6UOEsnmGZo,8048
src/detection-rules/rules/integrations/aws/discovery_multiple_discovery_api_calls_via_cli.toml,sha256=ghZp_0KI7yZ-ok0JQh4IeFuFL3UsdC3h_9iHD5_f4NQ,11691
src/detection-rules/rules/integrations/aws/discovery_new_terms_sts_getcalleridentity.toml,sha256=Sbjdn7tQpDly2NjPCnKwsY7NRe3pnWiqG5QIjc3DO_o,7145
src/detection-rules/rules/integrations/aws/discovery_servicequotas_multi_region_service_quota_requests.toml,sha256=6FMb9AK-7a2QnGZDzwl4-7i8uSIz1Q_qykbyzRnJgAc,9327
src/detection-rules/rules/integrations/aws/discovery_ssm_inventory_reconnaissance.toml,sha256=TX-gFNcXVs7bAhCTuXemuiElt2ouLBdVfFfWuASAuoI,6976
src/detection-rules/rules/integrations/aws/execution_lambda_external_layer_added_to_function.toml,sha256=x46Ie7mY8P_LEer1Tsjq6_r7nIUxtSaWcXsbVJTx1Ac,6215
src/detection-rules/rules/integrations/aws/execution_new_terms_cloudformation_createstack.toml,sha256=6xnf7heUkc3JRFjtuaqvls4eSO3tPnbljnt7wJYMAqQ,6297
src/detection-rules/rules/integrations/aws/execution_ssm_command_document_created_by_rare_user.toml,sha256=AI0QYOEfCnXjaIpaapAgWo3mHXysuZMJgAU0tlB7zvg,6212
src/detection-rules/rules/integrations/aws/execution_ssm_sendcommand_by_rare_user.toml,sha256=CHN3Js8Z2f26aS6ZTrJVnrTaPFz51jJWaeJV9r31uE0,7461
src/detection-rules/rules/integrations/aws/exfiltration_dynamodb_scan_by_unusual_user.toml,sha256=uSwHYyeApM3W52e0ImPXQE45ozry_dYZGbnIiqdCoEM,6565
src/detection-rules/rules/integrations/aws/exfiltration_dynamodb_table_exported_to_s3.toml,sha256=9ly2vTdA8rZ5WA8GN-0kYCY3ojH4JImIpeAazgDoirE,6096
src/detection-rules/rules/integrations/aws/exfiltration_ec2_ami_shared_with_separate_account.toml,sha256=GfJtWty62DGwiPXI6gKHtJysNIv0XtIUhucsiDvC7mo,6548
src/detection-rules/rules/integrations/aws/exfiltration_ec2_ebs_snapshot_shared_with_another_account.toml,sha256=WgYKH2gS2Mg240Bf4lbRFlFc5QjwxGlUOX7kMDNjEeM,8871
src/detection-rules/rules/integrations/aws/exfiltration_ec2_export_task.toml,sha256=RWu7L3QCXsSVHzIx4UeacjLSKEEHpaew-UgfB_CtNX4,6868
src/detection-rules/rules/integrations/aws/exfiltration_ec2_full_network_packet_capture_detected.toml,sha256=rMS-YoRNzdmoJqhJ3U2NZmBFMy_FIcyRZwGP2dM5W4Y,8038
src/detection-rules/rules/integrations/aws/exfiltration_rds_snapshot_export.toml,sha256=SWwh-MrZ0LA97wMYySdrTecsMMGudUPpyU6Ro4m_5fc,8024
src/detection-rules/rules/integrations/aws/exfiltration_rds_snapshot_shared_with_another_account.toml,sha256=GlzboxRen8Y5DSOpS14qt2mCfpdlzxmHp6vnzQDv_Jg,7987
src/detection-rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_external_account_access.toml,sha256=BP4zsOQQ1sIWCD-I888XlXLvPYWzc_VQoQ-9laUcPxU,9664
src/detection-rules/rules/integrations/aws/exfiltration_s3_bucket_policy_added_for_public_access.toml,sha256=922nNY5fBQw96DFS1BZUEbeoBLnCyOvfPe_F6uO2i0I,8661
src/detection-rules/rules/integrations/aws/exfiltration_s3_bucket_replicated_to_external_account.toml,sha256=_azvDSHfL9QNdugdlbaCDfGn7rJFE3GUMgzoeZYtnuU,8134
src/detection-rules/rules/integrations/aws/exfiltration_sns_rare_protocol_subscription_by_user.toml,sha256=08x2jLF07IbjTceFtrpK7ey4hp86_TgnV3tB96_nlBs,7291
src/detection-rules/rules/integrations/aws/impact_aws_eventbridge_rule_disabled_or_deleted.toml,sha256=9zsO9_g4yz7QelZxrO3OoeBxM9vRmgru5-QS27QimPE,7539
src/detection-rules/rules/integrations/aws/impact_aws_s3_bucket_enumeration_or_brute_force.toml,sha256=lgF2DqCKdKvVvXFe0vzJgX5bL5KJxxKXxQyW6n1O9vs,7815
src/detection-rules/rules/integrations/aws/impact_cloudtrail_logging_updated.toml,sha256=mRihrdx6iP8mqFL3hYejuDf2320ZM0rL2rFE0amJ-uE,5012
src/detection-rules/rules/integrations/aws/impact_cloudwatch_log_group_deletion.toml,sha256=1OvfxSPndarjNT-9JVCSimM1g9QyMociWvAzU6gQmys,8015
src/detection-rules/rules/integrations/aws/impact_cloudwatch_log_stream_deletion.toml,sha256=cnaYfwQ31Lnq6phoZ-ZB309b0GGovk_gqa29IB_AyGU,7807
src/detection-rules/rules/integrations/aws/impact_ec2_disable_ebs_encryption.toml,sha256=5x3HhXoftjSftSVyHKVNLlE3zCLjrZ7NtciYTnhpf4g,9046
src/detection-rules/rules/integrations/aws/impact_ec2_ebs_snapshot_access_removed.toml,sha256=aFKyPLgUK6L_iYvKd27pEcst7wHzSWsY6YPUhxx9Ovw,9090
src/detection-rules/rules/integrations/aws/impact_efs_filesystem_deleted.toml,sha256=DTg-JZLjlTJ6Da1eoC8-FQKThgfDbeCu2PSXHHQ6SiM,7755
src/detection-rules/rules/integrations/aws/impact_iam_deactivate_mfa_device.toml,sha256=WgBspSzPR3Doxwx8DMonke8OBK1WdnudCLJdNn6dDT8,7367
src/detection-rules/rules/integrations/aws/impact_iam_group_deletion.toml,sha256=8TtmyopC88phWjTYIalQm9FEe1bd2u-oMKlhYk7_Ugc,4892
src/detection-rules/rules/integrations/aws/impact_kms_cmk_disabled_or_scheduled_for_deletion.toml,sha256=40ybSCB613Q_JXiSYbQ3M5wFLrQ38wvIz8TfXW6W_FY,7882
src/detection-rules/rules/integrations/aws/impact_rds_instance_cluster_deletion.toml,sha256=yREWoKTFdF3kAK0cpuFgrpVF0GXa5Kt7UHRKaxPDnKU,7263
src/detection-rules/rules/integrations/aws/impact_rds_instance_cluster_deletion_protection_disabled.toml,sha256=l7L1ZaC3ZXQqu93rVOLF6ze9lt6QWjDvWTrp-rrnWLA,6483
src/detection-rules/rules/integrations/aws/impact_rds_snapshot_deleted.toml,sha256=FY713Y6OIAlHyU0Ye5o4jARBskRHsMfUYW6sxrHAO4Y,9077
src/detection-rules/rules/integrations/aws/impact_s3_bucket_object_uploaded_with_ransom_keyword.toml,sha256=Y9omOrCr-kJRIptDKkLKGo7WNeBKeNX9DLJ55VDcaNY,9523
src/detection-rules/rules/integrations/aws/impact_s3_excessive_object_encryption_with_sse_c.toml,sha256=4u1hp0AEdj8QlOGgbYDrorbV_6B8AmBuRIpHqPs4Z1M,5708
src/detection-rules/rules/integrations/aws/impact_s3_object_encryption_with_external_key.toml,sha256=shvNGAtVRp16KoWCkW9TVNAoVNn_yCyPwu1JS3vAXZs,10437
src/detection-rules/rules/integrations/aws/impact_s3_object_versioning_disabled.toml,sha256=qrUmdAQPFohyrAP2nPCObf7kGKz3BV1tjh4ISpuigTw,8188
src/detection-rules/rules/integrations/aws/impact_s3_static_site_js_file_uploaded.toml,sha256=T_f6C76Q_EEXmDDSNRuJ4YsM1Nmv7apUanT90xRSOBA,5775
src/detection-rules/rules/integrations/aws/impact_s3_unusual_object_encryption_with_sse_c.toml,sha256=NEC-9p3uW_X74sJubE7P2SuIGli6WLrsjyN3nH_QvVw,5824
src/detection-rules/rules/integrations/aws/initial_access_console_login_root.toml,sha256=IgAXmVmissgTgGw0PsB2UMLUzB2_9lRjW_30Teore7Y,7808
src/detection-rules/rules/integrations/aws/initial_access_iam_session_token_used_from_multiple_addresses.toml,sha256=P5zpWna_FBJP19_Gz84rC0JNY4rajtO-Z6730zas3I8,12224
src/detection-rules/rules/integrations/aws/initial_access_kali_user_agent_detected_with_aws_cli.toml,sha256=WjftwYCfV033I1gDPm7CYC9HNtU3x9OaYuG5oqKvSTQ,6774
src/detection-rules/rules/integrations/aws/initial_access_password_recovery.toml,sha256=57jGF9YuNJrIsijFFMeYOr32nTE0Al59Ub--nJPzJAM,6772
src/detection-rules/rules/integrations/aws/initial_access_signin_console_login_federated_user.toml,sha256=8zEBTeYTltmiKthJpuv1VEdqhSzVFrDZ9ZGgKAKstRc,6620
src/detection-rules/rules/integrations/aws/lateral_movement_aws_ssm_start_session_to_ec2_instance.toml,sha256=BZHh5attQT4tzcRhiTdcpsux29lP7PevgqJUXSyXJgs,5714
src/detection-rules/rules/integrations/aws/lateral_movement_ec2_instance_connect_ssh_public_key_uploaded.toml,sha256=_o14LWhj2vo53eLGy0wgXga3abeEATveBrUo8g_0THk,7994
src/detection-rules/rules/integrations/aws/lateral_movement_ec2_instance_console_login.toml,sha256=7OHpZzBXDvFuHhbcgYZJmCA8vWyrhUJ2sw4MVM-LThw,8710
src/detection-rules/rules/integrations/aws/lateral_movement_sns_topic_message_publish_by_rare_user.toml,sha256=Rq9AI1rT5ruemMRe2RuDDD_wVSy3t0wMKLYI3qw2YpI,8412
src/detection-rules/rules/integrations/aws/ml_cloudtrail_error_message_spike.toml,sha256=fTOuAENlAYC3QS0aetQS7Ej1WsTibUrpKCZ-f_YZHe0,8304
src/detection-rules/rules/integrations/aws/ml_cloudtrail_rare_error_code.toml,sha256=Lx_9GiGGaOA2vn4lcfpdi48EhQ5KbbGCG8v5gH9poMA,8949
src/detection-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_city.toml,sha256=Yvr9RidIax8a1mabkOvQKddpnPFwVqUO8mJiZuhqRHw,8440
src/detection-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_country.toml,sha256=-Fc88tgeUHq2qgNMJrf3-G4mRDJWF8Yshlvr5pf-dAI,8455
src/detection-rules/rules/integrations/aws/ml_cloudtrail_rare_method_by_user.toml,sha256=bPNa7mNhTr7FoVN5oyYlHPThw5URb4b7_dhRBMxHis4,9092
src/detection-rules/rules/integrations/aws/persistence_aws_attempt_to_register_virtual_mfa_device.toml,sha256=o2W3LTgE6IofYp0cb8IxzKqxTbCQb5dPBnKm0ca9qAo,7544
src/detection-rules/rules/integrations/aws/persistence_ec2_network_acl_creation.toml,sha256=EEhgTPQ5EPXnhjDlMdEsK5kLvCdXuXgnNeb-_HeOeqY,7058
src/detection-rules/rules/integrations/aws/persistence_ec2_route_table_modified_or_deleted.toml,sha256=8m8lYosDwNcJbnyRTF7D4K9XhW5s0FV-7eoRWr2tMH8,8229
src/detection-rules/rules/integrations/aws/persistence_ec2_security_group_configuration_change_detection.toml,sha256=V5FfaqQwmIyGh5jfRWj2-Yxh506gVhLOIM-uHcrJtU8,7421
src/detection-rules/rules/integrations/aws/persistence_iam_api_calls_via_user_session_token.toml,sha256=3wLoL44PDq97j6qlue9sRQuofDy_N6cbid7VthnGtZ8,8003
src/detection-rules/rules/integrations/aws/persistence_iam_create_login_profile_for_root.toml,sha256=bD2Tykc6G240bFIOie1tpWFrDGhh7BW6g49ZG7SKFbY,9383
src/detection-rules/rules/integrations/aws/persistence_iam_create_user_via_assumed_role_on_ec2_instance.toml,sha256=6G6y_Ldq9H3qCBwofGJMBMKCXgArQJoS8wP2sc8GZaU,6978
src/detection-rules/rules/integrations/aws/persistence_iam_group_creation.toml,sha256=Nru9DFEi2wd9DkedlB8XRArkw6kW-sdiI8deu9Q16mg,5558
src/detection-rules/rules/integrations/aws/persistence_iam_oidc_provider_created.toml,sha256=knuI5JfcZa4jWjI8EUnQK1cPGY2fBYJC_cEzqtBnkas,7010
src/detection-rules/rules/integrations/aws/persistence_iam_roles_anywhere_profile_created.toml,sha256=tZQaVjJjT1l3M4rJzVZvMBpVNtA0fFE4dymxvd-aOMI,7740
src/detection-rules/rules/integrations/aws/persistence_iam_roles_anywhere_trusted_anchor_created_with_external_ca.toml,sha256=6v0EQOC-bnz4381kgap6W6YxlxU3ZbMd-FvoWaX62M8,7750
src/detection-rules/rules/integrations/aws/persistence_iam_saml_provider_created.toml,sha256=80oizE4FhEnOIGONj8CKtXJIC_QLPfpJTs1c2G5EKH0,6745
src/detection-rules/rules/integrations/aws/persistence_iam_user_created_access_keys_for_another_user.toml,sha256=ReRE76gYJPZDFe_lJwyUeD_6Axf2fvRipdk2ccDAFDM,9872
src/detection-rules/rules/integrations/aws/persistence_lambda_backdoor_invoke_function_for_any_principal.toml,sha256=kFtHU2EgL5pst6N_lenKnGnHnw4hxEwZniOGI9IPKEw,7056
src/detection-rules/rules/integrations/aws/persistence_rds_db_instance_password_modified.toml,sha256=V64eaRicIYeKDeSXM17ys14__7jsAfCJ54mWGSSMRTg,8773
src/detection-rules/rules/integrations/aws/persistence_rds_instance_made_public.toml,sha256=2FhiiTAbvIkBIEz5NjsII3quKpS0MIqoYEsiiR6T6io,7551
src/detection-rules/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml,sha256=GqgOCBoJD5iWVX_Z1hBF3ru1dXiz3OoJNcrxKdRZ8zY,7079
src/detection-rules/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml,sha256=Yy4Zc-o9VKlfseIJklXTehJi1fBu68fsnLf-ls8jjgo,8090
src/detection-rules/rules/integrations/aws/persistence_route_53_hosted_zone_associated_with_a_vpc.toml,sha256=qHzaxQIIYNRPCMVD9aM9JBoa-nJM5qJxelFmdv1mgGg,7221
src/detection-rules/rules/integrations/aws/persistence_route_table_created.toml,sha256=TtKzZFFod8c7Nur1X0mr8l3eOce1DW8nt9PtC0K0Qt4,6359
src/detection-rules/rules/integrations/aws/persistence_sensitive_operations_via_cloudshell.toml,sha256=bsdKWXE_RAHNlLFH546B8Jv6_VKtcBdv9jJABqXmNAs,7088
src/detection-rules/rules/integrations/aws/persistence_sts_assume_role_with_new_mfa.toml,sha256=m9gnPNbrsnJY07XWXsP4vx-OQkzK8GUoFxY7kUKSR0c,7696
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_group.toml,sha256=HZp1FTu3-kP8HYgJEM8d2ILiLPKwNqMhWtz3KQMdxC8,7039
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_role.toml,sha256=HUXNl-VW2Oa_FqRET2I4LwmYA2q21yj0ChQsVTFvEMI,6967
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_administratoraccess_policy_attached_to_user.toml,sha256=2kia7vLic3jpLJWSWsUnj1UJ4UX1I5FPrpbitXC3RJ8,7711
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_customer_managed_policy_attached_to_role.toml,sha256=Xk69MwI6SD2WqI4RTh7BaIXXsYdAgXNdITRTwpB3sFs,7867
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_saml_provider_updated.toml,sha256=wbBoU4EcxseLH1JnQcqqbcSBOTPGm7UlgRSXi6pdJfw,7703
src/detection-rules/rules/integrations/aws/privilege_escalation_iam_update_assume_role_policy.toml,sha256=YSZS_azp4dfuhRdGUqZt284nHxVCW87i35vuOzu4ck4,7339
src/detection-rules/rules/integrations/aws/privilege_escalation_role_assumption_by_service.toml,sha256=RhvlG9C9pZmltIuxh_2WyLPyOBUb7XmdI-J7SeBwDnM,7604
src/detection-rules/rules/integrations/aws/privilege_escalation_role_assumption_by_user.toml,sha256=VHJIOPVwuiiR8fkyCQyWFOiHxt4cesl1k555sJPNzn0,6938
src/detection-rules/rules/integrations/aws/privilege_escalation_sts_assume_root_from_rare_user_and_member_account.toml,sha256=b_Uby-UxezG4zFDrGBIrkWQGTgcFgXzGcOPXaRzMKJs,12028
src/detection-rules/rules/integrations/aws/privilege_escalation_sts_role_chaining.toml,sha256=sLF0f_MHzVHepSzV40OCBeEkOJA4QJ0YG4pfE-9fYOU,8573
src/detection-rules/rules/integrations/aws/resource_development_sns_topic_created_by_rare_user.toml,sha256=iA8YeqLHRUZGys6qC09ahq4nBB3d9N_-A_PGptQw1g8,6396
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_execution_without_guardrails.toml,sha256=c0cevT1mzWoFBX3gWSkDPj8yS7-hrq20C32I5yVCM-0,4847
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_by_single_user.toml,sha256=PqwbgjDSYma97wSBCrHkLxWG-TXDQY4FxI6cX7Yks1c,4857
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_guardrails_multiple_violations_in_single_request.toml,sha256=25G1pGkA_Pm9YsvEGJWJUzPADbmoepeGrWBn16IC4vw,5269
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_high_confidence_misconduct_blocks_detected.toml,sha256=sdLX9ZiabRdEBxm1GHsEQpd3C5gQKgyL013aOEcXmOM,5314
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_high_resource_consumption_detection.toml,sha256=T4DmttjFKaD-rI7yuuB6r_ahvOoJFRbW7HY1BujplYw,5036
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_attempts_to_use_denied_models_by_user.toml,sha256=u2c1QgxZcO68JmBCn_r7Ofd20lERSpnWi-QnGbepXDw,4568
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_sensitive_information_policy_blocks_detected.toml,sha256=7AXcjkalDO0nyTjJV3Hdmab9dqpFUN6z-O9QDvillHQ,4748
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_topic_policy_blocks_detected.toml,sha256=3Quejfd2m3jCBtrnbtnf1nQp6PvuUPX1Ol7JezXROUI,4638
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_validation_exception_errors_by_single_user.toml,sha256=tfMEkbWtIQ-hePLJTUuWB_9q1D6Uirbc2JSbzFumlvE,5019
src/detection-rules/rules/integrations/aws_bedrock/aws_bedrock_multiple_word_policy_blocks_detected.toml,sha256=YCDnc0Ztis4S7XDXsLcPROoVqWtBpaznHl3mLesDxM0,4652
src/detection-rules/rules/integrations/azure/collection_azure_storage_account_blob_public_access_enabled.toml,sha256=0GkNqHNLowP9mmdjTVAxMNb95ZbLV2g0XjuE1sPGptE,6092
src/detection-rules/rules/integrations/azure/collection_entra_id_sharepoint_access_from_unusual_application.toml,sha256=9l5JxTLMUZLpZq3qaqodjk6Gfs79r8yZOAa408uL4lw,8858
src/detection-rules/rules/integrations/azure/collection_graph_email_access_by_unusual_public_client_via_graph.toml,sha256=yT7kIeqgoF8-NJb7NNcp1Q7QE1wL5nuvLkDVvWs5Ms8,6809
src/detection-rules/rules/integrations/azure/credential_access_azure_entra_susp_device_code_signin.toml,sha256=jiYlWFkuvgCRmWJcCoRzJE2f7WPrgQMQhK56I9Xj5YA,7463
src/detection-rules/rules/integrations/azure/credential_access_azure_storage_account_keys_accessed.toml,sha256=9CUi2i0wbXjstu7SAIJgDTywOcKN9El1xE0v_T6bDd0,7267
src/detection-rules/rules/integrations/azure/credential_access_entra_id_brute_force_activity.toml,sha256=4KM8dBqQQCBwb42c-HU5fFy4AAB7UzyGjxSTZc5dEJE,14212
src/detection-rules/rules/integrations/azure/credential_access_entra_id_excessive_account_lockouts.toml,sha256=bC-k4inYcqAIAG_3k9UDPj-FxQesQdOreQVkKWCAclc,8949
src/detection-rules/rules/integrations/azure/credential_access_entra_id_signin_brute_force_microsoft_365.toml,sha256=RZG257Ro7fyDlV-vn5f6cA94HtZpM_lafAdKtfvLPmw,14624
src/detection-rules/rules/integrations/azure/credential_access_entra_id_suspicious_signin.toml,sha256=f_DG90TfpyoqgetC354GcOxYUslAMcl4LBNJwySD9gc,7689
src/detection-rules/rules/integrations/azure/credential_access_entra_id_totp_brute_force_attempts.toml,sha256=DNpGs69Qv5yJamvMogriuu8FrLkxMYjxapk5raiD-p4,10313
src/detection-rules/rules/integrations/azure/credential_access_key_vault_excessive_retrieval.toml,sha256=Gds6U8jrCOl1TLJv3l--dIQab72ovJFiV3J5Ebj95kw,10956
src/detection-rules/rules/integrations/azure/credential_access_key_vault_retrieval_from_rare_identity.toml,sha256=KfMSb76scs2bE_LKfoQCiQxgvomfJf7pQ0BfInCKqSA,8466
src/detection-rules/rules/integrations/azure/credential_access_network_full_network_packet_capture_detected.toml,sha256=xaJroWrdF5z5wtPpibrUxfBKJG2ae95kCcVBbBOCWgg,5987
src/detection-rules/rules/integrations/azure/credential_access_storage_account_key_regenerated.toml,sha256=TbGOqWOCd5OAOYfKKTh8wIJJ3Wymmu8YRWo8ZqvlAdo,6633
src/detection-rules/rules/integrations/azure/defense_evasion_automation_runbook_deleted.toml,sha256=hvrvjoWjKZ3M7bJkNGH3PG1PCEsRzWqdE69vvo1Z6Ng,5458
src/detection-rules/rules/integrations/azure/defense_evasion_event_hub_deletion.toml,sha256=UomEVaZjtw47eMcfHEKMnXGiXbIKt8ZkW3jkczjbaWo,6334
src/detection-rules/rules/integrations/azure/defense_evasion_insights_diagnostic_settings_deletion.toml,sha256=yWaogjfXJG8B5YEPK0U5_LyhHq4smpJsEzD7dofYSgA,6952
src/detection-rules/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml,sha256=JkwSTV6OaZvDLf0dxpsIEuLD7TOrhnZyMTrsU-kRH0M,6257
src/detection-rules/rules/integrations/azure/defense_evasion_network_firewall_policy_deletion.toml,sha256=40IWwJmxlTNBCLE6usvAEnlRQf545PaNpCs9tQdCrR4,6261
src/detection-rules/rules/integrations/azure/defense_evasion_network_frontdoor_firewall_policy_deletion.toml,sha256=XZmP0vQUq7GQoxsyy7YPpS-Bf4SzI9HyiALGnnsp2Ek,5991
src/detection-rules/rules/integrations/azure/defense_evasion_network_watcher_deletion.toml,sha256=kCdI7YVMseTFHcJ_BDj0F2RYcl3HJJKLOUf1nvYtxOE,5979
src/detection-rules/rules/integrations/azure/defense_evasion_security_alert_suppression_rule_created.toml,sha256=jpE7Fv7_1rLisAyT4L8j-UjGuI7pTC5V8tfrdpnRLCs,6523
src/detection-rules/rules/integrations/azure/defense_evasion_storage_blob_permissions_modified.toml,sha256=IJeS04ie39qApEXTkzCfer5P70i1v2WSdHd38wLbSP4,6211
src/detection-rules/rules/integrations/azure/discovery_bloodhound_user_agents_detected.toml,sha256=3-_2Z-gGAXeOQbVvPIohYQQ-kgIzTcGYEBau00J7KJ0,7386
src/detection-rules/rules/integrations/azure/discovery_entra_id_teamfiltration_user_agents_detected.toml,sha256=VB_MQnKAhZ2mmEUBDcMMYpvkfCa4A9bkPFr6f3nADmE,7871
src/detection-rules/rules/integrations/azure/discovery_storage_blob_container_access_modification.toml,sha256=rfkchhoMWB-RVjknCZp0AF0VvPUus0un1mHkj_DBmv8,6518
src/detection-rules/rules/integrations/azure/execution_automation_runbook_created_or_modified.toml,sha256=4bybzGtspnlzW89L54ysi964kGB-Q2hUePZOryvytb0,6291
src/detection-rules/rules/integrations/azure/execution_compute_vm_command_executed.toml,sha256=zdnEQvjhx2fFbhY_x_yLjuLV1m6gA-r8jHc2_tNRAog,6341
src/detection-rules/rules/integrations/azure/exfiltration_azure_storage_blob_download_azcopy_sas_token.toml,sha256=71S7vrY8fSDdAFVLDtHGQS9GnHBtNy2-ySB4o5xPwX4,7353
src/detection-rules/rules/integrations/azure/impact_azure_compute_restore_point_collection_deleted.toml,sha256=URI6Pz-knl3zhZEYCJKuM9qi16V66TjYNsGcO1U-jKs,6118
src/detection-rules/rules/integrations/azure/impact_azure_compute_restore_point_collections_deleted.toml,sha256=YDg6ORQyvI3CyJ4WrD92PgAOR0kL2j6AisdYg4G7BLc,7889
src/detection-rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletion.toml,sha256=kqYvdtBwsJlcqb9yjJRXF6blhc1eNQDvTET5Jx7ee54,7383
src/detection-rules/rules/integrations/azure/impact_azure_compute_vm_snapshot_deletions.toml,sha256=f1deZKfGr-f03ibDiJ1eURqJ6Axs2vrjPjSQY92uUQA,8380
src/detection-rules/rules/integrations/azure/impact_azure_storage_account_deletion.toml,sha256=fsxy0B1VMkBPrzpUBNXF1pF_C7bHuoya6ZCoUX1x4JM,6164
src/detection-rules/rules/integrations/azure/impact_azure_storage_account_deletion_multiple.toml,sha256=-qL2nZgaNOgfK0hDd17iqtLFAMS3Nnc_XsUTq53I9ao,7010
src/detection-rules/rules/integrations/azure/impact_key_vault_modified_by_unusual_user.toml,sha256=9zOmAEob_l0YXXrABOJ8DHjs2kPlQdsTRsBHumzt6HU,5783
src/detection-rules/rules/integrations/azure/impact_kubernetes_pod_deleted.toml,sha256=6ErGpIIM5gHI94tzindLvGmkMr-12oJClVCnuKS9870,5983
src/detection-rules/rules/integrations/azure/impact_resources_resource_group_deletion.toml,sha256=ylc6CGFM8c6BQgpwdT-BePEUZcRNtp-epy_IZaptUvo,6677
src/detection-rules/rules/integrations/azure/initial_access_entra_id_actor_token_user_impersonation_abuse.toml,sha256=rVW7oFU2v2lsAU5JsXhwcD0m4g8p5ce_GHccl5SjNZ4,6070
src/detection-rules/rules/integrations/azure/initial_access_entra_id_device_code_auth_with_broker_client.toml,sha256=n13X54l_5uC2YFL4DnyscN1Q9BD_2p2HdRYeYwSUlCs,7509
src/detection-rules/rules/integrations/azure/initial_access_entra_id_external_guest_user_invite.toml,sha256=zDJn7N7UHXx6mSNl1YKYmxx84HDJCsgY8Bzj5oIYv4Q,6393
src/detection-rules/rules/integrations/azure/initial_access_entra_id_federated_login_by_unusual_client.toml,sha256=S18VlM1Jaz8er2CdxTGeoRDxwEYhmkyawf2wTI9othg,7566
src/detection-rules/rules/integrations/azure/initial_access_entra_id_first_time_seen_device_code_auth.toml,sha256=4JkM2MIuS78y2bvM6mZ_RoWeLfILK8KP3xJQwJL7Ehk,7201
src/detection-rules/rules/integrations/azure/initial_access_entra_id_graph_single_session_from_multiple_addresses.toml,sha256=eV9lUcrl4-KLgIp9rbjg3lalW5vX_jMfVJBMoiYy4ow,12034
src/detection-rules/rules/integrations/azure/initial_access_entra_id_high_risk_signin.toml,sha256=wXM84DXuHuRjsFRU6h0zazM7YjDvvSGhLlhHA0FPK2o,5105
src/detection-rules/rules/integrations/azure/initial_access_entra_id_illicit_consent_grant_via_registered_application.toml,sha256=omtQ0ONAoXydNhHYVRsf7hZsJ-goQawKITHDuJWI08Y,7098
src/detection-rules/rules/integrations/azure/initial_access_entra_id_oauth_auth_code_grant_unusual_app_resource_user.toml,sha256=1pNrZz6kNAmSzy1cZ5KqorQxakyk7KWofYnFJWsTkTs,9476
src/detection-rules/rules/integrations/azure/initial_access_entra_id_oauth_phishing_via_first_party_microsoft_application.toml,sha256=X95cBw0kVuQJQnYPTXUV4kmutBPVJMPQXyKbxEMByW8,8712
src/detection-rules/rules/integrations/azure/initial_access_entra_id_oauth_user_impersonation_scope.toml,sha256=uW_r3ABRh9mm2GBYC58okcva2i65OPJ-KyfYah-IHs8,10371
src/detection-rules/rules/integrations/azure/initial_access_entra_id_powershell_signin.toml,sha256=4prjl_HgxAFjzyuJwC4aMmGNWlLhBKl4tp1slCQWtD0,6019
src/detection-rules/rules/integrations/azure/initial_access_entra_id_protection_alerts_for_user.toml,sha256=lYeNS-IW0qEuTu81qKZaO1OOIGNSA4D52e4exXbUqZM,5392
src/detection-rules/rules/integrations/azure/initial_access_entra_id_protection_confirmed_compromise.toml,sha256=dw8fH9x3Rn8j0BnajEB3TnsYhCvKjcjNmCmXCVCUnR0,7297
src/detection-rules/rules/integrations/azure/initial_access_entra_id_protection_sign_in_risk_detected.toml,sha256=1VKTCH8YEfvsif13XASDKONtk_3XFYbogKlGYscuiNQ,8844
src/detection-rules/rules/integrations/azure/initial_access_entra_id_protection_user_risk_detected.toml,sha256=yUfdgEwjjNR4bvus8elqq75Hhgqq0zu4nLF70CEf4EU,8601
src/detection-rules/rules/integrations/azure/initial_access_entra_id_rare_app_id_for_principal_auth.toml,sha256=QqNAY63zw6j7Vce5Fq14MuzBwsQDj8DB_fVqDo02g0A,10611
src/detection-rules/rules/integrations/azure/initial_access_entra_id_rare_authentication_requirement_for_principal_user.toml,sha256=5iUWrHc-7JjCwiuHxaKT8ApuA2Q4Bx3Xpi8hpBFiTMQ,8817
src/detection-rules/rules/integrations/azure/initial_access_entra_id_risky_user_or_compromised_sign_in.toml,sha256=Ao8FVE8P2ZelhfwVZceCnepFr6grcsSWys701enbUTw,5200
src/detection-rules/rules/integrations/azure/initial_access_entra_id_suspicious_oauth_flow_via_auth_broker_to_drs.toml,sha256=b9mNibzczMzWKwFzutErSrYbegUIe6J2xcxDeiIVGg4,13238
src/detection-rules/rules/integrations/azure/initial_access_entra_id_unusual_ropc_login_attempt.toml,sha256=S0CNx1qdIhdZuu0Odoco9PYXGPT_X_3ivGiGwPvooCU,6531
src/detection-rules/rules/integrations/azure/initial_access_entra_id_user_reported_risk.toml,sha256=1hrJbdzE0JmLeJcpCyvTOziv2zg3gjOKxHa_GHZqxco,4812
src/detection-rules/rules/integrations/azure/initial_access_graph_first_occurrence_of_client_request.toml,sha256=pviJA0zjZrKeXsNfP9oi-alM5d0eySR2U3n59rcjRE8,6557
src/detection-rules/rules/integrations/azure/ml_azure_event_failures.toml,sha256=U6mkeGU0Wnw8g5Mn9IFdPTk6dFMSMDoTVZHNd8g_Jrk,7716
src/detection-rules/rules/integrations/azure/ml_azure_rare_event_failures.toml,sha256=VZI-ivBYCIIkhEd7BSD_lmxM9_vEbs5ipy4-nX73p6U,7938
src/detection-rules/rules/integrations/azure/ml_azure_rare_method_by_city.toml,sha256=SwCN5TtcdPSa8VunLlmjm5jo_ZM-1mgIfWzH9BGEnHU,7023
src/detection-rules/rules/integrations/azure/ml_azure_rare_method_by_country.toml,sha256=qKcu4_BRkP3WZ4ggnYZM6zF6DFAmSCoDjmZBEOLzgoM,7029
src/detection-rules/rules/integrations/azure/ml_azure_rare_method_by_user.toml,sha256=6X_lvPz2YQze21zZXbpztbaGma1hwRILDqqjcoQhipU,7868
src/detection-rules/rules/integrations/azure/persistence_automation_account_created.toml,sha256=fmKKZGTBXnjevev0P_kv1_G4P5malaGgkte0ep2GaLQ,6072
src/detection-rules/rules/integrations/azure/persistence_automation_webhook_created.toml,sha256=AaXtvbymDAIQSGXIdCWacicfpkvorO9gORZr7CyXTjE,5914
src/detection-rules/rules/integrations/azure/persistence_entra_id_application_credential_modification.toml,sha256=mQ95_bTPS2SZeUvltt3zcIqmeq12hEn2FBUSCUCioJk,6404
src/detection-rules/rules/integrations/azure/persistence_entra_id_conditional_access_policy_modified.toml,sha256=-VMyX70L-mqy9K5htG54HllkrZxR3VKfqP7AKEorhXE,5150
src/detection-rules/rules/integrations/azure/persistence_entra_id_global_administrator_role_assigned.toml,sha256=luCI4cFzo754h_wJVYv6NOYpnBen-xeetTdXM0fA6a4,6581
src/detection-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user.toml,sha256=6e5juIy3RgmxyCW2LB-GZViX7ldylByx1PnIWAjnmuc,5561
src/detection-rules/rules/integrations/azure/persistence_entra_id_pim_user_added_global_admin.toml,sha256=X-LyYZvZhAgr_YsSyjwgwjBk_RZKBy1Eh6lIoAYuK5k,6391
src/detection-rules/rules/integrations/azure/persistence_entra_id_privileged_identity_management_role_modified.toml,sha256=RBoHdjni7Sti7waEdlmMSkB592IG3jou1sw6k8bkJ9c,5696
src/detection-rules/rules/integrations/azure/persistence_entra_id_rt_to_prt_transition_from_user_device.toml,sha256=OZO1RD4AXmWVhH4R-3VHMJc9oDX1D7zsajZfQcMzcV0,7035
src/detection-rules/rules/integrations/azure/persistence_entra_id_service_principal_created.toml,sha256=mif7pEbMuBoqq3oy4KUpfvyXPQ-3oWtfQFn2OcqK9TI,6336
src/detection-rules/rules/integrations/azure/persistence_entra_id_service_principal_credentials_added.toml,sha256=tconB8RE-BLBL58ZAnmXYMGRhC6V08TZcaUY5cS7ab4,5980
src/detection-rules/rules/integrations/azure/persistence_entra_id_service_principal_federated_issuer_modified.toml,sha256=4LVJVLjc-lPCq94KuwYMjc8nWibhHVKJ4OUqN-LehNM,6272
src/detection-rules/rules/integrations/azure/persistence_entra_id_suspicious_adrs_token_request.toml,sha256=SHQbOCAWXHno03OhTjfMcnPt2SDRH7cxweN8hM7Pw2w,6124
src/detection-rules/rules/integrations/azure/persistence_entra_id_suspicious_cloud_device_registration.toml,sha256=egV12HpDHEHHHxrBg1C8qEq8ggurWzqTmC51NfkW3rc,6595
src/detection-rules/rules/integrations/azure/persistence_entra_id_tenant_domain_federation_via_audit_logs.toml,sha256=lYXCzmFJvJu-idfkdzuAiQSSLtPKMry0qzN36LJLyfo,7050
src/detection-rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_application.toml,sha256=rBisriiwslGj--gC-OfAkgY-9193KpGmYz_fApCQjNM,5591
src/detection-rules/rules/integrations/azure/persistence_entra_id_user_added_as_owner_for_azure_service_principal.toml,sha256=MvHdQi2VYn6l2nzFasrNFMQqdBSWO5nwFMe0eEjTNgo,5798
src/detection-rules/rules/integrations/azure/persistence_entra_id_user_signed_in_from_unusual_device.toml,sha256=Xh_ducRE0FsSY5wd65pkl93Zvp33DALNG1EPvpta16I,7381
src/detection-rules/rules/integrations/azure/persistence_event_hub_created_or_updated.toml,sha256=Z8tDDqsF3wnJHdpxr8Tdk7HIOAxycYdVcAPSDKDoKuo,6636
src/detection-rules/rules/integrations/azure/persistence_graph_eam_addition_or_modification.toml,sha256=-OWlk34E2J1B7NXHEY5GlEaE8GwONWNeOrjZM7zKy7o,5364
src/detection-rules/rules/integrations/azure/persistence_identity_protect_alert_followed_by_device_reg.toml,sha256=sYwY0SeY7v0nw9mWZjIYE4Psg7C0KUTDfJpJL8Ga3YI,6066
src/detection-rules/rules/integrations/azure/privilege_escalation_azure_rbac_administrator_roles_assigned.toml,sha256=RV6hzF6OWHwVBklikvmsjgymkvrwINPDkcsPX8ggJZ4,5706
src/detection-rules/rules/integrations/azure/privilege_escalation_entra_id_elevate_to_user_administrator_access.toml,sha256=IwDbDuj8iq_CAeeTOuFF6vu3UvIMl5fMB75vlo9M4lM,5421
src/detection-rules/rules/integrations/azure/privilege_escalation_kubernetes_aks_rolebinding_created.toml,sha256=kzS0x9ZkPrqPR6F_wAhW1dFZK4E7MvrSWCGORaua2oM,6764
src/detection-rules/rules/integrations/azure/resource_development_entra_id_custom_domain_added_and_verified.toml,sha256=KlLZMbCr1TbF2DkV_VnwJNPocvHRY_Hk-4_vIn3KBNM,5781
src/detection-rules/rules/integrations/azure_openai/azure_openai_denial_of_ml_service_detection.toml,sha256=k7TmTJjP6U4hoMWtkHZpeml2xar7ddOs03uiXjsIZEQ,5996
src/detection-rules/rules/integrations/azure_openai/azure_openai_insecure_output_handling_detection.toml,sha256=VOiDNib8m07nXzBHp1CdpkkhZKPAL79HtetheJ23OZ0,5792
src/detection-rules/rules/integrations/azure_openai/azure_openai_model_theft_detection.toml,sha256=vvjnYVCilaJqtKtgE-vmX-yNqO46CEZD96uE2c8LUXM,5754
src/detection-rules/rules/integrations/beaconing/command_and_control_beaconing.toml,sha256=beqZ3uSu0G5aH7G3fKbarjXleVf8_6UQJ_genng6buw,7890
src/detection-rules/rules/integrations/beaconing/command_and_control_beaconing_high_confidence.toml,sha256=-DmlSn5FbfmH3rukFMNzcXUBGzjdmEKvyHfGgFRrq8I,7270
src/detection-rules/rules/integrations/cloud_defend/command_and_control_curl_socks_proxy_detected_inside_container.toml,sha256=3EaGFeZ_GuDWFx-F4zgXfeYkTz5sFq2OgfB4jzLohXA,4626
src/detection-rules/rules/integrations/cloud_defend/command_and_control_interactive_file_download_from_internet.toml,sha256=wlJIcvLKLciknqs8RZKGmcgB-4Y4fMD168mQW-j1My4,7489
src/detection-rules/rules/integrations/cloud_defend/command_and_control_tunneling_and_port_forwarding.toml,sha256=qCzYXy3GBt8-uoLFNrK6zTpd8lBM7nVgMnEgQl4D-8I,7051
src/detection-rules/rules/integrations/cloud_defend/container_workload_protection.toml,sha256=9Q1DAgjwjSYh57cnwCa12zHGybKbxEfNmzk6YfDdDbA,5003
src/detection-rules/rules/integrations/cloud_defend/credential_access_cloud_creds_search_inside_a_container.toml,sha256=Q7igfrVMx8kISmMpFXxlKIqCFcnacD0SGKe6izfhn2Y,3879
src/detection-rules/rules/integrations/cloud_defend/credential_access_collection_sensitive_files_compression_inside_a_container.toml,sha256=SjO3ukghLhKsDwVhcKrc-dsNk2_8B0fxH_RhE40jWoU,8371
src/detection-rules/rules/integrations/cloud_defend/credential_access_sensitive_keys_or_passwords_search_inside_a_container.toml,sha256=jyIT4drETjVm4TKTdeXvOwVNanJ_QLuJX8ANNxqSKh4,7827
src/detection-rules/rules/integrations/cloud_defend/credential_access_service_account_token_or_cert_read.toml,sha256=4tN7Mt57d9TrGlbxAGcuKD0lf-yd7YLFIELmNlkeDyw,7217
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_decoded_payload_piped_to_interpreter.toml,sha256=fshs2dRrXSWe0GzI9WZTRrEJjkdPAwVbX99zTxVVSFE,9004
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_deletion_of_shell_cmdline_history.toml,sha256=4H1u6bRINtkALN3KNqmhKPXyqne9F870ALoSVhXrwnA,6855
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_file_creation_execution_deletion_cradle.toml,sha256=SQA8HQC078yjaizDNyXvoS14_qPlTsyEI12Aw8TqlLI,8481
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_interactive_process_execution_from_suspicious_directory.toml,sha256=O0BiyWT7hN0gkM9uZ8CoHMEzydBHHBtseYX0sLCaenY,6059
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_ld_preload_shared_object_modified_inside_a_container.toml,sha256=cjwSPUwwzrI3geRQVlH1W3x1bHjA7pZ8tbvskbQTV5U,6676
src/detection-rules/rules/integrations/cloud_defend/defense_evasion_potential_evasion_via_encoded_payload.toml,sha256=QVv4RMQ2cUsy3kklhP5DGoJhl-xzEfyOgqTYwEtYoxk,7280
src/detection-rules/rules/integrations/cloud_defend/discovery_dns_enumeration.toml,sha256=7a8Gyw4ag2-zMZBZuoVlIKum5l-CKPM8KER3uyWk-g4,7481
src/detection-rules/rules/integrations/cloud_defend/discovery_environment_enumeration.toml,sha256=aDogQqyDsAbmtb9vaJyxfk6747mVuG556UGJTEvNnLw,7028
src/detection-rules/rules/integrations/cloud_defend/discovery_kubelet_certificate_file_access.toml,sha256=s8qb_m0tYy83BXEhH1y_SM8GiZ9t7MYBEa7fet2tK8c,7333
src/detection-rules/rules/integrations/cloud_defend/discovery_kubelet_pod_discovery_via_builtin_utilities.toml,sha256=O6AIiurq0Z9VC3u1_dJUUpGWQLOAWsypAHEdTn2JAis,6929
src/detection-rules/rules/integrations/cloud_defend/discovery_potential_cluster_enumeration_via_jq.toml,sha256=vlVXJ4-KFsKVN4BUdrx0emQfu6ij4tzdVN37Kbg5jz0,2105
src/detection-rules/rules/integrations/cloud_defend/discovery_privilege_boundary_enumeration_from_interactive_process.toml,sha256=GI0H2oAERLaQALn5_sJzKI3E1YAUWxTHAFQH2Ia7hcU,7462
src/detection-rules/rules/integrations/cloud_defend/discovery_service_account_namespace_read.toml,sha256=zVbDnP_IdpFD5ts_7mL2lC15yWq08jH81_j0Y8jNmD4,6785
src/detection-rules/rules/integrations/cloud_defend/discovery_suspicious_network_tool_launched_inside_a_container.toml,sha256=cGS-YZHXERsdYhHqj0m8nIgcqifjKrZ3BmP4d0HFIgg,8704
src/detection-rules/rules/integrations/cloud_defend/discovery_tool_enumeration.toml,sha256=kBKMMe_cjmtuSup8ehO4vyVZ6aQ3YIQ_gHlqS8YuSPM,7186
src/detection-rules/rules/integrations/cloud_defend/execution_container_management_binary_launched_inside_a_container.toml,sha256=Uti4d86uPS1DUnWD-yLHCl9o9RLB0RqbNIr7vr6t3rw,7791
src/detection-rules/rules/integrations/cloud_defend/execution_direct_interactive_kubernetes_api_request.toml,sha256=biSVZuw3Xo9sQPkb3D3gOJc7z3SZQLV3La7Np7f526Q,8399
src/detection-rules/rules/integrations/cloud_defend/execution_interactive_exec_to_container.toml,sha256=9KHzgpG89CSV66oZT6Vs-SKmJfX-YvT7BXh3M2lwzuU,7787
src/detection-rules/rules/integrations/cloud_defend/execution_interactive_file_creation_followed_by_execution.toml,sha256=MHfYiqrXaxlt8-szkbPcZA4snCSl8j2w3Bht5kS2p4k,6293
src/detection-rules/rules/integrations/cloud_defend/execution_interactive_file_creation_in_system_binary_locations.toml,sha256=QFqNH9I-DhIikkev2WaUecR1bF2x3zpvvuQ4uqnkROs,6414
src/detection-rules/rules/integrations/cloud_defend/execution_interactive_shell_spawned_from_inside_a_container.toml,sha256=VAxxtEM167qoZ2GksqG0NpU7_CZmPPizlYPt9QYIdc0,6668
src/detection-rules/rules/integrations/cloud_defend/execution_kubeletctl_execution.toml,sha256=cm0kgt211o7kXNHh6KH4ZPfPTCM01VkTy6htwneg6r0,7170
src/detection-rules/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml,sha256=lcdcm3NRfBSjlXpSFi8TW19XUCJgEKROlK4V_5wRdTM,7912
src/detection-rules/rules/integrations/cloud_defend/execution_payload_downloaded_and_piped_to_shell.toml,sha256=ZW42V7276SC0j2jCqADN5k7V4vebv7mlaIg2r9mLbzo,7540
src/detection-rules/rules/integrations/cloud_defend/execution_potential_direct_kubelet_access_via_process_args.toml,sha256=j-8WXdoiNsnFQlyZ1TOcIp8T5ymT1xJg47mKEaoqkxA,6857
src/detection-rules/rules/integrations/cloud_defend/execution_suspicious_file_made_executable_via_chmod_inside_a_container.toml,sha256=YJaIH0-9iwNuX0OJoR3yY0UdDEkJbuCheUjzh22bFkQ,7386
src/detection-rules/rules/integrations/cloud_defend/execution_suspicious_interactive_interpreter_command_execution.toml,sha256=bATJMzLdIbMyE5AQQVZFuzUzXBAtV6dfBcvxA-mupTM,9885
src/detection-rules/rules/integrations/cloud_defend/execution_tool_installation.toml,sha256=5tiU1PtUtD1c2G8Y06lQSdW_TmR0l8q8JFXb7y-pI3Q,6669
src/detection-rules/rules/integrations/cloud_defend/impact_process_killing.toml,sha256=DBOVgVXsvaaty71sZj0xe-BhuQsW3Xj_QUke3XX3Bk8,6702
src/detection-rules/rules/integrations/cloud_defend/persistence_modification_of_persistence_relevant_files.toml,sha256=kJPMUHMfbDB3cUW9VmzUPk0tNrKHphKCNowChVezHgo,9774
src/detection-rules/rules/integrations/cloud_defend/persistence_ssh_authorized_keys_modification_inside_a_container.toml,sha256=m9TVYsuN1HtHiqQlx6EBQ1T9r92x9NgYJU8Ncjdk7OY,6451
src/detection-rules/rules/integrations/cloud_defend/persistence_suspicious_echo_or_printf_execution.toml,sha256=SHstswUGuUo5MnP3P5Uw3xqeljwJOH5Lw_RrpW5RgbM,8647
src/detection-rules/rules/integrations/cloud_defend/persistence_suspicious_webserver_child_process_execution.toml,sha256=EhpeC3cQERzXQS6DeFgE3khsmNeuUcGbXS0ssX5mtRA,13017
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_debugfs_launched_inside_a_privileged_container.toml,sha256=PdBrf7pLNwodznqSztfNeylklUYqu6psIyRiRZAMIko,6949
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_mount_launched_inside_a_privileged_container.toml,sha256=Wq4ZsY5VVE8B42cFf1e_0rCriAJorEFLrgX8NmAyiis,6957
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_notify_on_release_file.toml,sha256=5fbR5wXspPD3RZclrNGGXu0VWFJiFFumpLPux9ZNSYk,6305
src/detection-rules/rules/integrations/cloud_defend/privilege_escalation_potential_container_escape_via_modified_release_agent_file.toml,sha256=5nqsbDtzuWLZO89OiUfEqffPZwoHbhh_iVN7VAf6dps,6138
src/detection-rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_error_audit_event_promotion.toml,sha256=g1PZStfMBEpfo26iVV7jxoTzO3YYmWDQNv1M5vnrBvg,2055
src/detection-rules/rules/integrations/cyberarkpas/privilege_escalation_cyberarkpas_recommended_events_to_monitor_promotion.toml,sha256=7wpibNWzfpXG_z8ZuQpApIOHaWyzGMqdpzHB-dsW5zs,2327
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_geo_country_iso_code.toml,sha256=yUyqYWbt_-tPnZWiee092frdu7OC82y6QnR6cghIbiE,7035
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_ip.toml,sha256=-e2f9NQKVz2R0sOFDBeCLpQ2ZwNTDLotMvwj1BYm0ng,7146
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_port.toml,sha256=siLAoIEQmcwd6tVe9USiWZ0u-Ng-VD6aV0MzA87mVZw,6972
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_destination_region_name.toml,sha256=VPcnBSb6qATSBvTIGlSEk8M6ohHZJjdxtuo4wr5YR9A,7073
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device.toml,sha256=HW-jgRxFbK8BUBEwalAQW-IqkzxSQUr88jMBApjiQJ8,6752
src/detection-rules/rules/integrations/ded/exfiltration_ml_high_bytes_written_to_external_device_airdrop.toml,sha256=YwqryqA_PZkg-tcb_4UXyqdQuliOp1v1knfEKKMJ1B4,6950
src/detection-rules/rules/integrations/ded/exfiltration_ml_rare_process_writing_to_external_device.toml,sha256=Qer-2B4zlg72eYoJxrQ2qV3Kdjj4lSDD2Ps-QCgs2MQ,6622
src/detection-rules/rules/integrations/dga/command_and_control_ml_dga_activity_using_sunburst_domain.toml,sha256=L-Y-ZYGXvI2YoMN2zwZPf_2QguPQFAOPlXaoCgWN9Kw,7844
src/detection-rules/rules/integrations/dga/command_and_control_ml_dga_high_sum_probability.toml,sha256=bP0I6i5aZiQS0LZ-BvdG1UdkPeL4EMgPkYBVjMUj4x8,8160
src/detection-rules/rules/integrations/dga/command_and_control_ml_dns_request_high_dga_probability.toml,sha256=Pz6Zy-U8hQ65GFhn392uSWj5aGwowLgYVYJ6q1N3SOo,7586
src/detection-rules/rules/integrations/dga/command_and_control_ml_dns_request_predicted_to_be_a_dga_domain.toml,sha256=5TaN8Xq5OERJenm80EgOFLxa-ywrQZwHiWXaVBqnuBg,7601
src/detection-rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_detected.toml,sha256=6aYCF6vJq9jFoeHmEQlHki90_jomKfVU1xiuXmejeZc,8837
src/detection-rules/rules/integrations/endpoint/defense_evasion_elastic_memory_threat_prevented.toml,sha256=K_i3j0ZsXFiJruD8AFPfkTWSsTnrwlxGUYxFjyVrnaY,8814
src/detection-rules/rules/integrations/endpoint/elastic_endpoint_security.toml,sha256=7JuxGnkWghYWeJrQTlNC_QP-4ErFwhZUw_9TWnPhCR8,6892
src/detection-rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_detected.toml,sha256=oINVbk8RAmb4vcg7D_kzJ-eNr6ZvN4jjo38bz4UpU8E,6928
src/detection-rules/rules/integrations/endpoint/elastic_endpoint_security_behavior_prevented.toml,sha256=HqxuwMpWU0DdAPsca_DN7_huN0C-UD4StK9ePoxSRxo,6907
src/detection-rules/rules/integrations/endpoint/execution_elastic_malicious_file_detected.toml,sha256=j0CdnaijJeAt9XYH333dOfAzwNQHyPQuGY4ylgwRoE4,8719
src/detection-rules/rules/integrations/endpoint/execution_elastic_malicious_file_prevented.toml,sha256=-ZPqaZmP2z-Su3cEmdqW4knt99pjQm2JQtU7eTBXHY0,8697
src/detection-rules/rules/integrations/endpoint/impact_elastic_ransomware_detected.toml,sha256=i0euPpVIU9ybfJMJd_KLq6vgW0eYJAXZ5AuzkKx-RKk,8674
src/detection-rules/rules/integrations/endpoint/impact_elastic_ransomware_prevented.toml,sha256=hWJgYtCQYC05-sA4f2dzwKiHOK8nylNPT8AizyzDBLo,8659
src/detection-rules/rules/integrations/fim/persistence_suspicious_file_modifications.toml,sha256=QQlt7EP_1nMhxEJTpj5FVAMj6Ue4EZTVMoWFmFUr_Ik,15053
src/detection-rules/rules/integrations/gcp/collection_gcp_pub_sub_subscription_creation.toml,sha256=zn9hBV5cGzj6-NFmzyMD59E_lBRPIQHudV0k1yM5Cyo,5620
src/detection-rules/rules/integrations/gcp/collection_gcp_pub_sub_topic_creation.toml,sha256=Opz-8ulSqyD7ksLmIISm_ArZiKPHox6Lc3yr_eWErgY,5776
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_created.toml,sha256=ok9-iJDOFd6AZ0ABCZfGZTdxnPUqH7gtzolcAVryvhE,6431
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_deleted.toml,sha256=w6q8AvmuTR31EGniMLOCpF4GLBYFh9Z9x06nskkH2TQ,5892
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_firewall_rule_modified.toml,sha256=iPe3TCAU_V98J5x-pNQky_MCQ8hDB8iTNOVdQ_k1DAw,6042
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_logging_bucket_deletion.toml,sha256=cFbhrrDKfVtxDUXi6YMT4ZwfWHa8RScbP7Rkvs3CHhE,6151
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_logging_sink_deletion.toml,sha256=INvRjYZmsaip6PvvTSGbaLQyDiwCgJ2tIxWDlpD8lvg,5886
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_subscription_deletion.toml,sha256=wKV_Hk6Rhz1PgkLX_fXSqsbWF_40J8dh5gaui-0CgxQ,5720
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_pub_sub_topic_deletion.toml,sha256=cednGFdqAbG2SINUVZs82VSRrb8WXQZ1rsPo2KSEGHg,5898
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_configuration_modified.toml,sha256=BZmS7CE65xmIBWtff6ZRjBWTKL8jeE1ALpTP4Cq4YYs,6073
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_storage_bucket_permissions_modified.toml,sha256=kBGGqBq0quX66cHDzDnlMW8HoRAHpDBt2vevlqvEMOE,5893
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_network_deleted.toml,sha256=iAyswdK3dd3psGlsshkrCwWSaUJAQmlS2zaxm1-nZao,5871
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_created.toml,sha256=0wlViS2g2Uu8K0yqbgrsOh2fFQuIJwlSCOL69BEjl5c,6257
src/detection-rules/rules/integrations/gcp/defense_evasion_gcp_virtual_private_cloud_route_deleted.toml,sha256=p6yRyEvj6XBnwt4bEJBIc483bUCYdsjSkC36ofUJoz8,6165
src/detection-rules/rules/integrations/gcp/exfiltration_gcp_logging_sink_modification.toml,sha256=lzx-HGw4W9iJpoQQC83yXXnHtsbhNmJisO9bUdTxHYk,6122
src/detection-rules/rules/integrations/gcp/impact_gcp_iam_role_deletion.toml,sha256=3xfXkaIMaiu9kR5Nx7HvZCTl9Pjx7t5GCccBm1jTR7w,5732
src/detection-rules/rules/integrations/gcp/impact_gcp_service_account_deleted.toml,sha256=kAVEKToZy2zBmx6TPL3f1kWgw3PZTWpNKBKIHA93yoE,5721
src/detection-rules/rules/integrations/gcp/impact_gcp_service_account_disabled.toml,sha256=I08lGtCXy11ojZfYMlsYe8XzJxSnYdFja1wDGrAVmrg,5645
src/detection-rules/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml,sha256=Qf-ZZH_3z9brqN-0klxtL-FsZAjFiZZS36Sn-qzTqwI,5489
src/detection-rules/rules/integrations/gcp/initial_access_gcp_iam_custom_role_creation.toml,sha256=fLfQBKs7ImYg1DxYvMwSalz5i0ZE3F0cg1a-EL3fC0I,5977
src/detection-rules/rules/integrations/gcp/ml_gcp_error_message_spike.toml,sha256=B27VhzFh1O3I1WEniqKMzOyr6A2T7bqZvqVq6tzewhU,3500
src/detection-rules/rules/integrations/gcp/ml_gcp_rare_error_code.toml,sha256=Qk8wE3uQFzH54XrVTxz6sLceAlXOIO5a7QB1Ypq8tho,4013
src/detection-rules/rules/integrations/gcp/ml_gcp_rare_method_by_city.toml,sha256=gkjd8P78xYDEGnjOAut98MY2FjQiS3aAHCXOFkGSIv4,3316
src/detection-rules/rules/integrations/gcp/ml_gcp_rare_method_by_country.toml,sha256=aKuOtgZSF2DmKXI7WpxdkCv8Eivyu1JzZAtwb111Ac4,3325
src/detection-rules/rules/integrations/gcp/ml_gcp_rare_method_by_user.toml,sha256=aLUduILKnUxVj8Bl_yKuqrh8XMQw_lM4CamyK4iT9W0,4108
src/detection-rules/rules/integrations/gcp/persistence_gcp_iam_service_account_key_deletion.toml,sha256=bHIsaQHQrybqxO11obuciwWWsNU5sYxdG4PgtsrnxhA,5711
src/detection-rules/rules/integrations/gcp/persistence_gcp_key_created_for_service_account.toml,sha256=7XqyO_jEKz6Dp8SqKZeCRCpK4BHJJq49xyMZ1tuZwbw,6128
src/detection-rules/rules/integrations/gcp/persistence_gcp_service_account_created.toml,sha256=OBfAb9oxCppW3-P5tG0A3E-4scrqHPDEnM7iHpVL4Nk,5604
src/detection-rules/rules/integrations/github/defense_evasion_github_protected_branch_settings_changed.toml,sha256=0jBQsfFARBCG0gwjWqgohVi9u8XBVJinyUZ0IRWEGtU,5375
src/detection-rules/rules/integrations/github/defense_evasion_secret_scanning_disabled.toml,sha256=lwxERK_5mssED6zsWuhDTBvZQvx89_YPrazF4rmbwW8,5397
src/detection-rules/rules/integrations/github/execution_github_app_deleted.toml,sha256=lUaccDzoJSUVeSFCFcYp3TMlV5O2ezDJk_Vpi4xPSY8,4793
src/detection-rules/rules/integrations/github/execution_github_high_number_of_cloned_repos_from_pat.toml,sha256=WHTSMMTXGx-_evL-naeTN9QS64PnM2idGY3PQs60q8Y,5079
src/detection-rules/rules/integrations/github/execution_github_ueba_multiple_behavior_alerts_from_account.toml,sha256=6q-SntMIphiYXYTB1_Th2IH790UQp_-7pI2uqtWrzi8,5139
src/detection-rules/rules/integrations/github/execution_new_github_app_installed.toml,sha256=MkD6gHp77xXX-SCceSoWrfQgAXS392mBTPt5W875thw,5030
src/detection-rules/rules/integrations/github/exfiltration_github_private_repository_turned_public.toml,sha256=2wgQgN-GB1dzSCk-TGT7fXvhM_DonSn7B5A6rdzrxwA,5548
src/detection-rules/rules/integrations/github/exfiltration_high_number_of_cloning_by_user.toml,sha256=NxI8yZ4uq1sjkPcBaescZoZyO29OzV4hnNxP4Xilce8,6015
src/detection-rules/rules/integrations/github/impact_github_repository_activity_from_unusual_ip.toml,sha256=AanCG2Xa6J1-FZp6hhi6-YEJVLVheiT6h-H9F_Kc15M,2339
src/detection-rules/rules/integrations/github/impact_github_repository_deleted.toml,sha256=IJJ2S5jZqlKAdtz5HlQLJM-_BFACYGWErZ0csvPqwp0,5248
src/detection-rules/rules/integrations/github/impact_high_number_of_closed_pull_requests_by_user.toml,sha256=TPqPNH77f-RS5zouMP8GjneE3y2mYWrIvkaWjPYNlGQ,6514
src/detection-rules/rules/integrations/github/impact_high_number_of_failed_protected_branch_force_pushes_by_user.toml,sha256=2WpOQOijs3mgBNcvMemqcZlyF2Wett67D9181_EmTYA,6490
src/detection-rules/rules/integrations/github/impact_high_number_of_protected_branch_force_pushes_by_user.toml,sha256=reI6rtNKJkvlKSMANnwqFhRCc66o9zo2Ll_S1NgagCs,7046
src/detection-rules/rules/integrations/github/initial_access_github_actions_bot_first_push_to_repo.toml,sha256=VkR7x_xf5PEdsSOn7ASdMu8cKAHjUzDtdEA0EPvPImA,4574
src/detection-rules/rules/integrations/github/initial_access_github_actions_workflow_injection_blocked.toml,sha256=OriSgjDOAt30MxEPbIaK8VD-xFXo0CBKYUcMmqhCOR8,5055
src/detection-rules/rules/integrations/github/initial_access_github_register_self_hosted_runner.toml,sha256=AgbpMm6HBFDZ59j_dynU2qsrXLcGBmgsJlc-KeYkljQ,3456
src/detection-rules/rules/integrations/github/persistence_github_org_owner_added.toml,sha256=LbXN15NvNoQagu6h-A5Wt7xT_UZ1EsM4BVHQOQDyl1c,5336
src/detection-rules/rules/integrations/github/persistence_new_pat_created.toml,sha256=OxykXsMxlQt7XAiS2BWjxSbvoWGguYlnUt1SRV9QUZ4,5443
src/detection-rules/rules/integrations/github/persistence_organization_owner_role_granted.toml,sha256=krgvUBqURO0EJgbO6O85jZCU2lDcAmCo-MGbodiUFY4,5126
src/detection-rules/rules/integrations/google_workspace/collection_google_drive_ownership_transferred_via_google_workspace.toml,sha256=FlES1Pm0gy22moYPW4LO5uRdluGsEU4Nz9JpucNUnwk,6762
src/detection-rules/rules/integrations/google_workspace/collection_google_workspace_custom_gmail_route_created_or_modified.toml,sha256=vc-vHBfyOJj9pOcvvFG9v6kFS-K7oCgxOU8ALWrRJP8,6657
src/detection-rules/rules/integrations/google_workspace/credential_access_google_workspace_drive_encryption_key_accessed_by_anonymous_user.toml,sha256=EsDdILNPqFI0qC1KZnR2kRM8wy_IUmucSfKAbvtqrDU,7615
src/detection-rules/rules/integrations/google_workspace/defense_evasion_application_removed_from_blocklist_in_google_workspace.toml,sha256=f9XJiZmSnOAcNvv9_zuyjv8p-BWqv86WcTJiVqXK94Y,7579
src/detection-rules/rules/integrations/google_workspace/defense_evasion_domain_added_to_google_workspace_trusted_domains.toml,sha256=oz9xb0Clo6Q__vpjux7sSRPaxxdHIahowVGlPa0JZcs,6026
src/detection-rules/rules/integrations/google_workspace/defense_evasion_google_workspace_bitlocker_setting_disabled.toml,sha256=00OHyV1qyLjVGEWBS3KT09yi5VFW8RN5b8aVnl-iP6o,6346
src/detection-rules/rules/integrations/google_workspace/defense_evasion_google_workspace_new_oauth_login_from_third_party_application.toml,sha256=bQbSfMHmOi0sz-WDXLBBwFgNJb-0nkDbRsCtxzI7Lm8,7618
src/detection-rules/rules/integrations/google_workspace/defense_evasion_restrictions_for_marketplace_modified_to_allow_any_app.toml,sha256=Z_uqwiUaPO0otQYWIWhUUkte7Y9ugTSICxTs93CKON4,7579
src/detection-rules/rules/integrations/google_workspace/google_workspace_alert_center_promotion.toml,sha256=bBR7s_FEaulvwd7td3iDT311L_aMiELyQrxYGCizNtM,2219
src/detection-rules/rules/integrations/google_workspace/impact_google_workspace_admin_role_deletion.toml,sha256=gHwhsvgSxaZGWUC78TcyWyXyhpRrTWEOwb3sZ1WU-1c,6262
src/detection-rules/rules/integrations/google_workspace/impact_google_workspace_mfa_enforcement_disabled.toml,sha256=LJ0F_nKmneK-cymEcEAWt12wczoP_DVR-oukq13GQQ0,6228
src/detection-rules/rules/integrations/google_workspace/initial_access_external_user_added_to_google_workspace_group.toml,sha256=kFPuv5XFpFmVLygTxCFH8JNSJIut8JU344giQagrhj4,7000
src/detection-rules/rules/integrations/google_workspace/initial_access_google_workspace_suspended_user_renewed.toml,sha256=dGGxBIhxitxerDSijj753Or8TLmzQe_tBWNmbIrtc-o,6820
src/detection-rules/rules/integrations/google_workspace/initial_access_object_copied_to_external_drive_with_app_consent.toml,sha256=DlRq0x180q0cFfOR_cFtnphIKHtbhR6Q1z3FvERI_90,8249
src/detection-rules/rules/integrations/google_workspace/persistence_application_added_to_google_workspace_domain.toml,sha256=9C4P40l5Cg-bP2hXwmIby3MEir7N3JD2xW-1Knhv7Jc,6721
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_2sv_policy_disabled.toml,sha256=h-ZM6nLfvY2UmT0pBmZO3Rrbv2rfo08mty2w0fxTHuc,6728
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_admin_role_assigned_to_user.toml,sha256=eHvwHLRiUzFQK5Z-23N0v09ny1wlln7dWlJFRrKcPEk,7484
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_api_access_granted_via_dwd.toml,sha256=yADwDxtcVCGaosfr8ILvpmL4xtecbbq1hBrPJZOansM,6905
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_custom_admin_role_created.toml,sha256=p2ePG03eMu2bAmzR4BRA3gt0oPqcd6NJ4VFbUNYbSqM,7209
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_password_policy_modified.toml,sha256=99AySUmjxq_noPxSMLBV7YYn6cLYQpZDXo8OXzGxhhs,6891
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_role_modified.toml,sha256=ppX37krjo76hOtGp2MsrzB58ZZWIghf0S-dZ3mHYVW0,7110
src/detection-rules/rules/integrations/google_workspace/persistence_google_workspace_user_organizational_unit_changed.toml,sha256=oxAYWeX_CgvxFlHCzr2o4v8-TtKVEgXsvDQlOeUF3Io,7313
src/detection-rules/rules/integrations/google_workspace/persistence_mfa_disabled_for_google_workspace_organization.toml,sha256=IGkaCHQZng1S2xfIWby2niHPmLInChdW0lLLTfHs4T0,6272
src/detection-rules/rules/integrations/kubernetes/defense_evasion_events_deleted.toml,sha256=PHNcM0qGDBGH9Ohy4pcsGnaxT7G_W1l-fiUDAVOWsIU,5667
src/detection-rules/rules/integrations/kubernetes/discovery_denied_service_account_request.toml,sha256=L6vjWcocc0PDYMBD7RVSMYaUUVqM9afcH-wvQhe2lVM,6792
src/detection-rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_anonymous_user.toml,sha256=65dOkKxVfkt-da-tR8Ytch8ftkknS0vxDNnKKrWKzvQ,9130
src/detection-rules/rules/integrations/kubernetes/discovery_endpoint_permission_enumeration_by_user_and_srcip.toml,sha256=t5fgtZ67zsnEzcLjmGmYK1vDLb2hSXU5arIQrWwdwAU,7410
src/detection-rules/rules/integrations/kubernetes/discovery_suspicious_self_subject_review.toml,sha256=8jzYA3bVbOOsUSRlFWe8_0rA2xtyaSHYrXb4NvuN4zk,7059
src/detection-rules/rules/integrations/kubernetes/execution_anonymous_create_update_patch_pod_request.toml,sha256=JPnT0reZ9htsVbdpBOrVBe5TRRCUn7ZhA4A2G_bxzXk,1541
src/detection-rules/rules/integrations/kubernetes/execution_forbidden_creation_request.toml,sha256=Fbm-eCmReXC_zJmqSsyWempwevK637_v8YeiqNgq2TM,6443
src/detection-rules/rules/integrations/kubernetes/execution_forbidden_request_from_unsual_user_agent.toml,sha256=vE_5qBTW9RGYF-55216qbgvTipXJqsFgPbXI4WjweTA,5697
src/detection-rules/rules/integrations/kubernetes/execution_unusual_request_response_by_user_agent.toml,sha256=LrmSudcIadgzbyRw_-0GCQ8mhNq2g1wG_AOZ77--l5Q,5792
src/detection-rules/rules/integrations/kubernetes/execution_user_exec_to_pod.toml,sha256=PFdwQSayYYp26YhdYJai2kSJ1Xq7OAmAoDEZIHoHD6U,9274
src/detection-rules/rules/integrations/kubernetes/initial_access_anonymous_request_authorized.toml,sha256=ibBrwP4E8Vm3EXxk95LQs9xcM9ONwKXWkzgNvZK3QJE,6305
src/detection-rules/rules/integrations/kubernetes/persistence_cluster_admin_rolebinding_created.toml,sha256=dHlPPOvB1JU3netRGByQ5Hf2_tZZkGv3sCrvD3LwrEo,6466
src/detection-rules/rules/integrations/kubernetes/persistence_exposed_service_created_with_type_nodeport.toml,sha256=hsrAhHYdkgBCnpnwwBQlpCrYo7TfkDCpFjY3XNWN0Tg,7391
src/detection-rules/rules/integrations/kubernetes/persistence_sensitive_role_creation_or_modification.toml,sha256=kfOfRm5wTH-jm36MNimmRLFCY4myzdzJ1A6iFANGchQ,7401
src/detection-rules/rules/integrations/kubernetes/persistence_service_account_bound_to_clusterrole.toml,sha256=KrbOf1Ci_6FviraDTX2Z60yje8My7E8QyXwcxbREIAE,6713
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_container_created_with_excessive_linux_capabilities.toml,sha256=l6TpEI4zkXz_ta4aesw2vZf2t0RrafzChi8AS0bq-mk,5461
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostipc.toml,sha256=2QFeZKjluFF430UyI8qr--mMKfvUCAmFCubTPGwtBgY,7307
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostnetwork.toml,sha256=WgKFqdSJR_nsvvavZAbnm9k2_adidtVBLKy1L6EmyV8,7406
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_hostpid.toml,sha256=F4Ha-ywVfcAk9UaLKY2YRheOCYnpbKxpdW8yyv1YGf4,8080
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_pod_created_with_sensitive_hostpath_volume.toml,sha256=N68mJMOR52OUjopXGhdlar8cOaaKk1DIqQijdYJQ-DE,8848
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_privileged_pod_created.toml,sha256=jXDthDMq65ab5TU3qtPxsbU7SR5nG4wOwjI-rE7DXxw,8370
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_sensitive_rbac_change_followed_by_workload_modification.toml,sha256=9yHVaOzsYo7D-914NsBrPOUXbcD6uaOQnWSRlx0x_Fc,6772
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_sensitive_workload_modification_by_user_agent.toml,sha256=Ljk7V8fu9VgLw9or9jvkzrd7_GMFzIpzjj3CEbinstE,6924
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_service_account_rbac_write_operation.toml,sha256=Dt9CEWzaCTj13CFWy1Oy59V6B8kHNlrQD9OQDqwVgGw,6416
src/detection-rules/rules/integrations/kubernetes/privilege_escalation_suspicious_assignment_of_controller_service_account.toml,sha256=dqspgHD-R72ALeXkWTVkX9OjcpqcC0LBEgx1QjFCAX4,7277
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_process_args.toml,sha256=2A4sOwIgPZmwUHRDvRMGqV7rdrXeGti3ROu5PV9l1Po,7254
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_high_mean_rdp_session_duration.toml,sha256=a-62JsxBG7xYD0AvIH987CdfBVhK1iySz8agnCGrluY,7107
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_high_remote_file_size.toml,sha256=0tgupsMMknDKpTZQfk-SdCEYtAl4RQ0SPcEV007QC6U,7281
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_high_variance_rdp_session_duration.toml,sha256=mT4BLKSdRDSAbsYK77yqDG0idgtsgHeAqkjeLwx9vtY,7191
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_directory.toml,sha256=N4V_QZQXuyUKU2vsNMZnqCjA3glyYnfcXSnwMd7aZ20,7413
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_rare_remote_file_extension.toml,sha256=zK97bidjkfJPP2uZj4r5UAJK8pkbJ2Z1OVcfxftHnpQ,6917
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_from_a_source_ip.toml,sha256=mO8vzrknB7Qh1X1rpygO-uim1dnrCHE7qxNtizNzBFE,7222
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_connections_to_a_destination_ip.toml,sha256=A2AtoSeI74SqkbIg1eIAgo2K8ux7NZ-jGSG1za9YK1c,7027
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_rdp_processes.toml,sha256=uOgGC8bWq2UZxrpYqZV3tD5XRYjLoXGGPQDdR5vZcuQ,7109
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_spike_in_remote_file_transfers.toml,sha256=7HAOSGp2hpDC65zB5oB5Apew0mJg7PH-EgFcabXzCZ4,7329
src/detection-rules/rules/integrations/lmd/lateral_movement_ml_unusual_time_for_an_rdp_session.toml,sha256=E8rM_7eEhPHQxiTAjKugT_s6WFeJPwH6FeVa2rpzrYg,7178
src/detection-rules/rules/integrations/o365/collection_exchange_excessive_mail_items_accessed.toml,sha256=VGmwDJY1qs6rLvbWjrx7-G47oIlGnCEJGePAKMJNnWE,7491
src/detection-rules/rules/integrations/o365/collection_exchange_mailbox_access_by_unusual_client_app_id.toml,sha256=74mMYw6Pi1QRaIkBY3RGRrh3taMef3ENlz3ARb_zJJ0,13124
src/detection-rules/rules/integrations/o365/collection_exchange_new_inbox_rule.toml,sha256=dWOxdKR-qxdoxAy6Uwt7QX8QiiqWsEDpq_DYvGRIgdo,7091
src/detection-rules/rules/integrations/o365/collection_onedrive_excessive_file_downloads.toml,sha256=xBzDu-iggCiXZM1W6c1TpHGKuFbJ4e3DKWHwO3n0cyo,8234
src/detection-rules/rules/integrations/o365/collection_sharepoint_file_download_via_powershell.toml,sha256=oaibpYg3PlmWBscYvuDhxcWq5rMmGH18qil5IY3pdKI,5101
src/detection-rules/rules/integrations/o365/credential_access_entra_id_device_reg_via_oauth_redirection.toml,sha256=PH4-5QkY2w2g9xwk6g1FVUK6xgeVljuE4G-5TSdBRjI,5750
src/detection-rules/rules/integrations/o365/credential_access_entra_id_potential_user_account_brute_force.toml,sha256=ux42C1eFcWp-7-KbaGgFzW6-7lEN2Su3xYSu4FMbWnA,8753
src/detection-rules/rules/integrations/o365/credential_access_identity_user_account_lockouts.toml,sha256=nBq4QTthKDuR2CrrYNuRGq9ZOIq4pOg1p0OJjgSeRMc,6558
src/detection-rules/rules/integrations/o365/defense_evasion_entra_id_susp_oauth2_authorization.toml,sha256=vIak6A0xrbGzGq__U7hytuHls5CM27_3mUprXV5uMBE,10596
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_policy_deletion.toml,sha256=OjUjMx1rodGjnXOcKI9SdwYbg1Ig-IEs73yHzS4vypI,5923
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_anti_phish_rule_modification.toml,sha256=dJ0St4ycnkg60waixL_5pYH5B1iFY4O0sQY40oe7Qy0,6064
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_dkim_signing_config_disabled.toml,sha256=5umxYnFTQAPw1_4OM1sgjiAdgT24Mg06LuO1F2B0k7M,6569
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_dlp_policy_removed.toml,sha256=nr7vx7y0cwzlropa73mUDiOtXtZqxjgFOgZ61oIm6Kc,5218
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_exchange_safelinks_disabled.toml,sha256=YTs3coNPAVIsbdu56V__qjm19j8HnqAAr0HEi-YQqJQ,5992
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_mailbox_audit_bypass_association.toml,sha256=ec5lR5FV8riC-O98O23IwBCzl0FtJ2ITmRcJeb6i88A,6305
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_policy_deletion.toml,sha256=y2eclxWxXlwsvEQ_Co1SQQeBREzeTDnT5EmL2oiVwcc,5867
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_malware_filter_rule_mod.toml,sha256=Ia5oR-GC1af4lDFAWRp64sb9IbKeCJyO1Vh8UwUPgG8,5863
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_new_inbox_rule_delete_or_move.toml,sha256=xpw0zZkC64InlU1ETrM2apAkjHOy4U-Iq9lS9TXYAM0,5989
src/detection-rules/rules/integrations/o365/defense_evasion_exchange_safe_attach_rule_disabled.toml,sha256=ARToSlmH8b_FRKeUML2NmE2rQeZEeHjth7lgx_4y2s4,5915
src/detection-rules/rules/integrations/o365/defense_evasion_mfa_notification_email_deleted.toml,sha256=mf8Dj_lDvh9_H_zmfOAoeseUgicDsqfRzUnln5NYR_8,5871
src/detection-rules/rules/integrations/o365/defense_evasion_sharepoint_sharing_policy_weakened.toml,sha256=nv0VEU2L-_gD1C7LyjHbB1rvbRpiGrY4ZN26Jm9CB6w,6974
src/detection-rules/rules/integrations/o365/defense_evasion_teams_custom_app_interaction_allowed.toml,sha256=-1oYktXe-UoxqrbUzI7xmmT8ZrlKBKZk5arwF1ru7Fk,6554
src/detection-rules/rules/integrations/o365/defense_evasion_teams_external_access_enabled.toml,sha256=HnPMEZcd6-Jp4ltkyLI1uc_FyaKBcqx_D7nXkpHXdH0,5603
src/detection-rules/rules/integrations/o365/discovery_sharepoint_sensitive_term_search.toml,sha256=OgkPlmXBwCQ8s4r4KbVkGj9M8_5RsMhOGRwfmtgYZsE,6082
src/detection-rules/rules/integrations/o365/exfiltration_exchange_transport_rule_creation.toml,sha256=gpodIAPJ74ZnmnU7E6f0NfsyN74eVboNZL81y9tTOI0,5548
src/detection-rules/rules/integrations/o365/exfiltration_exchange_transport_rule_modification.toml,sha256=qe4fSU_khBBga-J7O2gKhMl8uAuGiEEc54EN_3iubzY,6155
src/detection-rules/rules/integrations/o365/impact_security_compliance_potential_ransomware_activity.toml,sha256=Reaqb89he2fhPamKP9QeGahIexGflCpaayJlQg3zLns,5626
src/detection-rules/rules/integrations/o365/impact_security_compliance_unusual_volume_of_file_deletion.toml,sha256=f7-u-MJmQ-B3uVvja9Nxk1z3Hycnqc98BKO-ukKpyJc,5894
src/detection-rules/rules/integrations/o365/initial_access_entra_id_portal_login_atypical_travel.toml,sha256=LUNFNIxfJbB7k-euUFhdoymOQ2YQArKsIuR2k6qm8i8,5567
src/detection-rules/rules/integrations/o365/initial_access_entra_id_portal_login_impossible_travel.toml,sha256=DsJZqg_nKvXPzwo0N3U0xAJrdYoXP3lh6yXhCfg3v2I,5446
src/detection-rules/rules/integrations/o365/initial_access_identity_illicit_consent_grant_via_registered_application.toml,sha256=NikXZWfqH8GqegZ-HlxL2rpejfTG0QhHIYXu0CtbhPQ,6509
src/detection-rules/rules/integrations/o365/initial_access_identity_oauth_phishing_via_first_party_microsoft_application.toml,sha256=wbxSDF-bT99e6S-EDMAoNiFRZV8vfQZsiwWyJvz52rs,8635
src/detection-rules/rules/integrations/o365/initial_access_identity_unusual_sso_errors_for_user.toml,sha256=EIeZeLhK714jea6QJtiNCbMMyMS0i1YxYRSg-BlBV38,6612
src/detection-rules/rules/integrations/o365/initial_access_security_compliance_user_reported_phish_malware.toml,sha256=Ii1ujOJcIc4DErpqB5Zib6bXtp0HqgYVIov4RfS08PA,6394
src/detection-rules/rules/integrations/o365/initial_access_security_compliance_user_restricted_from_sending_email.toml,sha256=y70w3S1_oBvcp-cI8Zekf6aN9eOjzl6zncqrT6G04LM,5661
src/detection-rules/rules/integrations/o365/lateral_movement_onedrive_malware_uploaded.toml,sha256=G6L9kfHEpF--gbNLteKBqj5i6QawW6gXeDTMCEHFP3Y,6611
src/detection-rules/rules/integrations/o365/lateral_movement_sharepoint_malware_uploaded.toml,sha256=hsG5-TU8chidt4_DgDIpDQdPj5nxuimA6mRtSIKSK84,6616
src/detection-rules/rules/integrations/o365/persistence_entra_id_global_administrator_role_assign.toml,sha256=Xwf-s2K6SZCnZ_BTWejdm1qfy5sgeoxfBiE-4s0YUjA,5534
src/detection-rules/rules/integrations/o365/persistence_exchange_management_role_assignment.toml,sha256=XjZSJ5py9Mih1RTle0I9TW030Z3nHJ7NONFZajazP0Y,5701
src/detection-rules/rules/integrations/o365/persistence_exchange_suspicious_mailbox_permission_delegation.toml,sha256=fMCsOClx23YjqkaMCXZGtkJcJwklLuY203f2ZFB5jeg,5983
src/detection-rules/rules/integrations/o365/persistence_teams_guest_access_enabled.toml,sha256=vXNKbLPwBrq1OquTVYP25a6Qy6idM60sDhMlZ4b6AaU,5692
src/detection-rules/rules/integrations/o365/privilege_escalation_exchange_new_or_modified_federation_domain.toml,sha256=79lexHlVATrUjiMod7kelv4KsK3Xs66RNOVx2akZtoU,6498
src/detection-rules/rules/integrations/okta/credential_access_attempted_bypass_of_okta_mfa.toml,sha256=sA57d01eFVTByjMXqeJrTOH2Yzg7FIDZlomLAYNVBXw,4602
src/detection-rules/rules/integrations/okta/credential_access_attempts_to_brute_force_okta_user_account.toml,sha256=gk6DdcFn-oQJY0ZqkGgZAZLTk3XjyBEPeDXytVe3N1I,4467
src/detection-rules/rules/integrations/okta/credential_access_multiple_auth_events_from_single_device_behind_proxy.toml,sha256=eqm0sduRv9TzF8_9D3q1sA-o3WJAayvclGH9ojXtnzk,6651
src/detection-rules/rules/integrations/okta/credential_access_multiple_device_token_hashes_for_single_okta_session.toml,sha256=fFlAhwPklAvEcxUQsBG4cM0dhXxezw-2brwI4Zg2DX8,6331
src/detection-rules/rules/integrations/okta/credential_access_multiple_user_agent_os_authentication.toml,sha256=JOvKG7UooxG8bDo9kNPlsHkuOJViAymFr7ieL6nbMiE,4746
src/detection-rules/rules/integrations/okta/credential_access_okta_aitm_session_cookie_replay.toml,sha256=PtzGvW3hICtA6VSue8J5K7x8voQ8NFMqItMyixUz2yA,9497
src/detection-rules/rules/integrations/okta/credential_access_okta_authentication_for_multiple_users_with_the_same_device_token_hash.toml,sha256=3dl9-vS0yRHV7pgWcdARQdkvgHw4XCATZvAvuxc6EHI,7820
src/detection-rules/rules/integrations/okta/credential_access_okta_brute_force_device_token_rotation.toml,sha256=AUdBWZs2E7IEa4j8hwVGR71ijjgG74t8EZ_9vW38meg,6597
src/detection-rules/rules/integrations/okta/credential_access_okta_brute_force_multi_source.toml,sha256=yglPz73jyrNVbUWm7QfzX-VSIOAhlN2QTbk4lzj-r9A,6322
src/detection-rules/rules/integrations/okta/credential_access_okta_credential_stuffing_single_source.toml,sha256=05xdT4EgFK38hVsZ4HBKsxrXP4TVmGUNUhiFc1Efo7E,7767
src/detection-rules/rules/integrations/okta/credential_access_okta_mfa_bombing_via_push_notifications.toml,sha256=bAiIf2czN9ZO8nTtYnPaDzL68ZIU3uS5mkpScvbTkpM,4934
src/detection-rules/rules/integrations/okta/credential_access_okta_password_spray_multi_source.toml,sha256=JMc-fWhxoKno6CWk35qHhxBdqGGfw1faQ-z9mMbCkrc,6646
src/detection-rules/rules/integrations/okta/credential_access_okta_password_spray_single_source.toml,sha256=9SRNsBMjL2CVSN5BJ5TB6oahpPL-FnwL4rh4LIjg210,7985
src/detection-rules/rules/integrations/okta/credential_access_okta_potentially_successful_okta_bombing_via_push_notifications.toml,sha256=VUxFWnqtFhLBiLg-Yo-H-G5ZKLPlqRHsosllUCvyXPs,5081
src/detection-rules/rules/integrations/okta/credential_access_okta_successful_login_after_credential_attack.toml,sha256=2N1PykolxZfimIEgkJlRFFVNBdipYP6bY3ACZTYtcec,9977
src/detection-rules/rules/integrations/okta/credential_access_user_impersonation_access.toml,sha256=E-CNCnMlZ8z_OrD1m4JBaVbXRo0Dd8Jzl-koapPzxoM,3908
src/detection-rules/rules/integrations/okta/defense_evasion_attempt_to_deactivate_okta_network_zone.toml,sha256=EAoonBbpfY_vtpTosj_F4YJ-tonptDnzulz33_wvYfQ,4365
src/detection-rules/rules/integrations/okta/defense_evasion_attempt_to_delete_okta_network_zone.toml,sha256=aLu9u7ml_OWplRG4NLBLL-H-Mlgn4oZngrBgI3aR_x8,4387
src/detection-rules/rules/integrations/okta/defense_evasion_first_occurence_public_app_client_credential_token_exchange.toml,sha256=hdTP8uTy4Ww_cJa-cyrqFIwInTFkkF7Bt2wQMX4Js2Q,6820
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy.toml,sha256=s6nWPWhW2ElRgnio0tD2ful2KuYTVZk90JpBPaTzm1M,5257
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_deactivate_okta_policy_rule.toml,sha256=jC8gt3ju3ZajKZMNqd-eobcPANjmWrbVuZ7P05K0pP0,5234
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy.toml,sha256=Zhi-kh8mdlFvDLHrL1uzp_7GBxgyLk9Txic3DHGO9Vk,5132
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_delete_okta_policy_rule.toml,sha256=kAFQRxnHAbP0wV8QBgAWwq43Zdwbnzl_H440MkECAVE,5053
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_network_zone.toml,sha256=ke3DBgzy8c9Jl8tgJvg-044bfJGdmB0Bn6Zm52Wx2GU,5070
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy.toml,sha256=EBG32-0JRPBGbi6xyVRJrwfERg34OrSzCJ8EQ1rsLec,4208
src/detection-rules/rules/integrations/okta/defense_evasion_okta_attempt_to_modify_okta_policy_rule.toml,sha256=6xN6XpNOkyoTOrLzIh2iCDXrYvYexcZv7H88wLVPz8Q,4630
src/detection-rules/rules/integrations/okta/defense_evasion_suspicious_okta_user_password_reset_or_unlock_attempts.toml,sha256=UIT4NqYFJMas9rmvDx0SVKQjnnxcO05Y2EZCu7b-970,5365
src/detection-rules/rules/integrations/okta/impact_attempt_to_revoke_okta_api_token.toml,sha256=svKxk8ZXaRBgq8cVWSIE60Homf1T-2WNoR-VFDL6eec,3631
src/detection-rules/rules/integrations/okta/impact_okta_attempt_to_deactivate_okta_application.toml,sha256=0t1yW1jhlTzwmAOPhqEZiNIvdtkP5iUpoQTstDd46Y8,4372
src/detection-rules/rules/integrations/okta/impact_okta_attempt_to_delete_okta_application.toml,sha256=h5LoMs9NTAxlgnmm5ut-6YuM_tYbN_6PJMKoPmKpUOg,5763
src/detection-rules/rules/integrations/okta/impact_okta_attempt_to_modify_okta_application.toml,sha256=3MOYprdRdrI3rcDBah--hqcVBs8KEwkWqOKXHcGMERk,5671
src/detection-rules/rules/integrations/okta/impact_possible_okta_dos_attack.toml,sha256=pJSXQPE48JGh3mIzgWYngOBctFuhubsk7WGAhQ_IUJk,6045
src/detection-rules/rules/integrations/okta/initial_access_first_occurrence_user_session_started_via_proxy.toml,sha256=ECy1VQqpoFblOfFquDNf3uR6cbHxInSUwVPM8slAW-g,4396
src/detection-rules/rules/integrations/okta/initial_access_okta_fastpass_phishing.toml,sha256=viy9G7om7zLnCSerXoOlEHwIyrKobMJ_xLpi3LxJjlw,6037
src/detection-rules/rules/integrations/okta/initial_access_okta_suspicious_activity_after_proxy_authentication.toml,sha256=LZrUGGWBKnVk1whcI8EcVXl8s0-ztfTWjETlI3IbcdU,4840
src/detection-rules/rules/integrations/okta/initial_access_okta_user_attempted_unauthorized_access.toml,sha256=Fb3zNtrOQC2Wkq8dLKzOoymc7bokJUhe_0Tecfiw4Dg,5807
src/detection-rules/rules/integrations/okta/initial_access_okta_user_sessions_started_from_different_geolocations.toml,sha256=lfDtQQgA-ILQjmfeAh9F5bWCADdPydsn7dbYXMp__KU,6367
src/detection-rules/rules/integrations/okta/initial_access_sign_in_events_via_third_party_idp.toml,sha256=Hy6kwpHbE2NN0k7zDQVXeSifOyyvNIKoSYWXoZ6J3Qw,6106
src/detection-rules/rules/integrations/okta/initial_access_successful_application_sso_from_unknown_client_device.toml,sha256=F5OoQhp4g2trjQNvxZo9q7s-JE0rOSadvCmyxqw469E,5788
src/detection-rules/rules/integrations/okta/initial_access_suspicious_activity_reported_by_okta_user.toml,sha256=QEovOSoUQTY_mXIEyUCNtcu6QwcJam1M7qUXk3w9K4c,6613
src/detection-rules/rules/integrations/okta/lateral_movement_multiple_sessions_for_single_user.toml,sha256=dX0GqdtxNK3Y7AoiADEp8KXss9IddxtrZTHSmdtzQEU,6405
src/detection-rules/rules/integrations/okta/okta_threatinsight_threat_suspected_promotion.toml,sha256=HWE1o_-bvXjirvO5seDWROOPFwFyWTxVtHwfr4n28u8,2396
src/detection-rules/rules/integrations/okta/persistence_administrator_privileges_assigned_to_okta_group.toml,sha256=XprehOAXZkmcIdQeskgkeOGChzxDWMuCgfXYpO2C44w,6031
src/detection-rules/rules/integrations/okta/persistence_administrator_role_assigned_to_okta_user.toml,sha256=BejOy0EZ_NY1SWvNE2fOUDCrZtB_lsAsuA0eK89wSec,6036
src/detection-rules/rules/integrations/okta/persistence_attempt_to_create_okta_api_token.toml,sha256=aPsi3hMm8oGoaCCKyx-RRLH3FawS50NfHH4Zv0Ym5-o,5620
src/detection-rules/rules/integrations/okta/persistence_attempt_to_reset_mfa_factors_for_okta_user_account.toml,sha256=qgMObZ-jQALt-pniNNGBC4yS7DB8pjlnyixbKiIqROI,5681
src/detection-rules/rules/integrations/okta/persistence_mfa_deactivation_with_no_reactivation.toml,sha256=ekxNAAwu2Gsx7OccJKZeErl1eAK6slKIPc9aZxg2sRs,4886
src/detection-rules/rules/integrations/okta/persistence_new_idp_successfully_added_by_admin.toml,sha256=1CnqYcuk4CGXPMYK5eLWSrUQsD0tcRCJqChaV5ozigo,4366
src/detection-rules/rules/integrations/okta/persistence_okta_attempt_to_modify_or_delete_application_sign_on_policy.toml,sha256=YC5uUXyT87ueVBuKBtRkcrR3IDCY1U9ejzqgR_5x2R8,5977
src/detection-rules/rules/integrations/okta/persistence_stolen_credentials_used_to_login_to_okta_account_after_mfa_reset.toml,sha256=VD9ZT3XnWRHyffoQQzr2AjQxvpY8usW9pkn1PnCG7iQ,5854
src/detection-rules/rules/integrations/pad/privileged_access_ml_linux_high_count_privileged_process_events_by_user.toml,sha256=Wl9pTqEsSCPtaurWoRMIKF_aHst9EkdHT8qWrp6HYXo,7202
src/detection-rules/rules/integrations/pad/privileged_access_ml_linux_high_median_process_command_line_entropy_by_user.toml,sha256=zdU5nWCVZI5s5UrA_VAGBovoGTNyBHVZ61Cv-lPA9U4,6699
src/detection-rules/rules/integrations/pad/privileged_access_ml_linux_rare_process_executed_by_user.toml,sha256=pOnFpbho8knSbghfFDSVl7FrPeWtJjcDzjpaHOnnWbM,6677
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_high_sum_concurrent_sessions_by_user.toml,sha256=M2i_MouCBWGtYWbQpHNMtK_RFP-TSlwEgoGRDMzWqRo,7194
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_rare_host_name_by_user.toml,sha256=nxmCF5yuVI--xS1eZWutbMpuBbaccJYc5o-g-Kk4vlE,6862
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_rare_region_name_by_user.toml,sha256=8swNF9qGv2fJD-TbQ7vhYQTpVHvRVh3lNVfyWJUXc6I,6911
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_rare_source_ip_by_user.toml,sha256=dp09bjr3LAQmK9m-keT37IMPAv20_n_mElMTM2iZvvc,6556
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_application_assignment_changes.toml,sha256=IQU5OHjLVlSz8IxavxetrXeBxqELBUUqRSIW8GguwyU,6755
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_lifecycle_changes.toml,sha256=l0ftDIbYM65LiIY_gqfdNNO13BsCOnzrEvRAkRhyFy0,6937
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_membership_changes.toml,sha256=c_Eyvv7F6EUuDAtSQDfdpODwvsgA6XtmJEIvAhn5zvA,6745
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_group_privilege_changes.toml,sha256=u0AGt7Bc3denjjhRKmjYTlUFLdy9su1F7CYuMBcl964,6735
src/detection-rules/rules/integrations/pad/privileged_access_ml_okta_spike_in_user_lifecycle_management_changes.toml,sha256=j6wIc3hb4S3AMuKiRw9oN1_R-BWNlItyczSNphb77Eo,6833
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_group_management_events.toml,sha256=seSo9JXXai-o4Cuweiq2iNiC_s6aTz6GIsjYNlqWq5c,6869
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_logon_events.toml,sha256=E7JKxcOvxk4EeDBLGDHb0w-V-e6oxGTfJbz_ucXqqfk,6893
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_special_privilege_use_events.toml,sha256=3pISlH6sfAdWbzmndIWjF4VduwU8huvFg4r7tW4M4hM,7016
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_high_count_user_account_management_events.toml,sha256=w6U-_xuSA7mPDVPS6iZh-ZWM6w5-5dv81DrwjnWgXBE,7366
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_device_by_user.toml,sha256=n_phVSzD6PuEwCEbgBRPscDfB1gZOPP-BPkrwVHheW0,6746
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_group_name_by_user.toml,sha256=Ho9jQrPWyuhMWpwIH_ww_npXE-jiuyIbEJIpROF4ZNE,7727
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_privilege_assigned_to_user.toml,sha256=NT8aDP65pypjhGOdfw7oJfUGQtccau9k6L3nUkjXqpM,7134
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_region_name_by_user.toml,sha256=ZsXg3q_O7upoj5IT9RQBH-Oxb1by7mC6dXKDwXb2Dro,6721
src/detection-rules/rules/integrations/pad/privileged_access_ml_windows_rare_source_ip_by_user.toml,sha256=wQfknX1HeEUw8ofJ5K5LZywlU54wwDDhLL5c8sa3bCM,6999
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_host.toml,sha256=lGO4fwMXScZx85oXzPbN2xj6m2y9Y6X-BziYjko1P9U,7116
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_parent_process.toml,sha256=FfiYW0rsH69SoV4ZOrtH_8wYtIrhxrUc25G8RlmkZpM,7084
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_rare_process_for_a_user.toml,sha256=M0p_YiyPrs7ILHfgQAfcI-nTYtpEhqzUDVaDPY3KD28,7251
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_high_probability.toml,sha256=rOdtOoLCvQ8TUwvKtPE48QQ8Bj4H4CYqBcD6kEA2X6c,9115
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_event_low_probability.toml,sha256=rHhQJBcQcNUJY51FPOG9eBb7FiPbde1ZqyjkeYcppKY,8993
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_host.toml,sha256=EoLIDJol3lLc8az15wG9n440bNT75pvMfPtMz8Ty24U,7423
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_parent_process.toml,sha256=xMvDfmMt0eMrJ22rijR1ITdicRjjLFrsrC3JKIsf910,7657
src/detection-rules/rules/integrations/problemchild/defense_evasion_ml_suspicious_windows_process_cluster_from_user.toml,sha256=zkarSPRMalu9eipDQ9_UhVDkYXCQRy0dzEXW_6QbpEQ,7401
src/detection-rules/rules/linux/collection_linux_clipboard_activity.toml,sha256=_OkgdYKcU3vE87fXOAF2AADGr0wUpZ6zNOGh69izDaE,5801
src/detection-rules/rules/linux/collection_potential_audio_recording_activity.toml,sha256=2H7x-URs5inD9pvEe8fdtqlNJAeStLBpgC-d3hdk-W8,6120
src/detection-rules/rules/linux/collection_potential_video_recording_or_screenshot_activity.toml,sha256=_B9UD4KmLfBXC6Z5EgmwSHW9QeFdmFe4Me90lxTMaA4,6079
src/detection-rules/rules/linux/command_and_control_aws_cli_endpoint_url_used.toml,sha256=PtTpsw8IhrtaP3BcIRV_c_6AkWvfqHJ4Yb4ZIKT_jUo,6083
src/detection-rules/rules/linux/command_and_control_cat_network_activity.toml,sha256=X4dfi6vQgc4-wEtDOgFaARb68eMf4SeBj1zsEsuhwLw,10069
src/detection-rules/rules/linux/command_and_control_cupsd_foomatic_rip_netcon.toml,sha256=c89NL_yBFDR1FTTPACEVqVa4-pI0E8Fo6WzKRQjSnWY,8141
src/detection-rules/rules/linux/command_and_control_curl_socks_proxy_detected.toml,sha256=fQ8opAka8JyfqlrTZ-6CRFtXYOm7PswsxSQ3r-CEzqI,9328
src/detection-rules/rules/linux/command_and_control_frequent_egress_netcon_from_sus_executable.toml,sha256=ARB8bpkm-gNgrQcRB8YpjX78ZlBqxndEwU2X2yJu9u8,9678
src/detection-rules/rules/linux/command_and_control_git_repo_or_file_download_to_sus_dir.toml,sha256=iw9CtYJE0iI0l6Gc4deQB-gXVSkvxgGznkIpahhQ62Q,8933
src/detection-rules/rules/linux/command_and_control_ip_forwarding_activity.toml,sha256=TLeNmBvy0DbXsblDaykWyKrrQF_JEQRm3PPV2k1WMhI,6568
src/detection-rules/rules/linux/command_and_control_kubectl_networking_modification.toml,sha256=KxnZcvHwqNMTmebGltJnOyfrCaFqo_AzVpv5xQbANJo,8574
src/detection-rules/rules/linux/command_and_control_linux_chisel_client_activity.toml,sha256=SvWpHMDz1-2Fui5qBgjtxegl4-rBYj9HxYbKNjQVJrA,10380
src/detection-rules/rules/linux/command_and_control_linux_kworker_netcon.toml,sha256=7Ahb2Lnev8krBvqRvjSQR62JHr1I8ofg84OGWpVEQeI,8487
src/detection-rules/rules/linux/command_and_control_linux_proxychains_activity.toml,sha256=TsAHcQzNSYi5NpNEg5ZpQ-UZZWb5zP8rVoEAOEwgaxc,7831
src/detection-rules/rules/linux/command_and_control_linux_ssh_x11_forwarding.toml,sha256=Ez0ojkdZpL98zBcNYNUdObQ8io5Bp-CssW9x4gIsGls,7549
src/detection-rules/rules/linux/command_and_control_linux_suspicious_proxychains_activity.toml,sha256=TMcisN_MHnSf1otUZmfQh-lTOfGTWSfRZWLaciMJqAE,10321
src/detection-rules/rules/linux/command_and_control_linux_tunneling_and_port_forwarding.toml,sha256=sXOd6kjDamnza5dvWlc51u_RibHjDvFwls9Zufijv2o,11439
src/detection-rules/rules/linux/command_and_control_linux_tunneling_via_ssh_option.toml,sha256=jUA4d450BQYEWrXg9x1EQgeAmHZE51_YVrPcewI_8zo,8306
src/detection-rules/rules/linux/command_and_control_potential_tunneling_command_line.toml,sha256=gbix0DRM9xD0UYJIBc9LcyFyGpGTvifk7zXR8E6cyYY,10477
src/detection-rules/rules/linux/command_and_control_suspicious_network_activity_from_unknown_executable.toml,sha256=Pt0EufHvRp9_LnsciX6Ogz2guSVZvi4s4ZJbGyY_0X0,14975
src/detection-rules/rules/linux/command_and_control_telegram_api_request.toml,sha256=BBPV_Te4zI9RvBtBVXmq6S8b423dDYcKOjeXos-v6sE,8678
src/detection-rules/rules/linux/command_and_control_tunneling_via_earthworm.toml,sha256=0nmpt-2HsoeJ92_HLE_ZZdNfmt0Fp5Ptpq1BJ8yo78Q,11425
src/detection-rules/rules/linux/credential_access_aws_creds_search_inside_container.toml,sha256=oqHoVqX2ecwdfbKhKxGpSkTIigvtoC6dm6udXAU2hw0,8343
src/detection-rules/rules/linux/credential_access_collection_sensitive_files.toml,sha256=Im1Ucgf4glB1VWV9qxlyhEXdCKZQptcrEfA0r1CMvyE,10786
src/detection-rules/rules/linux/credential_access_collection_sensitive_files_compression_inside_container.toml,sha256=qAjxiutGocDMWTGM3auMVVXNU3u1nSl7FkSm3-A3Dv8,8432
src/detection-rules/rules/linux/credential_access_credential_dumping.toml,sha256=L04DkMjFQuNuAj3ZuuzMaAjuQWwk8rfgWg6ISABMJ1M,8175
src/detection-rules/rules/linux/credential_access_gdb_init_process_hooking.toml,sha256=Ol9yBaTOAZl4ntxXw3AzEOVYjn5jvH607tFlRID1GW4,7995
src/detection-rules/rules/linux/credential_access_gdb_process_hooking.toml,sha256=kFvmVkghmRpPY-uXxU9OfYNt5QizMwJt47SkFneqWXQ,5973
src/detection-rules/rules/linux/credential_access_gh_auth_via_nodejs.toml,sha256=VBkQnH8ONNRaF29N7O3YD0-5ILVWcRu_qgIi5QZ-xf0,4600
src/detection-rules/rules/linux/credential_access_kubernetes_service_account_secret_access.toml,sha256=-FBxsymz6KufNfb4IOoY2KWZ-9lMQE8Y6EsvBcIzsNM,9539
src/detection-rules/rules/linux/credential_access_manual_memory_dumping.toml,sha256=3g1uB7lrH_3t5o8eDKgoycM9o7jz_B4FiPZ1XOa1QbQ,8726
src/detection-rules/rules/linux/credential_access_potential_linux_local_account_bruteforce.toml,sha256=suhirOyQt26j7mBoris7WLrhY-PlOxlkjutr6N1DZig,8870
src/detection-rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_external.toml,sha256=8ipFIiZE7dCgBXpJVPSkbc66PgwHXZAtA_gdSkIaBXE,6300
src/detection-rules/rules/linux/credential_access_potential_linux_ssh_bruteforce_internal.toml,sha256=ixgW2lIT1VKx7Y49g_0G8FCr-YGwDxerg1gkCvA6Kj4,5862
src/detection-rules/rules/linux/credential_access_potential_password_spraying_attack.toml,sha256=BrExHaaJqzd-CUrqJ2nOWlTGkXdekb2fzmPAiiKoM6Q,6425
src/detection-rules/rules/linux/credential_access_potential_successful_linux_ssh_bruteforce.toml,sha256=fJziWMVcB4WJQ7YiDlFEjsZqNRbDf711beFD8f_bCmU,6864
src/detection-rules/rules/linux/credential_access_proc_credential_dumping.toml,sha256=VedJirDQ_w4Hlo0sNzeHuWz4sVjsZJh8T7dZHz4NPnM,8846
src/detection-rules/rules/linux/credential_access_sensitive_keys_or_passwords_search_inside_container.toml,sha256=Q2DXzzbYraoEJOSj2yLtmjIvV5lTOjSuN7Wz7X-GTRQ,8248
src/detection-rules/rules/linux/credential_access_ssh_backdoor_log.toml,sha256=g8QX9X8QiphB1FBasdF4d1W59yjpK0THld4JuSqaA-I,10929
src/detection-rules/rules/linux/credential_access_ssh_password_grabbing_via_strace.toml,sha256=NdUFvdVG7LbuOtv8F1bWim0xPr2MkYs1JjfnPSLn9pI,5608
src/detection-rules/rules/linux/credential_access_unusual_instance_metadata_service_api_request.toml,sha256=nIefM5oiRIqxbr2dipBhXWp9qtql2FdG5KP6Hy3yVfI,10717
src/detection-rules/rules/linux/defense_evasion_acl_modification_via_setfacl.toml,sha256=WhGAdJaa58E0HAySHkOoXgRd9N9A_Y0nyVMKeFW0Nvc,6139
src/detection-rules/rules/linux/defense_evasion_attempt_to_disable_auditd_service.toml,sha256=d_L0J_F742xi6mTSTUyMrva6ox9oG8nJ2Xc9ihyc2Zk,7896
src/detection-rules/rules/linux/defense_evasion_attempt_to_disable_iptables_or_firewall.toml,sha256=uX0jwK1HavotVepGR4EslUupgYrFDy4sTkoD9jz-qM4,8732
src/detection-rules/rules/linux/defense_evasion_attempt_to_disable_syslog_service.toml,sha256=O5Xgou2JhM6-FeiGIvTYrVVpk4mUQWZwMWZFsBcQCW0,9971
src/detection-rules/rules/linux/defense_evasion_authorized_keys_file_deletion.toml,sha256=t22HAXIkaZ_BFUTNk2x0cnyHmkTb9YS5uDC0tqqbfdo,7853
src/detection-rules/rules/linux/defense_evasion_base16_or_base32_encoding_or_decoding_activity.toml,sha256=_zuW_A5dV6Jo023dES6RvelkYXTvrb6C5yF3WuPDkRo,9762
src/detection-rules/rules/linux/defense_evasion_base64_decoding_activity.toml,sha256=pu3NuBFMF_PGOxGIJBsegBbmD-h-DnPeXS4pLHFquiw,11004
src/detection-rules/rules/linux/defense_evasion_binary_copied_to_suspicious_directory.toml,sha256=PJwrfjeTFrIDPU4Z05CwxCAWFHZ1OwM5GS--mIWNg5s,8423
src/detection-rules/rules/linux/defense_evasion_bpf_program_tampering.toml,sha256=g_1oim_d6WCeAdAUALIUB46OIxKhyEpE-aq71yJ8PxY,6701
src/detection-rules/rules/linux/defense_evasion_busybox_indirect_shell_spawn.toml,sha256=jfzhhJJOkWjPvGILtaEwcqJeydqi5QM8Eio8tnWh7Rs,8851
src/detection-rules/rules/linux/defense_evasion_chattr_immutable_file.toml,sha256=KMfaOCSonrVniQOfgVNQrTe1oz42paQkB9bleA0iqsY,10425
src/detection-rules/rules/linux/defense_evasion_clear_kernel_ring_buffer.toml,sha256=oNvXU3WshoJ-MqayO6AthZlpBra9kWx2S6PpAFVWLYY,8032
src/detection-rules/rules/linux/defense_evasion_creation_of_hidden_files_directories.toml,sha256=MJP2WYfkRMThDmSrxCTN-KSGy78gPTC8j6uLuHD1Hr8,5554
src/detection-rules/rules/linux/defense_evasion_curl_or_wget_executed_via_lolbin.toml,sha256=lAgFYdkGSQguSzn288bGUY_76XY-CvYhgzNh9soVYno,12398
src/detection-rules/rules/linux/defense_evasion_directory_creation_in_bin.toml,sha256=6RxOMNQEQInfQexrwjPDh91IatPQTn-v7Z9ek5fw-LY,8374
src/detection-rules/rules/linux/defense_evasion_disable_apparmor_attempt.toml,sha256=5Mqq4JhNl3KWypBNlZ3PRap9e7juVTO1sx7h3mtUl4U,8699
src/detection-rules/rules/linux/defense_evasion_disable_selinux_attempt.toml,sha256=cXzdqBucVnJylkAsTEBdB4dWVg40j8ID0i5Gd6hVEyU,9270
src/detection-rules/rules/linux/defense_evasion_doas_configuration_creation_or_rename.toml,sha256=HC5bCQzXJ4ZdMs8vSgr_MrEkwRsFs6zVmxfePZV5gKU,7579
src/detection-rules/rules/linux/defense_evasion_dynamic_linker_file_creation.toml,sha256=CBXNE10kRCc1VXvU--QBpbtEKY_mXYM0sZPSSBSSjds,10270
src/detection-rules/rules/linux/defense_evasion_esxi_suspicious_timestomp_touch.toml,sha256=LR7nv5kcnab8M6Zy11Nj1eCYG9cTJjlbwCE1S4iGGZI,8400
src/detection-rules/rules/linux/defense_evasion_file_deletion_via_shred.toml,sha256=8finuCUSbOoyXSFf8q3uUfU-XxgZ12ndrbAn4JtZshQ,7811
src/detection-rules/rules/linux/defense_evasion_file_mod_writable_dir.toml,sha256=2r4Yodlsfgmo0Y79UYmWqOvc8HuRe19MigUZpjcFj2Y,9663
src/detection-rules/rules/linux/defense_evasion_hex_payload_execution_via_commandline.toml,sha256=z6fUCpeYERod_sqzflcI5jikLuKNt-R08AgD_rrj22Q,8545
src/detection-rules/rules/linux/defense_evasion_hex_payload_execution_via_utility.toml,sha256=JLTQgjPuDG9EHUGR_FSTzcYrjtyAn0PXckwk3F1Q5FM,9395
src/detection-rules/rules/linux/defense_evasion_hidden_directory_creation.toml,sha256=KDo5Yziw7zmWcYLF-kbQB2iQi1Gb19ZHs5TueyaB5G8,8734
src/detection-rules/rules/linux/defense_evasion_hidden_file_dir_tmp.toml,sha256=jDBiezk8YZmghhUupwgx4Y2oLjALq3B1JpyrM-cVQgw,10236
src/detection-rules/rules/linux/defense_evasion_hidden_shared_object.toml,sha256=Xer440a3Vsv4I0i7TZOUWtUPxSzs-3233RzMGABFOH0,9437
src/detection-rules/rules/linux/defense_evasion_interactive_shell_from_system_user.toml,sha256=3QN1X2-kZrQxNZXHIuBYhnCA7U0uBrDEPWL_K9l7Fxw,9504
src/detection-rules/rules/linux/defense_evasion_interpreter_launched_from_decoded_payload.toml,sha256=ZgtoFzVKbkUKMG3jCdrTNy7lv88jSef9gOmcHWixtJ4,10614
src/detection-rules/rules/linux/defense_evasion_journalctl_clear_logs.toml,sha256=49ezxY359A0LAkqgZ6glhU1gxFGc_npbfZ8EeLMqNfc,8526
src/detection-rules/rules/linux/defense_evasion_kernel_module_removal.toml,sha256=2VsHHvaN6B10OOEA3OSfSpr7PXVhybpYsbFwUOLUSqc,9074
src/detection-rules/rules/linux/defense_evasion_kill_command_executed.toml,sha256=huaqm6hzEdyjS9Ss7HMOWgzQ-OOG9yKWIuNk1YYrNWg,9162
src/detection-rules/rules/linux/defense_evasion_kthreadd_masquerading.toml,sha256=C3LbomHcPUgBDS8pDdiY_gJ2SSZltwMMwwiA20bsg0s,8284
src/detection-rules/rules/linux/defense_evasion_ld_preload_cmdline.toml,sha256=qSRRiVtYZjC4e-AHsk3KsXR79ZY38uBp3wL3rWrfoEQ,9502
src/detection-rules/rules/linux/defense_evasion_ld_so_creation.toml,sha256=ZXPFNNEtUvgWbraVhEyKW0_gJzVHhhVzI76J0PH4WzI,10054
src/detection-rules/rules/linux/defense_evasion_log_files_deleted.toml,sha256=Ah9FixYfYZckVzM9cy5JEDnLGSShxUjPvgPXixPebKk,10020
src/detection-rules/rules/linux/defense_evasion_mount_execution.toml,sha256=rGtjSWfT32AEY9HATJ4wsYTliUvROZPAiXHw4gQWb-w,8310
src/detection-rules/rules/linux/defense_evasion_multi_base64_decoding_attempt.toml,sha256=p0WXp81M7PvK4zGsJkbxDkjqCwHmtfFPUhcCgnBlVkg,9983
src/detection-rules/rules/linux/defense_evasion_potential_kubectl_impersonation.toml,sha256=8D_TNX8KA5jx7DUYtaPq0W9ayGItlnrP6ucdFy5-fFs,9883
src/detection-rules/rules/linux/defense_evasion_potential_kubectl_masquerading.toml,sha256=0yaA9Cvu9Y819BBqI8472_wLczpFXp9I5Q-lw68iqKI,9647
src/detection-rules/rules/linux/defense_evasion_potential_proot_exploits.toml,sha256=h4-5_XOaXut6geW6YtR5vQcxmM8hOtDxa_LNXvh3zaU,8411
src/detection-rules/rules/linux/defense_evasion_prctl_process_name_tampering.toml,sha256=E4ZxSxDwf318o7KXE79b57zIzAnzAWFKX8D07gR2wk4,7888
src/detection-rules/rules/linux/defense_evasion_rename_esxi_files.toml,sha256=5aGfSNpu2N8YxcR94d7fqrPF5-Ix6UJ4_i0CSLyvTcE,8286
src/detection-rules/rules/linux/defense_evasion_root_certificate_installation.toml,sha256=2xLu4cgO4BWYiMB-Yl6q7JlYBYH9QXRoxu4QJnmALjo,9184
src/detection-rules/rules/linux/defense_evasion_selinux_configuration_creation_or_renaming.toml,sha256=fyt155f04_AnYrrfpTABXkJZA3m2LLxTky89uf1V9wk,8406
src/detection-rules/rules/linux/defense_evasion_ssl_certificate_deletion.toml,sha256=QRakqzMhU1oEPcIWpuXBJjLavNsFiMZvu2Q_IU05RgM,8122
src/detection-rules/rules/linux/defense_evasion_sus_utility_executed_via_tmux_or_screen.toml,sha256=UdFYM_muJ_K9z0Pe_MjygXH1OEk7QFKWDxi7okTjcnU,5850
src/detection-rules/rules/linux/defense_evasion_suspicious_path_mounted.toml,sha256=BP-zPhT25p11YLqW99Tw-kOpE9MbNsDgnFzLHriefhk,7822
src/detection-rules/rules/linux/defense_evasion_symlink_binary_to_writable_dir.toml,sha256=_z-mc6DOpWRHjNabZHy6d5OnIU-wic9Ycml5MSVZVcg,6824
src/detection-rules/rules/linux/defense_evasion_sysctl_kernel_feature_activity.toml,sha256=DeSLqfUs7csKrBh5NF-ppBwUnd2aysWFtEMDZug3LC0,8280
src/detection-rules/rules/linux/defense_evasion_unsual_kill_signal.toml,sha256=vn04YcJAec8CQWl1hEkYjfMfB7VyIon7UHlGgu6B3KQ,7077
src/detection-rules/rules/linux/defense_evasion_unusual_preload_env_vars.toml,sha256=eilh6rnvXUIbl1mGTl4XNxhmxAjqR40m7aEnhr7rRLc,9204
src/detection-rules/rules/linux/defense_evasion_user_or_group_deletion.toml,sha256=DpEkS0ZDwMbXWHgRbI8dWnE47Yc-pC_ToYeDFoo2aiU,6973
src/detection-rules/rules/linux/defense_evasion_var_log_file_creation_by_unsual_process.toml,sha256=R16H6iI29EAnX3IxQzK9T4WJspjVhSc3NHs8efod5DM,8890
src/detection-rules/rules/linux/discovery_dmidecode_system_discovery.toml,sha256=O9YzLPPrBIX4dEYVccNZHTmUpIAbaH5VR6jFvAb2sNs,9579
src/detection-rules/rules/linux/discovery_docker_socket_discovery.toml,sha256=szS8LCZEV3asynqdzsBdQ6m6Lgfd_sH_MITHVzAHHag,8707
src/detection-rules/rules/linux/discovery_dynamic_linker_via_od.toml,sha256=zu61ZmFHsQ631v7-XmFUBWjTvjFxRz9_cLQYQkXxda4,8051
src/detection-rules/rules/linux/discovery_esxi_software_via_find.toml,sha256=Hq6rmhJ_Tlko1mSO3HieKBPSxpzSLtuOITA7_2sDfSQ,7969
src/detection-rules/rules/linux/discovery_esxi_software_via_grep.toml,sha256=FAUMNKwwe51X1wsN7EBccYn1T-EHrrFRtnKGSoCOj6I,8066
src/detection-rules/rules/linux/discovery_kernel_instrumentation_discovery_via_kprobes_and_tracefs.toml,sha256=qHfsqiyEPIn59Ei8KLsXx5Nlys42_eaF9oWfhpUoi8A,6519
src/detection-rules/rules/linux/discovery_kernel_module_enumeration.toml,sha256=3dtJNQr1BF92_MEy9h3zeKrBo10SF9qFG6s4Mbjz_Sw,8794
src/detection-rules/rules/linux/discovery_kernel_seeking.toml,sha256=k-ViM-MXKimXaFTStp5PkXd-ttu8bS1ipKQNi8E9d8Q,8401
src/detection-rules/rules/linux/discovery_kernel_unpacking.toml,sha256=aGE3tNtuTrgESBB9JTGpyyIxsrZW4iu9c6tj3zRAfjU,8208
src/detection-rules/rules/linux/discovery_kubeconfig_file_discovery.toml,sha256=ryW4JSvRK8-P743od5F7AOXjSQqgXtPuX7tRtplXqF0,9325
src/detection-rules/rules/linux/discovery_kubectl_permission_discovery.toml,sha256=xcGnhk8mcukknsRtqEldqXSY0fd6Vx5yLOtqVwPrIqw,8054
src/detection-rules/rules/linux/discovery_linux_hping_activity.toml,sha256=fWCXh_okLQKIUZPNJclqOpo7RPpJfk5h6nPGibcCzfA,9494
src/detection-rules/rules/linux/discovery_linux_nping_activity.toml,sha256=XwEtWlP4qmOMEfuttoyF2c2MG2CXSuHMAA8Jw5ScVFA,9359
src/detection-rules/rules/linux/discovery_manual_mount_discovery_via_exports_or_fstab.toml,sha256=pwl9x6Ic07DfbM94BxO1MAbrLluHXJstalClLE8Zbyc,8029
src/detection-rules/rules/linux/discovery_pam_version_discovery.toml,sha256=EwvFSpT2rkaxhk6Cvm_1iIfRWQUBkZhV-bdFu5_IwUc,8930
src/detection-rules/rules/linux/discovery_ping_sweep_detected.toml,sha256=a2uVzAAJkVML5oguRft0-FiUHmwAUxbEqwWQI1vyfDk,8234
src/detection-rules/rules/linux/discovery_polkit_version_discovery.toml,sha256=FTf9rdbETKCW6pHsckgkKhI-cQ5mz0pfIGMIo3MVgNE,7857
src/detection-rules/rules/linux/discovery_port_scanning_activity_from_compromised_host.toml,sha256=qG54Mlpu4qW_140Z06ZhgB9abdcTQLOWBb73AtD1XrI,10023
src/detection-rules/rules/linux/discovery_private_key_password_searching_activity.toml,sha256=DS_-FmrpaPvfdtO6rr9vUdl1ZLOCR5fEhvLTLWqBDgI,8296
src/detection-rules/rules/linux/discovery_proc_maps_read.toml,sha256=59-HGnakH6C7SiSRh67I8fNRVuflOVluXC7lgCQpv18,9008
src/detection-rules/rules/linux/discovery_process_capabilities.toml,sha256=OSmWMHrl9g6ynXUnwA4-Rd-wvQ_ndP46iCiAdvF2YqQ,7236
src/detection-rules/rules/linux/discovery_security_file_access_via_common_utility.toml,sha256=ufmtbkTGCYEajj8TOnO2mIi9K-S67BbjEY3Xdfpl9wA,8825
src/detection-rules/rules/linux/discovery_subnet_scanning_activity_from_compromised_host.toml,sha256=mo40Ww6_xNmirq4Icd3FmMm0G_h7nTCEYsewex89on4,9302
src/detection-rules/rules/linux/discovery_sudo_allowed_command_enumeration.toml,sha256=4ao0p2kDS6PdcaWBMSNwStAqjryYmKZL968Xzjef-uA,7424
src/detection-rules/rules/linux/discovery_suid_sguid_enumeration.toml,sha256=qoZnKDQyXtdW_t4b5GireMB5hDTrWR5gr2pVkA0eY94,8694
src/detection-rules/rules/linux/discovery_suspicious_memory_grep_activity.toml,sha256=PKEj5VzGioz-FZb4eur29qt-XXafXROkxVbfB21yBhg,5891
src/detection-rules/rules/linux/discovery_suspicious_network_tool_launched_inside_container.toml,sha256=dDZFw1TANF25cBPmLCWLhTwuXu6bBJzgqZ-UKJrmJIQ,8827
src/detection-rules/rules/linux/discovery_suspicious_which_command_execution.toml,sha256=TpOc_GM-b4mDIcAmm6e50TVQNt3Yw0BMx7O3J6bHtHg,5815
src/detection-rules/rules/linux/discovery_unusual_user_enumeration_via_id.toml,sha256=C88kZypERsj0RImwjvJBZlpeiSrgiCu5R7sJBqVn77U,7756
src/detection-rules/rules/linux/discovery_virtual_machine_fingerprinting.toml,sha256=Tz5Al_15K-9OEYE3aqJQGvNeEvw3sEekOV4eswgkmQA,9904
src/detection-rules/rules/linux/discovery_yum_dnf_plugin_detection.toml,sha256=6ZlfEhpARO9mfRZNSP1vNjzcofk07_aSMfOBnRiwmIs,8269
src/detection-rules/rules/linux/execution_abnormal_process_id_file_created.toml,sha256=X0n-VRqLkzdi2FiLF66Z6x1Gt-v17-9b7XtRxOk9qdI,9198
src/detection-rules/rules/linux/execution_container_management_binary_launched_inside_container.toml,sha256=2x6eMayyt9OBl9iI4EG-8hX4K1fClgZSs29Q1dzbbyM,8334
src/detection-rules/rules/linux/execution_cupsd_foomatic_rip_file_creation.toml,sha256=erQz6ZYT8HZOcFgh7DHkAXub52-psOhDCqFhm_WSEqo,7887
src/detection-rules/rules/linux/execution_cupsd_foomatic_rip_lp_user_execution.toml,sha256=TWXA679vlkbIIXHPqwfUEjNo3cpc6F8qSvF_BVmwyy4,8094
src/detection-rules/rules/linux/execution_cupsd_foomatic_rip_shell_execution.toml,sha256=20ecrSU5dJRRFt6RbnLuHr6_K5-GKzr218L7SWh2PX8,7921
src/detection-rules/rules/linux/execution_cupsd_foomatic_rip_suspicious_child_execution.toml,sha256=bPUwa6M_T6-3B8daseeA3TV-Jc3pQc50Y507IJ4CVXs,8623
src/detection-rules/rules/linux/execution_egress_connection_from_entrypoint_in_container.toml,sha256=yAtiJ1D1K5udOraTZsT2LPJl7wv6IBssj9I6VGJUvEk,7206
src/detection-rules/rules/linux/execution_executable_stack_execution.toml,sha256=U5ckXsRVzpATgLyS0SStXNATn0gOA-16STv92_2g_bg,6941
src/detection-rules/rules/linux/execution_file_execution_followed_by_deletion.toml,sha256=2LrlMPsAJBaCGSVuSJnkQHA1MQsRsOcbHJJEVnJlYEk,8601
src/detection-rules/rules/linux/execution_file_made_executable_via_chmod_inside_container.toml,sha256=OyZS4RLaYPGORnGMlnWkPfY-v1IU260i3JAo99E14H4,8605
src/detection-rules/rules/linux/execution_file_transfer_or_listener_established_via_netcat.toml,sha256=5u43vY2SdAr1x98IsQFg3sF_I9AX5xWXlX-b1dAmRbY,9493
src/detection-rules/rules/linux/execution_interpreter_tty_upgrade.toml,sha256=du3SJvHQ-y5rNfWUPH80h2QlRIsyde69ejqkvF-eiNo,8025
src/detection-rules/rules/linux/execution_kubectl_apply_pod_from_url.toml,sha256=V97MNOx8jRR3vShI7X4K43T-i1RtP9oLfpjKh1Hdh4E,8521
src/detection-rules/rules/linux/execution_kubernetes_direct_api_request_via_curl_or_wget.toml,sha256=tz4mRfCkD4SnNAmNmlkdOV68_bhcyJxfR4i65qh4gQo,9405
src/detection-rules/rules/linux/execution_nc_listener_via_rlwrap.toml,sha256=Vndl9Lq9t5UOI3cjKVz1jDPtOx-ppmHT6FMObZvNvPY,8017
src/detection-rules/rules/linux/execution_netcon_from_rwx_mem_region_binary.toml,sha256=wXGeb_kyqs7ZOotob6UIpEdSdp355TjKUmH4cvtHNrM,8294
src/detection-rules/rules/linux/execution_network_event_post_compilation.toml,sha256=VzEil-v-VkVuGPzdZCzl_IPyA0fp76kaLPISQp69frQ,8939
src/detection-rules/rules/linux/execution_perl_tty_shell.toml,sha256=v0QYyGKbG_ZbkWfrpetOLGi-M4sLRTX6Az2b-ZG-H1M,9328
src/detection-rules/rules/linux/execution_potential_hack_tool_executed.toml,sha256=Yo9knz_kZ5hVrofQURQ30zxPEL24RVnSrlZPX9DYX8c,8312
src/detection-rules/rules/linux/execution_potentially_overly_permissive_container_creation.toml,sha256=kodpHg4lUAKHwne0GEhY461ZXymKC_6GC9Cuol2lprM,8578
src/detection-rules/rules/linux/execution_process_backgrounded_by_unusual_parent.toml,sha256=cqNh5UjoI3_PojhpAfaLeu7M0YFNNKbGTJbrkeZWBhU,9543
src/detection-rules/rules/linux/execution_process_started_from_process_id_file.toml,sha256=Hszt_h0pZh_4VqhrNfBCEBtV6ac8f8y9L9VoFu9Rc3k,5209
src/detection-rules/rules/linux/execution_process_started_in_shared_memory_directory.toml,sha256=S81MrlrSBwoBNyLO6QsBxRPrh9jbC1W4xfwsag_fbGE,8504
src/detection-rules/rules/linux/execution_python_tty_shell.toml,sha256=ROB9Xtiucw0YkCOodtbe2C68ijjGHqfjpjfxeXVya_c,8347
src/detection-rules/rules/linux/execution_python_webserver_spawned.toml,sha256=pQuhuJdrMc87uuflERFCEKlmRxhfqPemAxl2o4jCmT0,8319
src/detection-rules/rules/linux/execution_remote_code_execution_via_postgresql.toml,sha256=e45AO0-sdOTo1uY3bfjH-4BvIJuQhkYyWvZfb-0bzR8,8354
src/detection-rules/rules/linux/execution_shell_evasion_linux_binary.toml,sha256=nkLpAOvKoT1hA9VvAxwVnOa0hAOH4XZHdVIuYtxDdeE,12109
src/detection-rules/rules/linux/execution_shell_openssl_client_or_server.toml,sha256=KiOjtNm9AcEm-EQgW4vmO8lJszOSCjoVHzd5JYTr-48,8848
src/detection-rules/rules/linux/execution_shell_via_background_process.toml,sha256=3QVkmOMaQyCwY5ZXE-jqwFzvpuJ6rzcqqLJfZt_29-Q,8254
src/detection-rules/rules/linux/execution_shell_via_child_tcp_utility_linux.toml,sha256=6cT-_8WwDerMb-hvCxMV6AQAis5g1mk_lTg3iLzKyVE,9098
src/detection-rules/rules/linux/execution_shell_via_java_revshell_linux.toml,sha256=18K5qY7q-ysYikldoJ1CMYyUkyr8FwbgjKUB_W4fgBI,9588
src/detection-rules/rules/linux/execution_shell_via_lolbin_interpreter_linux.toml,sha256=rJ4N8f2ftPTIo80VboW3-vhBbRD4MID6dG25kRKK9Vk,9893
src/detection-rules/rules/linux/execution_shell_via_meterpreter_linux.toml,sha256=Bm3dKrO3XRcws3JdG4FORFL2UNz00S_fK8acb7mR8Y8,9975
src/detection-rules/rules/linux/execution_shell_via_suspicious_binary.toml,sha256=n7GWULkIM0mfs6rHIEHZh1d5iNcmO42IdDIlMfRFwFk,9348
src/detection-rules/rules/linux/execution_shell_via_tcp_cli_utility_linux.toml,sha256=bFXvgmEtdDe3y7tbf8bwVOxxyNDMnbhXEMyd9MqB430,8745
src/detection-rules/rules/linux/execution_shell_via_udp_cli_utility_linux.toml,sha256=wm609VsFdKvotQsHYOdZGO16Yz0q5R95OMY9kBV51W8,10778
src/detection-rules/rules/linux/execution_sus_extraction_or_decrompression_via_funzip.toml,sha256=AxQvlkEzqbH4Mek-leO50JeI_sO3NpsSLWbiU3wRI_E,8835
src/detection-rules/rules/linux/execution_suspicious_executable_running_system_commands.toml,sha256=VudO7xO-ahVQo52Cvwu5g9ZGNo5PBnN0xn6WiQYBhhI,10025
src/detection-rules/rules/linux/execution_suspicious_mining_process_creation_events.toml,sha256=F62KZ40i-7mmb7y-EucT-RN4JYSzI1SikHjFLCewI2w,7844
src/detection-rules/rules/linux/execution_suspicious_mkfifo_execution.toml,sha256=lzg5gJTjZQOdfJn8j5y3rd20fUCZpQJF_iAR-Rry7Dg,8601
src/detection-rules/rules/linux/execution_suspicious_pod_or_container_creation_command_execution.toml,sha256=N6jzMWVTussM8gbKSArfY39C1feoHfuq8h2tDQ-1uFg,8074
src/detection-rules/rules/linux/execution_system_binary_file_permission_change.toml,sha256=8TSWiDL-zUVPXw7juUBbeP1IyJMaB2EREOkTYmLwctQ,8787
src/detection-rules/rules/linux/execution_tc_bpf_filter.toml,sha256=3g5bh9MRe0fP9t_P1QPC-CRms-NVhues5zGqSt4nAoY,8322
src/detection-rules/rules/linux/execution_unix_socket_communication.toml,sha256=ZFRsY5lv70ZXLuuBUj_ed_hVpMvYZpD1n0Ncu-yBEDs,6487
src/detection-rules/rules/linux/execution_unknown_rwx_mem_region_binary_executed.toml,sha256=A3n3TzVyMUhaW-fsQ4iQnzRa5qiRPU0-jGZ52RXSR4E,7503
src/detection-rules/rules/linux/execution_unusual_interactive_process_inside_container.toml,sha256=6jVZ24rin2FGoAMfo-_h6iTJqKEjaeFcNoZMNJ5Dcos,4213
src/detection-rules/rules/linux/execution_unusual_kthreadd_execution.toml,sha256=EcrQUjk3U3kYdp2DQgfajr_qgfwXhoPzHi5Db-dgzCU,9373
src/detection-rules/rules/linux/execution_unusual_path_invocation_from_command_line.toml,sha256=7Qlx82Bd5gsYfKdIFAMDlD5oUVlEGZ4LKgdDSAJlSZk,9130
src/detection-rules/rules/linux/execution_unusual_pkexec_execution.toml,sha256=8wmQ3-iBYuNe59AMSoES640sRud1V7A8n0AMRHiqXUo,10208
src/detection-rules/rules/linux/exfiltration_potential_curl_data_exfiltration.toml,sha256=LK2NuoQIiIBDl2dEMtq2YsesFdR-E_L5QdU4ungxhGU,8133
src/detection-rules/rules/linux/exfiltration_potential_data_splitting_for_exfiltration.toml,sha256=BNUjHsIh7XnOYj2B1wegNxxAAHy_kVdra6H6kklU1DM,8288
src/detection-rules/rules/linux/exfiltration_potential_wget_data_exfiltration.toml,sha256=AvUiqVGQXGny9xeIyFmnUHekvgtcwjccGJ28WIl9fp0,7784
src/detection-rules/rules/linux/exfiltration_unusual_file_transfer_utility_launched.toml,sha256=sreTXdsnmhm5JvUzHjRPFfNLiy10FQ2-Zy5HfwuKmI4,10036
src/detection-rules/rules/linux/impact_data_encrypted_via_openssl.toml,sha256=i4R-zncaOYqoO3u7l_rfwEndIbX5Qnn9ghzrIV79wcM,8215
src/detection-rules/rules/linux/impact_esxi_process_kill.toml,sha256=KA0IvGN2_bKOD6WfLOAcmSS7raOGjYp46xXnlrbmua0,7725
src/detection-rules/rules/linux/impact_memory_swap_modification.toml,sha256=saHXDCbEyp-l2uSRPE_ig_3jSFK1EBX4w6XKUvvEiG4,8619
src/detection-rules/rules/linux/impact_potential_bruteforce_malware_infection.toml,sha256=XhL_YGt6JdbnTDZHh6dLJyZI5U1EgUAT_aYUVg4IqsU,10780
src/detection-rules/rules/linux/impact_potential_linux_ransomware_note_detected.toml,sha256=VQcAxOTYwOgi9N3NfXVNGYbAQGjRNQJre9H9MhaK-5E,9038
src/detection-rules/rules/linux/impact_process_kill_threshold.toml,sha256=ZUMZVGRzHgH8yOsxhOcmamO19DN3xNRTbagZcOzFCEA,5955
src/detection-rules/rules/linux/initial_access_apache_struts_cve_2023_50164_exploitation_to_webshell.toml,sha256=N-w5Id7sGqGQ1pIXSSMk94F4JY7PqggFGk9Szz_pTH0,9666
src/detection-rules/rules/linux/initial_access_first_time_public_key_authentication.toml,sha256=mb_kOUIAXlzMTNcPxw_3fpt3q7JIB-FXBr3VqzRZwgE,7650
src/detection-rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_ip.toml,sha256=jm26aKSrax97H_xEULH6TskYm4fPGxPJYeYAbuFviHs,7037
src/detection-rules/rules/linux/initial_access_successful_ssh_authentication_by_unusual_user.toml,sha256=EI-9YjtAnwwtwOOn6Se98zaw2LztCN4TzY9R6DK4KfU,5186
src/detection-rules/rules/linux/initial_access_telnet_auth_bypass_envar_auditd.toml,sha256=NYNsLxoW4XEopqAnIKzLi7CPCtuRoboBl_FCcjQdudg,5295
src/detection-rules/rules/linux/initial_access_telnet_auth_bypass_via_user_envar.toml,sha256=xDnUp2X-wNedpL73Amc70Coyg4cmCl97pnZOthsdcYM,5355
src/detection-rules/rules/linux/lateral_movement_kubeconfig_file_activity.toml,sha256=u-fOmhRfQcqVNo4fqzS1NoKGm4gD76Sl0CKt3p81F54,9317
src/detection-rules/rules/linux/lateral_movement_remote_file_creation_world_writeable_dir.toml,sha256=9D_qZ1F4tnYGXtimOsMn83gR3Tnes3Ff7rCZAzfR-Yk,9563
src/detection-rules/rules/linux/lateral_movement_ssh_it_worm_download.toml,sha256=-_rGiBddgWyuIYQUU58mMfbYAlUiMt49eQIYOzB3xKE,8822
src/detection-rules/rules/linux/lateral_movement_telnet_network_activity_external.toml,sha256=nGH61JbVQ2YxOM3R-txM8p0k2xRWur0JAiPcXcULFBc,9789
src/detection-rules/rules/linux/lateral_movement_telnet_network_activity_internal.toml,sha256=f4wE7rZ0EpspUIiKRLqUWsthmtAPAq4FYk9hw5EINbE,9772
src/detection-rules/rules/linux/lateral_movement_unusual_remote_file_creation.toml,sha256=CLBSX_nbQEU6F8yDLhqa7cBSoMfS4_IC3duS2IyAqp4,9971
src/detection-rules/rules/linux/persistence_apt_package_manager_execution.toml,sha256=AFS7JGj4Aw_AhicdFzfsCyS1Lce1zGTPNBMAlNI-4OQ,11626
src/detection-rules/rules/linux/persistence_apt_package_manager_file_creation.toml,sha256=hWu_EV3-dCzR8G5CNSp9qorj-EGnGFDePFJtwl24caQ,10936
src/detection-rules/rules/linux/persistence_apt_package_manager_netcon.toml,sha256=Fkrc-wdaF1e6StgvGGgyxRfu4DTgG7KknC1taiE0OgQ,9843
src/detection-rules/rules/linux/persistence_at_job_creation.toml,sha256=xeMNrk6WBcacX_HBaRnQDZ98o9DPupM2KqlWJLtRoUg,10030
src/detection-rules/rules/linux/persistence_boot_file_copy.toml,sha256=syTz59FJrPPC1RpO3TwEDbrPw4FSnQdYuWikNC_ywL4,10632
src/detection-rules/rules/linux/persistence_bpf_probe_write_user.toml,sha256=nYKpoYhnDuz87nqSAVjefxGc6e41MNUU6BbByGBE2xg,7505
src/detection-rules/rules/linux/persistence_bpf_program_or_map_load.toml,sha256=bgNWKhHcWkF4Ynxk56RNFweGOgHPBILWO-uNv8gdDH8,7007
src/detection-rules/rules/linux/persistence_chkconfig_service_add.toml,sha256=DRU75OFbaB9ET4Hw7PSV-1VEi7Ggg6bt0-rNOnubO-s,12319
src/detection-rules/rules/linux/persistence_credential_access_modify_ssh_binaries.toml,sha256=ZIKMGSkJNcazg6Z_DhFmf4n1EJiVKtPm0juNBH_sFzA,12791
src/detection-rules/rules/linux/persistence_cron_job_creation.toml,sha256=KibhbKhtUfzVXWpAOnmCEGRRHL2qwXJwmh-B18RrZSY,14648
src/detection-rules/rules/linux/persistence_dbus_service_creation.toml,sha256=xet-nhOYMXiuB6r36wWOLpDzRNOo_GRlllxfyf0pHq4,10436
src/detection-rules/rules/linux/persistence_dbus_unsual_daemon_parent_execution.toml,sha256=RGOSWZrIcYimXF0GUrsh4o8_r67UXedBnYHtS19D6Ec,9600
src/detection-rules/rules/linux/persistence_dnf_package_manager_plugin_file_creation.toml,sha256=ltpo6xxRW0FnDNZWHsx-91-wcprLxBW-oDU_kxAK5pI,10247
src/detection-rules/rules/linux/persistence_dpkg_package_installation_from_unusual_parent.toml,sha256=MuAqHxt4gBQeCgVA56qD7LIO3Z81U69kpp6EvL6pVX4,8568
src/detection-rules/rules/linux/persistence_dpkg_unusual_execution.toml,sha256=EQGOM9vQNQFNuSK-F8xuc_lXrYxrSEpc0pRn1flVgqc,8850
src/detection-rules/rules/linux/persistence_dracut_module_creation.toml,sha256=g6FHWoJdTMR6PdgJAG88PXv4FUjPd5JtxGo74ZtKcHo,10680
src/detection-rules/rules/linux/persistence_dynamic_linker_backup.toml,sha256=Gk0v8LtATd4aqBSfYeRmhwPOc3KC5mccDCMthBleoto,11840
src/detection-rules/rules/linux/persistence_extract_initramfs_via_cpio.toml,sha256=ccaQT5jKSI2NFtngD6sShgaBbCldybwogJfn_3jc7gk,8619
src/detection-rules/rules/linux/persistence_git_hook_execution.toml,sha256=7THtj0iWasJ7HTCWWFIBT3rdS0BzoR8eITDKLsqQwhY,8761
src/detection-rules/rules/linux/persistence_git_hook_file_creation.toml,sha256=NUWtRjbxQCKQylNhyLFAOyrXnDjRFSfWZUvb3NtfM5E,9911
src/detection-rules/rules/linux/persistence_git_hook_netcon.toml,sha256=_Bab74VAjoV-fs7rOnVgsnFYCrmZZCl7EE0R43pvzw4,9689
src/detection-rules/rules/linux/persistence_git_hook_process_execution.toml,sha256=GolEcARMPEKBSoPAmj4IrciQFTPLck7UZcPkmM_IQ6E,9501
src/detection-rules/rules/linux/persistence_grub_configuration_creation.toml,sha256=ositihYaP85Rt1C861zUqKXxrRTmIFdod6G_13Zp-LQ,10087
src/detection-rules/rules/linux/persistence_grub_makeconfig.toml,sha256=5hbjdG2IuI9saQf9tpe3ertKDV-pZvCigyslLARkY74,8859
src/detection-rules/rules/linux/persistence_init_d_file_creation.toml,sha256=n0H9-Gpdy6djwYaoPAMjn1D6-3tEgbCBH1-5SDZsTmU,12718
src/detection-rules/rules/linux/persistence_insmod_kernel_module_load.toml,sha256=emw4iI0CwOqQf7XdmMTmo4GFdQWUtXB4MqwBsag_wLY,12354
src/detection-rules/rules/linux/persistence_kde_autostart_modification.toml,sha256=61y5-87O3NXh1hPbES8CXIOMYgK70MvevR92WHzZsmI,16780
src/detection-rules/rules/linux/persistence_kernel_driver_load.toml,sha256=DxfD31AcKQjAIUExxQJLlcydUDtyw_Jc4e9ApWC8wOE,7725
src/detection-rules/rules/linux/persistence_kernel_driver_load_by_non_root.toml,sha256=MbUg6SArWp7Tp9-IW3N3t-9p1NO5eS9kENv6NXTtuN0,7972
src/detection-rules/rules/linux/persistence_kernel_module_load_from_unusual_location.toml,sha256=0pvJzsUNZstkxAB4yJXbQFk7ES73reEcURr-5uOWaKM,9191
src/detection-rules/rules/linux/persistence_kernel_object_file_creation.toml,sha256=2o2uS_IY9Z_nRi5wT8v_jPA8HaGM48J2KyXpnXxHFM0,8641
src/detection-rules/rules/linux/persistence_kubernetes_sensitive_file_activity.toml,sha256=KdIl2sE-fVLbR0BRy7zT5g4GcKFYNR7PhJa5pKfljuE,8777
src/detection-rules/rules/linux/persistence_kworker_file_creation.toml,sha256=XbKdKUORWvEQcIZNrCuhzZ10QtSiv7Y1moNFICK20Ns,11260
src/detection-rules/rules/linux/persistence_linux_backdoor_user_creation.toml,sha256=pYoMtIC4bXX5etqHrXQE6dycmj5axzllEKeFQg3egdI,8413
src/detection-rules/rules/linux/persistence_linux_group_creation.toml,sha256=QeiAoqRTZkrhUbGD6XyFEY1v1wfvtESEjdiWP0SZraI,7230
src/detection-rules/rules/linux/persistence_linux_shell_activity_via_web_server.toml,sha256=shHxp8f1ivMdranp3la_iVMm3SSTPmDGrGHbVhTiGVs,10904
src/detection-rules/rules/linux/persistence_linux_user_account_creation.toml,sha256=HKezADEGZZSulbYr1rclnqagD9B24Mv7I8l12Rwtrvw,7106
src/detection-rules/rules/linux/persistence_linux_user_added_to_privileged_group.toml,sha256=CG3-2Yhsrtch7mrYfjJ2j-MK2o2HH_DeqqC4de00tr4,8245
src/detection-rules/rules/linux/persistence_lkm_configuration_file_creation.toml,sha256=2J8asdiJ5TPeXXFgvLxh3g4rNJPFtFhp10VOvEDvo3I,8350
src/detection-rules/rules/linux/persistence_manual_dracut_execution.toml,sha256=PZc8jJqWyWnBMmYePVJcAQCp3hwRIDizQMxf4DKC56Y,8419
src/detection-rules/rules/linux/persistence_message_of_the_day_creation.toml,sha256=6iwP1Tbw94KoGddPGlYNXTwzTCvrHavQjnRk0O-ZoUA,10799
src/detection-rules/rules/linux/persistence_message_of_the_day_execution.toml,sha256=VcAsyHQ1c47aMRW9veLXTuCeaZ2kFN0cu8Mm-VGGZkM,11203
src/detection-rules/rules/linux/persistence_network_manager_dispatcher_persistence.toml,sha256=XPBoLhS_xcVt6MA6Qr4LOVj3ej0b5pV_l04003guPTE,10505
src/detection-rules/rules/linux/persistence_openssl_passwd_hash_generation.toml,sha256=-rreSab6GBEgLmCTciE9T9tHNx4IKki754zstJYQ2dg,8385
src/detection-rules/rules/linux/persistence_pluggable_authentication_module_creation.toml,sha256=u3BAwVE79nmeQcZo_fzKwnPm6CS8i-8no_g_gme6PKE,9007
src/detection-rules/rules/linux/persistence_pluggable_authentication_module_creation_in_unusual_dir.toml,sha256=3utJviJaArLKh-uWeoReHLcdkG4Iv8QphJhg-D5Ie2c,7385
src/detection-rules/rules/linux/persistence_pluggable_authentication_module_pam_exec_backdoor_exec.toml,sha256=e41WWPOaUFcavokUcLR-_LUXaWfabOzekCMZxk_y4F8,7814
src/detection-rules/rules/linux/persistence_pluggable_authentication_module_source_download.toml,sha256=2J3GrEkNmgnk9XAE24YXiW8MDDNSqwqolnjZcVvDpHo,6253
src/detection-rules/rules/linux/persistence_polkit_policy_creation.toml,sha256=g3Yj1V2vK-qZfuVdAruMZIQxfN60Eo885l1t6qbBOuk,8308
src/detection-rules/rules/linux/persistence_potential_persistence_script_executable_bit_set.toml,sha256=SYGN0S2OJ3fZn2-F8fWqngHTMCYm_UrDd75rS_ireuM,9769
src/detection-rules/rules/linux/persistence_process_capability_set_via_setcap.toml,sha256=ZHtOeLnyFQJxgQrQnTYjUAgh2Vmp61f9_kVz22CI-k4,8021
src/detection-rules/rules/linux/persistence_pth_file_creation.toml,sha256=BGR_Tm0U9IVg-T9KAirQb8WQDI1TGYc62a6_HRLxcCo,9713
src/detection-rules/rules/linux/persistence_rc_local_error_via_syslog.toml,sha256=xnlzUAguaqZ5QuNYrXiLgHZQyQnyaBiUJxGfTNGYQxo,7656
src/detection-rules/rules/linux/persistence_rc_local_service_already_running.toml,sha256=ZX6g3rOAhErIOLACFNPA3etIaZGgRg4hZb5NxWlpTAc,8469
src/detection-rules/rules/linux/persistence_rc_script_creation.toml,sha256=4WFkrXTiOVxn7bV1wmziC0xajCZLiQw6T42TPfHEHO4,11843
src/detection-rules/rules/linux/persistence_rpm_package_installation_from_unusual_parent.toml,sha256=jDCDZJyIzl-PVvNuZpuTjVC5n7qrhb9eT4YKQ_MPKvM,8419
src/detection-rules/rules/linux/persistence_setuid_setgid_capability_set.toml,sha256=Hc5gI0gX8PKF1G3svLgV2YtdyQ4LZeqbqBCFmgmBvUM,10147
src/detection-rules/rules/linux/persistence_shadow_file_modification.toml,sha256=1ldWNEb0SU9VgkRUNBEIIhKiTJ4IijriVTVsAYpKfmU,8047
src/detection-rules/rules/linux/persistence_shared_object_creation.toml,sha256=O-8k-T-0KN9xghMG59r1OSNYiGin-OxyciGFUvTeh98,12789
src/detection-rules/rules/linux/persistence_shell_configuration_modification.toml,sha256=JaObTzDzN-2aH44HpSoH2I4-G3qOhP-4WcwQXYhkmsc,10781
src/detection-rules/rules/linux/persistence_simple_web_server_connection_accepted.toml,sha256=b_RUJvUet0F_NEY6-dReBSbnKlwwvxyUSoE5m2IlKgk,9099
src/detection-rules/rules/linux/persistence_simple_web_server_creation.toml,sha256=NRKAN0sZGR-xRGW42YHOIHk_SPnmITolO26P7FvQr0U,9242
src/detection-rules/rules/linux/persistence_site_and_user_customize_file_creation.toml,sha256=z6KFIjgbjXoGbBQh5QDODjRh289KgrS0gF7SFCA_kqs,9577
src/detection-rules/rules/linux/persistence_ssh_key_generation.toml,sha256=SOV5QSz_Wl-r1KYd6r98AFMMwfj4-VatQKtlPzPUDHE,6638
src/detection-rules/rules/linux/persistence_ssh_netcon.toml,sha256=6B4nCDxr4rhcCwDXhWq2ZHEX2SZLeKKOxlsVMPA1GmQ,8301
src/detection-rules/rules/linux/persistence_ssh_via_backdoored_system_user.toml,sha256=betWfWGzKlA99elftMVFWI-KL4aouBAgUJgRdsoko_Q,8371
src/detection-rules/rules/linux/persistence_suspicious_file_opened_through_editor.toml,sha256=UK8mOhj35CFWkBh3A4WwnJvsx4uASssiY1-rD6hr8fY,8212
src/detection-rules/rules/linux/persistence_suspicious_ssh_execution_xzbackdoor.toml,sha256=QxIuRt-wBv8Eq3IQY-oR1LzmuitiCFf_pAjNKkZ7FsY,7758
src/detection-rules/rules/linux/persistence_systemd_generator_creation.toml,sha256=mjXQazSjtWib31m38mmh5rZHVV77KBz-rLhpQ8UnAdI,10402
src/detection-rules/rules/linux/persistence_systemd_netcon.toml,sha256=7yhPWNFpdb5d95mTrKGb21Jx3II7doOatAIsaDJdfmk,10438
src/detection-rules/rules/linux/persistence_systemd_scheduled_timer_created.toml,sha256=XhKCP2JxqbeYWCVfiEMRgxrK9YnsHeFFvpCIuL9p5XM,13072
src/detection-rules/rules/linux/persistence_systemd_service_creation.toml,sha256=swWRxBWzYPAwD1OQjwtfnbv_6IDu5X82ZTME4Zp8ZVc,15835
src/detection-rules/rules/linux/persistence_systemd_service_started.toml,sha256=qtOqCNa57QtiCXxMau9ySYJggZaVxDWqzz147hpiDAk,13429
src/detection-rules/rules/linux/persistence_systemd_shell_execution.toml,sha256=6D2CPejTsfbI9ID23l6im_2dn97jm4H6WhdJd8JbVoM,7964
src/detection-rules/rules/linux/persistence_tainted_kernel_module_load.toml,sha256=mRFK2HPqtDVTgFEZp7ixKz0wHwb0WBW-qE4WWLZI9T4,7827
src/detection-rules/rules/linux/persistence_tainted_kernel_module_out_of_tree_load.toml,sha256=i31Dvp_EEaEtxDafJuIAox-uxfUwGmkhojl6WdgbQBA,7789
src/detection-rules/rules/linux/persistence_udev_rule_creation.toml,sha256=-Wv-vd03wVA5nkLv_oUwXig89loK_xsTn0XbOZ9TaG8,9559
src/detection-rules/rules/linux/persistence_unpack_initramfs_via_unmkinitramfs.toml,sha256=Eqh1u49Hn77Fjy0jts8yrfuys76vrD4aNHEbXU4-5J8,8604
src/detection-rules/rules/linux/persistence_unusual_exim4_child_process.toml,sha256=5q0NPiDyV73reGcCsBsPVO0EwHRvQuqw4SLkBIe0RMw,6052
src/detection-rules/rules/linux/persistence_unusual_pam_grantor.toml,sha256=GTKIqvtm33z4qrs3x0lmMzf1paV6h9bopYC-Aq_FZeY,6964
src/detection-rules/rules/linux/persistence_unusual_sshd_child_process.toml,sha256=6t7EEC-j_uN71uwqSj6dJ5mFF8XXVIhLD68St46ay8A,6719
src/detection-rules/rules/linux/persistence_user_credential_modification_via_echo.toml,sha256=92z9wEZx8OL4PvqxOLqISwsyUttZnR0mWbANwpUAZfI,7390
src/detection-rules/rules/linux/persistence_user_or_group_creation_or_modification.toml,sha256=BDxyHnlqc1EhroVjghcJ-Ej_BTfh78TFQZEmkGmiBs8,8160
src/detection-rules/rules/linux/persistence_web_server_sus_child_spawned.toml,sha256=k6O_-CSc_y8wNlwiBBUbyFom8cgH5nplX7A_acbxC0Y,12206
src/detection-rules/rules/linux/persistence_web_server_sus_command_execution.toml,sha256=bM0zw5TdzBDYI7qD0uwPzX-d2G_w022t4WfxMAX5t18,11858
src/detection-rules/rules/linux/persistence_web_server_sus_destination_port.toml,sha256=LKDYfBgA3UcOTrxVteZTo7BAntwfxpdr1sVwAo212zw,9778
src/detection-rules/rules/linux/persistence_web_server_unusual_command_execution.toml,sha256=TI5zJ7TG5K4CUWsIJWpxEi4NqBlU2yQ7oK7w6AKdqAs,8215
src/detection-rules/rules/linux/persistence_xdg_autostart_netcon.toml,sha256=BtGr5rbOtCrfTYOgypVOvhjrB3aehROcf9HtZgi-RIM,11096
src/detection-rules/rules/linux/persistence_yum_package_manager_plugin_file_creation.toml,sha256=WzpGN52J-sT5tIh8xBarqFQUbQhFcIu4ttwdxmrGZy0,9904
src/detection-rules/rules/linux/privilege_escalation_chown_chmod_unauthorized_file_read.toml,sha256=dZy37zK3a1SxnWNy1E69In8DSxYOg8ZmwHjLj7hgNQo,8876
src/detection-rules/rules/linux/privilege_escalation_container_util_misconfiguration.toml,sha256=cyjLHUtkU1Lk4Q4Kp5TDKeYDWlQQo7BnYEhfsDuTStw,9424
src/detection-rules/rules/linux/privilege_escalation_cve_2025_32463_nsswitch_file_creation.toml,sha256=olHnHYfZtZW99xTMY1TRcsAmfT8TvLcKJjHhCYzxo1M,8042
src/detection-rules/rules/linux/privilege_escalation_cve_2025_32463_sudo_chroot_execution.toml,sha256=osYV7v_M_L-iT5qtrZZajlgMAPp135Ov9jC8vq64kRA,8236
src/detection-rules/rules/linux/privilege_escalation_cve_2025_41244_vmtoolsd_lpe.toml,sha256=azyW4brdvaZf29W2Sk079QEA9-H74zy1DP4hhGvyaos,9804
src/detection-rules/rules/linux/privilege_escalation_dac_permissions.toml,sha256=xOQ7ubusRiNM4dk9TqxSAd2EmlqhfBFVIE0ri8eAmls,8965
src/detection-rules/rules/linux/privilege_escalation_debugfs_launched_inside_container.toml,sha256=UGY8pvEwNquAwC5IfEqCRGIUK7sPeOduBzwbZbc7RHQ,8067
src/detection-rules/rules/linux/privilege_escalation_docker_escape_via_nsenter.toml,sha256=ELm_kKA_a6ogrvDSNBXoTn8iWa_ktWEBxHPRsX3hVy8,6062
src/detection-rules/rules/linux/privilege_escalation_docker_mount_chroot_container_escape.toml,sha256=QZ0Ao8jj4kKt0_8xFH2giRZm1XvZ6dexrAS1N8j2FQE,9404
src/detection-rules/rules/linux/privilege_escalation_docker_release_file_creation.toml,sha256=IykufAJfBqMigreENj01C6kwm9xUo97bnh_fR-MVMk4,5757
src/detection-rules/rules/linux/privilege_escalation_enlightenment_window_manager.toml,sha256=d73k_UWBaun1Gv2_Wtbnag_MYoTGkkWnSrfMKu6zr7k,7908
src/detection-rules/rules/linux/privilege_escalation_gdb_sys_ptrace_elevation.toml,sha256=2csNSCx_PwhzftUqTqS3PhoKt7xUKtjDntZQQuXfq40,8254
src/detection-rules/rules/linux/privilege_escalation_gdb_sys_ptrace_netcon.toml,sha256=_FyuOlOLKjdUVh7VAGx3q_fOS2szVF36FjboNjOsXuI,9162
src/detection-rules/rules/linux/privilege_escalation_kworker_uid_elevation.toml,sha256=dbfNl9YgrgjFX3KMMhIc18HkioA-iYiAQgkIx2kWlbk,7929
src/detection-rules/rules/linux/privilege_escalation_ld_preload_shared_object_modif.toml,sha256=cHe4VGl4ZLEnI04pdY7MMCYqmMLNDIEGFHb9mnz1ahs,9474
src/detection-rules/rules/linux/privilege_escalation_linux_suspicious_symbolic_link.toml,sha256=n3Ji4kg2eFjD-s6zX0lbAXf2V86GpcUrek7LjyILFRM,9505
src/detection-rules/rules/linux/privilege_escalation_load_and_unload_of_kernel_via_kexec.toml,sha256=JSOwi8XeHIpROzJZQReVPfb_2QkiyE5s8hd167UtBeM,9488
src/detection-rules/rules/linux/privilege_escalation_looney_tunables_cve_2023_4911.toml,sha256=xbszI392oxWvNotGfhF0JNxKyV9MFQvChyCdLSStoj0,8689
src/detection-rules/rules/linux/privilege_escalation_mount_launched_inside_container.toml,sha256=PAGyHLDFkHFw3Vaq1bNOkos91OE2w9H79rapyouZ14Q,8538
src/detection-rules/rules/linux/privilege_escalation_overlayfs_local_privesc.toml,sha256=gJMFQ-itEpEN0CKtpPWoDDhEWWE1mBeWIMkbiWKSu98,8489
src/detection-rules/rules/linux/privilege_escalation_pkexec_envar_hijack.toml,sha256=YGDRcwskVSSLF5HsNCw3JJu_-ad6VliqEBm3F6IgKCY,8243
src/detection-rules/rules/linux/privilege_escalation_potential_bufferoverflow_attack.toml,sha256=nHc1pS4i9zFdfc2iJtT_P0qtPYQ_-q8QWJY3fF4xopk,6527
src/detection-rules/rules/linux/privilege_escalation_potential_suid_sgid_exploitation.toml,sha256=bmUZ9A-jQxiSHKVFax5If6eSbVH48fN_Sku25U7xTpQ,11087
src/detection-rules/rules/linux/privilege_escalation_potential_suid_sgid_proxy_execution.toml,sha256=E7u0v9fzcwS3w83yBfA8jDRA0m8Iao0im1xmxTvJAe4,9880
src/detection-rules/rules/linux/privilege_escalation_potential_wildcard_shell_spawn.toml,sha256=xS7J0Kdlkc-0CH_Qofsq_nQEcz2Q9lGydIHEPdzaGOo,9062
src/detection-rules/rules/linux/privilege_escalation_sda_disk_mount_non_root.toml,sha256=o-5vUjT81OQe9zqi5yfFhXmwTRlGwC8_T3jFhy-DdGg,7829
src/detection-rules/rules/linux/privilege_escalation_shadow_file_read.toml,sha256=KHhFPJFE_Sz2Y2K2tG0uJnVf7LkdmXeJC-vC02o4j4c,8939
src/detection-rules/rules/linux/privilege_escalation_sudo_cve_2019_14287.toml,sha256=i4poNgql4SYeLfHWkanXXZNZFnt76V6Ar-5qJtSAKW4,8244
src/detection-rules/rules/linux/privilege_escalation_sudo_hijacking.toml,sha256=0-_XoeHqz9DeJWn6Zw_VyzaSMyEFfEZl1Hqiyn_ALWI,9593
src/detection-rules/rules/linux/privilege_escalation_sudo_token_via_process_injection.toml,sha256=s_CaajfT8cd56U8mJx9wMi5oqtye5R3kb6cIfe0DhRY,8419
src/detection-rules/rules/linux/privilege_escalation_suspicious_cap_setuid_python_execution.toml,sha256=66dQ5fuq2Ebg0ynDa9AC4EsPjtVirD2zflAphxjjCng,8097
src/detection-rules/rules/linux/privilege_escalation_suspicious_chown_fowner_elevation.toml,sha256=gLvlAlwvDkq2AOqtDYmYtvExIqXOhQefoXoPim8G6yg,8062
src/detection-rules/rules/linux/privilege_escalation_suspicious_passwd_file_write.toml,sha256=yWOFmH37Te8LVwBSJcOBxUsOYxK-YJHRg-AQDNcjKHM,10004
src/detection-rules/rules/linux/privilege_escalation_suspicious_uid_guid_elevation.toml,sha256=5e1O-ozaJO6m5W2fM5P_buicmV_x7VHjiy5CVkQ2Ch4,9806
src/detection-rules/rules/linux/privilege_escalation_uid_change_post_compilation.toml,sha256=Q3OgrSGAYp3BN6bLfFiQpeCV2lQF5VUUg0KenjpwPiA,8581
src/detection-rules/rules/linux/privilege_escalation_uid_elevation_from_unknown_executable.toml,sha256=20Hy-VApHsWEtoqyHstsjIoJ1t5qGJfwvHhWqDNL-Wc,9660
src/detection-rules/rules/linux/privilege_escalation_unshare_namespace_manipulation.toml,sha256=er0rXQ5VR8IyL-roXvKGbdzcNj0_UW5AxcOPFekd1ic,9252
src/detection-rules/rules/linux/privilege_escalation_writable_docker_socket.toml,sha256=qIYLG5mr7BXUfHBSVZZiirHTWBSg46Y_IjUw2DAvq_k,8168
src/detection-rules/rules/macos/collection_discovery_output_written_to_suspicious_file.toml,sha256=dwTzDjpFXUrqH3Uj1CD_-SG_jUsJyMrM7IdLxffH310,6354
src/detection-rules/rules/macos/collection_pbpaste_execution_via_unusual_parent.toml,sha256=MOuIwF0QUZdKLrEgeF4kgzk_LsjtTW6sNmAUTWPVd2o,5296
src/detection-rules/rules/macos/collection_sensitive_file_access_followed_by_compression.toml,sha256=HUHNHsKDXgggExM1pVPfv27vxyN0uzd9HVOzXEB6LrI,6034
src/detection-rules/rules/macos/command_and_control_aws_s3_connection_via_script.toml,sha256=xPu7ArR3Psr7vczwpVeEpey-3wBILXvcEp-umKTaGOg,6527
src/detection-rules/rules/macos/command_and_control_executable_download_via_wget.toml,sha256=L9a2W_0xlldlGc5k3KsT_707Vy2ham61BC14Gz88l6M,5736
src/detection-rules/rules/macos/command_and_control_google_calendar_c2_via_script.toml,sha256=-lD-uOnoZCUxusweUeSs7X9gm5Ed_Q8b8LWl35DVpOs,6467
src/detection-rules/rules/macos/command_and_control_network_connection_to_oast_domain.toml,sha256=SzIc-x8Whwc76oBjwqhzRVPW0p0QLRByOg6xHht_7HU,5582
src/detection-rules/rules/macos/command_and_control_perl_outbound_network_connection.toml,sha256=M8DK2l1ZyBMujPWMJ2hf2Z0Xrb670CXHylgrzhW7K9k,6270
src/detection-rules/rules/macos/command_and_control_potential_etherhiding_c2.toml,sha256=jKDQDB3paOuVFGth8V7zr33SwVHEyBN-bx10kigULZA,6678
src/detection-rules/rules/macos/command_and_control_script_interpreter_connection_to_non_standard_port.toml,sha256=WyrTNsQseCsxy0oPVy7BiggpICugNAOKgMqzZZ3ghQE,7232
src/detection-rules/rules/macos/command_and_control_suspicious_curl_from_macos_application.toml,sha256=wCaK61MKq5Wfb4ltZOOcWBW2DAu0XdpiKc1e_GzCA6c,5865
src/detection-rules/rules/macos/command_and_control_suspicious_curl_to_google_app_script.toml,sha256=ACzlmlrm5MdWIXTMyK4IqVSuMLZ0EQIiVrFKpbFyOZo,5602
src/detection-rules/rules/macos/command_and_control_suspicious_outbound_network_via_unsigned_binary.toml,sha256=nXdzBIiBZMhDIXUa4BOqGrttGKzN5sg7KNdDp445X4M,5857
src/detection-rules/rules/macos/command_and_control_unusual_connection_to_suspicious_top_level_domain.toml,sha256=LN8dHmYMcoYkttyNBU4NqsUQfgPZLaENnkcHjVuFu6E,5965
src/detection-rules/rules/macos/command_and_control_unusual_network_connection_to_suspicious_web_service.toml,sha256=1h8_D7uIe-YkOFcvEBRo3RPw4Tt8qMZFWg9KV5134RM,8696
src/detection-rules/rules/macos/credential_access_credentials_keychains.toml,sha256=dy_0jIupjutCU81DgrEwQ7BEQ3A6r1zv2R41NMtbLOY,8142
src/detection-rules/rules/macos/credential_access_dumping_hashes_bi_cmds.toml,sha256=yszECE3S0q-SEnQ7jK7eZOxce234xeQFm1V7U8HfduQ,7499
src/detection-rules/rules/macos/credential_access_dumping_keychain_security.toml,sha256=s9_J0Ulfo1eTvKajhrw8iYXxsEpqsVAgnq56EOSXq5k,7610
src/detection-rules/rules/macos/credential_access_high_volume_of_pbpaste.toml,sha256=96ARm-2gHb3h4_DS2IhjeCDBsWKSSxwfZJTpvPI9QyI,5728
src/detection-rules/rules/macos/credential_access_kerberosdump_kcc.toml,sha256=csUAtIl0eaUHsb5v0bnmCIwJUac9V842a87CuYTEW5A,7701
src/detection-rules/rules/macos/credential_access_keychain_pwd_retrieval_security_cmd.toml,sha256=3GRU5GxJvQlTF5-3OcNCGKY51GrW0luSG1Trd_lK0ss,8846
src/detection-rules/rules/macos/credential_access_mitm_localhost_webproxy.toml,sha256=4W4EKKc1lBd2Q4xhc-YArHkVAStrIdhjeY1cBKFw7Xg,7970
src/detection-rules/rules/macos/credential_access_potential_macos_ssh_bruteforce.toml,sha256=IUfsrsa7cjvmf4RcRioiOiJWL-bbLz3tHrUFuZc7ZOw,7421
src/detection-rules/rules/macos/credential_access_promt_for_pwd_via_osascript.toml,sha256=ek0cGGzoTUgIirjr7xoOIfk-lO42v1I8B1g1jf16pQ0,8928
src/detection-rules/rules/macos/credential_access_suspicious_web_browser_sensitive_file_access.toml,sha256=6MTqMuSxZAVGtsXKlAfdfHKujiZV4oIYQ4-96Vr3SaI,8088
src/detection-rules/rules/macos/credential_access_systemkey_dumping.toml,sha256=y4_EnCzwSRLhKf4t2S2xKeMoxdZcrAkUEJhMVrmAOx4,7689
src/detection-rules/rules/macos/defense_evasion_apple_softupdates_modification.toml,sha256=7BbrSaTtue4yyvGZ8G4EUH6VdgONQLD4cCDe2wG60so,7804
src/detection-rules/rules/macos/defense_evasion_attempt_del_quarantine_attrib.toml,sha256=NEye5wuw3G1Z2X3UvcuQw0fN5Gc0P1fNQhoJAzlCKWQ,8412
src/detection-rules/rules/macos/defense_evasion_attempt_to_disable_gatekeeper.toml,sha256=BaLYYIRiEgOZfoe13f7kiKNufFJByeQiSMjxot694sU,7590
src/detection-rules/rules/macos/defense_evasion_dylib_injection_via_env_vars.toml,sha256=ISH12sFdu9zdfF_iyr3G5pIBXwSX2-oGWYVjhFGKv7I,6860
src/detection-rules/rules/macos/defense_evasion_gatekeeper_override_and_execution.toml,sha256=VHERwPtkGiupq4sVn_0_0IEwHF8Pg75SznDkY-z-2T4,5551
src/detection-rules/rules/macos/defense_evasion_install_root_certificate.toml,sha256=xvgo9kKY1acPOjih3Xe3a_Q2HDwhvqdbad1D6xHQXdw,8341
src/detection-rules/rules/macos/defense_evasion_modify_environment_launchctl.toml,sha256=-ooz-u8KhxllRhOFDzkN4MM7_woESAiuL-AHNxK06f0,8058
src/detection-rules/rules/macos/defense_evasion_privacy_controls_tcc_database_modification.toml,sha256=5jR9Ledo5S6kzg-2hGPk1TBkQ-vfsPP7MuzyhE9x-6M,8178
src/detection-rules/rules/macos/defense_evasion_privilege_escalation_privacy_pref_sshd_fulldiskaccess.toml,sha256=sq7cXjksDWAwUNkZjO8IlDzEyv7XAZp8VAxm0UfQ-gk,8129
src/detection-rules/rules/macos/defense_evasion_safari_config_change.toml,sha256=4CoCu8dxLhOqs4Cl56NljMeSUDqvfIZnsop9E8LeDtA,7921
src/detection-rules/rules/macos/defense_evasion_sandboxed_office_app_suspicious_zip_file.toml,sha256=UC-la95cobLkJ4S_mLNjm3rN3LSE4oFBpenoxUmJLjg,7493
src/detection-rules/rules/macos/defense_evasion_suspicious_tcc_access_granted.toml,sha256=uI21pEaT54jo1HCLXR9spoAkP8pgeYol9JcV6dlHpns,6093
src/detection-rules/rules/macos/defense_evasion_tcc_bypass_mounted_apfs_access.toml,sha256=caADtaP2Gfxd4oLftwuXg_xdeSE-IhedU-EonWxvPmE,7399
src/detection-rules/rules/macos/defense_evasion_unload_endpointsecurity_kext.toml,sha256=dPnT7UmAw6QDOSGOEn8ESLPrix3c2KcAjLgsVI-e13E,8115
src/detection-rules/rules/macos/discovery_dns_request_for_ip_lookup_service.toml,sha256=reMJZ-686mS6RL32B31oD1oPAQgqDQHgx8K24UfrXes,6605
src/detection-rules/rules/macos/discovery_external_ip_address_discovery_via_curl.toml,sha256=umZGY6wimNB9vaSo79VKGFwGgsfIHnz01fZl6GKFl4I,6492
src/detection-rules/rules/macos/discovery_full_disk_access_check.toml,sha256=PgeMdjHyewDwFt79y0lPxVNK_PvPMQEqkMO_QBgoM8U,6113
src/detection-rules/rules/macos/discovery_suspicious_sip_check.toml,sha256=XxXt-cVT91ywPhaTp34FpO7eN2WKp4LXhbHeiloAnbI,6376
src/detection-rules/rules/macos/discovery_system_and_network_configuration_check.toml,sha256=dLP0Imgjt7G9gZSsoH4e-TWcylC7I6D_O3HMvQGI7n0,5957
src/detection-rules/rules/macos/discovery_users_domain_built_in_commands.toml,sha256=5pH_s8KtNB7wEed7JsnlTNjT0TjvfMxcEJKEbeXC-Xw,8598
src/detection-rules/rules/macos/execution_defense_evasion_electron_app_childproc_node_js.toml,sha256=5z1qCFn-N3jiAOEuwmAWt9vR39QcxCvQQ77pwMn92H4,8092
src/detection-rules/rules/macos/execution_initial_access_suspicious_browser_childproc.toml,sha256=H5Sa4bbA9RiPp00UhMJhIos4U17ZNWuOxey9SrgxbxQ,8536
src/detection-rules/rules/macos/execution_installer_package_spawned_network_event.toml,sha256=dQdEqV4MelN1Q4vGD6nSNmLV90kfrILlSNVNeciWs6g,9216
src/detection-rules/rules/macos/execution_script_via_automator_workflows.toml,sha256=ZQrqBmfAik286RJJVM-sVLIGacMlT0tspDSVQikKLaU,7499
src/detection-rules/rules/macos/execution_scripting_osascript_exec_followed_by_netcon.toml,sha256=_ntRnJOzJoOtHdhu-DC11lhgdg2R6GStrmbnRxJmHpQ,8532
src/detection-rules/rules/macos/execution_shell_execution_via_apple_scripting.toml,sha256=eDZnvM0iDA5PtV7vjSBZVSC2ol7oX2HbP5i2w2Mk-xw,7980
src/detection-rules/rules/macos/execution_unusual_library_load_via_python.toml,sha256=N_-Fuv0Oxpw0yOVsT6bfNx7E76ADrk4eWH0e6tBurx8,5530
src/detection-rules/rules/macos/initial_access_suspicious_mac_ms_office_child_process.toml,sha256=x9Ga8Ye3v6Rxv4jHjORhrVX2Y7PgWX8jxo7NzOwiJRM,9286
src/detection-rules/rules/macos/lateral_movement_credential_access_kerberos_bifrostconsole.toml,sha256=y_Zr4sHTULZSwOaiEqOXzTbZIKpMTjDtZbZFpmWVz9Q,8166
src/detection-rules/rules/macos/lateral_movement_mounting_smb_share.toml,sha256=c1-KZz_e9CoLb-TOTopEwi2QNcJjcGoA9EQp40zG8IM,7912
src/detection-rules/rules/macos/lateral_movement_remote_ssh_login_enabled.toml,sha256=4OWW3vYZ9euMRei4PpmlDPLwaa70Jv3CW1gvDYU1EjA,7390
src/detection-rules/rules/macos/lateral_movement_suspicious_curl_to_jamf_endpoint.toml,sha256=0tsZUp5-tjFo1ivnL7TwTJ8386u7vQgTwVzzq3PqLOg,5524
src/detection-rules/rules/macos/lateral_movement_vpn_connection_attempt.toml,sha256=QrdrZX-oOJQCqGkoL8TPMT4QDh1E_sT378mqiH6UfZ0,7486
src/detection-rules/rules/macos/persistence_account_creation_hide_at_logon.toml,sha256=aUEvaB3nST1X63QHwXadwzdlafmMkXHTD00eOCyTgDA,7679
src/detection-rules/rules/macos/persistence_apple_mail_rule_modification.toml,sha256=uMhapTp7AQi2YVt3dltZkwXTBvVlI984bBXIUGnkVk0,6398
src/detection-rules/rules/macos/persistence_creation_change_launch_agents_file.toml,sha256=tJsHdrWZ1BCLDXXyBOUfrlNE87oDpPag57rw_MJoZ4Y,8161
src/detection-rules/rules/macos/persistence_creation_hidden_login_item_osascript.toml,sha256=mzvVbrU6_sRuCiSgxNMkOy8D64UE3cypqUpsD6Qf5vY,7777
src/detection-rules/rules/macos/persistence_credential_access_authorization_plugin_creation.toml,sha256=u9ENOcfkgqZ71KP_1nSeXrfHZ4sBw4D_JvLEIcxBig0,8207
src/detection-rules/rules/macos/persistence_crontab_creation.toml,sha256=pF6GGft3QuuGPWZXkmqZO0DkJOnhDrkjbh_aoEnfvgU,7544
src/detection-rules/rules/macos/persistence_curl_execution_via_shell_profile.toml,sha256=m2d6gktVzcInK9jmgmAyjWhplOZfi-6c7yzP-nJ6IOo,5706
src/detection-rules/rules/macos/persistence_defense_evasion_hidden_launch_agent_deamon_logonitem_process.toml,sha256=bDwr9sSh9Yxt118lv3dakCMCrVW5csKbEg-ho1sHinw,8219
src/detection-rules/rules/macos/persistence_directory_services_plugins_modification.toml,sha256=y9g_Zo7ie89xK0rH6kVuTYm7doG1az2o7nlcgrbT92U,7737
src/detection-rules/rules/macos/persistence_docker_shortcuts_plist_modification.toml,sha256=DjdGXoAp99NDQmF86DzSLjo-4s21n_6DnW31cNmhiAM,7717
src/detection-rules/rules/macos/persistence_emond_rules_file_creation.toml,sha256=ZuG7uE-jTOKqL1v_CCZfTybfBnBbaJJNiC8eroiKaq8,7657
src/detection-rules/rules/macos/persistence_emond_rules_process_execution.toml,sha256=NlB6u3Svek_V2PuO9k-X8YQ7E5ilz_hf4BQHEDnSMzU,7834
src/detection-rules/rules/macos/persistence_enable_root_account.toml,sha256=u-9eN4tqkC6YpEfiD4cft_cet1gh3YGwWolpSV_EufE,6839
src/detection-rules/rules/macos/persistence_evasion_hidden_launch_agent_deamon_creation.toml,sha256=aBT2VCu8m4lfdrrjrSm5z395_hHjn-ntEzxfizG9qOw,8168
src/detection-rules/rules/macos/persistence_finder_sync_plugin_pluginkit.toml,sha256=1WJ4TW3ALI-AcKMG-VKOaVDzgDTETbRyDc_QoMah4F0,7829
src/detection-rules/rules/macos/persistence_folder_action_scripts_runtime.toml,sha256=LXmcostzqhfR506bzj8xUpVS_v__TEmoBg3IE9FUSus,8097
src/detection-rules/rules/macos/persistence_hidden_plist_filename.toml,sha256=5PQ1eIdfDATzG34UnIq5QTfO0Icl_bqAEmdHiuHI6jI,6323
src/detection-rules/rules/macos/persistence_login_logout_hooks_defaults.toml,sha256=hi6M6ALwTRal3enYqAo0VNMls6BuMlSLgC4ek6U43Mg,7240
src/detection-rules/rules/macos/persistence_loginwindow_plist_modification.toml,sha256=2LLoy9k4GJ5d-h-RsivGqKxcFaOrjKNw4DbGrmaIP78,4210
src/detection-rules/rules/macos/persistence_manual_chromium_extension_loading.toml,sha256=h9WXVZwZWg0kKQGHCX1ePr--9RI4rrG4K7qw2LJZciM,5901
src/detection-rules/rules/macos/persistence_modification_sublime_app_plugin_or_script.toml,sha256=EuOo_KJ_BadsO4mpfnWiharCGoEnmsfZDmp0gNUWvew,8273
src/detection-rules/rules/macos/persistence_periodic_tasks_file_mdofiy.toml,sha256=acbzspvAYZ-pRmwWM0xWTnAJS69fl5tsddhGpgDALuU,7859
src/detection-rules/rules/macos/persistence_screensaver_engine_unexpected_child_process.toml,sha256=gPR2OV-QlPwZvEiqGP8HY80yr4nfBg8ynKGQ9rlU8Pc,4217
src/detection-rules/rules/macos/persistence_screensaver_plist_file_modification.toml,sha256=DvY6wLcqphqFSUQR3cDXeiHISWLZ64i4C_-xeg9zHVc,4766
src/detection-rules/rules/macos/persistence_startup_item_plist_creation.toml,sha256=NKDSf-jeYjkAev1U9odr8gJ222nUaSwDoz4Fz6kY5xw,5047
src/detection-rules/rules/macos/persistence_suspicious_calendar_modification.toml,sha256=ZnYLMS2ZhEqTX1kGBRFsttUsBXFJ1nVc6p4mpo8DCmk,7595
src/detection-rules/rules/macos/persistence_suspicious_file_creation_via_pkg_install_script.toml,sha256=AIrPBt_Sfo9sNiq09FZloHxM9vI05Nl2emP35OPgF_U,6170
src/detection-rules/rules/macos/persistence_suspicious_launch_agent_or_launch_daemon.toml,sha256=mt59iKhzbqu4Yuw6q38KWyavjO3cRK9toSOqJTZhC9c,6834
src/detection-rules/rules/macos/persistence_via_atom_init_file_modification.toml,sha256=lWBfxcgfygMH_KWbEJ7YvXeuey4a9xXdwAe5-pdrUBg,7542
src/detection-rules/rules/macos/privilege_escalation_applescript_with_admin_privs.toml,sha256=x9UF5Dz80VMqJNFZMd6uImYQ2yZ0V-Sw-9xu37shbD8,7512
src/detection-rules/rules/macos/privilege_escalation_explicit_creds_via_scripting.toml,sha256=At9WFkoUsAvzqKQ0pbL1siXAxgK7aiimFE5ycUzCEK8,8508
src/detection-rules/rules/macos/privilege_escalation_exploit_adobe_acrobat_updater.toml,sha256=-99EFGyt0XZ_iUpbaBmg0jC6x9-tVTKFGsuNlLu3d8A,8647
src/detection-rules/rules/macos/privilege_escalation_local_user_added_to_admin.toml,sha256=xmzuHaNOjJ1hSF13JB1fVTL4aWh1GYomjLYJ-0Fde04,8057
src/detection-rules/rules/macos/privilege_escalation_root_crontab_filemod.toml,sha256=Es9pov7nRqsJ5ZsSFFYuDed5FewpCWYNH5Xv2HDsXC8,7371
src/detection-rules/rules/macos/privilege_escalation_user_added_to_admin_group.toml,sha256=_1K7GHIOd270Bo-f5HdAZANmCBJsE8SGS5l21I5CpJE,4385
src/detection-rules/rules/ml/command_and_control_ml_packetbeat_dns_tunneling.toml,sha256=-use4HHUNupNGD0esvj-wI8f-CVcf469Cf9Vc1F_gnA,9232
src/detection-rules/rules/ml/command_and_control_ml_packetbeat_rare_dns_question.toml,sha256=fRtqHKR5SWV_5GrU2ro0DVJzYTiqSLtgJJ10wPa5lz4,9922
src/detection-rules/rules/ml/command_and_control_ml_packetbeat_rare_urls.toml,sha256=7EXtTBvD0HlyutDXGwsbp749AnB8qoApE8vxe-UlsJs,10347
src/detection-rules/rules/ml/command_and_control_ml_packetbeat_rare_user_agent.toml,sha256=bwZyiyg4hyoLxGGZ01xwxND4hn86g26BQYUqeLa9hU8,9945
src/detection-rules/rules/ml/credential_access_ml_auth_spike_in_failed_logon_events.toml,sha256=IdzOCH49v7_Jj34c07yAgjNzX2Npigp4Z-c7O4EnIUg,9283
src/detection-rules/rules/ml/credential_access_ml_auth_spike_in_logon_events.toml,sha256=lQT0erutWT4ZtBF7IY4HbDsI0-JSUUIb0ExdTAQqTiQ,10338
src/detection-rules/rules/ml/credential_access_ml_auth_spike_in_logon_events_from_a_source_ip.toml,sha256=zY-mkRXD6B_sgIOrmPACyTzqmhoCyirwgJpbvBVDnrw,9185
src/detection-rules/rules/ml/credential_access_ml_linux_anomalous_metadata_process.toml,sha256=YUOagZUeBgKt1vW9ykrI1N2dUl53q6poPrJdBO2C8MI,9889
src/detection-rules/rules/ml/credential_access_ml_linux_anomalous_metadata_user.toml,sha256=CNkfeMB6mhBSI-bVnFJLf787zgJFtuRCAFNHFSmFAa4,10052
src/detection-rules/rules/ml/credential_access_ml_suspicious_login_activity.toml,sha256=_mwL1ga1MkQ_VDwKLaMZF0Tryd7oREvTPrhnE5wqRPs,10287
src/detection-rules/rules/ml/credential_access_ml_windows_anomalous_metadata_process.toml,sha256=Z75iuvO3fmFzQ4mjy4wOUkEFG8knS57hnVu4sMMShyk,8750
src/detection-rules/rules/ml/credential_access_ml_windows_anomalous_metadata_user.toml,sha256=QfVRrRtoNltXvP0eUQkAU2piwpW9yQ5ZzPXfZtyz_ac,8938
src/detection-rules/rules/ml/discovery_ml_linux_system_information_discovery.toml,sha256=15sScVLrjRxSphNhUDsS8OSYjmwwRYAnAR-179RRMRc,9860
src/detection-rules/rules/ml/discovery_ml_linux_system_network_configuration_discovery.toml,sha256=cv_IzWQRv0tTAfSa9ck7MtuFjo7LhaFxdIb8teZ2Sm4,10240
src/detection-rules/rules/ml/discovery_ml_linux_system_network_connection_discovery.toml,sha256=G7-2crZlKQNlwrB4baRsQki8WsRbod0JuFOOpGLgcIo,9612
src/detection-rules/rules/ml/discovery_ml_linux_system_process_discovery.toml,sha256=fAlhrhI979xigmZ4M7q-XBX6m0DeOWz71k7tF-HiM8o,10006
src/detection-rules/rules/ml/discovery_ml_linux_system_user_discovery.toml,sha256=m4yiyPLj0-0hxAbY0ooW6TPrpdTHF7dMsvHqd6ZTaeE,9625
src/detection-rules/rules/ml/execution_ml_windows_anomalous_script.toml,sha256=g5cVx9IRXTL5ySJV3KWgJpwmt6Y8hVS7-anfb2CWpss,9036
src/detection-rules/rules/ml/initial_access_ml_auth_rare_hour_for_a_user_to_logon.toml,sha256=GywIgSgOnoVPdXlYeWNImbCTHqF0SfALVNT4qQzsRi4,8436
src/detection-rules/rules/ml/initial_access_ml_auth_rare_source_ip_for_a_user.toml,sha256=zCSKAbxkQ5_Jm-WUyifV7BfSUGiNU5QZmFV8_rSnKQo,10420
src/detection-rules/rules/ml/initial_access_ml_auth_rare_user_logon.toml,sha256=kG69KSKfe7Pd7aVaUIU14suP5L4TaYUYV78SuH8YHio,8749
src/detection-rules/rules/ml/initial_access_ml_linux_anomalous_user_name.toml,sha256=iNufQcmdGizV-2smL--et7zPuAmJ2jab-UWQt-JcSY4,7456
src/detection-rules/rules/ml/initial_access_ml_windows_anomalous_user_name.toml,sha256=RZFc5oqap1Gapd74KWg0ygdFvchJnARdXpOVYZ_61Rg,7152
src/detection-rules/rules/ml/initial_access_ml_windows_rare_user_type10_remote_login.toml,sha256=9ucTP7Q6X6kTiuXWEa9nueqW0r_EdFNOAQ7ZG9d1FJs,5685
src/detection-rules/rules/ml/ml_high_count_events_for_a_host_name.toml,sha256=JSoCQ_sBJXfQp_JOfbj-8K-mcWCsFu-3NA4b55s7I24,8617
src/detection-rules/rules/ml/ml_high_count_network_denies.toml,sha256=pIiKMyeOI6v_kHTIP_0HeEZSoYvUaBwIM6NSV18WoOA,10823
src/detection-rules/rules/ml/ml_high_count_network_events.toml,sha256=Opp883aStXYGCLFyt7t9Krm1aCGH26IzqFHkWQYIc9I,10376
src/detection-rules/rules/ml/ml_linux_anomalous_network_activity.toml,sha256=AJ4AXTBiFSmlMusoEvpzTPJDlWPH6esnpENOX3RRSdI,8049
src/detection-rules/rules/ml/ml_linux_anomalous_network_port_activity.toml,sha256=cy-cHGJ_51fjRQ8Gw6FlSmXxnSGBjawphjYWjenMxhg,10322
src/detection-rules/rules/ml/ml_low_count_events_for_a_host_name.toml,sha256=6hJhS5Ors15sl7GNR_rFCl3T6Cf_7709wfCtGNNSLlM,7680
src/detection-rules/rules/ml/ml_packetbeat_rare_server_domain.toml,sha256=JShjfA-ylsE4i8aGnrvlDjYNf_jW0zvTrj0YcKsSX_0,11218
src/detection-rules/rules/ml/ml_rare_destination_country.toml,sha256=fr7qgbjlL7BQYb6ZgtAUVJ9UuCqXiwb0o00ElVGKuGE,11337
src/detection-rules/rules/ml/ml_spike_in_traffic_to_a_country.toml,sha256=Novfl3ap1ltCvQjUVB5TQYhfvCuzsCaQHtoWIzNjzDA,10081
src/detection-rules/rules/ml/ml_windows_anomalous_network_activity.toml,sha256=5-m0T7sslRq_opLq7PlJ4775qIwR0kcpQQiqM22pfu4,7755
src/detection-rules/rules/ml/persistence_ml_linux_anomalous_process_all_hosts.toml,sha256=KF2u9Gr51vPCHGCaTMWYMa-7JDOUB-mrkXM7h4X8P70,9351
src/detection-rules/rules/ml/persistence_ml_rare_process_by_host_linux.toml,sha256=yCKzM-DKLvxs6Oz2RcT2KfC1cgVykUyFSI17oc8pTRw,9330
src/detection-rules/rules/ml/persistence_ml_rare_process_by_host_windows.toml,sha256=M35LHGnQJl1pkeVV6GlYqkiZIivkV2XNwEE2j_wlbrY,11661
src/detection-rules/rules/ml/persistence_ml_windows_anomalous_path_activity.toml,sha256=U-HcPYVf3FQ_C2P_fl0box4wWYCBN_Ko_rktUm1A2Fw,9777
src/detection-rules/rules/ml/persistence_ml_windows_anomalous_process_all_hosts.toml,sha256=kKVbzWAqQabtIOj2JNIsdaPHxppj2Qt2DPECCuFfO38,11979
src/detection-rules/rules/ml/persistence_ml_windows_anomalous_process_creation.toml,sha256=r6Cp63xAybl3vRdAOcVCd-50Kusk97eacuGvtIqe_0A,12114
src/detection-rules/rules/ml/persistence_ml_windows_anomalous_service.toml,sha256=Zm75mdZAuWAZcTVGqvn7lT0aJ0OKiO66Xd_J11XqB9Q,9053
src/detection-rules/rules/ml/privilege_escalation_ml_linux_anomalous_sudo_activity.toml,sha256=DRQsxghIERBj0WZNYs7UjNBJzEBY__IkiSlPSXL--e4,9895
src/detection-rules/rules/ml/privilege_escalation_ml_windows_rare_user_runas_event.toml,sha256=cZuL-OllNqDAvP4pSuoxk9c6jyq2HyGYTCBmPPmuw9o,8746
src/detection-rules/rules/ml/resource_development_ml_linux_anomalous_compiler_activity.toml,sha256=TgTWEnq81oCS-Ah9l8Gk5OWwKEknQB3zvUklyNr4ri8,9873
src/detection-rules/rules/network/collection_fortigate_config_download.toml,sha256=KuLPTt9L6L9NCjdqDYMThIFsmFuD1IRQ7v4AP8lwfv0,4631
src/detection-rules/rules/network/command_and_control_accepted_default_telnet_port_connection.toml,sha256=F-hydUUXHot5PVPht7GB9FhqBlCBZOngkf-6aqYectM,7058
src/detection-rules/rules/network/command_and_control_cobalt_strike_beacon.toml,sha256=js9zdKz06loux-ETkv_fEqJOiukKbLVN-4vFNPptdFs,6302
src/detection-rules/rules/network/command_and_control_cobalt_strike_default_teamserver_cert.toml,sha256=ltAuXm5_5K91v7VpY8rL8vzjOwxVPGFHJCW0nBpDomc,6602
src/detection-rules/rules/network/command_and_control_download_rar_powershell_from_internet.toml,sha256=iSPMH0nAeD_9DFCyXYtN0eS0ZYLOyZADNC9NT187kes,6858
src/detection-rules/rules/network/command_and_control_fin7_c2_behavior.toml,sha256=dVqA6lrnNeIg_jkbG0AN8c_yfefcP-olPdUb0ZXwY0A,2444
src/detection-rules/rules/network/command_and_control_halfbaked_beacon.toml,sha256=H7SdShpgvXG1C21Dq_uFOBH7FHDanRrjBMvDcvGtAdw,6069
src/detection-rules/rules/network/command_and_control_nat_traversal_port_activity.toml,sha256=aabur90wGqoOXRJsh10uYYsL17pa654DJZVXYvcSSC8,6023
src/detection-rules/rules/network/command_and_control_port_26_activity.toml,sha256=S2fq_zcbn3GWLbIgKEEplEtnLNJcowxPWX86aThxLEI,5614
src/detection-rules/rules/network/command_and_control_rdp_remote_desktop_protocol_from_the_internet.toml,sha256=gAcufp5myizgphfNxTfJG-wEzddPzNWoNZcplZVtlSI,7327
src/detection-rules/rules/network/command_and_control_vnc_virtual_network_computing_from_the_internet.toml,sha256=AuG5v-eeQnjLC0fbkLSuU4JHqyzrXICKa2IjIp5BdIk,6885
src/detection-rules/rules/network/command_and_control_vnc_virtual_network_computing_to_the_internet.toml,sha256=HRuMy4JMi46yi-SaSYxIYpKBF404amez5ZWeJLt6WJM,6565
src/detection-rules/rules/network/defense_evasion_fortigate_overly_permissive_firewall_policy.toml,sha256=j6-SxhSU7XOaIX4O-m6A-j7JycG3-WAFYOCtAa5UQmc,4596
src/detection-rules/rules/network/discovery_potential_network_sweep_detected.toml,sha256=Zlg6_PJQspCiY1Fj_N8yFptKXBR8oCdkydK3A0pKiHc,6623
src/detection-rules/rules/network/discovery_potential_port_scan_detected.toml,sha256=xZNbZ5lWHlpukA5CL3H5WDWUkQP2I9sbuEdEHkJAOfs,7523
src/detection-rules/rules/network/discovery_potential_syn_port_scan_detected.toml,sha256=t4LkcTUWOthb1Ja8IouDptcHGPPLj3nt73PWnTqXYGk,6635
src/detection-rules/rules/network/initial_access_fortigate_admin_login_multi_srcip.toml,sha256=CaCkMJ86zcDBOOfwsOrp7cnoPbRTCLy7yEYTO-DTGnw,5428
src/detection-rules/rules/network/initial_access_fortigate_sso_login_from_unusual_source.toml,sha256=B0_kU1rAxCaVGoeb68LUhpw_torhSlxRNvghjuuoIII,5718
src/detection-rules/rules/network/initial_access_newly_observed_fortigate_admin_logon.toml,sha256=6QjUocLJzrcHTa90Hs7opfRB1MJxelNhLLZwfsi0xyU,4676
src/detection-rules/rules/network/initial_access_react_server_components_rce_attempt.toml,sha256=5Z70AlUVQJJkLqtvCJKCbXUZxTdlO3lYb2Dl1hIbUu4,5131
src/detection-rules/rules/network/initial_access_react_server_rce_network_alerts.toml,sha256=IloxAwxSysFszZSHZJUKu-rVXhxPwaLLJnE0SnmMmr8,4993
src/detection-rules/rules/network/initial_access_rpc_remote_procedure_call_from_the_internet.toml,sha256=NSOb9s9aT90JXGocfJ7AAV9lRgRlm5soQEJW9dprfwU,5977
src/detection-rules/rules/network/initial_access_rpc_remote_procedure_call_to_the_internet.toml,sha256=7Lko0AyJx0dSe0f6bXpLnjlZi309glFt4dSJRDKlZ2k,6152
src/detection-rules/rules/network/initial_access_smb_windows_file_sharing_activity_to_the_internet.toml,sha256=2lZtpdxbYlh9ggwZ2sSHqulq_m_LIsDHE-_R-cjT2l4,6734
src/detection-rules/rules/network/initial_access_unsecure_elasticsearch_node.toml,sha256=aI075Ejg71KLPQNxt-rlYl-XMdQws2WOUNDVrtfMSVk,6189
src/detection-rules/rules/network/lateral_movement_dns_server_overflow.toml,sha256=yuOXwndVOVePtpI2b0Rsmx-oIXgaQhJmkpFKSavZ5No,5181
src/detection-rules/rules/network/persistence_fortigate_admin_creation_unusual_source.toml,sha256=DLR3bgLJDfTAKd-BZyZsSbwVH--RGS2OzoxZwMpSHw0,4491
src/detection-rules/rules/network/persistence_fortigate_sso_login_followed_by_admin_creation.toml,sha256=gZ9i9Nv-60rqCGSFsLzUe5d7_XdksM27jamdBB7qWD0,4575
src/detection-rules/rules/network/persistence_fortigate_super_admin_account_creation.toml,sha256=7NKCW6KcMBZqoiyFwjS8aKTXZnxbRRayA_DK0dC3KAg,4253
src/detection-rules/rules/promotions/credential_access_endgame_cred_dumping_detected.toml,sha256=z6nBuhaCnYaL-UJtn66PpMIIy0PE8gdaN-Fo6371PlM,5472
src/detection-rules/rules/promotions/credential_access_endgame_cred_dumping_prevented.toml,sha256=fTMgE5OaSeG1ttIY3vNhZcTX9mqmUh0U1z3n9ZliTZ0,5336
src/detection-rules/rules/promotions/crowdstrike_external_alerts.toml,sha256=Fhq7sied6-0CVpFcYL5zGr-X-wpllOFfwJIwCZXdLAY,4625
src/detection-rules/rules/promotions/elastic_security_external_alerts.toml,sha256=lBiECEOwduNwMfnsVOWDea5YUNq4Ptj6_BQus8kn1ig,5417
src/detection-rules/rules/promotions/endgame_adversary_behavior_detected.toml,sha256=kHUD1yWpJ9M5XWnjJTM-obM9xAP4vrXi5xTrv16EHJU,4943
src/detection-rules/rules/promotions/endgame_malware_detected.toml,sha256=qxk6GJYxP4z3A6di71nq5JjKnTzGddjsGIORg52MD-w,4957
src/detection-rules/rules/promotions/endgame_malware_prevented.toml,sha256=yxtTGq6NKFsA0ZmIr5UcToQ0GGv_jQ4hDuX8sKDQlNg,5248
src/detection-rules/rules/promotions/endgame_ransomware_detected.toml,sha256=jzHzaCMGEFRZHaY-vx-qjEvxWP0HTEu-W3JbUPJV1tk,5038
src/detection-rules/rules/promotions/endgame_ransomware_prevented.toml,sha256=NbkC3mYaZo-9BNdCHkIIDou6qtaGjERlIsRVqx1UgHQ,5205
src/detection-rules/rules/promotions/execution_endgame_exploit_detected.toml,sha256=qf7eZQG0C_M-JudxEg58LKQg8UYOfVj7QJH7LpZNljY,5219
src/detection-rules/rules/promotions/execution_endgame_exploit_prevented.toml,sha256=_C-Ljdho36X-6MIv67-Uj5We3noqyc_KmlOUdY-OutE,5785
src/detection-rules/rules/promotions/external_alerts.toml,sha256=ENogaulAUMTAsCPCbT_GghuWhylEyqu4w3f1FmO3V2Q,5437
src/detection-rules/rules/promotions/google_secops_external_alerts.toml,sha256=N-RqHMdp-ShOWRbdjRWAlgpRul7D3HwAMBbTw2_NCtE,5408
src/detection-rules/rules/promotions/microsoft_sentinel_external_alerts.toml,sha256=579FABDjrD2Bx-HtjVbt9Xx_FbGxLZ6V8lwExUnbUjE,5192
src/detection-rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_detected.toml,sha256=OsC42xvAWZ73ucgomaH2F3Hz-qH2WgRXmhFvZ4UPFkg,5352
src/detection-rules/rules/promotions/privilege_escalation_endgame_cred_manipulation_prevented.toml,sha256=L9F0p1bAIyFqqhvhAh6SrVwXO6sStpEj0RQDpDGyOl0,5404
src/detection-rules/rules/promotions/privilege_escalation_endgame_permission_theft_detected.toml,sha256=I5eyZ4b_XcETD2QUvwQOvI0KxW3Nw2jd_moeE3TZ8vU,5323
src/detection-rules/rules/promotions/privilege_escalation_endgame_permission_theft_prevented.toml,sha256=S6Gy7Wzvm9qYZQZa3m-es_tLUjEzCOFP8e_e56774kA,5574
src/detection-rules/rules/promotions/privilege_escalation_endgame_process_injection_detected.toml,sha256=e6RvjlBLkLA_CSeRnPkMUd7d6nWs6gEVIP3kckyXNBo,5922
src/detection-rules/rules/promotions/privilege_escalation_endgame_process_injection_prevented.toml,sha256=g2LXoq92JyjLDT6xuq3EVmdnmOwezNba2mdaLGQTArM,5447
src/detection-rules/rules/promotions/sentinelone_alert_external_alerts.toml,sha256=ub8zDEBUmVyUF-DwD2Z0WH4hNjZ4-03lLfPSnzwIJzc,5420
src/detection-rules/rules/promotions/sentinelone_threat_external_alerts.toml,sha256=ceyGbQk6Pny24PcURQfR5l-LPMP7CYIP5B5-rcw5vFI,5345
src/detection-rules/rules/promotions/splunk_external_alerts.toml,sha256=FTrly6HfH8b2f0Ev3pzEr94aADkPL2aogz9B13BQj-U,5217
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_address.toml,sha256=sABfe4Vd_YB_dN7k0TwfcEFz7ForztJQfsK24dBdXPU,9398
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_email.toml,sha256=cuh4R_J-fUder7rRHeCDAckV5mC3Tjcw52o0WyyWAko,8113
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_hash.toml,sha256=FSffKHLWay2Jyy5_EVHjg33cbS4iVct4BPH9otI20co,10081
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_registry.toml,sha256=-8NPSRm082kvQpB-gFdnthoCa_1-5eODRRSlnZbfyCY,8355
src/detection-rules/rules/threat_intel/threat_intel_indicator_match_url.toml,sha256=JOmYkXME8BgYPNjCLRJA1mCi-gYEuu9yAemfKHyXWBU,9291
src/detection-rules/rules/threat_intel/threat_intel_rapid7_threat_command.toml,sha256=CG1NG4QEb28hBxQIeBqdugJO2bQWs0Xd14mg4uLF81s,4454
src/detection-rules/rules/windows/collection_email_outlook_mailbox_via_com.toml,sha256=s9xCQ9ZlD9aTL2N7NNsFR3ZNWbnYHD1Payf6CnMq1WE,6964
src/detection-rules/rules/windows/collection_email_powershell_exchange_mailbox.toml,sha256=PYNr5RnEgZPOirZq0paV0yAaQ9LxFrlxbiGcZNv4Afc,6659
src/detection-rules/rules/windows/collection_mailbox_export_winlog.toml,sha256=RNqIoiirmV8G6Yyz6t7pzSC4mB3xdTadMdEP_q0hG-Y,10903
src/detection-rules/rules/windows/collection_posh_audio_capture.toml,sha256=muZ7cVYQNMhtCvX_bxLTB7W5QgnIHkzPAtV8jINgBBI,9712
src/detection-rules/rules/windows/collection_posh_clipboard_capture.toml,sha256=kbZmJmKwcMQaHRac7_hav_WSlG-ctH1KbcGgcowVcQI,10651
src/detection-rules/rules/windows/collection_posh_keylogger.toml,sha256=mjhKHMRrElDrkEw9ofknOSzew8cKQoX0FDVCZMi0cUA,11405
src/detection-rules/rules/windows/collection_posh_mailbox.toml,sha256=vENDLH3XAX71HbtTLj82gpxi9u3jmFdFsE2tl87Km6o,10744
src/detection-rules/rules/windows/collection_posh_screen_grabber.toml,sha256=Rn7ZZ3O1Vt0tnhg6P-4I1R3QGLJLwEGap64E_EghujI,10894
src/detection-rules/rules/windows/collection_posh_webcam_video_capture.toml,sha256=x-i9ZYYwUZSOyuC-j0dEs76Kdzt5ZpN-Zk_tri1XHKU,9368
src/detection-rules/rules/windows/collection_winrar_encryption.toml,sha256=BlgWxZe2SDVkh_Vlm9c4W4z2iduhrN4TcGbvGMou1QM,6096
src/detection-rules/rules/windows/command_and_control_certreq_postdata.toml,sha256=Zy4h-3zDaUJOctE9E72kt8Dtc0popzZDZSC47Sbw1_c,7957
src/detection-rules/rules/windows/command_and_control_common_webservices.toml,sha256=6_1iTMwb_Ze_m5J3exDEoL9MoYPVUQb512pp-c-0OeA,16488
src/detection-rules/rules/windows/command_and_control_dns_rmm_domains_non_browser.toml,sha256=-99tu0xSqnNdVvMsbwJbqfUPuyp-USv8di1_00SF-X4,5088
src/detection-rules/rules/windows/command_and_control_dns_susp_tld.toml,sha256=7YsiR5XjwtQ5X7HZrm6hcIAcmfYJbCdgtEW1St-to5k,4779
src/detection-rules/rules/windows/command_and_control_dns_tunneling_nslookup.toml,sha256=OGBh4zDgseRjdRBBbAqE8Lhlmtu0QErRfeiFZqTMVVA,4816
src/detection-rules/rules/windows/command_and_control_encrypted_channel_freesslcert.toml,sha256=tu4oPRs2LaxkDndmPIJyqyBZpt2al03ncSZF0dn5xUU,6285
src/detection-rules/rules/windows/command_and_control_headless_browser.toml,sha256=Xle3lp5n4Sm_2CBxfAKCMXOWUAlmrLuXbvLt3vZuD7Y,4439
src/detection-rules/rules/windows/command_and_control_iexplore_via_com.toml,sha256=t352l1EUQOsmSYIHeCtV64-eIl4HRLBt7ezddO7CSK4,7030
src/detection-rules/rules/windows/command_and_control_ingress_transfer_bits.toml,sha256=OhAz9FbffgaQUWfWUn0mUeQklfG-tX5q9YOI0hqYcrY,8990
src/detection-rules/rules/windows/command_and_control_new_terms_commonly_abused_rat_execution.toml,sha256=XfG70TzeD04oZcjWjmS3MmWET33T5Vh4Nr2OEe2I1ls,19667
src/detection-rules/rules/windows/command_and_control_newly_observed_screenconnect_host_server.toml,sha256=VE3ltuzi9K6-fryx-GUbzzRhy4z-ZqP7wglP9o1U_nQ,4533
src/detection-rules/rules/windows/command_and_control_outlook_home_page.toml,sha256=yKnNDNQ90uDcZE1G1v7L9m-hMTrZinyGozWx8uRnqpU,6067
src/detection-rules/rules/windows/command_and_control_port_forwarding_added_registry.toml,sha256=0k_71fTnRdsyJ7IR1f5F3pt5dPRRfn2v9KUlthVtttQ,5431
src/detection-rules/rules/windows/command_and_control_rdp_tunnel_plink.toml,sha256=lbCU9ahoeoazokJTEDOEPmtkttOixNTI1h6N7-ayG4A,5365
src/detection-rules/rules/windows/command_and_control_remcos_rat_iocs.toml,sha256=_RlEXNyWPi7igTaZA9kR_odJEh2TvpWsOamGCHUxqpY,4244
src/detection-rules/rules/windows/command_and_control_remote_file_copy_desktopimgdownldr.toml,sha256=_-Qd-2zTjwiXp6FyvNVAbGkYmDG248FoxvpeQ2SDR2s,9002
src/detection-rules/rules/windows/command_and_control_remote_file_copy_mpcmdrun.toml,sha256=gVPjHGhhUnTqHuXSgNs0XyctOFNnA8_zPCBr2DIitiE,8909
src/detection-rules/rules/windows/command_and_control_remote_file_copy_powershell.toml,sha256=qgioQovJ7Ux6w6MgWFHDCcnAs7UT4eUe02ovoK1Js0A,9848
src/detection-rules/rules/windows/command_and_control_remote_file_copy_scripts.toml,sha256=gwf1K1s9FvKbq-IpvKw5nTrwHbVh2U3cXqZeD50_2fw,7100
src/detection-rules/rules/windows/command_and_control_rmm_netsupport_susp_path.toml,sha256=7v8D76L1T8xI4vEJsvG2DCCCm9pxBcwIOmHKqrgklSE,4324
src/detection-rules/rules/windows/command_and_control_screenconnect_childproc.toml,sha256=b9UAQBVkN26ez_CK8fLwsPcuMQFuIp2MpWvIFPyhi1w,7373
src/detection-rules/rules/windows/command_and_control_sunburst_c2_activity_detected.toml,sha256=DwEBgkB40-diO5sA_GvVqhJrx0BqM9BFl5XTIN2JOTE,8259
src/detection-rules/rules/windows/command_and_control_teamviewer_remote_file_copy.toml,sha256=SyA8UQTlYDc29-aKWNybjer0HmHNY3oGSmL7-0Y1LY0,7389
src/detection-rules/rules/windows/command_and_control_tool_transfer_via_curl.toml,sha256=2gFvlwnDOqHLUKcznk1nPxcSXXtG1EcgoAfGNWnDtJs,5277
src/detection-rules/rules/windows/command_and_control_tunnel_vscode.toml,sha256=BCj_FXkhQrHSHX2c-7dGlz9bdJFlk4LMuYZjlRI9gKA,6156
src/detection-rules/rules/windows/credential_access_adidns_wildcard.toml,sha256=hEwtQhdNCALDaZQbdp1d5P30gi_Z7jl2MqxeW2IWlLE,6835
src/detection-rules/rules/windows/credential_access_adidns_wpad_record.toml,sha256=Psrafl7T578EPeVDndK5ZF4K-b_kVpfdrsuQOuSol8I,6377
src/detection-rules/rules/windows/credential_access_browsers_unusual_parent.toml,sha256=7C-hUfZpvayUVb_Tpl60Bv_ZQyAFEK13wAxiJpwjb-E,7185
src/detection-rules/rules/windows/credential_access_bruteforce_admin_account.toml,sha256=MZgcPRslK2yDxvMZ8AvVVqGpjhSJpfYd72AS9zuhlqs,8048
src/detection-rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_followed_by_success.toml,sha256=wv0ROnpCvj_WJLV_BG4-KVOJsLR30rUETeW1lXw7nsk,7544
src/detection-rules/rules/windows/credential_access_bruteforce_multiple_logon_failure_same_srcip.toml,sha256=sJ7SGr-FbfAXxlrfT3lXckg6VEzbpo6rVSRVHvmEuqY,9010
src/detection-rules/rules/windows/credential_access_cmdline_dump_tool.toml,sha256=V4A3ymiX_GxF0UIbMJeD5v07CUrbRhqzqtghhZJSVMg,6591
src/detection-rules/rules/windows/credential_access_copy_ntds_sam_volshadowcp_cmdline.toml,sha256=J-76Kxtd9y6GmCwk4o6uVfd6_UqQVLjYPX3aH7r3X78,8865
src/detection-rules/rules/windows/credential_access_credential_dumping_msbuild.toml,sha256=XaAN-OkaK4N53OT3Fy3o3Bf0XZmKLD9cGBQSLAaYQ2U,8364
src/detection-rules/rules/windows/credential_access_dcsync_newterm_subjectuser.toml,sha256=R5PFPMjRz8n-Qeq-5K6wiqwSV_n2IIewpYzMFNkFFa4,8317
src/detection-rules/rules/windows/credential_access_dcsync_replication_rights.toml,sha256=Y8O_ULH-3_kTmGVZFCYOhChNR0l94g_C32O-qKpoGcU,8734
src/detection-rules/rules/windows/credential_access_dcsync_user_backdoor.toml,sha256=DGocam5Y7BzFWzl2kP3iU2-eRBerTqFxvgAQsfJoQ0A,6774
src/detection-rules/rules/windows/credential_access_disable_kerberos_preauth.toml,sha256=SEyjLzIl_kyxWHvWkpgVDIiOjkAUyD-qJAuyMha9wjU,5937
src/detection-rules/rules/windows/credential_access_dnsnode_creation.toml,sha256=IaJp5Nnh2xeFLs1gTS7O4tvdrqe8_QJ_WKwzHsMXcPo,6907
src/detection-rules/rules/windows/credential_access_dollar_account_relay.toml,sha256=hz9lh17uK85dIiBc6--XgnSvAUpR2XpMYK-Jx2OpBts,6802
src/detection-rules/rules/windows/credential_access_dollar_account_relay_kerberos.toml,sha256=OgX_x46jY1RtAq5xIIcRJYM321rjXBEoiI_aR2x1vgs,8113
src/detection-rules/rules/windows/credential_access_dollar_account_relay_ntlm.toml,sha256=YTp6bmbHnwUjHDg1rjJA8r8Mx86doFvhPiZSZnNNKQs,7878
src/detection-rules/rules/windows/credential_access_domain_backup_dpapi_private_keys.toml,sha256=b3nG19-5mHCS-oDPbnZcGjuTis_yk7WYlYnCCtpF-FA,2561
src/detection-rules/rules/windows/credential_access_dump_registry_hives.toml,sha256=Y5kiPg57DTvTu3EVViOXhWeMFNdRoWdNL4ueURwPLdk,4988
src/detection-rules/rules/windows/credential_access_generic_localdumps.toml,sha256=R4k0uIqw1AlJkr7Wck6cSRkEtpRg8UTFU3Mf-1FXfD0,7218
src/detection-rules/rules/windows/credential_access_iis_connectionstrings_dumping.toml,sha256=vbeqC7wKyFDXVDcRx5YAnHXNn2MqRICmP3lLQ8UpbCc,6440
src/detection-rules/rules/windows/credential_access_imageload_azureadconnectauthsvc.toml,sha256=NvhEAVoxQh3SNttFQZ7hTjpPMAZkhTH9yuuiaYRQaZ8,6297
src/detection-rules/rules/windows/credential_access_kerberoasting_unusual_process.toml,sha256=ARYIjrYa72RLBMbdxPa-abGCVCCP-r2mRY8RLhqul0U,9896
src/detection-rules/rules/windows/credential_access_kerberos_coerce.toml,sha256=90kwSIspPMV6UvS6AGT4fuENEdvpNWBLaZFHe38Tb3s,6265
src/detection-rules/rules/windows/credential_access_kerberos_coerce_dns.toml,sha256=28IBnrK6YYcgqps5Xi-gvJVEq4tXETBR4kggLd8sKO8,5350
src/detection-rules/rules/windows/credential_access_kirbi_file.toml,sha256=4d665QXNA3DC8ryn5zhoMopAXTN57hUS8jpR6m_ZteI,6030
src/detection-rules/rules/windows/credential_access_ldap_attributes.toml,sha256=AjLuZvPdc5XuS7T5st-_bZhQgG85hrfCMYgl9Uimhjg,7640
src/detection-rules/rules/windows/credential_access_lsass_handle_via_malseclogon.toml,sha256=y2u6YHfS59eNAZkWCilTMdE_WWRXXTihWD5-BQ6SDXI,6509
src/detection-rules/rules/windows/credential_access_lsass_loaded_susp_dll.toml,sha256=SYjWvNTTdhUJct2yGYvnrhEDp6-9mnw0T7DAU3XzPhc,9022
src/detection-rules/rules/windows/credential_access_lsass_memdump_file_created.toml,sha256=3omrNBBl3sohCpClavAJpJCx7KKKuRmIYhWtATKSAic,8374
src/detection-rules/rules/windows/credential_access_lsass_memdump_handle_access.toml,sha256=b9ipFixG4ShNHa6v3FjCSprtXVK5OY4b7s2_6VFVg1Q,9945
src/detection-rules/rules/windows/credential_access_lsass_openprocess_api.toml,sha256=zVW4MrG2sAjwt5cRkdDkU4jZHVJaf3yJcXQn1pMhDs8,10233
src/detection-rules/rules/windows/credential_access_machine_account_smb_relay.toml,sha256=EUon_TtKYRn9j-abTeNCecuux7so-0Vd3-johCqNT4U,6056
src/detection-rules/rules/windows/credential_access_mimikatz_memssp_default_logs.toml,sha256=M-jZlbzEco-xvYBnbnzXtP8MgUzmIUEptAgkQKzUUQ0,5385
src/detection-rules/rules/windows/credential_access_mimikatz_powershell_module.toml,sha256=g6MROiWm26ci5b9Ir4PZVp4L74rM14oBGw_6eQJqIWU,10676
src/detection-rules/rules/windows/credential_access_mod_wdigest_security_provider.toml,sha256=ca1dRqjNeYr48QQ0crUmuxHoUIxj0ieCSDTkinJB5ck,6146
src/detection-rules/rules/windows/credential_access_moving_registry_hive_via_smb.toml,sha256=6g-paoOwJJ8qc1AhkoQcFRDpWNom4D6vPnSjxZFy91U,5007
src/detection-rules/rules/windows/credential_access_persistence_network_logon_provider_modification.toml,sha256=u93XW9yQrJ99_QYbYYi3tj8zgixITmddC9WE3q-Dwp0,8920
src/detection-rules/rules/windows/credential_access_posh_invoke_ninjacopy.toml,sha256=ZhYjZUmBit24rWZHJUzAO5m1kR-z1Vo-rDqAM8XbawE,11209
src/detection-rules/rules/windows/credential_access_posh_kerb_ticket_dump.toml,sha256=QvFlTbWPB5syHyA-i1WYmZc87AuLfWuj8yvCvjjcFBY,10302
src/detection-rules/rules/windows/credential_access_posh_minidump.toml,sha256=weHpJU8cF4D3EL_SJunRjeO2_8nKc9otF5DvPz9KOQo,10797
src/detection-rules/rules/windows/credential_access_posh_relay_tools.toml,sha256=qXuTPHscLZju6BwZ8N2FQ8n7MLj-t2oQzZANYd98vv0,10240
src/detection-rules/rules/windows/credential_access_posh_request_ticket.toml,sha256=MxQ0uK1GVw2ezQ4lKeooi6kU7-ZImKENT7FNJg3DViY,10409
src/detection-rules/rules/windows/credential_access_posh_veeam_sql.toml,sha256=An8sAvc1Uae_C6mQLFYt-NivjJZ9xUF24DJrN1XQQek,11390
src/detection-rules/rules/windows/credential_access_potential_lsa_memdump_via_mirrordump.toml,sha256=hyX6TzSZeEYIpncq_WyREZJRs4QpwHNtusKXHyukrX0,6135
src/detection-rules/rules/windows/credential_access_rare_webdav_destination.toml,sha256=RylWx7GojuEfCjK7HmppPtM9iE8O6fOo81LYlTuT6EE,4411
src/detection-rules/rules/windows/credential_access_regback_sam_security_hives.toml,sha256=IlgMYu2u6WUR_u-vjongz-rl9BhVwO82OhWHzp3xnGg,4266
src/detection-rules/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml,sha256=5XU3oqye076_WHBRMjIg9ao7S0yH3AYzrojE6DC9kVU,6881
src/detection-rules/rules/windows/credential_access_remote_sam_secretsdump.toml,sha256=pHo0i42ZPV-a7iMVjbFkbPDc50IOkdK47QiKJuhqIt4,5186
src/detection-rules/rules/windows/credential_access_saved_creds_vault_winlog.toml,sha256=b9jBSv-NxFU_eOADIOEk122YzKGZC-cQ34C3tqAK1zs,6488
src/detection-rules/rules/windows/credential_access_saved_creds_vaultcmd.toml,sha256=qiCKAB-WqljHW2Yq2f-m-JS_IfOJEov1Apeu2Ub5LA4,6466
src/detection-rules/rules/windows/credential_access_seenabledelegationprivilege_assigned_to_user.toml,sha256=awvULFnldvqpEvnhKkPPpXsaCPLi1teJt5vc5zZCBv0,5553
src/detection-rules/rules/windows/credential_access_shadow_credentials.toml,sha256=sLuZNULJ-9W9l-WxGTr1A-jmCZTL4t9xsin5ol6bbf0,5637
src/detection-rules/rules/windows/credential_access_spn_attribute_modified.toml,sha256=-g7sIK_U5GcWID2FHKwNK-mEgz_7XUuBBtjO_ErMnkA,6335
src/detection-rules/rules/windows/credential_access_suspicious_comsvcs_imageload.toml,sha256=x8msdkYxBiyylg3B2FjIkQSSEwHUBr_E6VBQejdDlK4,8780
src/detection-rules/rules/windows/credential_access_suspicious_lsass_access_generic.toml,sha256=ntFCpKvstDWB6mlgJYyQGypLYD8ziS6XuaxKII5icuA,7769
src/detection-rules/rules/windows/credential_access_suspicious_lsass_access_memdump.toml,sha256=0pLJTbYCEuUic8_6ekSYzYrHcsZlfTFxPLO4Cxwh31Y,7198
src/detection-rules/rules/windows/credential_access_suspicious_lsass_access_via_snapshot.toml,sha256=k3fd4BbEys9x8L1k1bfa629F8WY7FZKEfGDhVg0uywI,6220
src/detection-rules/rules/windows/credential_access_suspicious_winreg_access_via_sebackup_priv.toml,sha256=UrHYXOWwwhKNDFEPDL9ntiBFu6q9mk1NRiLjdLsZzIo,5854
src/detection-rules/rules/windows/credential_access_symbolic_link_to_shadow_copy_created.toml,sha256=7O5szd_F1Mv9bf9z38Z_pIVsb5nHApLCH-MjlDiTEFE,6511
src/detection-rules/rules/windows/credential_access_veeam_backup_dll_imageload.toml,sha256=rnBBOHAV94UzhXLHfBaCqB07Or_ZhYOG6K5rLCs6mUs,6068
src/detection-rules/rules/windows/credential_access_veeam_commands.toml,sha256=zog-6c3oBy8CG8ft2XqPE5y4vAzqcHNJV3yOsdyg_N0,6736
src/detection-rules/rules/windows/credential_access_via_snapshot_lsass_clone_creation.toml,sha256=FkqWC77TLzL7inQOHxhTfn2uGp3MSI08W_xfcJjnteI,5975
src/detection-rules/rules/windows/credential_access_wbadmin_ntds.toml,sha256=FBuAX4oudIp72WMVkmL8ViikRNe1WZlxWIkHX0TjwFg,6355
src/detection-rules/rules/windows/credential_access_web_config_file_access.toml,sha256=kiEJ6WHediP03jmTKAzu77aZmefsfJqJEuEsLVbQxkk,5529
src/detection-rules/rules/windows/credential_access_wireless_creds_dumping.toml,sha256=TEb8V69y8mr4eR9g_UfA9NGqp2jSn0KmKRdHRxVumIQ,6574
src/detection-rules/rules/windows/defense_evasion_adding_the_hidden_file_attribute_with_via_attribexe.toml,sha256=u3vYqWy_LeTz9l-WAclUU8eqGTje6wEKwMqe69o2cbs,7890
src/detection-rules/rules/windows/defense_evasion_amsi_bypass_dllhijack.toml,sha256=x3a0x1oivXGDzofn51nrS6EcNygJC8s6_0ryYC6YIPk,8062
src/detection-rules/rules/windows/defense_evasion_amsi_bypass_powershell.toml,sha256=5Oxto9SmP80dCiuBpNx4Xxb-HuYWC3xIV0bUJwk4CWE,10355
src/detection-rules/rules/windows/defense_evasion_amsienable_key_mod.toml,sha256=K2jvBK4cp6bR081jPeAMfEV0A3fiAtk4R5havHh728o,5805
src/detection-rules/rules/windows/defense_evasion_audit_policy_disabled_winlog.toml,sha256=DA9IOBA2pjH4QW5_789bemlloh1QM8eG-MF9WTx51II,5013
src/detection-rules/rules/windows/defense_evasion_clearing_windows_console_history.toml,sha256=gedbzIvdBjjSNL0OwFGZKcfqNp1W_uRf3lA8Kp1UtD8,5651
src/detection-rules/rules/windows/defense_evasion_clearing_windows_event_logs.toml,sha256=K3zmE8R-oVhwdEA3gJH2IOMb-YzaFHaP2fEyOpY3l7g,5284
src/detection-rules/rules/windows/defense_evasion_clearing_windows_security_logs.toml,sha256=bmjZKhPRJu021FYDkBW8r5HopYEMJo03Nllctx7W-8E,3852
src/detection-rules/rules/windows/defense_evasion_code_signing_policy_modification_builtin_tools.toml,sha256=E6yGrwHEtAE32UvaIYgqatCCKiYjuoZOLW5o_usdwF4,7010
src/detection-rules/rules/windows/defense_evasion_code_signing_policy_modification_registry.toml,sha256=eQuF1xs8mhwsFwZKBR-7khOBCC0mtSryRzgF2A8KQlo,7230
src/detection-rules/rules/windows/defense_evasion_communication_apps_suspicious_child_process.toml,sha256=dSuIJCJk9KGZEWVfyBThkgyfLTNQzlEpccyt7Gb6SRQ,11714
src/detection-rules/rules/windows/defense_evasion_create_mod_root_certificate.toml,sha256=A-Qrg2LeLMC2xaf_j7WfTxaO3wmV6pUwKYQybYNkX1I,9333
src/detection-rules/rules/windows/defense_evasion_cve_2020_0601.toml,sha256=PhNsWUFZvST0yrKdgae9B09u2Uow8cwRmEiOM6AKf48,5272
src/detection-rules/rules/windows/defense_evasion_defender_disabled_via_registry.toml,sha256=cRS4u81ERR0Qf1Z8t-Rxq5croAiNTLeneENZAPmPkd0,5500
src/detection-rules/rules/windows/defense_evasion_defender_exclusion_via_powershell.toml,sha256=rGXktZPA701sYPZoESTDH3cSkbaQevlZcFBfy8cJ1RU,6886
src/detection-rules/rules/windows/defense_evasion_delete_volume_usn_journal_with_fsutil.toml,sha256=4xM9w0P-l4_qlRvYufVxyTzTIepx-SGWP0aGaH5TNXE,4800
src/detection-rules/rules/windows/defense_evasion_disable_nla.toml,sha256=v-xFfjkDc1xwsaQqC_xW80RG1xVviqpbxvUjXXlMycU,6623
src/detection-rules/rules/windows/defense_evasion_disable_posh_scriptblocklogging.toml,sha256=Oz8e4-0VM_NZeDkLwPIwSGhpKf4Vwu0aU6qCIWBgPCY,10020
src/detection-rules/rules/windows/defense_evasion_disable_windows_firewall_rules_with_netsh.toml,sha256=nnIPAdDt1uZ-Eingp__Hw5LNU5-iWTBEXG_kprBU9eE,4076
src/detection-rules/rules/windows/defense_evasion_disabling_windows_defender_powershell.toml,sha256=KSKGAvXV_IUuLTTNjst4l_HcwUusChuX9VK8HKc0MzA,5768
src/detection-rules/rules/windows/defense_evasion_disabling_windows_logs.toml,sha256=t9_pSezRRKhzmDn7CyHciTK0VpcRsxf-UgW67g9nnas,5476
src/detection-rules/rules/windows/defense_evasion_dns_over_https_enabled.toml,sha256=wGZX8Llv007yjG6kPcBSlPy1GeNg2rdrQ3tmBZHYKFo,6132
src/detection-rules/rules/windows/defense_evasion_dotnet_compiler_parent_process.toml,sha256=RdT0EEZz9pfKiHeTd1FyuacDx5bJLRqQhjKNCQR1Lmg,6856
src/detection-rules/rules/windows/defense_evasion_enable_inbound_rdp_with_netsh.toml,sha256=CodI7AAKgpFekckkN9iO_OMXhDejydW-9AMsdPf-fGA,4571
src/detection-rules/rules/windows/defense_evasion_enable_network_discovery_with_netsh.toml,sha256=t1xgcWVPq3ncUGKRIcjPVNBa5WTMDD2aRTcAHxeABm0,4565
src/detection-rules/rules/windows/defense_evasion_execution_control_panel_suspicious_args.toml,sha256=2l_WShG--om0N0VaxxSQrlqoC5LPM4BjoWM6Gavf2X4,6348
src/detection-rules/rules/windows/defense_evasion_execution_lolbas_wuauclt.toml,sha256=ZIdvbws-gs4jKlwN3zl74b2x6mVb8BldxsLYe7Ee12s,7693
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml,sha256=3Ngj5XsZKyHcVbPvE6_xVgGYMsqYKM6McYLO6-p07Xs,6983
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_by_script.toml,sha256=NfsSOsZTLEx68RGYOsqOXosAwCMND2GPniSNNozwRU8,7798
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_by_system_process.toml,sha256=PJce7quaYNsjLKYTgxSZlXAd-40GhOyQ-LV80FX_mLY,6154
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_renamed.toml,sha256=_US4K5CSmZR-JJLgx8Bhkef5RoB8lJbobrcyHB5svH4,7280
src/detection-rules/rules/windows/defense_evasion_execution_msbuild_started_unusal_process.toml,sha256=N0bdJDCkK8fv6okedsZYPQnFERHeaPgkS0LnfmBOGtw,6450
src/detection-rules/rules/windows/defense_evasion_execution_suspicious_explorer_winword.toml,sha256=5B1JjBE9wFtFEOJ8aqWkjuQnZeJiDW8igVmBw9NoPnc,8451
src/detection-rules/rules/windows/defense_evasion_execution_windefend_unusual_path.toml,sha256=7A1eKlt0yexoQdQDj9vl6N1GgbZg6MJpxYV7vxO7vjw,7239
src/detection-rules/rules/windows/defense_evasion_file_creation_mult_extension.toml,sha256=ovHbPm93Ci6NJQl-xjhxnESYYJENcZ8D2SH5vG3zi4k,7052
src/detection-rules/rules/windows/defense_evasion_from_unusual_directory.toml,sha256=iJ8aeBTG6KIVk9zBngltnbgUt_jj7wzPTGvlHru_Ms0,10332
src/detection-rules/rules/windows/defense_evasion_hide_encoded_executable_registry.toml,sha256=WvipE42SfMya50vLrMoxYNuMzVs-blsz0E2iBl1P9Io,5682
src/detection-rules/rules/windows/defense_evasion_iis_httplogging_disabled.toml,sha256=O1vxQ28uaS3W3CW6AdPDw75JEfDpfDI74IEpVhbMoSs,4793
src/detection-rules/rules/windows/defense_evasion_indirect_exec_conhost.toml,sha256=pWyQchmmo9_5u9HwR3uUAP-wtPDpr8BcAlnfuhGKZsU,3897
src/detection-rules/rules/windows/defense_evasion_indirect_exec_forfiles.toml,sha256=gZk2J8gGv29W7EkTiGxH77Mkw7wUzrkmIPF1-m3G1Ws,3782
src/detection-rules/rules/windows/defense_evasion_indirect_exec_openssh.toml,sha256=haa5vuGskEXiwessb56I9lsW_C1AtUbsccOWy8kLEqo,3916
src/detection-rules/rules/windows/defense_evasion_injection_msbuild.toml,sha256=KaHJf_LGEb6ZhTxMQpA3P82Rt0-c94p1H-jNYW8IrE8,6360
src/detection-rules/rules/windows/defense_evasion_installutil_beacon.toml,sha256=UZvc5Hk7lr2Wrm5fhba5VYgK_joULfdSTfmn9HVmSaE,5902
src/detection-rules/rules/windows/defense_evasion_lolbas_win_cdb_utility.toml,sha256=7V6HIeM2Cx0z7CEPgT2FmI654kLyd3azSrR8pvwGeV4,5953
src/detection-rules/rules/windows/defense_evasion_lsass_ppl_disabled_registry.toml,sha256=n4j4WMBq6phG09eGPbshYv0JBTmQ65cyUIp2de5ihdI,5275
src/detection-rules/rules/windows/defense_evasion_masquerading_as_elastic_endpoint_process.toml,sha256=frvBRYQ_LC8iXipJ5Im8JtumujieS752GS9OksOrccs,7249
src/detection-rules/rules/windows/defense_evasion_masquerading_as_svchost.toml,sha256=8C5Q9OzmKb5wOxLpPutid_ThCYyC_uRxLKs_p_xPGiQ,5563
src/detection-rules/rules/windows/defense_evasion_masquerading_business_apps_installer.toml,sha256=m2eALeTLlZc9sgJFKC2pWRaj41YN1789IWSfm5lFkf8,11839
src/detection-rules/rules/windows/defense_evasion_masquerading_communication_apps.toml,sha256=L0PyFohm-UoDZ14MtbGTLVkFdqdf7KXVEGQ58IciL-8,8727
src/detection-rules/rules/windows/defense_evasion_masquerading_renamed_autoit.toml,sha256=LjiVW8uEXoIiU-PXNuCWdF08-ZXNvyv3uQuVJjhFMnY,7161
src/detection-rules/rules/windows/defense_evasion_masquerading_suspicious_werfault_childproc.toml,sha256=vRLrjK1aXPUw8ZhAk7kfskespF3BTIjtV-vThBaDotc,7393
src/detection-rules/rules/windows/defense_evasion_masquerading_trusted_directory.toml,sha256=D-Ay0XdJM7ZTWAQcWWnG_Z1wzP1f2jtBqpYS72cjV3c,6969
src/detection-rules/rules/windows/defense_evasion_masquerading_werfault.toml,sha256=p9WyCbWVJOHFEYYH2K9Xn1yBvO5AyZaCcQyvGA0Y75k,7549
src/detection-rules/rules/windows/defense_evasion_microsoft_defender_tampering.toml,sha256=ePc89p9GUgP5QvxIjnn3nj_Of5pYO7YPBM7RVpRPt7o,8313
src/detection-rules/rules/windows/defense_evasion_misc_lolbin_connecting_to_the_internet.toml,sha256=TTVe5n_Ahqhq7Fr9aKoqKmfSQlup_t2BDrlAj3EFjXU,7894
src/detection-rules/rules/windows/defense_evasion_modify_ownership_os_files.toml,sha256=twcv5fW5Wg42EnTijcperhi2mXmUKD2iHy1Txc7WHic,4536
src/detection-rules/rules/windows/defense_evasion_ms_office_suspicious_regmod.toml,sha256=LFL2InKm4d-a-2Q00eIepI9DXVnf81RVyU6C2QtO6DA,6350
src/detection-rules/rules/windows/defense_evasion_msbuild_making_network_connections.toml,sha256=unw-Ac5qJQZKub2gJN7H-GC_q8FgN-Xk7UIXUW2sW_c,8188
src/detection-rules/rules/windows/defense_evasion_mshta_beacon.toml,sha256=M19dA1Mxm5RwTOm5OKJWIMX8qTHtFiLWZpQ8UKD_fso,5825
src/detection-rules/rules/windows/defense_evasion_mshta_susp_child.toml,sha256=CLe2eoeiXOT1GiByBeldnJIkCF2ybCFVS5wnC54uZOk,6001
src/detection-rules/rules/windows/defense_evasion_msiexec_child_proc_netcon.toml,sha256=y2sxL9lzaJymFGgvjwamjtvIKh922KFcWnW7VevmHdc,7765
src/detection-rules/rules/windows/defense_evasion_msiexec_remote_payload.toml,sha256=K_cCt9udSMsKEv0Z1scpBmhfoClo2pQkXj8AfC0Pl9w,6669
src/detection-rules/rules/windows/defense_evasion_msxsl_network.toml,sha256=yND0U96mXWuJbyt7ImTTdNz2TzZab5zn3sfE4nObRlM,6022
src/detection-rules/rules/windows/defense_evasion_network_connection_from_windows_binary.toml,sha256=cZfD0nzNcy7_fsaf9GEH6sQnWAV-Xk4tZTCj6FCR4UQ,9690
src/detection-rules/rules/windows/defense_evasion_ntlm_downgrade.toml,sha256=I0QMtsmH62BbBHhNYnVs6rkS0O1vr89yzE2sQ4Vm05M,5015
src/detection-rules/rules/windows/defense_evasion_obf_args_unicode_modified_letters.toml,sha256=oE7_1oyfB-tvtWyzYX42HjVeSqsgSnf8jOp9DeMKzKY,5455
src/detection-rules/rules/windows/defense_evasion_parent_process_pid_spoofing.toml,sha256=VJZ41spg5FzT2ZBz5ceq0eW2djHavJ6FJU1W4sjEPvk,8300
src/detection-rules/rules/windows/defense_evasion_persistence_account_tokenfilterpolicy.toml,sha256=T6jdu2QEyVTTxJU6fL-oBuf0mncTsDVhlMVwowpaW4g,7362
src/detection-rules/rules/windows/defense_evasion_posh_assembly_load.toml,sha256=gMIxp8Jeo-ZOEBNtWMOwS9bVRW65GNmcQfR1Uw0c54w,11656
src/detection-rules/rules/windows/defense_evasion_posh_compressed.toml,sha256=7zLSF4EzeP6-ZaWAGxeX0nRIoYshipxEJdBpl3Yr8yo,11434
src/detection-rules/rules/windows/defense_evasion_posh_defender_tampering.toml,sha256=7_I_yI1MFttsvshrfrBBw94XhifkgL59od0Mbz8vVSI,11053
src/detection-rules/rules/windows/defense_evasion_posh_encryption.toml,sha256=-fsT73YaXwh6RXgn9KfYen1-7YYmNe7O5Zlq__b4w0w,10773
src/detection-rules/rules/windows/defense_evasion_posh_high_entropy.toml,sha256=fGAs2uS17SD3LEXmkcM1HTAlXUTLjGveBh0Lcfqx1q8,12477
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation.toml,sha256=dYF8EJYLnNUeg2ztvp9x5NqL4Efy8O9QS7Ty05AhINk,7709
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_backtick.toml,sha256=bkpCTDZClY6j9UMwwCSb08hxsW44rgnlNC2XUKNFibo,12777
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_backtick_var.toml,sha256=IC_HXgoYX8mA1i-_7EHIJuMSGTCh-yrwWebSiHs3a7o,11775
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_char_arrays.toml,sha256=rzUL5EHyc1490qxdr3_QTY3XJcDo0ThP-jjlmCfCdv8,11948
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_concat_dynamic.toml,sha256=OjMzcxoX1B6UdXcVEwXE_wleG84Qb24NzcTs-q6d_-k,12089
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml,sha256=ow_xW7a39yQTwssttqLqpFLZS7annxHrGnMGvOlq3PE,10821
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_iex_env_vars_reconstruction.toml,sha256=upEGKR89-ti2lu_kpgEWHizYNtnm2M7onr_U_BQZCSo,12160
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_iex_string_reconstruction.toml,sha256=CXNG94TiIpnyTlfRlKVLIQ49wbpXdjiIYx50Mu1KQoA,12116
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_index_reversal.toml,sha256=ymsXpELoXOcIxdMc2P1GXY5Sqemk9Ez_TgRWItH7pFw,10945
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_reverse_keyword.toml,sha256=NBBDxsZtCUUhuOOI2Qx2eYOpMPhSTSNzzSH8Hvdrs0c,12729
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_string_concat.toml,sha256=urfvgia_7u2v2RjUoqPYIBbj4Y23ZG5zqFYzAkJzZk8,11548
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_string_format.toml,sha256=DtaF7Gawu3APgU8Q6N4AeZrKC0dH_na9Gb54LRuIY9k,12797
src/detection-rules/rules/windows/defense_evasion_posh_obfuscation_whitespace_special_proportion.toml,sha256=7f71GjCwPMRo6lTvB34lX2zJgmhhDMhmmR1tZkffZ-o,12700
src/detection-rules/rules/windows/defense_evasion_posh_process_injection.toml,sha256=pA7mOGWetQQZ1IX8Q1sVogE4beBeRSVzk8gm56lKIw0,11309
src/detection-rules/rules/windows/defense_evasion_powershell_windows_firewall_disabled.toml,sha256=am79dz3gAQf4ByzAl7vlv9jEnROtTepQl17hraYTH5k,5851
src/detection-rules/rules/windows/defense_evasion_proxy_execution_via_msdt.toml,sha256=1Iz_8gB8Nc9vXF38AZDEUcuAM296PwoYAzGAI39HCf8,6930
src/detection-rules/rules/windows/defense_evasion_reg_disable_enableglobalqueryblocklist.toml,sha256=NzVhm5SYxa7qO2i97Q3BQErCIgGEKOqkP2US0846A3Q,6868
src/detection-rules/rules/windows/defense_evasion_regmod_remotemonologue.toml,sha256=da2Ije8evHBR9OUhUeSWBRlGVSlLT5yfWi0E3VDAY1I,5372
src/detection-rules/rules/windows/defense_evasion_right_to_left_override.toml,sha256=AQsFNVVW-R8EjotOa_V3p78hQLHO5bOWkJpvm44615k,6553
src/detection-rules/rules/windows/defense_evasion_root_dir_ads_creation.toml,sha256=e7Jvr7aImnA1iEZfenqMK6ROkm6GCPWz0FfX6erKHDI,6122
src/detection-rules/rules/windows/defense_evasion_run_virt_windowssandbox.toml,sha256=uRXXqt_phf_qZq9Xrs29e1dZ6vbjAI9GIdSLRGkJzDo,6489
src/detection-rules/rules/windows/defense_evasion_rundll32_no_arguments.toml,sha256=eAgWv0d8l-9DMRS3IM2WA9JFkT15aRmfRYJsvX381ig,7646
src/detection-rules/rules/windows/defense_evasion_sc_sdset.toml,sha256=9A9RSf_-68PQPDqRl7DY5pNhMNC2iE8u20dtuRzavsk,6841
src/detection-rules/rules/windows/defense_evasion_sccm_scnotification_dll.toml,sha256=uvnhItoYwlIdevC52yczeQzZrW-Xy-d_QiQR1Lv4CNU,5183
src/detection-rules/rules/windows/defense_evasion_scheduledjobs_at_protocol_enabled.toml,sha256=Gs7gHCniulkjkXATKqPNiPfueBIpKhplY-8fu9XCMZA,6377
src/detection-rules/rules/windows/defense_evasion_script_via_html_app.toml,sha256=HPUn1ahYN8LH1fLcNZn3HUuZIFI6sPcUY-YaT092Bwk,7584
src/detection-rules/rules/windows/defense_evasion_sdelete_like_filename_rename.toml,sha256=aCL1Yx5TElh_k-BfNqccxZZvhMn7e40dRWSVay-rAnU,4831
src/detection-rules/rules/windows/defense_evasion_sip_provider_mod.toml,sha256=4d1kKEoMNLU3Y7RHiuqumwbcELh5pN8TWKQMIRKFUf8,6571
src/detection-rules/rules/windows/defense_evasion_solarwinds_backdoor_service_disabled_via_registry.toml,sha256=S5IzTxyOpDOTQkAVvodIcDI_KDAY6fonh2JFbmowuP8,7272
src/detection-rules/rules/windows/defense_evasion_suspicious_certutil_commands.toml,sha256=mTaNP1zEBHLEsUECHLUgBDrd498WcUa6-GpkLguR1KM,7534
src/detection-rules/rules/windows/defense_evasion_suspicious_execution_from_mounted_device.toml,sha256=CkBAfL6QIht9t_ZITPMc5HSzEWF4JNg-cfcoeeXGmx4,6991
src/detection-rules/rules/windows/defense_evasion_suspicious_managedcode_host_process.toml,sha256=0KtPjjJmzi6_tvXvEEBn_rginTEE48B6pefrMm80inE,6050
src/detection-rules/rules/windows/defense_evasion_suspicious_process_access_direct_syscall.toml,sha256=HdOwBb3aEKj1lUtcaLZBd9si-1rg9mO2PiPpvI12aoM,8928
src/detection-rules/rules/windows/defense_evasion_suspicious_process_creation_calltrace.toml,sha256=8BAvgVkbqxlFPZ7ub1kD_4xvrKWO2APFhjQ0vtsqDlM,5035
src/detection-rules/rules/windows/defense_evasion_suspicious_scrobj_load.toml,sha256=m9gOiWWP1O0nBOpIM2n7xf5SNEb1Geow5key6tMF_i8,6214
src/detection-rules/rules/windows/defense_evasion_suspicious_short_program_name.toml,sha256=QTLl47P2tk_9pn7C09Lsp5Ijg5yaurscuwoUxb0HgV4,6566
src/detection-rules/rules/windows/defense_evasion_suspicious_wmi_script.toml,sha256=EqJoH6VQvaPWIiiNm0GYZCw87GKHDqvwH-I6h6z4Bb4,6330
src/detection-rules/rules/windows/defense_evasion_suspicious_zoom_child_process.toml,sha256=t9aVHa3nPGnq5zriFYfR3M3880CVIF1rRXP2FDp8csg,7337
src/detection-rules/rules/windows/defense_evasion_system_critical_proc_abnormal_file_activity.toml,sha256=G3pBiBPH7pliXYPPNRJtf8VW5B7hu9on8ECOoJ_2pWI,7204
src/detection-rules/rules/windows/defense_evasion_timestomp_sysmon.toml,sha256=lLWHCeKZjxscoSsQsW2Y2ygPVTtVLYAmp7_EDc6Edtk,8254
src/detection-rules/rules/windows/defense_evasion_unsigned_dll_loaded_from_suspdir.toml,sha256=QAxInct42dZsyHBq1Bw0FkKD4hC6osFxvZZmYJ4v06g,10248
src/detection-rules/rules/windows/defense_evasion_untrusted_driver_loaded.toml,sha256=lzlcToq_Ifgyo74fDO2XcnSPjgrGifJ3DOchv2uDoSQ,7390
src/detection-rules/rules/windows/defense_evasion_unusual_ads_file_creation.toml,sha256=RgsElJC4P3U_Oy08T_4gBOaIc3fX9DyO1A_uZcGbvdQ,8004
src/detection-rules/rules/windows/defense_evasion_unusual_dir_ads.toml,sha256=d9_AVjW57h62EmShdJZ68r-qA1W_VVSbVzAPTih3kjs,5742
src/detection-rules/rules/windows/defense_evasion_unusual_network_connection_via_dllhost.toml,sha256=KnrlZkb9QbggGSgq6-feTNXxSjOGqz0v_r33RDmL7So,6006
src/detection-rules/rules/windows/defense_evasion_unusual_network_connection_via_rundll32.toml,sha256=2aTFUA1a1LmP7at2lA_skHiidlWtLMy-aro6lwfP4Mg,5452
src/detection-rules/rules/windows/defense_evasion_unusual_process_network_connection.toml,sha256=yX6Ophmpkpzel5lGktE9SRn7vBL0cBAYTCWGa9gBwvk,4647
src/detection-rules/rules/windows/defense_evasion_unusual_system_vp_child_program.toml,sha256=D0gyOcS64wZ9qOBS-YX4dJIQ3-WNmNcSr5IXa_vqr9M,5979
src/detection-rules/rules/windows/defense_evasion_via_filter_manager.toml,sha256=YIAWTd_tXAFXDg9gA29QKnqpsJNVMD25BZAZFLsanLI,7807
src/detection-rules/rules/windows/defense_evasion_wdac_policy_by_unusual_process.toml,sha256=gNMVWqo-oD_fMzMxlWivneh2Mn2GznaC0fpQk8RI-uY,4207
src/detection-rules/rules/windows/defense_evasion_windows_filtering_platform.toml,sha256=vp6IPNfz6MMHHg3tOtK3STacneRVfNraPdC1YUb44uo,10801
src/detection-rules/rules/windows/defense_evasion_workfolders_control_execution.toml,sha256=RrNWQAHunYKEN9cgxqPAQOCXT3gd-JPV13a7VDupiqk,4870
src/detection-rules/rules/windows/defense_evasion_wsl_bash_exec.toml,sha256=puYptvYAfibK6l9D9JFCiZLqdyEdcmZqiWNaDhU5cDY,7079
src/detection-rules/rules/windows/defense_evasion_wsl_child_process.toml,sha256=mVW_R3Dbfp-M3a280xKDWKvLtAMWM3d09GuE5k_tcXg,7299
src/detection-rules/rules/windows/defense_evasion_wsl_enabled_via_dism.toml,sha256=UesneOswq1R7iocJo8vg9QLaxl88WgiTXKvj3KlLFjE,4790
src/detection-rules/rules/windows/defense_evasion_wsl_filesystem.toml,sha256=fTbCy6hGMcd9jsaagXooFfzWDjAfuljjPltx2EJqL7U,5690
src/detection-rules/rules/windows/defense_evasion_wsl_kalilinux.toml,sha256=7294lxGdAu9mtl33cvpYWPkgVkUPdqPuxw05IehmkFA,6609
src/detection-rules/rules/windows/defense_evasion_wsl_registry_modification.toml,sha256=HOBOA2c-daK49hs6kOSFeCwiXuk-MF1yJrVGCJ7f0Ww,4979
src/detection-rules/rules/windows/discovery_active_directory_webservice.toml,sha256=eZHSHkw703rfmtDtdjCXfgOIFji3anbPm-RXPvAhHj4,6129
src/detection-rules/rules/windows/discovery_ad_explorer_execution.toml,sha256=Sjm0lrn1mK6Fu3ec9yq-WKFNiJGkqbVLYhfSRXn46U8,4843
src/detection-rules/rules/windows/discovery_adfind_command_activity.toml,sha256=3Ll9ppcq4JywqUcNANuQioo2hkvdqCTOsn5ML_W-jhU,6873
src/detection-rules/rules/windows/discovery_admin_recon.toml,sha256=Pakn_fc5BIi0YEv8JZ0ZoMlSIep30_ztxJpOrHLrBQE,5295
src/detection-rules/rules/windows/discovery_command_system_account.toml,sha256=CfHAemH9rU1mPUtJ4-Kyl9SJ11qU_byhbGl00ds6Atc,6307
src/detection-rules/rules/windows/discovery_enumerating_domain_trusts_via_dsquery.toml,sha256=mGjX076dCRw3OzcpnABV4DHAxjCwNbL-QV5CPGworTc,4698
src/detection-rules/rules/windows/discovery_enumerating_domain_trusts_via_nltest.toml,sha256=8RgkXdZSD_9dBZKXzdFacySiYG0nmAanTQa-LfSDTaM,5041
src/detection-rules/rules/windows/discovery_group_policy_object_discovery.toml,sha256=6ULB5GD46JX88TLugEYL1zf5ajAR9M4xaZtsyDPrBpE,5131
src/detection-rules/rules/windows/discovery_high_number_ad_properties.toml,sha256=FVs-8mEVY1HT3nvjso4b27W8hB5__lHXbERWlVFeNfE,5822
src/detection-rules/rules/windows/discovery_host_public_ip_address_lookup.toml,sha256=OmyinbFOqLlMLwKsOVW_AVR4FFJFs26vEW4QX7piOxA,5677
src/detection-rules/rules/windows/discovery_peripheral_device.toml,sha256=e0pasFK70AAHYXvfhJuoWi6oM9orXQZljUEO4BIWXSc,4309
src/detection-rules/rules/windows/discovery_posh_invoke_sharefinder.toml,sha256=a3_FIXAArAqSZc91DesjxJL5e5hRK9wvjfJMxZXnB3k,11928
src/detection-rules/rules/windows/discovery_posh_suspicious_api_functions.toml,sha256=LxinEk7IAVW5KbV8Y6Ban2BjVmk3CMOpfUQHrxjaQLw,13595
src/detection-rules/rules/windows/discovery_privileged_localgroup_membership.toml,sha256=v7cGEw1rPI9n-OgAM1gZfEjjldwuATwMqtPPJ-4V8k0,10561
src/detection-rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_cmdline.toml,sha256=Gj1vJ6zUmgL0imGWKEAjmWEabtKqt0KxNrYZ5-DK7JE,5733
src/detection-rules/rules/windows/discovery_signal_unusual_discovery_signal_proc_executable.toml,sha256=yDoMV7s3ssw7ZhVoD7uVLBePdWg304HsxwMpzWIFm4M,5341
src/detection-rules/rules/windows/discovery_whoami_command_activity.toml,sha256=ZiSmLfsT28O-EhmiIgkZ-uOD_ZPUG38FJ77drJqWT9Q,5471
src/detection-rules/rules/windows/execution_apt_solarwinds_backdoor_child_cmd_powershell.toml,sha256=UNKozCBeuEku94tos5JqwAax1e89TMktriajD9ro6mM,7436
src/detection-rules/rules/windows/execution_apt_solarwinds_backdoor_unusual_child_processes.toml,sha256=soMDgJ9mny9YGN19iItkxZnBQbUBqISETaZwoGhXoww,7032
src/detection-rules/rules/windows/execution_com_object_xwizard.toml,sha256=g8_UOIiMfV5CVzvy2HyVfA-qTO344rF_DHwrtXDyND8,6688
src/detection-rules/rules/windows/execution_command_prompt_connecting_to_the_internet.toml,sha256=I_u9NcE1nn8fmIi9hpnp3YL5du3HM4ndENPIZhpsmw0,9629
src/detection-rules/rules/windows/execution_command_shell_started_by_svchost.toml,sha256=JOWtVT2cNCWJED6tr8wyl1Srx0hzVgXIY8id4k-gTJs,7536
src/detection-rules/rules/windows/execution_command_shell_started_by_unusual_process.toml,sha256=R3m3cNawp8y9rAXja6gnwRhpuGAWYrbQPAC_2iRtS0A,7122
src/detection-rules/rules/windows/execution_command_shell_via_rundll32.toml,sha256=l_J8i2Zg32z6fwJedx49b5WJd-ZEeRGka-_uh1l4Ybk,6608
src/detection-rules/rules/windows/execution_delayed_via_ping_lolbas_unsigned.toml,sha256=IPytLKsHkI2yqR_MdqWdnTwqW1dF5JLqBsaP8p1oF20,9032
src/detection-rules/rules/windows/execution_downloaded_shortcut_files.toml,sha256=kBrvs0VjryyCZ5EkNxDzlDnL1ANsCG-xFRWtKNXcz8g,5577
src/detection-rules/rules/windows/execution_downloaded_url_file.toml,sha256=oPpSCfeIGyAd5oGnVnCP2qOdlmVhGa-cIKKJ0vJEnjo,5484
src/detection-rules/rules/windows/execution_enumeration_via_wmiprvse.toml,sha256=2GT1vfvc8R5Q0iRA1irPtiOZprOebiGRBdFzvbddOrA,7381
src/detection-rules/rules/windows/execution_from_unusual_path_cmdline.toml,sha256=8BxUTbOdIJpUtADoXEQntY3wjkp6QciTHGhBBmkO-KA,12174
src/detection-rules/rules/windows/execution_html_help_executable_program_connecting_to_the_internet.toml,sha256=u8SPJyERVtvQ5RPoT3K4ESvMDEW8inuBj5SFunM4dqw,8778
src/detection-rules/rules/windows/execution_initial_access_foxmail_exploit.toml,sha256=slLJWsy3407bImrRqjWyaw9pVkj3nTY6OfDO5HSpL4w,6394
src/detection-rules/rules/windows/execution_initial_access_via_msc_file.toml,sha256=5oemDsqMX0qqarn2HuZSRbUGeIHekt9WmtYas8uP5Xc,5332
src/detection-rules/rules/windows/execution_initial_access_wps_dll_exploit.toml,sha256=AFWn1tkQOm9VE7XZygQ42adpIqeGo3htbQnw5UiWIok,6432
src/detection-rules/rules/windows/execution_mofcomp.toml,sha256=_at_pdfpImMrb1p1IN3mxlS7r7yi_dcscBOkTFwatk0,5921
src/detection-rules/rules/windows/execution_ms_office_written_file.toml,sha256=fMnUyxhLwpy1-qrf5ynsdWZwKY7V2YL2z3qr7y3-nY8,6419
src/detection-rules/rules/windows/execution_nodejs_susp_patterns.toml,sha256=uP8ICm99MNfB-aM5NRoqrT1lOpdNxP0GUbv2dSqoOB4,6096
src/detection-rules/rules/windows/execution_notepad_markdown_child_process.toml,sha256=V1kCVTXwzcGyEf7LUH4WuPEoU9rM14mYsEUihAmyrmc,3752
src/detection-rules/rules/windows/execution_posh_hacktool_authors.toml,sha256=XuPFXXr84H1OaTXWxVWJXa6lUpjc4ZlNIavpvGt6EQ0,10135
src/detection-rules/rules/windows/execution_posh_hacktool_functions.toml,sha256=mX3EvcA_n5oDUJ5jB0Yc4a2tEHGSEpjS_MOM6i1jyk0,19253
src/detection-rules/rules/windows/execution_posh_malicious_script_agg.toml,sha256=H6eExB762G9ijLOEkI2X8KPvkYbxeJAVkdhED2NWuOg,8647
src/detection-rules/rules/windows/execution_posh_portable_executable.toml,sha256=e51LFclzYdenDfEiYG-j-IP8yrd0k7Mk1befUU9XNag,9936
src/detection-rules/rules/windows/execution_posh_psreflect.toml,sha256=uQuHqQhk4gudcIJnnKaVsc00Dsb8dKaw_vD_ZKlsEcY,10325
src/detection-rules/rules/windows/execution_powershell_susp_args_via_winscript.toml,sha256=SBeYxBOK_1aaB9e3a7Dh6CYwWqC29OtXyCyf3VtyQjY,7030
src/detection-rules/rules/windows/execution_psexec_lateral_movement_command.toml,sha256=UkS2etnO--R8YsIif4zIHhaQTSc4hcq5lccc9f67ysk,5744
src/detection-rules/rules/windows/execution_register_server_program_connecting_to_the_internet.toml,sha256=6gyNAcHyRYLYV3Bkt19TuqZxS6-PIQV4ynYWWH0RtLg,8533
src/detection-rules/rules/windows/execution_revshell_cmd_via_netcat.toml,sha256=_iPOjO7tXhpz4NuPOWEz3rXyO43HRPUp-q1pMcEiSFs,3914
src/detection-rules/rules/windows/execution_scheduled_task_powershell_source.toml,sha256=Ukii3UFyN-UBXR38e1nx4343xfuoLNvbXsLrfjPkn6Q,6366
src/detection-rules/rules/windows/execution_scripting_remote_webdav.toml,sha256=9aqVUlUCElNddS9-paTMmLcL__r5Ffs6ewsdKmjNlpI,4678
src/detection-rules/rules/windows/execution_scripts_archive_file.toml,sha256=250EUSRKlflfvfXXb2STv_7gxNWtI4tcieidmg1UxB0,6740
src/detection-rules/rules/windows/execution_shared_modules_local_sxs_dll.toml,sha256=6KtKP1sQpMPG2P8t5vsAY_Pxgb7S3yH3E--ty6m3I1k,2235
src/detection-rules/rules/windows/execution_suspicious_cmd_wmi.toml,sha256=-4Hoo7imXX8xOa6_S8vyRVgzGLrSFxs7WR4pBTFUpEI,6678
src/detection-rules/rules/windows/execution_suspicious_image_load_wmi_ms_office.toml,sha256=oXZSLLYVYGDhKu4z2yv1-EGT3ncczzOtud0NE1EmRN0,6229
src/detection-rules/rules/windows/execution_suspicious_pdf_reader.toml,sha256=bR5Jv4nTWhGA98t69DzpaPnnGqn4WtGzC80oW1d3paI,6756
src/detection-rules/rules/windows/execution_suspicious_powershell_imgload.toml,sha256=VTQoTrfSZYNrlMd-fQ67_RzX9WLZLkntZZDMydFVHdU,6783
src/detection-rules/rules/windows/execution_suspicious_psexesvc.toml,sha256=ic2nrCsXMZniME32tkpy4HNMdo1-CTEqQ_04HofZmFE,4908
src/detection-rules/rules/windows/execution_via_compiled_html_file.toml,sha256=wdu_WI5h7QgX_3BspesTdTlszCl-G5nBfrIaLbMH7oc,8522
src/detection-rules/rules/windows/execution_via_hidden_shell_conhost.toml,sha256=A0XLi8MarYpc3HKALpWHwvxkUSzoMQJyloHhjHGI2Rk,6406
src/detection-rules/rules/windows/execution_via_mmc_console_file_unusual_path.toml,sha256=coOcynWXWswe_RY2uWRjyJ6uTSU7XDM4QbXTb7IiWaY,7089
src/detection-rules/rules/windows/execution_windows_cmd_shell_susp_args.toml,sha256=d4VzL7AyXFmmQ8MJpyXJUNBB_LSAsn9-i3viQ6Qa8jg,10526
src/detection-rules/rules/windows/execution_windows_fakecaptcha_cmd_ps.toml,sha256=30e8gROm412sQcxTLcZwS6BOTIgVne61ajBkvIF4aLU,5687
src/detection-rules/rules/windows/execution_windows_phish_clickfix.toml,sha256=mhz5fOI0RpiWb2FpH8f22si9HtL0wzfhSwWNRC2jaV0,5564
src/detection-rules/rules/windows/execution_windows_powershell_susp_args.toml,sha256=TqVryvH_CDZ6W2L3DcabHgs9aVCprK2Dl29EbJofPW4,9107
src/detection-rules/rules/windows/execution_windows_script_from_internet.toml,sha256=HJkPHyLDdoSnVCM4SrzVWVlurDbacaWTJeuXYi0MpVg,7330
src/detection-rules/rules/windows/exfiltration_smb_rare_destination.toml,sha256=_wtLhQ8pARBL-l3mXfop7qSOblDv8jxXviSqPWCGEhs,6530
src/detection-rules/rules/windows/impact_backup_file_deletion.toml,sha256=2xNOIQuekfe6RxkxyYHG706ozcO_HcMlQc6An8xKR9U,5553
src/detection-rules/rules/windows/impact_deleting_backup_catalogs_with_wbadmin.toml,sha256=1Od1FkY5Osw6bnVJVkMrmp7xQvm3uZYPnNtIuxAiHHM,4807
src/detection-rules/rules/windows/impact_high_freq_file_renames_by_kernel.toml,sha256=JPsfxZjIJlrCFX-ABDimIuTvSTfDoUnKKQJhi3yPoVA,5080
src/detection-rules/rules/windows/impact_mod_critical_os_files.toml,sha256=W7odggYHI38fTaZ3OnY9NlTLHkQ1TJBRwb7oqYkX9Cc,4512
src/detection-rules/rules/windows/impact_modification_of_boot_config.toml,sha256=p_xQQaFrLRDa2y9GSyC2H-KDpP3f6xZVhQpW2ZVRr5s,4605
src/detection-rules/rules/windows/impact_ransomware_file_rename_smb.toml,sha256=yuOkSMN7HB0IG3yZ_K1g3OWIfU6B9mNdrpe3SKvMcA8,4744
src/detection-rules/rules/windows/impact_ransomware_note_file_over_smb.toml,sha256=HjYDFOX4vpan1X3ElPd4V1Qy-AdHOQSmAbfZflvIVsU,4625
src/detection-rules/rules/windows/impact_stop_process_service_threshold.toml,sha256=LDad3pb85c60JYoO4xEhMHNWGJQOkAehbWlYySHpfAg,4251
src/detection-rules/rules/windows/impact_volume_shadow_copy_deletion_or_resized_via_vssadmin.toml,sha256=6o6d3tN57CKggjtetenudPo_t0GFDqkz9QYGKZ-eK3A,6138
src/detection-rules/rules/windows/impact_volume_shadow_copy_deletion_via_powershell.toml,sha256=CYA8bXjDIvP9LIUa5qPjOE-zkkekmm2oGq3KRpgWuuQ,6805
src/detection-rules/rules/windows/impact_volume_shadow_copy_deletion_via_wmic.toml,sha256=qePq_WqWQjh-yqaFlqOEo1Prcpc9G6SdUpfqMa4kCRw,6227
src/detection-rules/rules/windows/initial_access_evasion_suspicious_htm_file_creation.toml,sha256=xpUAEkFc1-iWrClJdKEZADRro0XO9Z8IUOACXuDJLk0,8615
src/detection-rules/rules/windows/initial_access_execution_from_inetcache.toml,sha256=St0s-hodAJk3gPP0Nfy7YTVzJ5Lc1GUVMMVsB2scz_E,7248
src/detection-rules/rules/windows/initial_access_execution_from_removable_media.toml,sha256=-ivRxxTMZL9_Av4RCI08Itn-sJTHzJQCNVbM8OkyuaE,5929
src/detection-rules/rules/windows/initial_access_execution_remote_via_msiexec.toml,sha256=YpUOCGGForsbJTcGewZqI-v61lSmxZu7j36f3YzWl00,8419
src/detection-rules/rules/windows/initial_access_execution_via_office_addins.toml,sha256=9N1AKA3-oXUrQMf7fZTdC5h7YSvCK8VgFQp1ySbz-Jo,8435
src/detection-rules/rules/windows/initial_access_exfiltration_first_time_seen_usb.toml,sha256=h4u7saCsLJMSHZiMRO22F-oQtlWOFF7GTMPh19CRcfs,6179
src/detection-rules/rules/windows/initial_access_exploit_jetbrains_teamcity.toml,sha256=sVFLXGry7649R07fftCtmre12RiLdOIrLPQS_sgT7bo,8312
src/detection-rules/rules/windows/initial_access_potential_webhelpdesk_exploit.toml,sha256=96yFYGZTMthPRbTu3zgGfz0rZdZ5ve_Bi6S1pUDGWac,5427
src/detection-rules/rules/windows/initial_access_rdp_file_mail_attachment.toml,sha256=wZVayAcqomUSOuFChxajSHr6B6Grwi9jtMd65fYGHIU,6738
src/detection-rules/rules/windows/initial_access_script_executing_powershell.toml,sha256=4zCgBbWrC_gy54rghqp3lL8vgtqTGCHfsQGgJwUm5Rg,6172
src/detection-rules/rules/windows/initial_access_scripts_process_started_via_wmi.toml,sha256=sH6JR5fiJnujcYPGyHmoAL60muueSRwRFgP6CHMhov0,7350
src/detection-rules/rules/windows/initial_access_suspicious_execution_from_vscode_extension.toml,sha256=ZdsnsyVk7JO2glyp-b2dW474YiSVTWdBeXmzmKFLnh0,5146
src/detection-rules/rules/windows/initial_access_suspicious_ms_exchange_files.toml,sha256=UtWxZ8dd390xlJe99VzMvDZwcXHEzpM_ymsHjBs8r78,3950
src/detection-rules/rules/windows/initial_access_suspicious_ms_exchange_process.toml,sha256=3TtfdzAbCServFNM7MOTj4XGlJt1ex5oypkepIuaV2Q,8241
src/detection-rules/rules/windows/initial_access_suspicious_ms_exchange_worker_child_process.toml,sha256=VpXVpiCdgoreMl92vhEVKXNZzmb22wsQ26x-SI07zEU,7550
src/detection-rules/rules/windows/initial_access_suspicious_ms_office_child_process.toml,sha256=hdL6L6bSAC2sPWMQBbtHJLuCmGYQa0ZN5LvcKeuK8Z8,7900
src/detection-rules/rules/windows/initial_access_suspicious_ms_outlook_child_process.toml,sha256=gawfeD2jrcx8aFY7zGvaeuayatbfoWNfde2qe_ZK6dY,7158
src/detection-rules/rules/windows/initial_access_suspicious_windows_server_update_svc.toml,sha256=LEv4S7HT4zY-LhWxoEhCyQwbsheC8ztjbgXQrYpQ7ZE,5430
src/detection-rules/rules/windows/initial_access_url_cve_2025_33053.toml,sha256=cmmLNonNSdmBbAvMLW-0xMvE9FetE5VquUtFb7pWrfs,4665
src/detection-rules/rules/windows/initial_access_via_explorer_suspicious_child_parent_args.toml,sha256=Y1YQkZVZt9rtJvgFz7Z5lIfRcpUqDXS-Xyoi22omv2M,7969
src/detection-rules/rules/windows/initial_access_webshell_screenconnect_server.toml,sha256=cNqxe5irmQ7QVNHqh5jzJCpeejD6_4bU22N7bsARH0g,7010
src/detection-rules/rules/windows/initial_access_xsl_script_execution_via_com.toml,sha256=NoSSCuAYQHs8QrjiLBQdGkE0YyLcqNHff2OlA9SzNW8,6533
src/detection-rules/rules/windows/lateral_movement_alternate_creds_pth.toml,sha256=qFnnTafyct_DTY8T7dDcTgztcIioPDTYkTdytfyzVmA,6014
src/detection-rules/rules/windows/lateral_movement_cmd_service.toml,sha256=9G94e6Y3KmSsquCqUFQMEOdRh6PlhxM31EQO5OnSLxQ,6500
src/detection-rules/rules/windows/lateral_movement_credential_access_kerberos_correlation.toml,sha256=RN8XzW_Mo_isBotSL34GlaerUHEndd5Nmmp8-t4P0_M,5897
src/detection-rules/rules/windows/lateral_movement_dcom_hta.toml,sha256=gEpTvWudeoZStefuMe6tDmKibtQNtk_KhpeYWT7Br3U,6639
src/detection-rules/rules/windows/lateral_movement_dcom_mmc20.toml,sha256=S1HB9Ld0M7TMSU3tjFbED_DemqNR7AKbj8tLveR5Cl8,6445
src/detection-rules/rules/windows/lateral_movement_dcom_shellwindow_shellbrowserwindow.toml,sha256=_MIRxeTLGXDjHnYJQgGv5Da-MLcwffJ750sjz1quMlQ,6325
src/detection-rules/rules/windows/lateral_movement_defense_evasion_lanman_nullsessionpipe_modification.toml,sha256=ZJCl6KzuIkoYQ2UHdNEkVTSFTppLhB6Vvla5pubpHfE,6698
src/detection-rules/rules/windows/lateral_movement_direct_outbound_smb_connection.toml,sha256=h6Lz6mbGtRuMR2P4Q2DsjzSfaiSoc7dFiCbbWBF3c-c,8389
src/detection-rules/rules/windows/lateral_movement_evasion_rdp_shadowing.toml,sha256=d9mjpw2BfOTbnmaqjiAcwGRPvsugAxUTD0k0FBEoBK0,6586
src/detection-rules/rules/windows/lateral_movement_executable_tool_transfer_smb.toml,sha256=CzhkNIUTzxiFD4WMA9_XqXu-0pPbohnOWF6PAkM2GKE,5226
src/detection-rules/rules/windows/lateral_movement_execution_from_tsclient_mup.toml,sha256=Se2Wq3Ze0t1JX0-ZHzXJYPVEcSImReZ8YH4CNcGamXw,6139
src/detection-rules/rules/windows/lateral_movement_execution_via_file_shares_sequence.toml,sha256=L8QVfLJlmFk9kx0QVAkLE81K7I7UuQJK5OLwBqvfVNE,7545
src/detection-rules/rules/windows/lateral_movement_incoming_winrm_shell_execution.toml,sha256=Z1wQLbJ69Yo0kp5-18gvJfW4Rxe2CNWJb2QwxKLzHq4,6130
src/detection-rules/rules/windows/lateral_movement_incoming_wmi.toml,sha256=X-ST6KFz9EiHw5Vr64PFL0I9zC52LwgGRF7S1RDWKNE,6982
src/detection-rules/rules/windows/lateral_movement_mount_hidden_or_webdav_share_net.toml,sha256=jDtlhgzz1As5YeTGc3k3VL0aNJMY89GC4ENVZ6XMjmk,7035
src/detection-rules/rules/windows/lateral_movement_powershell_remoting_target.toml,sha256=1nrfmGWaYohRxMnjtpfpMKYqzNuom7qW_qJ62eHFhX4,6744
src/detection-rules/rules/windows/lateral_movement_rdp_enabled_registry.toml,sha256=M3-fEtX-W4sNCwu8sAQAyc7nLbxbF5sdEaWwOoDvoIM,5570
src/detection-rules/rules/windows/lateral_movement_rdp_sharprdp_target.toml,sha256=8TpR6ecUn1w5QA6SVYZrYOKWPrvdliKgYSo9E0YJvPk,6678
src/detection-rules/rules/windows/lateral_movement_remote_file_copy_hidden_share.toml,sha256=mFKFrnJUSK3yrOkHkMDSjgX2TsJ40KZqtceM26Sjgtg,5984
src/detection-rules/rules/windows/lateral_movement_remote_service_installed_winlog.toml,sha256=XKrC5WwooOdlfknHVaa19T0voPxHslbZ09U6-Vlijis,7696
src/detection-rules/rules/windows/lateral_movement_remote_services.toml,sha256=u1u1CINBlmKFGbPHr-82QLnTzXgwX8YcnNQzQMoZrfI,9595
src/detection-rules/rules/windows/lateral_movement_remote_task_creation_winlog.toml,sha256=9adwBkanumF87DWPl5FqaXzWm-0muxS-mH_Gam3ZlK8,4112
src/detection-rules/rules/windows/lateral_movement_scheduled_task_target.toml,sha256=NfT5CX5OhIA1-ig74iS0ro3Q3ZiGN3vkgJtYyUZbEy0,4790
src/detection-rules/rules/windows/lateral_movement_suspicious_rdp_client_imageload.toml,sha256=ygBXLX6oPAfyi5CHQmQ0Ma3vGH3Y1jbxdt7vpa7bPsE,6706
src/detection-rules/rules/windows/lateral_movement_unusual_dns_service_children.toml,sha256=_zYzWEUS5w1MdYEPphXVJfUK5D1HlyNk7lo4vZ_zguc,6342
src/detection-rules/rules/windows/lateral_movement_unusual_dns_service_file_writes.toml,sha256=oKkF_nhf1x63kCDYR7rNP3zSKlXcbuk2wl0E7OlAnO8,5880
src/detection-rules/rules/windows/lateral_movement_via_startup_folder_rdp_smb.toml,sha256=nQtCpnS_IeeyjXLk2-WnXgzL1BG-kDJoKH6P3toaGwM,7181
src/detection-rules/rules/windows/lateral_movement_via_wsus_update.toml,sha256=b_vlfgglV26zGuiA8WfQqm9RiS1RbBA4s04XWAONT_c,6347
src/detection-rules/rules/windows/persistence_ad_adminsdholder.toml,sha256=8-gJSzOvxfB6IX-VgSyCI-WKELD1s28MoFHdAxEVicM,6257
src/detection-rules/rules/windows/persistence_adobe_hijack_persistence.toml,sha256=C7Sdp4DrqC32ll7LfozFq0TgQalvoqXmTU0JwNWj3Ig,7373
src/detection-rules/rules/windows/persistence_app_compat_shim.toml,sha256=7sny3AHhPTiCeo2R9IzRPcrbp2PlqkHjzmzt_iUzW2U,6838
src/detection-rules/rules/windows/persistence_appcertdlls_registry.toml,sha256=oqyEWPuHdLNTdM-lGMtWrFapC6MDIkDgKCWQQ2R2zqQ,6977
src/detection-rules/rules/windows/persistence_appinitdlls_registry.toml,sha256=6o_KRcTnOhbEwY2WdNXEdEZli9y9Dw8QtmV90Lr0jc8,9499
src/detection-rules/rules/windows/persistence_browser_extension_install.toml,sha256=8x1eUWPkbYNThw-RQGbDTBH4V58eIUKzofO-M0d5bEw,6605
src/detection-rules/rules/windows/persistence_dontexpirepasswd_account.toml,sha256=AZXaI7PI9rdgkzslU1i6XrxQ0YJN6bHxapWQc22nRLU,5129
src/detection-rules/rules/windows/persistence_evasion_hidden_local_account_creation.toml,sha256=S_iyl_wqONlSR00uS_CGllonqvXpLPgS9iAUhXg7PQM,3930
src/detection-rules/rules/windows/persistence_evasion_registry_ifeo_injection.toml,sha256=gX-XC2BVe0whasBLIQXPPEKClZBC-KW9WoqDEVJ_K-I,7712
src/detection-rules/rules/windows/persistence_evasion_registry_startup_shell_folder_modified.toml,sha256=hsrLgGXkCF75egxVbsGrxiiKumlTz_ZGEHmS3ABcY4I,9721
src/detection-rules/rules/windows/persistence_group_modification_by_system.toml,sha256=2QXh4A3kLgYal-tRWX_TXmaw6TlU_tvdtFkiceUsZgs,5706
src/detection-rules/rules/windows/persistence_local_scheduled_job_creation.toml,sha256=NnafdcMu7_pe3HIenwn5_jeTA1UNbKIYcpVBIKn_cDA,6469
src/detection-rules/rules/windows/persistence_local_scheduled_task_creation.toml,sha256=IBuY_5zZqclSpzNX9cmSfz-nERqJ7zMUeFrCZxrpO4I,7139
src/detection-rules/rules/windows/persistence_local_scheduled_task_scripting.toml,sha256=s_pbs0UqdP6q4nqjD21vvoXR-kSfZhHbFnG5a2aqH4k,2970
src/detection-rules/rules/windows/persistence_ms_office_addins_file.toml,sha256=cy3RyKwO4vdRodc3sw7ri0fMry5WyB0nmQCOjadPib8,6217
src/detection-rules/rules/windows/persistence_ms_outlook_vba_template.toml,sha256=JGPl37JjgEjnecyB8vsSk8UENi0UGuZhVs1iMPL7kY8,6049
src/detection-rules/rules/windows/persistence_msds_alloweddelegateto_krbtgt.toml,sha256=CDJsA_izN_TmjgRB12lzsVVd1ex1kA_b0R358MrSp_I,6418
src/detection-rules/rules/windows/persistence_msi_installer_task_startup.toml,sha256=C1FaVDWas9PgzmGdZiGaIwBVIIUHCGmTVCKXZACpcCw,9240
src/detection-rules/rules/windows/persistence_msoffice_startup_registry.toml,sha256=Z3eUPnDpSxQ5-Jl1WhGnVqYFI_tQBb-05xcxR2-wz98,6081
src/detection-rules/rules/windows/persistence_netsh_helper_dll.toml,sha256=y86NtRIlST2dtiOdIrw5PRjHghqbcd16Gzc36JJquQA,5914
src/detection-rules/rules/windows/persistence_powershell_exch_mailbox_activesync_add_device.toml,sha256=kL6Ogski61D2lOyolZk2mDYDERpIRds3ULpxmfWE1vg,6884
src/detection-rules/rules/windows/persistence_powershell_profiles.toml,sha256=nxTbeLwh3NxDXs54OapQbltK_H-AW-RTslotxjFp1jI,9063
src/detection-rules/rules/windows/persistence_priv_escalation_via_accessibility_features.toml,sha256=qaMbXjbErE3TiUT1aTOf_0pQn6-nszmVwO_s9Y3cgTg,8567
src/detection-rules/rules/windows/persistence_registry_uncommon.toml,sha256=Fg4KjYWjsSu3Q2wf-SLsNLcKULTrfCakfuSBOrDERaw,12169
src/detection-rules/rules/windows/persistence_remote_password_reset.toml,sha256=bFx4cJH5B6nrOLvaDEyB3Ic3jSWoB-jwW3JXoMj5woc,6707
src/detection-rules/rules/windows/persistence_run_key_and_startup_broad.toml,sha256=yt8Vy2kGhnlY1mmDMQCacmMMdPwkaxnsoLa6nObjhQw,10835
src/detection-rules/rules/windows/persistence_runtime_run_key_startup_susp_procs.toml,sha256=rr_kFtiyokWS45HL2LkflVOVtXfq4ZD-O5cqfTvrv6s,6773
src/detection-rules/rules/windows/persistence_scheduled_task_creation_winlog.toml,sha256=xPf3XobPspYdkn3FSjuxfw34ZjFUBuX-gvEE4uE01W8,5827
src/detection-rules/rules/windows/persistence_scheduled_task_updated.toml,sha256=TMNldIFjfdrAlpRAJM6enTC6vWdm2oV3pBxV_SnzqN4,5488
src/detection-rules/rules/windows/persistence_sdprop_exclusion_dsheuristics.toml,sha256=LucqhOTCiMD4LKOVzAyybqINXNGzlcAp_ZLGoD-2HQI,5342
src/detection-rules/rules/windows/persistence_service_dll_unsigned.toml,sha256=GrZl-Wmm2mimAgvefK9LulLUBjdTTetl9i7orguJgsI,10255
src/detection-rules/rules/windows/persistence_service_windows_service_winlog.toml,sha256=KZ_lFGzauCjHGYQr5FFycF7ekG26y-N84hxb2zWX6Rw,8218
src/detection-rules/rules/windows/persistence_services_registry.toml,sha256=qRhDxeRpn5XfmNIJcr2j_8xULLV1ZXfJa9HnrKtPNNQ,7868
src/detection-rules/rules/windows/persistence_startup_folder_file_written_by_suspicious_process.toml,sha256=9lnH3fa8F375CQeEcrfVBkSZplb2pvQ5NSqM0_fjyFk,8096
src/detection-rules/rules/windows/persistence_startup_folder_file_written_by_unsigned_process.toml,sha256=8Jz6WkLjJGw6IqtwYmozV0blhLk1m5OPkldT_FlozMc,8067
src/detection-rules/rules/windows/persistence_startup_folder_scripts.toml,sha256=yRa7JxAMnYqwcMOTIX1Wx9jn_lL_a0Yh6xeEKj7e7_s,8028
src/detection-rules/rules/windows/persistence_suspicious_com_hijack_registry.toml,sha256=WddID_HrajISVPexDSEEAOpO0s8vm2c5pTu07zNbhfU,8198
src/detection-rules/rules/windows/persistence_suspicious_image_load_scheduled_task_ms_office.toml,sha256=l1np43Kuu_g8lXVH2GM8j5iv5ZuJplbw8YeNquq4xxE,9279
src/detection-rules/rules/windows/persistence_suspicious_scheduled_task_runtime.toml,sha256=Bept3Ey5tSjryIjHaV7SpqVxJ5-_uI0FaNhwTthk1O0,8264
src/detection-rules/rules/windows/persistence_suspicious_service_created_registry.toml,sha256=bP2ZxCkd7myIpsR89NI29Ra90K2xTZNNuaP5j-omruQ,6214
src/detection-rules/rules/windows/persistence_suspicious_user_mandatory_profile_file.toml,sha256=iJmQHCmilMaWDBe54MeIrUYMMmN8DhzUd3MsqynflbU,5719
src/detection-rules/rules/windows/persistence_sysmon_wmi_event_subscription.toml,sha256=9Qx7_YKk9slHgBfR7ZqtCmNecLd9dTtTITPcQUnpt2c,6230
src/detection-rules/rules/windows/persistence_system_shells_via_services.toml,sha256=T72sPeDDVArWoCW01WcKVVZL1ne-xcNI9CMoJScdVdM,6838
src/detection-rules/rules/windows/persistence_temp_scheduled_task.toml,sha256=L30_D2T9iV407bRv0GteNk8piyXdhBaW_BIGKAOewh0,6152
src/detection-rules/rules/windows/persistence_time_provider_mod.toml,sha256=mFCP4Yo4X0BGLgmJM9FeqsWvA8A9jZ0Yzq39jghrmTY,8067
src/detection-rules/rules/windows/persistence_user_account_added_to_privileged_group_ad.toml,sha256=iVYIz72BHW2jNAZ4_QWsV93AHnTLfGJX60qbVd0imSg,4313
src/detection-rules/rules/windows/persistence_user_account_creation.toml,sha256=d34lugH0guU-EOL8YEpdmlm32Hk2ssMyVCCkbiqzA0M,3921
src/detection-rules/rules/windows/persistence_via_application_shimming.toml,sha256=sjEhC3FrjKbNCTYS--HOBHtj0FbfmXgLo6OV8D1tRBk,7195
src/detection-rules/rules/windows/persistence_via_bits_job_notify_command.toml,sha256=1RB-1YfPFvC-1rmAO_vYHeUb2FpCx18-SpFA9JEg_ng,6320
src/detection-rules/rules/windows/persistence_via_hidden_run_key_valuename.toml,sha256=PbVWdM15MMKTbPu6obodbM9VKlpU3w4_H7nlbRy84v4,7346
src/detection-rules/rules/windows/persistence_via_lsa_security_support_provider_registry.toml,sha256=LilCihIdWiHBu-r9N0bKxdXONXntkWxtn70crDt--_A,6962
src/detection-rules/rules/windows/persistence_via_telemetrycontroller_scheduledtask_hijack.toml,sha256=NhRaW9jBpgzvnFv8pzuyfLZasi1tOXdmiO2fkZlfgTE,7313
src/detection-rules/rules/windows/persistence_via_update_orchestrator_service_hijack.toml,sha256=9PiKID-KMwKKr_742zfdiENfSZFm78gx46plUeBPHtQ,8766
src/detection-rules/rules/windows/persistence_via_windows_management_instrumentation_event_subscription.toml,sha256=oqsJt6wCLxcFgimA7q_V6WYwXKhRF68SvlCV4RdQVas,6603
src/detection-rules/rules/windows/persistence_via_wmi_stdregprov_run_services.toml,sha256=Zx923dwdBeM2X2Q7a6h4CHoySKMQbj1wTkI7K8hZi3Q,12257
src/detection-rules/rules/windows/persistence_via_xp_cmdshell_mssql_stored_procedure.toml,sha256=VdOvYJYKpZLNQwBmeh5-ytJ6GXCuDXiT6LRgIPMBWi4,7057
src/detection-rules/rules/windows/persistence_web_shell_aspx_write.toml,sha256=_gaWz_EyDZIDXsx4j_iegA49gTzcMO_cmN1oy75kA8g,6606
src/detection-rules/rules/windows/persistence_webshell_detection.toml,sha256=jq9_xWsKzv3bmEaiEee8rKb_zLQLRZyHnYmQP3BAXCI,9011
src/detection-rules/rules/windows/persistence_werfault_reflectdebugger.toml,sha256=zP4to8CBNGOYxl2fh99FXdjYX15jB9mGZoxg-JfyR7I,6411
src/detection-rules/rules/windows/privilege_escalation_account_takeover_mixed_logon_types.toml,sha256=UCJ20BT2uMkQ_yhjyjJcN2jQUed4e9DTct_fRw9lBNk,4050
src/detection-rules/rules/windows/privilege_escalation_badsuccessor_dmsa_abuse.toml,sha256=YxJC9Bs1GBxHLLAyCiXo_GpF5nI-igmI-0FYyQCub54,3900
src/detection-rules/rules/windows/privilege_escalation_create_process_as_different_user.toml,sha256=IOR4zon5Qzx1DvXysdb9D1lIFKb07uHqUaTbVUjj0kk,6162
src/detection-rules/rules/windows/privilege_escalation_create_process_with_token_unpriv.toml,sha256=cRCPOcCsL-iBUKtP-1CauPqHNP-MRZI86-rMxHTHWcI,8084
src/detection-rules/rules/windows/privilege_escalation_credroaming_ldap.toml,sha256=RqETi80qGAOMv2PL07GACwKoTMEeggzZHU4rpwb78D4,6466
src/detection-rules/rules/windows/privilege_escalation_disable_uac_registry.toml,sha256=fDx3FSeDoqRI7syLUE4AE42Jcc1mMTBMeE6Ry0u3Fow,7634
src/detection-rules/rules/windows/privilege_escalation_dmsa_creation_by_unusual_user.toml,sha256=_AToeouvpr3KvYTV-dt5_mbRfzlejC9AKvPiPyC8suw,3679
src/detection-rules/rules/windows/privilege_escalation_dns_serverlevelplugindll.toml,sha256=By3pab7JTH2gvz1q5PCed4FURgtTrTDEyK0vh4h2DJA,5915
src/detection-rules/rules/windows/privilege_escalation_driver_newterm_imphash.toml,sha256=HvxZYo_y6xMXAhru0FSi4eDZzEk4htjzMLTFEkDS2bE,8380
src/detection-rules/rules/windows/privilege_escalation_expired_driver_loaded.toml,sha256=4o8S2nojMRbU0qLmUapbVJD4DND38Fw-FeBkVn03RFI,5667
src/detection-rules/rules/windows/privilege_escalation_exploit_cve_202238028.toml,sha256=TOeZ7w5EdVFDCnv6aJzqj8mDznxiKkT_rzdRemnkPdA,6997
src/detection-rules/rules/windows/privilege_escalation_gpo_schtask_service_creation.toml,sha256=FmOeG6iCTwQ7TDlbLtD9ibYf6w6lP0IP0zwpQEPFQgc,6994
src/detection-rules/rules/windows/privilege_escalation_group_policy_iniscript.toml,sha256=Q-ZE1jt71B5frxlH01m5tkI6tJTghabYnf6GI8KMA8M,5282
src/detection-rules/rules/windows/privilege_escalation_group_policy_privileged_groups.toml,sha256=FZ4FmDBZlnH8c6v5ZSvCxdGnZ1JUGdRvkJ14K-LfgU0,4127
src/detection-rules/rules/windows/privilege_escalation_group_policy_scheduled_task.toml,sha256=hc2GQapWYlu6LnKQP5KwwBxYhyBckXtJgA-JKiWnXP4,5677
src/detection-rules/rules/windows/privilege_escalation_installertakeover.toml,sha256=1TmwFX2UmGubx3O00U7n0BpTohU55lXJgdqaSyqHPfw,7822
src/detection-rules/rules/windows/privilege_escalation_krbrelayup_service_creation.toml,sha256=Ft-8K-1XC1qcRN9NEbgECuy75AHUNt7KSWz1pXe_-r4,7081
src/detection-rules/rules/windows/privilege_escalation_lsa_auth_package.toml,sha256=xgLw5lU_iv7VySHfH5LJBI8mD0mC8xcYCb_7dmi5Wjk,6174
src/detection-rules/rules/windows/privilege_escalation_make_token_local.toml,sha256=j-o--7rwCLV8SZF3Wr2yrHKWRaZMON1jUIWsLV7zvws,6050
src/detection-rules/rules/windows/privilege_escalation_msi_repair_via_mshelp_link.toml,sha256=Ol8QUs6qcWn-sV6lHS1UpdqVFkn2TmJd2Y_--j27thI,6709
src/detection-rules/rules/windows/privilege_escalation_named_pipe_impersonation.toml,sha256=FXCMt9RLRtepV9B7hJL0kNdttYMUgwO0yvIC2Cr2mJY,7478
src/detection-rules/rules/windows/privilege_escalation_newcreds_logon_rare_process.toml,sha256=us1AHh_03NE8OKQSYJEJGw2NcM8EhR2UaM5FDNv77hs,5764
src/detection-rules/rules/windows/privilege_escalation_persistence_phantom_dll.toml,sha256=pn1Cc4bNIA-YtITNIJ5GgLLm13R4_iBiVT8bkw1smSo,10080
src/detection-rules/rules/windows/privilege_escalation_port_monitor_print_processor_abuse.toml,sha256=koaoBM2pcIj7d0-dByUh7F-uTMA5KNaeF2ICXe4ujNM,7324
src/detection-rules/rules/windows/privilege_escalation_posh_token_impersonation.toml,sha256=P-YQxYBWrL6OGx2zfHG6mJlWH15bAMfFcYtkCEKQwco,12267
src/detection-rules/rules/windows/privilege_escalation_printspooler_registry_copyfiles.toml,sha256=Eg48LGw7VwKJOSnAuwMMhlM99OZHJIeMLf6O6TgW1e4,6660
src/detection-rules/rules/windows/privilege_escalation_printspooler_service_suspicious_file.toml,sha256=MuYoGaeO_j7o-EZyKrVfrxUu547rQHkXMNye00l7oqw,7396
src/detection-rules/rules/windows/privilege_escalation_printspooler_suspicious_file_deletion.toml,sha256=6Olg1aRWx55mkrgr8M0miiQ9IGmwMQeRyR1ohKS6VJo,5845
src/detection-rules/rules/windows/privilege_escalation_printspooler_suspicious_spl_file.toml,sha256=anlUETfBUTJ0eBdFxPg2pCCtFDIq5ScIGsIRVLJQrAE,7968
src/detection-rules/rules/windows/privilege_escalation_reg_service_imagepath_mod.toml,sha256=UWTYbQVThaIflkVxD_X4inb2g1sKSejTExtRL4zDVfM,9122
src/detection-rules/rules/windows/privilege_escalation_rogue_windir_environment_var.toml,sha256=ZAdk_Q5fPwpje4gVXOZI4IByOVHd3GCCg1vbpqciBEg,6355
src/detection-rules/rules/windows/privilege_escalation_samaccountname_spoofing_attack.toml,sha256=mTtiDTkIXzLZY_ZFMIJBzWtPT6KuKpYSz6BUOubzAo0,6933
src/detection-rules/rules/windows/privilege_escalation_service_control_spawned_script_int.toml,sha256=ZreqoWddgjw4cKRpxSxjYDlXFIzr-QqtcmwsSPFbBOk,8019
src/detection-rules/rules/windows/privilege_escalation_suspicious_dnshostname_update.toml,sha256=XdQS5q3CcyaXwnXg2-ICNqR_uKXDZPvwkGfpr8xpeMY,6765
src/detection-rules/rules/windows/privilege_escalation_takeover_new_source_ip.toml,sha256=5FKIZ56yaMiy6mnB4fCPu2C3CvxuptOElQoNIe7FTZM,3938
src/detection-rules/rules/windows/privilege_escalation_thread_cpu_priority_hijack.toml,sha256=vZE6uCCgGpiOoyQFh8VNlqbb1Co1b-j_pGrAH8Mz1HQ,3617
src/detection-rules/rules/windows/privilege_escalation_tokenmanip_sedebugpriv_enabled.toml,sha256=nQwFtMkDIXKhxdobRJcOUbC-AbIABxduQqVbpJqaQ00,7329
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_com_clipup.toml,sha256=PhYC8BalSKrAuCZjRpnDQEoWOVf48VwuE9BjMEgfzmM,7485
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_com_ieinstal.toml,sha256=MBFTRYxAq_f1nveeFpm1a6HYnBGIecOwj2Vj4VnpQeQ,7580
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_com_interface_icmluautil.toml,sha256=nOT_xIotEHyAvo6GvsMSiCS8J7ByCW4la_9K8qCcN8g,6912
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_diskcleanup_hijack.toml,sha256=9lWxFYv_G8wXAKgJRc4yiAp1JSkr7wikOh90AeuNIRM,7452
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_dll_sideloading.toml,sha256=9FqkePH9R--lXMs4uksZRUOJaTQU4ofYzj079opdkbc,7254
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml,sha256=CMksZTL1thkcN0T6GbM3kACxmEUjUaET9PsWmMnLndg,8807
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_mock_windir.toml,sha256=G_6JPw4SnaOvFrds5mNO-6_pL-Hd91kX0nHjo8GwRjw,8625
src/detection-rules/rules/windows/privilege_escalation_uac_bypass_winfw_mmc_hijack.toml,sha256=ZctV6YJb52604KHgmkA678wgsQZUrqiCXLgUH2MGa5c,8539
src/detection-rules/rules/windows/privilege_escalation_unquoted_service_path.toml,sha256=KAz8Bu33Lgkvst8UsmPd8bhkCHcefmHb-F_Hz7lYC4c,6355
src/detection-rules/rules/windows/privilege_escalation_unusual_parentchild_relationship.toml,sha256=_Axno6Ol0VTI3eJYhRjh2GkV7gvs__nwP2wcw_EZLn8,9841
src/detection-rules/rules/windows/privilege_escalation_unusual_printspooler_childprocess.toml,sha256=PmbNzQ7Bp3siV1IJTolLocvYIfjNTEK8iodgGDTtoCc,8592
src/detection-rules/rules/windows/privilege_escalation_unusual_svchost_childproc_childless.toml,sha256=u_TLhyqMmCF4HBw0EYYk_DbEPO99haj9K5CbY-p0YvE,7828
src/detection-rules/rules/windows/privilege_escalation_via_ppid_spoofing.toml,sha256=9DQ5eeYr8aSwr8bwJSyjOggjxo5soeQmqkA38k_bdTY,9880
src/detection-rules/rules/windows/privilege_escalation_via_rogue_named_pipe.toml,sha256=pUlGQseYyqX77bUWbD5nDMAs8T6-rgPh5uECXrKjS8E,6176
src/detection-rules/rules/windows/privilege_escalation_via_token_theft.toml,sha256=goupRYA1Zc5_m40C3VhjB9R9g4wc1xcCg4Q7hu0BDaw,10206
src/detection-rules/rules/windows/privilege_escalation_windows_service_via_unusual_client.toml,sha256=Qfi-w1KpA3dLyZ_s0xc3vZOey9IasOKirk-C3JPzRkw,7502
crowdsentinel_mcp_server-0.5.6.dist-info/METADATA,sha256=VhUYiOQ50CTfJosmcF9sOKcfSs_eCnFm-2ESs1EbGzc,38856
crowdsentinel_mcp_server-0.5.6.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
crowdsentinel_mcp_server-0.5.6.dist-info/entry_points.txt,sha256=W1ohzQLof2Ig0sMej7Y87in7_XVwXnvGzUUWhSP6Lo4,186
crowdsentinel_mcp_server-0.5.6.dist-info/licenses/LICENSE,sha256=qJjlNcG6XN9jPfGEE6cF-Cn6xwxX3C6WJUFHDBIZvD4,35149
crowdsentinel_mcp_server-0.5.6.dist-info/RECORD,,
