Приложения on Alertix

Стандартный конфигурационный файл Winlogbeat

Mon, 01 Jan 0001 00:00:00 +0000

Для ОС Windows:

processors:
- add_host_metadata:
 netinfo.enabled: true

winlogbeat.event_logs:
 - name: Application
 ignore_older: 72h
 - name: Security
 ignore_older: 72h
 - name: System
 ignore_older: 72h
 - name: Microsoft-Windows-Sysmon/Operational
 ignore_older: 72h
 - name: Microsoft-Windows-Windows Defender/Operational
 ignore_older: 72h
 - name: Microsoft-Windows-PowerShell/Operational
 event_id: 4104
 ignore_older: 72h
 - name: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
 ignore_older: 72h
 - name: Kaspersky Event Log
 ignore_older: 72h
 - name: Kaspersky Endpoint Security
 ignore_older: 72h
 - name: Kaspersky Security for Exchange Servers
 ignore_older: 72h
 - name: Microsoft-Windows-TaskScheduler/Operational
 ignore_older: 72h

output.logstash:
 ssl.enabled: true
 ssl.verification_mode: none

Стандартный конфигурационный файл Sysmon

Mon, 01 Jan 0001 00:00:00 +0000

Подробно с параметрами конфигурационного файла для загружаемой версии Sysmon можно ознакомиться в документации производителя.

Для ОС Windows:

<!-- Based on Sysmon-modular -->
<Sysmon schemaversion="4.90">
 <HashAlgorithms>*</HashAlgorithms>
 <!-- This now also determines the file names of the files preserved (String) -->
 <CheckRevocation>False</CheckRevocation>
 <!-- Setting this to true might impact performance -->
 <DnsLookup>False</DnsLookup>
 <!-- Disables lookup behavior, default is True (Boolean) -->
 <ArchiveDirectory>Sysmon</ArchiveDirectory>
 <!-- Sets the name of the directory in the C:\ root where preserved files will be saved (String)-->
 <EventFiltering>
 <!-- Event ID 1 == Process Creation - Includes -->
 <RuleGroup groupRelation="or">
 <ProcessCreate onmatch="include">
 <Rule name="Eventviewer Bypass UAC" groupRelation="and">
 <ParentImage name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="image">eventvwr.exe</ParentImage>
 <Image condition="is not">c:\windows\system32\mmc.exe</Image>
 </Rule>
 <Rule name="technique_id=T1021.003,technique_name=Distributed Component Object Model" groupRelation="and">
 <ParentCommandLine condition="contains">-Embedding</ParentCommandLine>
 <ParentImage condition="is">c:\windows\system32\mmc.exe</ParentImage>
 </Rule>
 <Rule groupRelation="and">
 <CommandLine condition="contains">Set-MpPreference</CommandLine>
 <CommandLine condition="contains any">-DisableRealTimeMonitoring $true;-DisableBehaviorMonitoring $true;-DisableBlockAtFirstSeen $true;-DisableIOAVProtection $true;-DisablePrivacyMode $true;-SignatureDisableUpdateOnStartupWithoutEngine $true;-DisableArchiveScanning $true;-DisableIntrusionPreventionSystem $true;-DisableScriptScanning $true</CommandLine>
 </Rule>
 <Rule name="Fltmc" groupRelation="and">
 <OriginalFileName name="technique_id=T1562.006,technique_name=Indicator Blocking" condition="is">fltMC.exe</OriginalFileName>
 <CommandLine name="technique_id=T1562.006,technique_name=Indicator Blocking" condition="contains">unload;detach</CommandLine>
 </Rule>
 <Rule groupRelation="or">
 <OriginalFileName name="technique_id=T1518.001,technique_name=Security Software Discovery" condition="is">fltMC.exe</OriginalFileName>
 <CommandLine name="technique_id=T1518.001,technique_name=Security Software Discovery" condition="contains">misc::mflt</CommandLine>
 </Rule>
 <Rule name="InstallUtil" groupRelation="and">
 <OriginalFileName name="technique_id=T1218.004,technique_name=InstallUtil" condition="is">InstallUtil.exe</OriginalFileName>
 <CommandLine name="technique_id=T1218.004,technique_name=InstallUtil" condition="contains all">/logfile=;/LogToConsole=false;/U</CommandLine>
 </Rule>
 <Rule name="technique_id=T1027.004,technique_name=Compile After Delivery" groupRelation="and">
 <ParentImage condition="is">csc.exe</ParentImage>
 <CommandLine condition="contains">-target:library</CommandLine>
 <CommandLine condition="contains">.cs</CommandLine>
 </Rule>
 <Rule name="technique_id=T1027.004,technique_name=Compile After Delivery" groupRelation="and">
 <ParentImage condition="is">csc.exe</ParentImage>
 <CommandLine condition="contains">-out:</CommandLine>
 <CommandLine condition="contains">.cs</CommandLine>
 </Rule>
 <Rule name="technique_id=T1003,technique_name=Credential Dumping" groupRelation="and">
 <OriginalFileName condition="is">esentutl.exe</OriginalFileName>
 <CommandLine condition="contains all">/y;/vss/d</CommandLine>
 </Rule>
 <Rule name="technique_id=T1003,technique_name=Credential Dumping" groupRelation="and">
 <OriginalFileName condition="is">ntdsutil.exe</OriginalFileName>
 <CommandLine condition="contains">ifm</CommandLine>
 </Rule>
 <Rule name="technique_id=T1003,technique_name=Credential Dumping (Likely)" groupRelation="and">
 <OriginalFileName condition="image">rpcping.exe</OriginalFileName>
 <CommandLine condition="contains any">-u;\u;-t;\t</CommandLine>
 <CommandLine condition="contains any">NTLM;ncacn_np</CommandLine>
 <CommandLine condition="contains any">\s;-s</CommandLine>
 </Rule>
 <Rule name="Ingress Tool Transfer" groupRelation="or">
 <OriginalFileName name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="is">IEExec.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="is">Print.Exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="is">curl.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="is">expand</OriginalFileName>
 <ParentImage name="technique=T1105,technique_name=Ingress Tool Transfer" condition="is">ftp.exe</ParentImage>
 </Rule>
 <Rule name="technique_id=T1564.004,technique_name=NTFS File Attributes" groupRelation="and">
 <OriginalFileName condition="is">print.exe</OriginalFileName>
 <CommandLine condition="contains">:</CommandLine>
 </Rule>
 <Rule name="technique_id=T1564.004,technique_name=NTFS File Attributes" groupRelation="and">
 <OriginalFileName condition="is">regedit.exe</OriginalFileName>
 <CommandLine condition="contains">:</CommandLine>
 </Rule>
 <Rule name="NTFS File Attributes" groupRelation="or">
 <OriginalFileName name="technique_id=T1564.004,technique_name=NTFS File Attributes" condition="is">esentutl.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1564.004,technique_name=NTFS File Attributes" condition="is">extrac32.exe</OriginalFileName>
 </Rule>
 <Rule name="Scheduled Task/Job" groupRelation="or">
 <OriginalFileName name="technique_id=T1053.005,technique_name=Scheduled Task/Job" condition="contains any">schtasks.exe;sctasks.exe</OriginalFileName>
 <OriginalFileName name="technique=T1053.002,technique_name=At" condition="contains any">at.exe;At.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1053,technique_name=Scheduled Task/Job" condition="is">taskeng.exe</OriginalFileName>
 </Rule>
 <Rule name="File Permissions Modification" groupRelation="or">
 <OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="is">takeown.exe</OriginalFileName>
 <Image name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="image">forfiles.exe</Image>
 <OriginalFileName name="technique_id=T1222.001,technique_name=File Permissions Modification" condition="contains any">icacls.exe;cacls.exe;xcacls.exe</OriginalFileName>
 </Rule>
 <Rule name="Access Token Manipulation" groupRelation="or">
 <OriginalFileName name="technique_id=T1134,technique_name=Access Token Manipulation" condition="is">runas.exe</OriginalFileName>
 <CommandLine name="technique_id=T1134,technique_name=Access Token Manipulation" condition="contains">runas</CommandLine>
 </Rule>
 <Rule name="Bypass User Access Control" groupRelation="or">
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="is">WSReset.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="is">computerdefaults.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="is">dism.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="is">fodhelper.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="is">xwizard.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Account Control" condition="is">computerdefaults.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Account Control" condition="is">dism.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Account Control" condition="is">fodhelper.exe</OriginalFileName>
 </Rule>
 <Rule name="technique_id=T1490,technique_name=Inhibit System Recovery" groupRelation="and">
 <OriginalFileName condition="contains any">vssadmin.exe;wbadmin.exe</OriginalFileName>
 <CommandLine condition="contains">delete</CommandLine>
 </Rule>
 <Rule name="technique_id=T1490,technique_name=Inhibit System Recovery" groupRelation="and">
 <OriginalFileName condition="is">bcdedit.exe</OriginalFileName>
 <CommandLine condition="contains">/set</CommandLine>
 </Rule>
 <Rule name="Inhibit System Recovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="is">vssadmin.exe</OriginalFileName>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">bcedit;set</CommandLine>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">vssadmin;delete</CommandLine>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">wbadmin;delete</CommandLine>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">wmic;delete</CommandLine>
 </Rule>
 <Rule name="Windows Management Instrumentation" groupRelation="or">
 <OriginalFileName name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="is">mofcomp.exe</OriginalFileName>
 <Image name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\WINDOWS\system32\wbem\scrcons.exe</Image>
 <OriginalFileName name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="is">ScrCons</OriginalFileName>
 <ParentImage name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="image">wmiprvse.exe</ParentImage>
 <OriginalFileName name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="is">wmiprvse.exe</OriginalFileName>
 </Rule>
 <Rule name="Account Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1087,technique_name=Account Discovery" condition="is">klist.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1087,technique_name=Account Discovery" condition="is">cmdkey.exe</OriginalFileName>
 <CommandLine name="technique_id=T1087.001,technique_name=Local Account" condition="contains any">net localgroup;net user;net group</CommandLine>
 <CommandLine name="technique_id=T1087.001,technique_name=Local Account" condition="contains any">dir C:\users;ls C:\users;dir C:\Users;ls C:\Users</CommandLine>
 <OriginalFileName name="technique_id=T1078.002,technique_name=Domain Accounts" condition="is">djoin.exe</OriginalFileName>
 </Rule>
 <Rule name="System Owner/User Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="contains any">systeminfo.exe;sysinfo.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="is">whoami.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="is">quser.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="contains any">nltest.exe;nltestk.exe</OriginalFileName>
 </Rule>
 <Rule name="System Network Configuration Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="contains any">nbtstat.exe;nbtinfo.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="is">ipconfig.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="is">nslookup.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="is">route.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="is">tracert.exe</OriginalFileName>
 </Rule>
 <Rule name="Security Software Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1518.001,technique_name=Security Software Discovery" condition="is">netsh.exe</OriginalFileName>
 <CommandLine name="technique_id=T1518.001,technique_name=Security Software Discovery" condition="contains">netsh advfirewall</CommandLine>
 </Rule>
 <Rule name="Remote System Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1018,technique_name=Remote System Discovery" condition="contains any">net.exe;net1.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1018,technique_name=Remote System Discovery" condition="contains any">ping.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1018,technique_name=Remote System Discovery" condition="contains any">dsquery.exe</OriginalFileName>
 <CommandLine name="technique_id=T1018,technique_name=Remote System Discovery" condition="contains any">net view;net group</CommandLine>
 </Rule>
 <Rule name="Process Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1057,technique_name=Process Discovery" condition="image">qprocess.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1057,technique_name=Process Discovery" condition="image">query.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1057,technique_name=Process Discovery" condition="image">qwinsta.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1057,technique_name=Process Discovery" condition="image">rwinsta.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1057,technique_name=Process Discovery" condition="image">tasklist.exe</OriginalFileName>
 </Rule>
 <Rule name="File and Directory Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1083,technique_name=File and Directory Discovery" condition="contains any">tree.com;findstr.exe;where.exe</OriginalFileName>
 <CommandLine name="technique_id=T1083,technique_name=File and Directory Discovery" condition="contains any">ls;dir</CommandLine>
 </Rule>
 <Rule name="System Network Connections Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1049,technique_name=System Network Connections Discovery" condition="is">netstat.exe</OriginalFileName>
 </Rule>
 <Rule name="technique_id=T1482,technique_name=Domain Trust Discovery" groupRelation="and">
 <OriginalFileName condition="is">nltestrk.exe</OriginalFileName>
 <CommandLine condition="contains">/domain_trusts</CommandLine>
 </Rule>
 <Rule name="Domain Trust Discovery" groupRelation="or">
 <OriginalFileName name="technique_id=T1482,technique_name=Domain Trust Discovery" condition="is">nltest.exe</OriginalFileName>
 </Rule>
 <Rule name="Query Registry" groupRelation="or">
 <OriginalFileName name="technique_id=T1012,technique_name=Query Registry" condition="is any">reg.exe;regedit.exe</OriginalFileName>
 </Rule>
 <Rule name="technique_id=T1070.001,technique_name=Clear Windows Event Logs" groupRelation="and">
 <OriginalFileName condition="is">wevtutil.exe</OriginalFileName>
 <CommandLine condition="contains any">cl;clear-log</CommandLine>
 </Rule>
 <Rule name="Indicator Removal" groupRelation="or">
 <OriginalFileName name="Event Log Access" condition="is">wevtutil.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1070,technique_name=Indicator Removal" condition="is">fsutil.exe</OriginalFileName>
 </Rule>
 <Rule name="technique_id=T1112,technique_name=Modify Registry" groupRelation="and">
 <OriginalFileName condition="is any">reg.exe;regedit.exe</OriginalFileName>
 <CommandLine condition="contains any">/i;.reg</CommandLine>
 </Rule>
 <Rule name="technique_id=T1112,technique_name=Modify Registry" groupRelation="and">
 <OriginalFileName condition="is any">reg.exe;regedit.exe</OriginalFileName>
 <CommandLine condition="contains any">hklm;HKLM;hkey_local_machine</CommandLine>
 <CommandLine condition="contains any">\system;\sam;\security</CommandLine>
 </Rule>
 <Rule name="technique_id=T1202,technique_name=Indirect Command Execution" groupRelation="and">
 <ParentImage condition="is">hh.exe</ParentImage>
 <CommandLine condition="contains">.exe</CommandLine>
 </Rule>
 <Rule name="Indirect Command Execution" groupRelation="or">
 <OriginalFileName name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">pcalua.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">cscript.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">wscript.exe</OriginalFileName>
 <ParentImage name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">pcalua.exe</ParentImage>
 <ParentImage name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">cscript.exe</ParentImage>
 <ParentImage name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">wscript.exe</ParentImage>
 <OriginalFileName name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">bash.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">certutil.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">winrs.exe</OriginalFileName>
 <ParentImage name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">control.exe</ParentImage>
 <OriginalFileName name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">desktopimgdownldr.exe</OriginalFileName>
 <ParentImage name="technique_id=T1202,technique_name=Indirect Command Execution" condition="is">wsl.exe</ParentImage>
 </Rule>
 <Rule name="System Script Proxy Execution" groupRelation="or">
 <CommandLine name="technique_id=T1216.001,technique_name=PubPrn" condition="contains">pubprn</CommandLine>
 <CommandLine name="technique_id=T1216,technique_name=System Script Proxy Execution" condition="contains">CL_Invocation</CommandLine>
 <CommandLine name="technique_id=T1216,technique_name=System Script Proxy Execution" condition="contains">CL_Mutexverifiers</CommandLine>
 <CommandLine name="technique_id=T1216,technique_name=System Script Proxy Execution" condition="contains">manage-bde</CommandLine>
 <CommandLine name="technique_id=T1216,technique_name=System Script Proxy Execution" condition="contains">slmgr</CommandLine>
 <CommandLine name="technique_id=T1216,technique_name=System Script Proxy Execution" condition="contains">winrm</CommandLine>
 </Rule>
 <Rule name="technique_id=T1216,technique_name=System Script Proxy Execution" groupRelation="and">
 <OriginalFileName condition="is">cscript.exe</OriginalFileName>
 <CommandLine condition="contains">.js</CommandLine>
 </Rule>
 <Rule name="System Binary Proxy Execution" groupRelation="or">
 <CommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains all">diskshadow.exe;-s</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains all">diskshadow.exe;/s</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">Scriptrunner.exe -appvscript</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">bginfo</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">cbd</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">ieexec.exe http</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">runscripthelper.exe surfacecheck</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">xwizard RunWizard</CommandLine>
 <Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="image">appcmd.exe</Image>
 <Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="image">jjs.exe</Image>
 <Image name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">diskshadow.exe</Image>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">Scriptrunner.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">Appvlp.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">InfDefaultInstall.EXE</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">PresentationHost.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">Register-cimprovider.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">RegisterCimProvider.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">RegisterCimProvider2.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">ScriptRunner.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">csi.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">extexport.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">msconfig.EXE</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">msdt.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">msiexec.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">odbcconf.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">rasautou.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">rasdlui.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">replace.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">tttracer.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">verclsid.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">wab.exe</OriginalFileName>
 <ParentCommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">csi.exe</ParentCommandLine>
 <ParentCommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="contains">devtoolslauncher.exe LaunchForDeploy</ParentCommandLine>
 <ParentCommandLine name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">bginfo</ParentCommandLine>
 <ParentImage name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">devtoolslauncher.exe</ParentImage>
 <ParentImage name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">wab.exe</ParentImage>
 <ParentImage name="technique_id=T1218,technique_name=System Binary Proxy Execution" condition="is">wsreset.exe</ParentImage>
 </Rule>
 <Rule name="Trusted Developer Utilities Proxy Execution" groupRelation="or">
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains all">dxcap.exe;-c</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains all">dxcap.exe;/c</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains all">squirrel.exe;--update</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains all">update.exe;--ProcessStart</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains all">update.exe;--update</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains">dnx.exe</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains">ilasm</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains">msdeploy.exe -verb:sync -source:RunCommand</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains">rundll32.exe dfshim.dll,ShOpenVerbApplication http://</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains">vbc.exe /target:exe</CommandLine>
 <CommandLine name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains">vsjitdebugger</CommandLine>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="contains">vbc.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">Microsoft.Workflow.Compiler.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">Microsoft.Workflow.Compiler.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">csc.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">dfsvc.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">ilasm.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">jsc.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">jsc.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">rcsi.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">te.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">tracker.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">vbc.exe</OriginalFileName>
 <ParentImage name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">dxcap.exe</ParentImage>
 <ParentImage name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">mftrace.exe</ParentImage>
 <ParentImage name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">vsjitdebugger.exe</ParentImage>
 </Rule>
 <Rule name="Mavinject" groupRelation="and">
 <OriginalFileName name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="contains any">Mavinject.exe;mavinject64.exe</OriginalFileName>
 <CommandLine name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="contains">/INJECTRUNNING</CommandLine>
 </Rule>
 <Rule name="CMSTP" groupRelation="and">
 <OriginalFileName name="technique_id=T1218.003,technique_name=CMSTP" condition="is">CMSTP.exe</OriginalFileName>
 <CommandLine name="technique_id=T1218.003,technique_name=CMSTP" condition="contains all">/ni;/s</CommandLine>
 </Rule>
 <Rule name="Windows Command Shell" groupRelation="or">
 <OriginalFileName name="technique_id=T1059.003,technique_name=Windows Command Shell" condition="is">cmd.exe</OriginalFileName>
 <Image name="technique_id=T1059.003,technique_name=Windows Command Shell" condition="image">cmd.exe</Image>
 </Rule>
 <Rule name="PowerShell" groupRelation="or">
 <OriginalFileName name="technique_id=T1059.001,technique_name=PowerShell" condition="image">powershell.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1059.001,technique_name=PowerShell" condition="image">powershell_ise.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1059.001,technique_name=PowerShell" condition="contains">Sqlps.exe</OriginalFileName>
 <CommandLine name="technique_id=T1059.001,technique_name=PowerShell" condition="contains">pester</CommandLine>
 </Rule>
 <Rule name="technique_id=T1218,technique_name=System Binary Proxy Execution" groupRelation="and">
 <OriginalFileName condition="is">ATBroker.exe</OriginalFileName>
 <CommandLine condition="contains">start</CommandLine>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="is">vssadmin.exe</OriginalFileName>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">delete;shadow</CommandLine>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="is">vssadmin.exe</OriginalFileName>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">resize;shadowstorage</CommandLine>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="is">wmic.exe</OriginalFileName>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">delete;shadowcopy</CommandLine>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="is">wbadmin.exe</OriginalFileName>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">delete;catalog</CommandLine>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="is">bcdedit.exe</OriginalFileName>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">recoveryenabled;no</CommandLine>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="is">bcdedit.exe</OriginalFileName>
 <CommandLine name="technique_id=T1490,technique_name=Inhibit System Recovery" condition="contains all">bootstatuspolicy;ignoreallfailures</CommandLine>
 </Rule>
 <Rule name="Control Panel Items" groupRelation="or">
 <CommandLine name="technique_id=T1218.002,technique_name=Control Panel Items" condition="contains all">control;/name</CommandLine>
 <CommandLine name="technique_id=T1218.002,technique_name=Control Panel Items" condition="contains all">rundll32.exe;shell32.dll;Control_RunDLL</CommandLine>
 </Rule>
 <Rule name="Windows Defender tampering" groupRelation="and">
 <Image name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="image">MpCmdRun.exe</Image>
 <CommandLine name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="contains any">Add-MpPreference;RemoveDefinitions;DisableIOAVProtection</CommandLine>
 </Rule>
 <Rule name="Remote Copy via wsl" groupRelation="and">
 <CommandLine name="technique_id=T1202,technique_name=Remote File Copy" condition="contains all">wsl.exe;--exec bash</CommandLine>
 <CommandLine name="technique_id=T1202,technique_name=Remote File Copy" condition="contains all">/dev/tcp</CommandLine>
 </Rule>
 <CommandLine name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">-ma lsass.exe</CommandLine>
 <CommandLine name="technique_id=T1027,technique_name=Obfuscated Files or Information" condition="contains">../../</CommandLine>
 <CommandLine name="technique_id=T1027,technique_name=Obfuscated Files or Information" condition="contains">FromBase64</CommandLine>
 <CommandLine name="technique_id=T1027,technique_name=Obfuscated Files or Information" condition="contains">^</CommandLine>
 <CommandLine name="technique_id=T1027,technique_name=Obfuscated Files or Information" condition="contains">decompress</CommandLine>
 <CommandLine name="technique_id=T1027,technique_name=Obfuscated Files or Information" condition="contains">gzip</CommandLine>
 <CommandLine name="technique_id=T1027,technique_name=Obfuscated Files or Information" condition="contains">http</CommandLine>
 <CommandLine name="technique_id=T1027,technique_name=Obfuscated Files or Information" condition="contains">replace</CommandLine>
 <CommandLine name="technique_id=T1036,technique_name=Process Evasion" condition="contains">-accepteula -ma</CommandLine>
 <CommandLine name="technique_id=T1105,technique_name=Remote File Copy" condition="contains all">squirrel;--download</CommandLine>
 <CommandLine name="technique_id=T1105,technique_name=Remote File Copy" condition="contains all">update;--download</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=Trusted Binary Proxy Execution" condition="contains all">wsl.exe;--exec bash</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=Trusted Binary Proxy Execution" condition="contains all">wsl.exe;-e</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=Trusted Binary Proxy Execution" condition="contains all">wsl.exe;-u root</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=Trusted Binary Proxy Execution" condition="contains all">wsl.exe;/e</CommandLine>
 <CommandLine name="technique_id=T1218,technique_name=Trusted Binary Proxy Execution" condition="contains all">wsl.exe;/u root</CommandLine>
 <Image name="technique_id=T1021.006,technique_name=Windows Remote Management" condition="image">winrm.cmd</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\$Recycle.bin\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Intel\Logs\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\PerfLogs\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Default\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\NetworkService\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Public\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Debug\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Fonts\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Help\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Media\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\addins\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\repair\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\security\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\system32\config\systemprofile\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">VolumeShadowCopy</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\Appdata\Local\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\Desktop\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\Downloads\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\Temp\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\htdocs\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\wwwroot\</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">SyncAppvPublishingServer.exe</Image>
 <OriginalFileName condition="contains">\</OriginalFileName>
 <OriginalFileName name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">ProcDump</OriginalFileName>
 <OriginalFileName name="technique_id=T1003,technique_name=Credential Dumping" condition="is">ProcDump</OriginalFileName>
 <OriginalFileName name="technique_id=T1003,technique_name=Credential Dumping" condition="is">TTTracer.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1003,technique_name=Credential Dumping" condition="is">rpcping.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1003,technique_name=Credential Dumping" condition="is">sqldumper.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1005,technique_name=Data from Local System" condition="is">PsLogList.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1007,technique_name=System Service Discovery" condition="contains">LoadOrd</OriginalFileName>
 <OriginalFileName name="technique_id=T1007,technique_name=System Service Discovery" condition="is">PsService.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1012,technique_name=Query Registry" condition="contains">Regsize</OriginalFileName>
 <OriginalFileName name="technique_id=T1012,technique_name=Query Registry" condition="is">ru.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1021.006,technique_name=Windows Remote Management" condition="is">winrshost.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1021.006,technique_name=Windows Remote Management" condition="is">wsmprovhost.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="is">LogonSessions.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="is">PsGetSID.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="is">PsLoggedOn.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1040,technique_name=Network Sniffing" condition="is">PktMon.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1057,technique_name=Process Discovery" condition="is">PipeList.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1057,technique_name=Process Discovery" condition="is">PsInfo.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1057,technique_name=Process Discovery" condition="is">PsList.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1074,technique_name=Data Staged" condition="is">robocopy.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1074,technique_name=Data Staged" condition="is">xcopy.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1083,technique_name=File and Directory Discovery" condition="is">AccessChk.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1083,technique_name=File and Directory Discovery" condition="is">AccessEnum.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1098,technique_name=Account Manipulation" condition="is">PsPasswd.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">PsFile.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1105,technique_name=Remote File Copy" condition="is">GfxDownloadWrapper.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1105,technique_name=Remote File Copy" condition="is">expand.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="is">MSBuild.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1197,technique_name=BITS Jobs" condition="is">bitsadmin.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218.001,technique_name=Compiled HTML File" condition="is">hh.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218.004,technique_name=InstallUtil" condition="is">installutil.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218.005,technique_name=Mshta" condition="is">mshta.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218.009,technique_name=Regsvcs/Regasm" condition="contains any">regsvcs.exe;regasm.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218.010,technique_name=Regsvr32" condition="is">regsvr32.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1218.011,technique_name=rundll32.exe" condition="contains">rundll32.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1489,technique_name=Service Stop" condition="is">taskkill.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1543.003,technique_name=Windows Service" condition="is">sc.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1543.003,technique_name=Windows Service" condition="is">sc.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1546.008,technique_name=Windows Error Reporting" condition="contains">werfault.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1546.011,technique_name=Application Shimming" condition="is">sdbinst.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">ShellRunas</OriginalFileName>
 <OriginalFileName name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="is">PKill.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="is">PsKill.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1564.001,technique_name=Hidden Files and Directories" condition="is">attrib.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1564.001,technique_name=Hidden Files and Directories" condition="is">attrib.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1569.002,technique_name=Service Execution" condition="is">PsExec.c</OriginalFileName>
 <OriginalFileName name="technique_id=T1569.002,technique_name=Service Execution" condition="is">PsExec.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1569.002,technique_name=Service Execution" condition="is">dnscmd.exe</OriginalFileName>
 <OriginalFileName name="technique_id=T1574.002,technique_name=DLL Side-Loading" condition="is">odbcconf.exe</OriginalFileName>
 <ParentCommandLine name="technique_id=T1204,technique_name=User Execution" condition="is">C:\Windows\explorer.exe</ParentCommandLine>
 <ParentCommandLine name="technique_id=T1218,technique_name=Trusted Binary Proxy Execution" condition="contains all">wsl.exe;-e</ParentCommandLine>
 <ParentCommandLine name="technique_id=T1218,technique_name=Trusted Binary Proxy Execution" condition="contains all">wsl.exe;/e</ParentCommandLine>
 <ParentImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">diskshadow.exe</ParentImage>
 <ParentImage name="technique_id=T1137,technique_name=Office Application Startup" condition="image">excel.exe</ParentImage>
 <ParentImage name="technique_id=T1137,technique_name=Office Application Startup" condition="image">msaccess.exe</ParentImage>
 <ParentImage name="technique_id=T1137,technique_name=Office Application Startup" condition="image">mspub.exe</ParentImage>
 <ParentImage name="technique_id=T1137,technique_name=Office Application Startup" condition="image">outlook.exe</ParentImage>
 <ParentImage name="technique_id=T1137,technique_name=Office Application Startup" condition="image">powerpnt.exe</ParentImage>
 <ParentImage name="technique_id=T1137,technique_name=Office Application Startup" condition="image">winword.exe</ParentImage>
 <ParentImage name="technique_id=T1204,technique_name=User Execution" condition="is">C:\Windows\explorer.exe</ParentImage>
 <ParentImage name="technique_id=T1218,technique_name=Trusted Binary Proxy Execution" condition="is">wsl.exe</ParentImage>
 <ParentImage name="technique_id=T1218.001,technique_name=Compiled HTML File" condition="is">hh.exe</ParentImage>
 <ParentImage name="technique_id=T1218.005,technique_name=Mshta" condition="image">mshta.exe</ParentImage>
 <ParentImage name="technique_id=T1546.008,technique_name=Accessibility Features" condition="image">AtBroker.exe</ParentImage>
 <ParentImage name="technique_id=T1546.008,technique_name=Accessibility Features" condition="image">DisplaySwitch.exe</ParentImage>
 <ParentImage name="technique_id=T1546.008,technique_name=Accessibility Features" condition="image">Magnify.exe</ParentImage>
 <ParentImage name="technique_id=T1546.008,technique_name=Accessibility Features" condition="image">Narrator.exe</ParentImage>
 <ParentImage name="technique_id=T1546.008,technique_name=Accessibility Features" condition="image">osk.exe</ParentImage>
 <ParentImage name="technique_id=T1546.008,technique_name=Accessibility Features" condition="image">sethc.exe</ParentImage>
 <ParentImage name="technique_id=T1546.008,technique_name=Accessibility Features" condition="image">utilman.exe</ParentImage>
 <ParentImage name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="image">fodhelper.exe</ParentImage>
 </ProcessCreate>
 </RuleGroup>
 <!-- Event ID 1 == Process Creation - Excludes -->
 <RuleGroup groupRelation="or">
 <ProcessCreate onmatch="exclude">
 <Rule groupRelation="and">
 <Image condition="end with">AcroRd32.exe</Image>
 <CommandLine condition="contains any">/CR;channel=</CommandLine>
 </Rule>
 <Rule groupRelation="or">
 <Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\LogTransport2.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe</Image>
 <ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe</ParentImage>
 </Rule>
		<Image condition="end with">Yandex\YandexBrowser\Application\browser.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AdobeCollabSync.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AdobeGCClient.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P6\adobe_licutil.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</Image>
 <Image condition="end with">C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe</Image>
 <ParentCommandLine condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" -Embedding</ParentCommandLine>
 <ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe</ParentImage>
 <ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe</ParentImage>
 <ParentImage condition="end with">C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe</ParentImage>
 <ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe</ParentImage>
 <ParentImage condition="end with">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\P7\adobe_licutil.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe</ParentImage>
 <Rule groupRelation="and">
 <ParentImage condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe"</ParentImage>
 <CommandLine condition="is">"C:\Windows\system32\cscript.exe" /nologo "MonitorKnowledgeDiscovery.vbs"</CommandLine>
 </Rule>
 <CommandLine condition="begin with">"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type=</CommandLine>
 <CommandLine condition="begin with">"C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe" --channel</CommandLine>
 <CommandLine condition="begin with">"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=</CommandLine>
 <CommandLine condition="begin with">"C:\Program Files\Mozilla Firefox\plugin-container.exe" --channel</CommandLine>
 <CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</CommandLine>
 <CommandLine condition="begin with">C:\Windows\system32\DllHost.exe /Processid</CommandLine>
 <CommandLine condition="is">C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost</CommandLine>
 <CommandLine condition="is">C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVC</CommandLine>
 <CommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k appmodel -p -s tiledatamodelsvc</CommandLine>
 <CommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvc</CommandLine>
 <CommandLine condition="is">C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\SearchIndexer.exe /Embedding</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel -s StateRepository</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k appmodel</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k camera -s FrameServer</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s LSM</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k dcomlaunch -s PlugPlay</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k defragsvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k devicesflow -s DevicesFlowUserSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k imgsvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s EventSystem</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s bthserv</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s nsi</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localService -s w32Time</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation -s SensrSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceAndNoImpersonation</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s Dhcp</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s EventLog</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s TimeBrokerSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted -s WFDSConMgrSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNetworkRestricted</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localServiceNoNetwork</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s WPDBusEnum</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -p -s fhsvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s DeviceAssociationService</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s NcbService</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s SensorService</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s TabletInputService</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s UmRdpService</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WPDBusEnum</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted -s WdiSystemHost</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -p -s ncaSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BDESVC</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s BITS</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s CertPropSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Gpsvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s ProfSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SENS</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s SessionEnv</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Themes</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -p -s DoSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s Dnscache</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s LanmanWorkstation</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s NlaSvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService -s TermService</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkService</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k networkServiceNetworkRestricted</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k rPCSS</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k secsvcs</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k swprv</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k unistackSvcGroup</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k utcsvc</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wbioSvcGroup</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k werSvcGroup</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx -s ClipSVC</CommandLine>
 <CommandLine condition="is">C:\Windows\system32\svchost.exe -k wsappx</CommandLine>
 <Image condition="begin with">C:\Program Files (x86)\Google\Update\</Image>
 <Image condition="begin with">C:\Program Files\NVIDIA Corporation\</Image>
 <Image condition="begin with">C:\Program Files\Realtek\</Image>
 <Image condition="begin with">C:\Program Files\SplunkUniversalForwarder\bin\</Image>
 <Image condition="begin with">C:\Program Files\Splunk\bin\</Image>
 <Image condition="begin with">C:\Program Files\Windows Defender\</Image>
 <Image condition="begin with">C:\Windows\SoftwareDistribution\Download\Install\AM_</Image>
 <Image condition="begin with">C:\program files (x86)\desktopcentral_agent\bin\</Image>
 <Image condition="begin with">C:\program files\desktopcentral_server\bin\</Image>
 <Image condition="begin with">D:\Program Files\SplunkUniversalForwarder\bin\</Image>
 <Image condition="begin with">D:\Program Files\Splunk\bin\</Image>
 <Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
 <Image condition="end with">C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe</Image>
 <Image condition="end with">C:\Windows\System32\CompatTelRunner.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Microsoft Office\Office16\MSOSYNC.EXE</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Remote Management System\ManagementAgentNT.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Sophos System Protection\ssp.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmExtIns.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmListen.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Trend Micro\OfficeScan Client\TmopExtIns32.exe</Image>
 <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image>
 <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE</Image>
 <Image condition="is">C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe</Image>
 <Image condition="is">C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe</Image>
 <Image condition="is">C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe</Image>
 <Image condition="is">C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe</Image>
 <Image condition="is">C:\Program Files\Microsoft Security Client\MpCmdRun.exe</Image>
 <Image condition="is">C:\Program Files\Trend Micro\Deep Security Agent\Notifier.exe</Image>
 <Image condition="is">C:\Program Files\Trend Micro\Deep Security Agent\ds_monitor.exe</Image>
 <Image condition="is">C:\Program Files\Trend Micro\Deep Security Agent\dsa.exe</Image>
 <Image condition="is">C:\Program Files\Trend Micro\Deep Security Agent\dsuam.exe</Image>
 <Image condition="is">C:\Program Files\Trend Micro\Deep Security Agent\lib\Patch.exe</Image>
 <Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Image>
 <Image condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</Image>
 <Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image>
 <Image condition="is">C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe</Image>
 <Image condition="is">C:\Windows\SysWOW64\wermgr.exe</Image>
 <Image condition="is">C:\Windows\System32\MusNotification.exe</Image>
 <Image condition="is">C:\Windows\System32\MusNotificationUx.exe</Image>
 <Image condition="is">C:\Windows\System32\audiodg.exe</Image>
 <Image condition="is">C:\Windows\System32\conhost.exe</Image>
 <Image condition="is">C:\Windows\System32\powercfg.exe</Image>
 <Image condition="is">C:\Windows\System32\wbem\WmiApSrv.exe</Image>
 <Image condition="is">C:\Windows\System32\wermgr.exe</Image>
 <Image condition="is">C:\Windows\system32\MpSigStub.exe</Image>
 <Image condition="is">C:\Windows\system32\sppsvc.exe</Image>
 <IntegrityLevel condition="is">AppContainer</IntegrityLevel>
 <ParentCommandLine condition="begin with">%%SystemRoot%%\system32\csrss.exe ObjectDirectory=\Windows</ParentCommandLine>
 <ParentCommandLine condition="contains">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentCommandLine>
 <ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</ParentCommandLine>
 <ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</ParentCommandLine>
 <ParentImage condition="begin with">C:\Program Files (x86)\Google\Update\</ParentImage>
 <ParentImage condition="end with">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe</ParentImage>
 <ParentImage condition="end with">C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe</ParentImage>
 <ParentImage condition="end with">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</ParentImage>
 <ParentImage condition="end with">C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\ResPesvc64.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\respesvc64.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files\Ivanti\Workspace Control\ResPesvc.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files\RES Software\Workspace Manager\respesvc.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files\Splunk\bin\splunk.exe</ParentImage>
 <ParentImage condition="is">C:\Program Files\Splunk\bin\splunkd.exe</ParentImage>
 <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</ParentImage>
 <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe</ParentImage>
 <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe</ParentImage>
 <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage>
 <ParentImage condition="is">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe</ParentImage>
 <ParentImage condition="is">C:\Windows\system32\SearchIndexer.exe</ParentImage>
 <ParentImage condition="is">D:\Program Files\SplunkUniversalForwarder\bin\splunk.exe</ParentImage>
 <ParentImage condition="is">D:\Program Files\SplunkUniversalForwarder\bin\splunkd.exe</ParentImage>
 <ParentImage condition="is">D:\Program Files\Splunk\bin\splunk.exe</ParentImage>
 <ParentImage condition="is">D:\Program Files\Splunk\bin\splunkd.exe</ParentImage>
 </ProcessCreate>
 </RuleGroup>
 <!-- Event ID 2 == File Creation Time - Includes -->
 <RuleGroup groupRelation="or">
 <FileCreateTime onmatch="include">
 <Image name="technique_id=T1070.006,technique_name=Timestomp" condition="begin with">C:\Temp</Image>
 <Image name="technique_id=T1070.006,technique_name=Timestomp" condition="begin with">C:\Tmp</Image>
 <Image name="technique_id=T1070.006,technique_name=Timestomp" condition="begin with">C:\Users</Image>
 <Image name="technique_id=T1070.006,technique_name=Timestomp" condition="begin with">C:\Windows\Temp</Image>
 <Image name="technique_id=T1099,technique_name=Timestomp" condition="begin with">\Device\HarddiskVolumeShadowCopy</Image>
 <TargetFilename name="technique_id=T1099,technique_name=Timestomp" condition="end with">.exe</TargetFilename>
 </FileCreateTime>
 </RuleGroup>
 <!-- Event ID 2 == File Creation Time - Excludes -->
 <RuleGroup groupRelation="or">
 <FileCreateTime onmatch="exclude">
 <Image condition="contains">setup</Image>
 <Image condition="end with">AppData\Local\Google\Chrome\Application\chrome.exe</Image>
 <Image condition="end with">AppData\Local\Microsoft\Teams\current\Teams.exe</Image>
 <Image condition="end with">Root\VFS\ProgramFilesX86\Google\Chrome\Application\chrome.exe</Image>
 <Image condition="end with">slack.exe</Image>
 <Image condition="image">OneDrive.exe</Image>
 <TargetFilename condition="contains">\NVIDIA\NvBackend\ApplicationOntology\</TargetFilename>
 </FileCreateTime>
 </RuleGroup>
 <!-- Event ID 3 == Network Connection - Includes -->
 <RuleGroup groupRelation="or">
 <NetworkConnect onmatch="include">
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">31337</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">4444</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">5353</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">5555</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">6667</DestinationPort>
 <Image name="technique_id=T1021,technique_name=Remote Services" condition="image">hpsmhd.exe</Image>
 <Image name="technique_id=T1021,technique_name=Remote Services" condition="image">omniinet.exe</Image>
 <Image name="technique_id=T1021,technique_name=Remote Services" condition="image">vnc.exe</Image>
 <Image name="technique_id=T1021,technique_name=Remote Services" condition="image">vncservice.exe</Image>
 <Image name="technique_id=T1021,technique_name=Remote Services" condition="image">vncviewer.exe</Image>
 <Image name="technique_id=T1102,technique_name=Web Service" condition="begin with">C:\Program Files\Microsoft\HybridConnectionManager</Image>
 <Image name="technique_id=T1197,technique_name=BITS Jobs" condition="image">bitsadmin.exe</Image>
 <Image name="technique_id=T1569.002,technique_name=Service Execution" condition="image">winexesvc.exe</Image>
 <Rule name="Unusual Connection" groupRelation="or">
 <Image condition="image">dllhost.exe</Image>
 <Image condition="image">hh.exe</Image>
 <Image condition="image">klist.exe</Image>
 <Image condition="image">schtasks.exe</Image>
 <Image condition="image">taskkill.exe</Image>
 <Image name="technique_id=T1069,technique_name=Permission Groups Discovery" condition="image">net1.exe</Image>
 <Image name="technique_id=T1070,technique_name=Indicator Removal on Host" condition="image">wevtutil.exe</Image>
 <Image name="technique_id=T1112,technique_name=Modify Registry" condition="image">reg.exe</Image>
 <Image name="technique_id=T1134,technique_name=Access Token Manipulation" condition="image">runas.exe</Image>
 <Image name="technique_id=T1218.005,technique_name=Mshta" condition="image">mshta.exe</Image>
 <Image name="technique_id=T1218.010,technique_name=Regsvr32" condition="image">regsvr32.exe</Image>
 <Image name="technique_id=T1518.001,technique_name=Security Software Discovery" condition="image">netsh.exe</Image>
 <Image name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="image">xwizard.exe</Image>
 <Image name="technique_id=T1564.004,technique_name=NTFS File Attributes" condition="image">esentutl.exe</Image>
 </Rule>
 <Image name="technique_id=T1003,technique_name=Credential Dumping" condition="image">RpcPing.exe</Image>
 <Rule name="Discovery" groupRelation="or">
 <Image name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="image">ipconfig.exe</Image>
 <Image name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="image">nbtstat.exe</Image>
 <Image name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="image">nslookup.exe</Image>
 <Image name="technique_id=T1018,technique_name=Remote System Discovery" condition="image">net.exe</Image>
 <Image name="technique_id=T1018,technique_name=Remote System Discovery" condition="image">nslookup.exe</Image>
 <Image name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="image">nltest.exe</Image>
 <Image name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="image">quser.exe</Image>
 <Image name="technique_id=T1049,technique_name=System Network Connections Discovery" condition="image">netstat.exe</Image>
 <Image name="technique_id=T1057,technique_name=Process Discovery" condition="image">qprocess.exe</Image>
 <Image name="technique_id=T1057,technique_name=Process Discovery" condition="image">query.exe</Image>
 <Image name="technique_id=T1057,technique_name=Process Discovery" condition="image">qwinsta.exe</Image>
 <Image name="technique_id=T1057,technique_name=Process Discovery" condition="image">rwinsta.exe</Image>
 <Image name="technique_id=T1057,technique_name=Process Discovery" condition="image">tasklist.exe</Image>
 </Rule>
 <Rule name="Ingress Tool Transfer" groupRelation="or">
 <Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">expand.exe</Image>
 <Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">extrac32.exe</Image>
 <Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">IEExec.exe</Image>
 <Image name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="image">Print.Exe</Image>
 </Rule>
 <Rule name="Execution" groupRelation="or">
 <Image name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="image">dfsvc.exe</Image>
 <Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">cscript.exe</Image>
 <Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">desktopimgdownldr.exe</Image>
 <Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">pcalua.exe</Image>
 <Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">winrs.exe</Image>
 <Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">wscript.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">Msdt.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">RegisterCimProvider.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">ScriptRunner.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">msiexec.exe</Image>
 </Rule>
 <Rule name="Services" groupRelation="or">
 <Image name="technique_id=T1053,technique_name=Scheduled Task/Job" condition="image">taskeng.exe</Image>
 <Image name="technique_id=T1543.003,technique_name=Windows Service" condition="image">sc.exe</Image>
 <Image name="technique_id=T1569.002,technique_name=Service Execution" condition="image">dnscmd.exe</Image>
 </Rule>
 <Rule name="Shells and Terminals" groupRelation="or">
 <Image name="technique_id=T1059.001,technique_name=PowerShell" condition="image">OpenConsole.exe</Image>
 <Image name="technique_id=T1059.001,technique_name=PowerShell" condition="image">WindowsTerminal.exe</Image>
 <Image name="technique_id=T1059.001,technique_name=PowerShell" condition="image">powershell.exe</Image>
 <Image name="technique_id=T1059.003,technique_name=Windows Command Shell" condition="image">cmd.exe</Image>
 <Image name="technique_id=T1202,technique_name=Indirect Command Execution" condition="image">bash.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">88</DestinationPort>
 <Image condition="is not">C:\Windows\System32\lsass.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <SourcePort name="technique_id=T1557,technique_name=Adversary-in-the-Middle" condition="is any">445;389;8492;636;3268;3269</SourcePort>
 <Image condition="is not">C:\Windows\System32\lsass.exe</Image>
 <Image condition="is not">c:\Windows\System32\dsamain.exe</Image>
 <ProcessId condition="is not">4</ProcessId>
 </Rule>
 <DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">22</DestinationPort>
 <DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">23</DestinationPort>
 <DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">3389</DestinationPort>
 <DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">5800</DestinationPort>
 <DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">5900</DestinationPort>
 <DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">5985</DestinationPort>
 <DestinationPort name="technique_id=T1021,technique_name=Remote Services" condition="is">5986</DestinationPort>
 <DestinationPort name="technique_id=T1021.006,technique_name=Windows Remote Management" condition="is">5985</DestinationPort>
 <DestinationPort name="technique_id=T1021.006,technique_name=Windows Remote Management" condition="is">5986</DestinationPort>
 <DestinationPort name="technique_id=T1087.002,technique_name=Account Discovery: Domain Account" condition="is">9389</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">1080</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">1723</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">25</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">3128</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">4500</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">8080</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">9001</DestinationPort>
 <DestinationPort name="technique_id=T1571,technique_name=Non-Standard Port" condition="is">9030</DestinationPort>
 <Image condition="image">driverquery.exe</Image>
 <Image condition="image">hh.exe</Image>
 <Image condition="image">infDefaultInstall.exe</Image>
 <Image condition="image">java.exe</Image>
 <Image condition="image">javaw.exe</Image>
 <Image condition="image">javaws.exe</Image>
 <Image condition="image">tor.exe</Image>
 <Image name="technique_id=T1012,technique_name=Query Registry" condition="image">reg.exe</Image>
 <Image name="technique_id=T1016,technique_name=System Network Configuration Discovery" condition="image">nbtstat.exe</Image>
 <Image name="technique_id=T1018,technique_name=Remote System Discovery" condition="image">nslookup.exe</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\$Recycle.bin\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Intel\Logs\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\PerfLogs\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\ProgramData</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Temp</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Default\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\NetworkService\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Public\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Debug\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Fonts\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Help\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Media\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Temp</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\addins\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\repair\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\security\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\system32\config\systemprofile\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">C:\Windows\SysWOW64</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\AppData\LocalLow\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\AppData\Local\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\AppData\Local\Temp\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\AppData\Roaming\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\htdocs\</Image>
 <Image name="technique_id=T1036,technique_name=Masquerading" condition="contains">\wwwroot\</Image>
 <Image name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="image">wmic.exe</Image>
 <Image name="technique_id=T1053,technique_name=Scheduled Task" condition="image">at.exe</Image>
 <Image name="technique_id=T1053,technique_name=Scheduled Task/Job" condition="image">schtasks.exe</Image>
 <Image name="technique_id=T1057,technique_name=Process Discovery" condition="image">qprocess.exe</Image>
 <Image name="technique_id=T1057,technique_name=Process Discovery" condition="image">qwinsta.exe</Image>
 <Image name="technique_id=T1057,technique_name=Process Discovery" condition="image">rwinsta.exe</Image>
 <Image name="technique_id=T1069,technique_name=Permission Groups Discovery" condition="image">AdFind.exe</Image>
 <Image name="technique_id=T1069,technique_name=Permission Groups Discovery" condition="image">dsquery.exe</Image>
 <Image name="technique_id=T1069,technique_name=Permission Groups Discovery" condition="image">net.exe</Image>
 <Image name="technique_id=T1218,technique_name=Regsvr32" condition="image">regsvr32.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">Mavinject.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">SyncAppvPublishingServer.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">certutil.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">msbuild.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">msiexec.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">notepad.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="image">replace.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Script Proxy Execution" condition="image">cscript.exe</Image>
 <Image name="technique_id=T1218,technique_name=Signed Script Proxy Execution" condition="image">wscript.exe</Image>
 <Image name="technique_id=T1218.005,technique_name=Mshta" condition="image">mshta.exe</Image>
 <Image name="technique_id=T1218.009,technique_name=Regsvcs/Regasm" condition="image">regsvcs.exe</Image>
 <Image name="technique_id=T1218.011,technique_name=Rundll32" condition="image">rundll32.exe</Image>
 <Image name="technique_id=T1543.003,technique_name=Windows Service" condition="image">mmc.exe</Image>
 <Image name="technique_id=T1543.003,technique_name=Windows Service" condition="image">sc.exe</Image>
 <Image name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="image">taskkill.exe</Image>
 <Image name="technique_id=T1569.002,technique_name=Service Execution" condition="image">psexec.exe</Image>
 <Image name="technique_id=T1569.002,technique_name=Service Execution" condition="image">psexesvc.exe</Image>
 </NetworkConnect>
 </RuleGroup>
 <!-- Event ID 3 == Network Connection - Excludes -->
 <RuleGroup groupRelation="or">
 <NetworkConnect onmatch="exclude">
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\System32\lsass.exe</Image>
 <DestinationPort condition="is">88</DestinationPort>
 </Rule>
 <Rule groupRelation="and">
 <Protocol condition="is">udp</Protocol>
 <DestinationPort condition="is">3389</DestinationPort>
 </Rule>
		<Image condition="end with">GoogleUpdate.exe</Image>
		<Image condition="end with">OfficeClickToRun.exe</Image>
		<Image condition="end with">Skype.exe</Image>
		<Image condition="end with">Skype\Browser\SkypeBrowserHost.exe</Image>
		<Image condition="end with">System32\backgroundTaskHost.exe</Image>
		<Image condition="end with">Windows\System32\svchost.exe</Image>
		<Image condition="end with">Windows\SystemApps\Microsoft.Windows.Cortana</Image>
		<Image condition="end with">Yandex\YandexBrowser\Application\browser.exe</Image>
		<Image condition="end with">chrome.exe</Image>
		<Image condition="end with">firefox.exe</Image>
		<Image condition="end with">iexplore.exe</Image>
		<Image condition="end with">lync.exe</Image>
		<Image condition="end with">opera.exe</Image>
		<Image condition="end with">outlook.exe</Image>
 <DestinationHostname condition="end with">.update.microsoft.com</DestinationHostname>
 <DestinationHostname condition="end with">.windowsupdate.com</DestinationHostname>
 <DestinationHostname condition="end with">.windowsupdate.microsoft.com</DestinationHostname>
 <DestinationHostname condition="end with">download.microsoft.com</DestinationHostname>
 <DestinationHostname condition="end with">go.microsoft.com</DestinationHostname>
 <DestinationHostname condition="end with">microsoft.com.akadns.net</DestinationHostname>
 <DestinationHostname condition="end with">microsoft.com.nsatc.net</DestinationHostname>
 <DestinationHostname condition="end with">wustat.windows.com</DestinationHostname>
 <Image condition="end with">AppData\Local\SynologyDrive\SynologyDrive.app\bin\cloud-drive-daemon.exe</Image>
 <Image condition="end with">AppData\Local\SynologyDrive\SynologyDrive.app\bin\cloud-drive-ui.exe</Image>
 <Image condition="end with">AppData\Roaming\Dropbox\bin\Dropbox.exe</Image>
 <Image condition="end with">AppData\Roaming\Spotify\Spotify.exe</Image>
 <Image condition="end with">ownCloud\owncloud.exe</Image>
 <Image condition="end with">packetbeat.exe</Image>
 <Image condition="end with">winlogbeat.exe</Image>
 <Image condition="image">OneDrive.exe</Image>
 <Image condition="image">OneDriveStandaloneUpdater.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Remote Management System\RouterNT.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Control\swc_service.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Trend Micro\BM\TMBMSRV.exe</Image>
 <Image condition="is">C:\Program Files\ESET\ESET Nod32 Antivirus\ekrn.exe</Image>
 <Image condition="is">C:\Program Files\Palo Alto Networks\Traps\cyserver.exe</Image>
 <Image condition="is">C:\Program Files\Sophos\Sophos Network Threat Protection\bin\SntpService.exe</Image>
 <Image condition="is">C:\Program files (x86)\Trend Micro\OfficeScan Client\tmlisten.exe</Image>
 </NetworkConnect>
 </RuleGroup>
 <!-- Event ID 5 == Process Terminated - Includes -->
 <RuleGroup groupRelation="or">
 <ProcessTerminate onmatch="include">
 <Image condition="begin with">C:\Users</Image>
 <Image condition="begin with">C:\Temp</Image>
 <Image condition="begin with">C:\Windows\Temp</Image>
 </ProcessTerminate>
 </RuleGroup>
 <!-- Event ID 6 == Driver Loaded - Excludes -->
 <RuleGroup groupRelation="or">
 <!--Default to log all and exclude only valid signed Microsoft or Intel drivers-->
 <DriverLoad onmatch="exclude">
 <Rule groupRelation="and">
 <Signature condition="begin with">Intel </Signature>
 <SignatureStatus condition="is">Valid</SignatureStatus>
 </Rule>
 <Rule groupRelation="and">
 <Signature condition="contains">Microsoft</Signature>
 <SignatureStatus condition="is">Valid</SignatureStatus>
 </Rule>
 </DriverLoad>
 </RuleGroup>
 <!-- Event ID 7 == Image Loaded - Includes -->
 <RuleGroup groupRelation="or">
 <ImageLoad onmatch="include">
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1059.001,technique_name=PowerShell" condition="is">amsi.dll</OriginalFileName>
 <Image condition="excludes any">powershell.exe;powershell_ise.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <Image name="technique_id=T1037.005,technique_name=Boot or Logon Initialization Scripts - Startup Items" condition="end with">bginfo.exe</Image>
 <ImageLoaded condition="contains any">System.ni.dll;System.Core.ni.dll</ImageLoaded>
 </Rule>
 <ImageLoaded name="technique_id=T1197,technique_name=BITS" condition="end with">bitsproxy.dll</ImageLoaded>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">clr.dll</OriginalFileName>
 <Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">clrjit.dll</OriginalFileName>
 <Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscoreei.dll</OriginalFileName>
 <Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscoree.dll</OriginalFileName>
 <Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscoreeis.dll</OriginalFileName>
 <Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscorlib.dll</OriginalFileName>
 <Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1055,technique_name=Process Injection" condition="is">mscorlib.ni.dll</OriginalFileName>
 <Image condition="excludes">C:\Windows\Microsoft.NET\</Image>
 </Rule>
 <ImageLoaded name="technique_id=T1047,technique_name=Windows Scheduled Tasks" condition="end with">mstask.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1059,technique_name=Command and Scripting Interpreter" condition="end with">wshom.ocx</ImageLoaded>
 <OriginalFileName condition="is">scrrun.dll</OriginalFileName>
 <OriginalFileName condition="is">vbscript.dll</OriginalFileName>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1218.005,technique_name=MSHTA with AMSI Bypass" condition="is">jscript.dll</OriginalFileName>
 <Image condition="end with">mshta.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName name="technique_id=T1218.005,technique_name=MSHTA with AMSI Bypass" condition="is">jscript9.dll</OriginalFileName>
 <Image condition="end with">mshta.exe</Image>
 </Rule>
 <ImageLoaded name="technique_id=T1137,technique_name=Office Application Startup" condition="end with">.wll</ImageLoaded>
 <ImageLoaded name="technique_id=T1137,technique_name=Office Application Startup" condition="end with">.xll</ImageLoaded>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <OriginalFileName name="technique_id=T1559.001,technique_name=Component Object Model" condition="is">combase.dll</OriginalFileName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <OriginalFileName name="technique_id=T1559.001,technique_name=Component Object Model" condition="is">coml2.dll</OriginalFileName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <OriginalFileName name="technique_id=T1559.001,technique_name=Component Object Model" condition="is">comsvcs.dll</OriginalFileName>
 </Rule>
 <Rule groupRelation="and" name="technique_id=T1055,technique_name=Process Injection">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <ImageLoaded condition="begin with">C:\Windows\assembly\</ImageLoaded>
 </Rule>
 <Rule groupRelation="and" name="technique_id=T1055,technique_name=Process Injection">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <ImageLoaded condition="begin with">C:\Windows\Microsoft.NET\assembly\GAC_MSIL</ImageLoaded>
 </Rule>
 <Rule groupRelation="and" name="technique_id=T1055,technique_name=Process Injection">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <OriginalFileName condition="is">clr.dll</OriginalFileName>
 </Rule>
 <Rule groupRelation="and" name="technique_id=T1059.005,technique_name=Command and Scripting Interpreter VBScript">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <OriginalFileName condition="is">VBE7INTL.DLL</OriginalFileName>
 </Rule>
 <Rule groupRelation="and" name="technique_id=T1059.005,technique_name=Command and Scripting Interpreter VBScript">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <OriginalFileName condition="is">VBE7.DLL</OriginalFileName>
 </Rule>
 <Rule groupRelation="and" name="technique_id=T1059.005,technique_name=Command and Scripting Interpreter VBScript">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <OriginalFileName condition="is">VBEUI.DLL</OriginalFileName>
 </Rule>
 <Rule groupRelation="and" name="technique_id=T1137.001,technique_name=Office Application Startup - Office Template Macros">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <OriginalFileName condition="is">OUTLVBA.DLL</OriginalFileName>
 </Rule>
 <Image name="technique_id=T1137,technique_name=Office Application Startup" condition="end with">VSTOInstaller.exe</Image>
 <Rule groupRelation="and">
 <Image name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="contains all">C:\Program Files;\Microsoft Office\root\Office</Image>
 <ImageLoaded condition="is">C:\Windows\SysWOW64\wbem\wbemdisp.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="end with">rundll32.exe</Image>
 <OriginalFileName name="technique_id=T1003.004,technique_name=LSASS Memory" condition="is">comsvcs.dll</OriginalFileName>
 </Rule>
 <Rule groupRelation="and">
 <OriginalFileName condition="is">urlmon.dll</OriginalFileName>
 </Rule>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Intel\Logs\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\PerfLogs\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Temp</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\Debug\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\Fonts\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\Help\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\Media\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\Temp</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\addins\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\repair\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\security\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">C:\Windows\system32\config\systemprofile\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">c:\programdata\</ImageLoaded>
 <ImageLoaded condition="begin with" name="technique_id=T1574.002,technique_name=DLL Side-Loading">file:</ImageLoaded>
 <ImageLoaded condition="contains" name="technique_id=T1574.002,technique_name=DLL Side-Loading">Documents</ImageLoaded>
 <ImageLoaded condition="contains" name="technique_id=T1574.002,technique_name=DLL Side-Loading">Downloads</ImageLoaded>
 <ImageLoaded condition="contains" name="technique_id=T1574.002,technique_name=DLL Side-Loading">Music</ImageLoaded>
 <ImageLoaded condition="contains" name="technique_id=T1574.002,technique_name=DLL Side-Loading">Public</ImageLoaded>
 <ImageLoaded condition="contains" name="technique_id=T1574.002,technique_name=DLL Side-Loading">Video</ImageLoaded>
 <ImageLoaded name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="end with">wmiutils.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">Microsoft.PowerShell.Commands.Diagnostics.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">Microsoft.PowerShell.Commands.Management.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">Microsoft.PowerShell.Commands.Utility.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">Microsoft.PowerShell.ConsoleHost.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">Microsoft.PowerShell.Security.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">system.management.automation.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">system.management.automation.ni.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1210,technique_name=Exploitation of Remote Services" condition="begin with">C:\Windows\System32\spool\drivers\</ImageLoaded>
 <ImageLoaded name="technique_id=T1218.010,technique_name=Regsvr32" condition="end with">scrobj.dll</ImageLoaded>
 <ImageLoaded name="technique_id=T1574.002,technique_name=DLL Side-Loading" condition="contains any">admin$;c$;\\;\appdata\;\temp\</ImageLoaded>
 <ImageLoaded name="technique_id=T1574.002,technique_name=DLL Side-Loading" condition="contains">$Recycle.bin\</ImageLoaded>
 <ImageLoaded name="technique_id=T1574.002,technique_name=DLL Side-Loading" condition="contains">\Windows\IME\</ImageLoaded>
 <OriginalFileName name="technique_id=T1053,technique_name=Scheduled Task" condition="is">taskschd.dll</OriginalFileName>
 <OriginalFileName name="technique_id=T1112,technique_name=Modify Registry" condition="is">regsvc.dll</OriginalFileName>
 <OriginalFileName name="technique_id=T1218.010,technique_name=Regsvr32" condition="is">scrobj.dll</OriginalFileName>
 </ImageLoad>
 </RuleGroup>
 <!-- Event ID 7 == Image Loaded - Excludes -->
 <RuleGroup groupRelation="or">
 <ImageLoad onmatch="exclude">
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\System32\cscript.exe</Image>
 <OriginalFileName condition="is">scrobj.dll</OriginalFileName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">powershell.exe</Image>
 <OriginalFileName condition="excludes all">mscoree.dll;mscoreei.dll;mscoreeis.dll;clr.dll;clrjit.dll</OriginalFileName>
 </Rule>
 <Rule groupRelation="and">
 <Image name="technique_id=T1137,technique_name=Office Application Startup" condition="end with">VSTOInstaller.exe</Image>
 <ImageLoaded condition="begin with">C:\Windows\</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
 <ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileSyncTelemetryExtensions.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
 <ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileCoAuthLib.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
 <ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\OneDriveTelemetryStable.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
 <ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\vcruntime140.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
 <ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\UpdateRingSettings.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
 <ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\LoggingPlatform.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all"> C:\Users\;\AppData\Local\Microsoft\OneDrive;\FileCoAuth.exe</Image>
 <ImageLoaded condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\;\FileCoAuth.exe</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\System32\svchost.exe</Image>
 <ImageLoaded condition="is">C:\Windows\System32\netapi32.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\System32\svchost.exe</Image>
 <ImageLoaded condition="is">C:\Windows\System32\msvcp110_win.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\System32\svchost.exe</Image>
 <ImageLoaded condition="is">C:\Windows\System32\dsreg.dll</ImageLoaded>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\System32\svchost.exe</Image>
 <ImageLoaded condition="is">C:\Windows\System32\perfctrs.dll</ImageLoaded>
 </Rule>
 </ImageLoad>
 </RuleGroup>
 <!-- Event ID 8 == CreateRemoteThread - Excludes -->
 <RuleGroup groupRelation="or">
 <!--Default to log all and exclude a few common processes-->
 <CreateRemoteThread onmatch="exclude">
 <Rule groupRelation="and">
 <SourceImage condition="is">C:\Windows\System32\dwm.exe</SourceImage>
 <TargetImage condition="is">C:\Windows\System32\csrss.exe</TargetImage>
 </Rule>
		<SourceImage condition="is">C:\Windows\System32\audiodg.exe</SourceImage>
		<StartModule condition="is">C:\Windows\system32\kernel32.dll</StartModule>
 <SourceImage condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</SourceImage>
 <SourceImage condition="is">C:\Windows\System32\csrss.exe</SourceImage>
 <SourceImage condition="is">C:\Windows\System32\services.exe</SourceImage>
 <SourceImage condition="is">C:\Windows\System32\svchost.exe</SourceImage>
 <SourceImage condition="is">C:\Windows\System32\wbem\WmiPrvSE.exe</SourceImage>
 <SourceImage condition="is">C:\Windows\System32\wininit.exe</SourceImage>
 <SourceImage condition="is">C:\Windows\System32\winlogon.exe</SourceImage>
 <TargetImage condition="end with">Google\Chrome\Application\chrome.exe</TargetImage>
 </CreateRemoteThread>
 </RuleGroup>
 <!-- Event ID 9 == RawAccessRead - Includes -->
 <RuleGroup groupRelation="or">
 <RawAccessRead onmatch="include" />
 </RuleGroup>
 <!-- Event ID 10 == ProcessAccess - Includes -->
 <RuleGroup groupRelation="or">
 <ProcessAccess onmatch="include">
 <CallTrace name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">dbghelp.dll</CallTrace>
 <CallTrace name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">dbgcore.dll</CallTrace>
 <TargetImage condition="contains">Desktop</TargetImage>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\csrss.exe</TargetImage>
 <GrantedAccess>0x1F1FFF</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\wininit.exe</TargetImage>
 <GrantedAccess>0x1F1FFF</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\winlogon.exe</TargetImage>
 <GrantedAccess>0x1F1FFF</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\services.exe</TargetImage>
 <GrantedAccess>0x1F1FFF</GrantedAccess>
 </Rule>
 <GrantedAccess name="technique_id=T1055.012,technique_name=Process Hollowing">0x21410</GrantedAccess>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
 <GrantedAccess>0x1FFFFF</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
 <GrantedAccess>0x1F1FFF</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
 <GrantedAccess>0x1010</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">C:\Windows\system32\lsass.exe</TargetImage>
 <GrantedAccess>0x143A</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <TargetImage name="technique_id=T1003,technique_name=Credential Dumping" condition="image">lsass.exe</TargetImage>
 <SourceImage name="technique_id=T1003,technique_name=Credential Dumping" condition="image">wsmprovhost.exe</SourceImage>
 </Rule>
 <Rule groupRelation="and" name="technique_id=T1055,technique_name=Process Injection">
 <SourceImage condition="contains all">C:\Program Files;\Microsoft Office\Root\Office</SourceImage>
 <CallTrace condition="contains">\Microsoft Shared\VBA</CallTrace>
 </Rule>
 <Rule groupRelation="and">
 <CallTrace name="technique_id=T1055.001,technique_name=Dynamic-link Library Injection" condition="contains all">C:\Windows\SYSTEM32\ntdll.dll;C:\Windows\System32\kernelbase.dll;UNKNOWN</CallTrace>
 <GrantedAccess name="technique_id=T1055.001,technique_name=Dynamic-link Library Injection" condition="contains any">0x1F0FFF;0x1F1FFF;0x143A;0x1410;0x1010;0x1F2FFF;0x1F3FFF;0x1FFFFF;0x147A</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\AppData\</SourceImage>
 <SourceImage condition="not end with">\AppData\Local\Microsoft\Teams\current\Teams.exe</SourceImage>
 </Rule>
 <Rule groupRelation="and">
 <CallTrace name="technique_id=T1059.001,technique_name=PowerShell" condition="contains">System.Management.Automation.ni.dll</CallTrace>
 <SourceImage condition="is not">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</SourceImage>
 </Rule>
 <Rule groupRelation="and">
 <CallTrace name="technique_id=T1055,technique_name=Process Injection" condition="not begin with">C:\Windows\SYSTEM32\ntdll.dll</CallTrace>
 <CallTrace name="technique_id=T1055,technique_name=Process Injection" condition="not begin with">C:\Windows\SYSTEM32\win32u.dll</CallTrace>
 <CallTrace name="technique_id=T1055,technique_name=Process Injection" condition="not begin with">C:\Windows\SYSTEM32\wow64win.dll</CallTrace>
 </Rule>
 <GrantedAccess name="technique_id=T1003,technique_name=Credential Dumping">0x0810</GrantedAccess>
 <GrantedAccess name="technique_id=T1003,technique_name=Credential Dumping">0x810</GrantedAccess>
 <GrantedAccess name="technique_id=T1055,technique_name=Process Injection">0x0820</GrantedAccess>
 <GrantedAccess name="technique_id=T1055,technique_name=Process Injection">0x820</GrantedAccess>
 <GrantedAccess name="technique_id=T1055.012,technique_name=Process Hollowing">0x0800</GrantedAccess>
 <GrantedAccess name="technique_id=T1055.012,technique_name=Process Hollowing">0x800</GrantedAccess>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\$Recycle.bin\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Intel\Logs\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\PerfLogs\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Default\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\NetworkService\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Users\Public\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Debug\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Fonts\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Help\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\Media\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\addins\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\repair\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\security\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="begin with">C:\Windows\system32\config\systemprofile\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">VolumeShadowCopy</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\Temp\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\htdocs\</SourceImage>
 <SourceImage name="technique_id=T1036,technique_name=Masquerading" condition="contains">\wwwroot\</SourceImage>
 </ProcessAccess>
 </RuleGroup>
 <!-- Event ID 10 == ProcessAccess - Excludes -->
 <RuleGroup groupRelation="or">
 <ProcessAccess onmatch="exclude">
 <Rule groupRelation="and">
 <SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe</SourceImage>
 <TargetImage condition="is">C:\Windows\system32\cscript.exe</TargetImage>
 </Rule>
 <Rule name="Exclude Chrome SW Reporter into Reporter" groupRelation="and">
 <SourceImage condition="image">software_reporter_tool.exe</SourceImage>
 <TargetImage condition="image">software_reporter_tool.exe</TargetImage>
 <GrantedAccess condition="is">0x1410</GrantedAccess>
 </Rule>
 <Rule name="Exclude Chrome SW Reporter into Chrome" groupRelation="and">
 <SourceImage condition="image">software_reporter_tool.exe</SourceImage>
 <TargetImage condition="image">chrome.exe</TargetImage>
 <GrantedAccess condition="is">0x1410</GrantedAccess>
 </Rule>
 <Rule name="Exclude Chrome SW Reporter Accessing Anything" groupRelation="and">
 <SourceImage condition="image">software_reporter_tool.exe</SourceImage>
 <GrantedAccess condition="is">0x1410</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <SourceImage condition="contains all">C:\Users\;\AppData\Local\Microsoft\Teams\current\Teams.exe</SourceImage>
 <TargetImage condition="contains all">C:\Users\;\AppData\Local\Microsoft\Teams\current\Teams.exe</TargetImage>
 </Rule>
 <Rule groupRelation="and">
 <SourceImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</SourceImage>
 <TargetImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</TargetImage>
 <GrantedAccess condition="is">0x100000</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <SourceImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</SourceImage>
 <TargetImage condition="is">C:\Program Files\Microsoft VS Code\Code.exe</TargetImage>
 <GrantedAccess condition="is">0x1401</GrantedAccess>
 </Rule>
 <Rule groupRelation="and">
 <SourceImage condition="contains all">C:\Users\;\AppData\Local\Programs\Microsoft VS Code\Code.exe</SourceImage>
 <TargetImage condition="contains all">C:\Users\;\AppData\Local\Programs\Microsoft VS Code\Code.exe</TargetImage>
 <GrantedAccess condition="is">0x1401</GrantedAccess>
 </Rule>
 <GrantedAccess>0x1000</GrantedAccess>
 <GrantedAccess>0x101000</GrantedAccess>
 <GrantedAccess>0x101400</GrantedAccess>
 <GrantedAccess>0x1400</GrantedAccess>
 <SourceImage condition="begin with">C:\Program Files (x86)\Symantec\Symantec Endpoint Protection</SourceImage>
 <SourceImage condition="contains all">C:\Program Files;\Common Files\Adobe\AdobeGCClient\AGMService.exe</SourceImage>
 <SourceImage condition="contains all">C:\Program Files;\FireEye\xagt\xagt.exe</SourceImage>
 <SourceImage condition="contains all">C:\Program Files\Cisco\AMP\;sfc.exe</SourceImage>
 <SourceImage condition="contains all">C:\Program Files\Elastic\Agent\data\;\metricbeat.exe</SourceImage>
 <SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\;\OpenHandleCollector.exe</SourceImage>
 <SourceImage condition="contains all">C:\ProgramData\Microsoft\Windows Defender\Platform\;\MsMpEng.exe</SourceImage>
 <SourceImage condition="contains all">C:\Users\;\AppData\Local\Citrix\ICA Client\receiver\Receiver.exe</SourceImage>
 <SourceImage condition="contains all">C:\Users\;\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe</SourceImage>
 <SourceImage condition="contains all">C:\WindowsAzure\GuestAgent_;CollectGuestLogs.exe</SourceImage>
 <SourceImage condition="end with">GoogleUpdate.exe</SourceImage>
 <SourceImage condition="end with">LTSVC.exe</SourceImage>
 <SourceImage condition="end with">Microsoft.Identity.AadConnect.Health.AadSync.Host.exe</SourceImage>
 <SourceImage condition="end with">VBoxService.exe</SourceImage>
 <SourceImage condition="end with">\Citrix\System32\wfshell.exe</SourceImage>
 <SourceImage condition="end with">taskmgr.exe</SourceImage>
 <SourceImage condition="end with">vmtoolsd.exe</SourceImage>
 <SourceImage condition="end with">wmiprvse.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\Adobe\Acrobat DC\Acrobat\Acrobat.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\Citrix\ICA Client\Receiver\Receiver.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\cpushld.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\Mobatek\MobaXterm\MobaXterm.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\cpushld.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\VMware\VMWare Player\vmware-authd.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Adobe\Adobe Creative Cloud Experience\libs\node.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Adobe\Adobe Photoshop 2021\Photoshop.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Ivanti\Workspace Control\cpushld.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\McAfee\Agent\x86\macompatsvc.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE</SourceImage>
 <SourceImage condition="is">C:\Program Files\Microsoft Security Client\MsMpEng.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Palo Alto Networks\Traps\cyserver.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\PowerToys\modules\KeyboardManager\KeyboardManagerEngine\PowerToys.KeyboardManagerEngine.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Qualys\QualysAgent\QualysAgent.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\RES Software\Workspace Manager\cpushld.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Splunk\bin\splunkd.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\WinZip\FAHWindow64.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</SourceImage>
 <SourceImage condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</SourceImage>
 <SourceImage condition="is">C:\WINDOWS\CCM\CcmExec.exe</SourceImage>
 <SourceImage condition="is">C:\Windows\CarbonBlack\cb.exe</SourceImage>
 <SourceImage condition="is">C:\Windows\System32\lsm.exe</SourceImage>
 <SourceImage condition="is">c:\Program Files\Couchbase\Server\bin\sigar_port.exe</SourceImage>
 <TargetImage condition="begin with">C:\Program Files (x86)\Autodesk\Autodesk Desktop App</TargetImage>
 <TargetImage condition="begin with">C:\Program Files\Autodesk\Autodesk Desktop App</TargetImage>
 </ProcessAccess>
 </RuleGroup>
 <!-- Event ID 11 == FileCreate - Includes -->
 <RuleGroup groupRelation="or">
 <FileCreate onmatch="include">
 <Rule groupRelation="and">
 <Image condition="end with">\WINWORD.EXE</Image>
 <TargetFilename condition="contains any">.cab;.inf</TargetFilename>
 </Rule>
 <Rule groupRelation="and">
 <TargetFilename condition="end with">.js</TargetFilename>
 <TargetFilename condition="contains">Appdata\Local\whatsapp\</TargetFilename>
 <Image condition="excludes">Appdata\Local\whatsapp\</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetFilename condition="end with">.js</TargetFilename>
 <TargetFilename condition="contains">Appdata\Local\Microsoft\Teams\</TargetFilename>
 <Image condition="excludes">Appdata\Local\Microsoft\Teams\</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetFilename condition="end with">.js</TargetFilename>
 <TargetFilename condition="contains">Appdata\Local\slack\</TargetFilename>
 <Image condition="excludes">Appdata\Local\slack\</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetFilename condition="end with">.js</TargetFilename>
 <TargetFilename condition="contains">Appdata\Local\discord\</TargetFilename>
 <Image condition="excludes">Appdata\Local\discord\</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetFilename condition="end with">.js</TargetFilename>
 <TargetFilename condition="contains">Appdata\Local\signal\</TargetFilename>
 <Image condition="excludes">Appdata\Local\signal\</Image>
 </Rule>
 <Rule name="technique_id=T1003.001,technique_name=OS Credential Dumping: LSASS Memory" groupRelation="and">
 <TargetFilename condition="contains">lsass</TargetFilename>
 <TargetFilename condition="contains any">dmp;DMP</TargetFilename>
 <Image condition="image">taskmgr.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetFilename name="technique_id=T1562.001,technique_name=Disable or Modify tools" condition="begin with">C:\Windows\System32\CodeIntegrity\CIPolicies\Active\</TargetFilename>
 <TargetFilename name="technique_id=T1562.001,technique_name=Disable or Modify tools" condition="end with">.cip</TargetFilename>
 </Rule>
 <Rule groupRelation="and">
 <TargetFilename name="technique_id=T1562.001,technique_name=Disable or Modify tools" condition="begin with">C:\Windows\System32\CodeIntegrity\</TargetFilename>
 <TargetFilename name="technique_id=T1562.001,technique_name=Disable or Modify tools" condition="end with">.p7b</TargetFilename>
 </Rule>
 <Image condition="image">rundll32.exe</Image>
 <Image name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\WINDOWS\system32\wbem\scrcons.exe</Image>
 <TargetFilename condition="begin with">C:\Users\Default</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\SysWOW64\Drivers</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\Drivers</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\Machine\Scripts</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\GroupPolicy\User\Scripts</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\Tasks</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\Tasks\</TargetFilename>
 <TargetFilename condition="contains all">C:\Users\;\.alibabacloud\credentials</TargetFilename>
 <TargetFilename condition="contains all">C:\Users\;\.aws\credentials</TargetFilename>
 <TargetFilename condition="contains all">C:\Users\;\.azure\accesstokens.json</TargetFilename>
 <TargetFilename condition="contains all">C:\Users\;\.kube\config</TargetFilename>
 <TargetFilename condition="contains all">C:\Users\;\.ssh\</TargetFilename>
 <TargetFilename condition="contains all">C:\Users\;\config\gcloud</TargetFilename>
 <TargetFilename condition="contains">Desktop</TargetFilename>
 <TargetFilename condition="contains">Roaming\Microsoft\Outlook\Outlook.xml</TargetFilename>
 <TargetFilename condition="contains">Roaming\Microsoft\Outlook\VbaProject.OTM</TargetFilename>
 <TargetFilename condition="contains">\Content.Outlook\</TargetFilename>
 <TargetFilename condition="contains">\Downloads\</TargetFilename>
 <TargetFilename condition="contains">\Start Menu</TargetFilename>
 <TargetFilename condition="contains">\Startup</TargetFilename>
 <TargetFilename condition="end with">.ace</TargetFilename>
 <TargetFilename condition="end with">.application</TargetFilename>
 <TargetFilename condition="end with">.appref-ms</TargetFilename>
 <TargetFilename condition="end with">.asp</TargetFilename>
 <TargetFilename condition="end with">.aspx</TargetFilename>
 <TargetFilename condition="end with">.bat</TargetFilename>
 <TargetFilename condition="end with">.cmd</TargetFilename>
 <TargetFilename condition="end with">.docm</TargetFilename>
 <TargetFilename condition="end with">.dotm</TargetFilename>
 <TargetFilename condition="end with">.exe</TargetFilename>
 <TargetFilename condition="end with">.img</TargetFilename>
 <TargetFilename condition="end with">.iqy</TargetFilename>
 <TargetFilename condition="end with">.iso</TargetFilename>
 <TargetFilename condition="end with">.jsp</TargetFilename>
 <TargetFilename condition="end with">.jspx</TargetFilename>
 <TargetFilename condition="end with">.kirbi</TargetFilename>
 <TargetFilename condition="end with">.php</TargetFilename>
 <TargetFilename condition="end with">.potm</TargetFilename>
 <TargetFilename condition="end with">.ppsm</TargetFilename>
 <TargetFilename condition="end with">.pptm</TargetFilename>
 <TargetFilename condition="end with">.py</TargetFilename>
 <TargetFilename condition="end with">.pyc</TargetFilename>
 <TargetFilename condition="end with">.pyw</TargetFilename>
 <TargetFilename condition="end with">.rdp</TargetFilename>
 <TargetFilename condition="end with">.rft</TargetFilename>
 <TargetFilename condition="end with">.rwz</TargetFilename>
 <TargetFilename condition="end with">.settingcontent-ms</TargetFilename>
 <TargetFilename condition="end with">.sldm</TargetFilename>
 <TargetFilename condition="end with">.slk</TargetFilename>
 <TargetFilename condition="end with">.sys</TargetFilename>
 <TargetFilename condition="end with">.url</TargetFilename>
 <TargetFilename condition="end with">.vb</TargetFilename>
 <TargetFilename condition="end with">.vbe</TargetFilename>
 <TargetFilename condition="end with">.vbs</TargetFilename>
 <TargetFilename condition="end with">.war</TargetFilename>
 <TargetFilename condition="end with">.xla</TargetFilename>
 <TargetFilename condition="end with">.xlam</TargetFilename>
 <TargetFilename condition="end with">.xlm</TargetFilename>
 <TargetFilename condition="end with">.xlsm</TargetFilename>
 <TargetFilename condition="end with">.xltm</TargetFilename>
 <TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\PerfLogs\</TargetFilename>
 <TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\Temp\</TargetFilename>
 <TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="begin with">C:\Users\Public\</TargetFilename>
 <TargetFilename name="technique_id=T1047,technique_name=File System Permissions Weakness" condition="contains">\AppData\Temp\</TargetFilename>
 <TargetFilename name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\Windows\SysWOW64\Wbem</TargetFilename>
 <TargetFilename name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="begin with">C:\Windows\System32\Wbem</TargetFilename>
 <TargetFilename name="technique_id=T1059,technique_name=Command and Scripting Interpreter" condition="end with">.chm</TargetFilename>
 <TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="begin with">C:\Windows\SysWOW64\WindowsPowerShell</TargetFilename>
 <TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="begin with">C:\Windows\System32\WindowsPowerShell</TargetFilename>
 <TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">.ps1</TargetFilename>
 <TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">.ps2</TargetFilename>
 <TargetFilename name="technique_id=T1059.007,technique_name=JavaScript" condition="end with">.javascript</TargetFilename>
 <TargetFilename name="technique_id=T1059.007,technique_name=JavaScript" condition="end with">.js</TargetFilename>
 <TargetFilename name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="end with">.*proj</TargetFilename>
 <TargetFilename name="technique_id=T1127,technique_name=Trusted Developer Utilities Proxy Execution" condition="end with">.sln</TargetFilename>
 <TargetFilename name="technique_id=T1187,technique_name=Forced Authentication" condition="end with">.lnk</TargetFilename>
 <TargetFilename name="technique_id=T1187,technique_name=Forced Authentication" condition="end with">.scf</TargetFilename>
 <TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="contains">AppData\Local\Microsoft\CLR_v2.0\UsageLogs\</TargetFilename>
 <TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\cscript.exe.log</TargetFilename>
 <TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\mshta.exe.log</TargetFilename>
 <TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\regsvr32.exe.log</TargetFilename>
 <TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\rundll32.exe.log</TargetFilename>
 <TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\svchost.exe.log</TargetFilename>
 <TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\wmic.exe.log</TargetFilename>
 <TargetFilename name="technique_id=T1218,technique_name=Office Signed Binary Proxy Execution" condition="end with">\UsageLogs\wscript.exe.log</TargetFilename>
 <TargetFilename name="technique_id=T1218.005,technique_name=Mshta" condition="end with">.hta</TargetFilename>
 <TargetFilename name="technique_id=T1546.008,technique_name=Services File Permissions Weakness" condition="begin with">C:\Program\</TargetFilename>
 <TargetFilename name="technique_id=T1546.008,technique_name=Services File Permissions Weakness" condition="begin with">C:\Windows\Temp\</TargetFilename>
 <TargetFilename name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">C:\Windows\AppPatch\Custom</TargetFilename>
 <TargetFilename name="technique_id=T1574.010,technique_name=Services File Permissions Weakness" condition="begin with">C:\Windows\</TargetFilename>
 <TargetFilename name="technique_id=T1574.010,technique_name=Services File Permissions Weakness" condition="begin with">C:\Windows\SysWoW64</TargetFilename>
 <TargetFilename name="technique_id=T1574.010,technique_name=Services File Permissions Weakness" condition="begin with">C:\Windows\System32</TargetFilename>
 </FileCreate>
 </RuleGroup>
 <!-- Event ID 11 == FileCreate - Excludes -->
 <RuleGroup groupRelation="or">
 <FileCreate onmatch="exclude">
 <Image condition="is">C:\Program Files (x86)\Dell\CommandUpdate\InvColPC.exe</Image>
 <Rule groupRelation="and">
 <Image condition="is">C:\Program Files\Elastic\Endpoint\elastic-endpoint.exe</Image>
 <TargetFilename condition="is">C:\Program Files\Elastic\Endpoint\state\last-document-id.json</TargetFilename>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="begin with">C:\Program Files\Elastic\Agent\data\</Image>
 <TargetFilename condition="contains all">C:\Program Files\Elastic\Agent\data\;.ndjson</TargetFilename>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="image">Outlook.exe</Image>
 <TargetFilename condition="contains">Roaming\Microsoft\Outlook\Outlook.xml</TargetFilename>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\system32\wsmprovhost.exe</Image>
 <TargetFilename condition="contains all">C:\Users\;\AppData\Local\Temp;__PSScriptPolicyTest;.ps1</TargetFilename>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe</Image>
 <TargetFilename condition="contains all">C:\Windows\Temp;__PSScriptPolicyTest;.ps1</TargetFilename>
 <User condition="is">NT AUTHORITY\SYSTEM</User>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\System32\svchost.exe</Image>
 <TargetFilename condition="is">C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat</TargetFilename>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\System32\svchost.exe</Image>
 <TargetFilename condition="is">C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat</TargetFilename>
 </Rule>
 <Image condition="begin with">C:\WINDOWS\winsxs\amd64_microsoft-windows</Image>
 <Image condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
 <Image condition="is">C:\Program Files (x86)\RES Software\Workspace Manager\pfwsmgr.exe</Image>
 <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe</Image>
 <Image condition="is">C:\WINDOWS\CCM\CcmExec.exe</Image>
 <Image condition="is">C:\Windows\System32\smss.exe</Image>
 <Image condition="is">C:\Windows\system32\CompatTelRunner.exe</Image>
 <Image condition="is">C:\Windows\system32\igfxCUIService.exe</Image>
 <Image condition="is">C:\Windows\system32\wbem\WMIADAP.EXE</Image>
 <Image condition="is">c:\Program Files\Microsoft Security Client\MsMpEng.exe</Image>
 <Image condition="is">c:\windows\system32\provtool.exe</Image>
 <TargetFilename condition="begin with">C:\$WINDOWS.~BT\Sources\SafeOS\SafeOS.Mount\</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\CCM</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\DriverStore\Temp\</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerCeipAssistant</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\Server\ServerRoleUsageCollector</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\PLA\FabricTraces</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask</TargetFilename>
 <TargetFilename condition="begin with">C:\Windows\System32\wbem\Performance\</TargetFilename>
 <TargetFilename condition="contains all">C:\Windows\Prefetch;.pf</TargetFilename>
 <TargetFilename condition="contains">\AppData\Roaming\Microsoft\Windows\Recent\</TargetFilename>
 <TargetFilename condition="end with">WRITABLE.TST</TargetFilename>
 </FileCreate>
 </RuleGroup>
 <!-- Event ID 12,13,14 == RegObject added/deleted, RegValue Set, RegObject Renamed - Includes -->
 <RuleGroup groupRelation="or">
 <RegistryEvent onmatch="include">
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1125,technique_name=Video Capture" condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam</TargetObject>
 <Image condition="excludes any">Google\Chrome\Application\chrome.exe;Zoom\bin\Zoom.exe;slack\slack.exe;Mozilla Firefox\firefox.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1123,technique_name=Audio Capture" condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\microphone</TargetObject>
 <Image condition="excludes any">Google\Chrome\Application\chrome.exe;Zoom\bin\Zoom.exe;slack\slack.exe;Mozilla Firefox\firefox.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1123,technique_name=Audio Capture" condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\bluetooth</TargetObject>
 <Image condition="excludes any">Google\Chrome\Application\chrome.exe;Zoom\bin\Zoom.exe;slack\slack.exe;Mozilla Firefox\firefox.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1005,technique_name=Data from Local System" condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\usb</TargetObject>
 <Image condition="excludes any">Google\Chrome\Application\chrome.exe;Zoom\bin\Zoom.exe;slack\slack.exe;Mozilla Firefox\firefox.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1005,technique_name=Data from Local System" condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location</TargetObject>
 <Image condition="excludes any">Google\Chrome\Application\chrome.exe;Zoom\bin\Zoom.exe;slack\slack.exe;Mozilla Firefox\firefox.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1005,technique_name=Data from Local System" condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\contacts</TargetObject>
 <Image condition="excludes any">Google\Chrome\Application\chrome.exe;Zoom\bin\Zoom.exe;slack\slack.exe;Mozilla Firefox\firefox.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1056.001,technique_name=Input Capture - Keylogging" condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\humanInterfaceDevice</TargetObject>
 <Image condition="excludes any">Google\Chrome\Application\chrome.exe;Zoom\bin\Zoom.exe;slack\slack.exe;Mozilla Firefox\firefox.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\Sense</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WinDefend</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\MsMpSvc</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\NisSrv</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WdBoot</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WdNisDrv</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\wscsvc</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\wuauserv</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc</TargetObject>
 <Details condition="contains">DWORD (0x00000004)</Details>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</TargetObject>
 <Image condition="is not">C:\Windows\System32\svchost.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System</TargetObject>
 <Image condition="is not">C:\Windows\System32\svchost.exe</Image>
 </Rule>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Clients\Mail\Microsoft Outlook\DllPath</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Clients\Mail\Microsoft Outlook\DllPathEx</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Control.exe</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Plap Providers</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\PostRebootReporting\</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired\</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Services\Pending\</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32</TargetObject>
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa</TargetObject>
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order</TargetObject>
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Safeboot</TargetObject>
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Winlogon</TargetObject>
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services</TargetObject>
 <TargetObject condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\WinSock</TargetObject>
 <TargetObject condition="begin with">HKLM\SYSTEM\setup\cmdline</TargetObject>
 <TargetObject condition="begin with">HKLM\SYSTEM\setup\upgrade</TargetObject>
 <TargetObject condition="begin with">HKLM\Software\Classes\protocols\filter\</TargetObject>
 <TargetObject condition="begin with">HKLM\Software\Classes\protocols\handler\</TargetObject>
 <TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUsername</TargetObject>
 <TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellExecuteHooks</TargetObject>
 <TargetObject condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObject</TargetObject>
 <TargetObject condition="begin with">hklm\software\microsoft\windows script\settings\amsienable</TargetObject>
 <TargetObject condition="begin with">hklm\system\mounteddevices\</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Account Name</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Display Name</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\Email</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP Password</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\HTTP User</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP Password</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\IMAP User</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\MAPI Provider</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 Password</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\POP3 User</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP Password</TargetObject>
 <TargetObject condition="contains all">SOFTWARE\Microsoft\Office\;\Outlook\Profiles\;\9375CFF0413111d3B88A00104B2A6676\;\SMTP User</TargetObject>
 <TargetObject condition="contains all">Software\microsoft\ctf\langbaraddin\;\Enable</TargetObject>
 <TargetObject condition="contains all">Software\microsoft\ctf\langbaraddin\;\FilePath</TargetObject>
 <TargetObject condition="contains all">hklm\system\;\enum\usb\</TargetObject>
 <TargetObject condition="contains all">software\;microsoft\office\;\Common\COM Compatibility</TargetObject>
 <TargetObject condition="contains all">software\;microsoft\office\;\addins\</TargetObject>
 <TargetObject condition="contains all">software\microsoft\office\;\Options\OPEN</TargetObject>
 <TargetObject condition="contains all">software\microsoft\office\;\common\internet\server cache\</TargetObject>
 <TargetObject condition="contains all">software\microsoft\office\;\word\options\globaldotname</TargetObject>
 <TargetObject condition="contains">HKLM\software\wow6432node\microsoft\internet explorer\urlsearchhooks\</TargetObject>
 <TargetObject condition="contains">Software\policies\microsoft\windows\control panel\desktop\scrnsave.exe</TargetObject>
 <TargetObject condition="contains">\Browser Helper Objects</TargetObject>
 <TargetObject condition="contains">\Classes\AllFilesystemObjects</TargetObject>
 <TargetObject condition="contains">\Classes\Directory</TargetObject>
 <TargetObject condition="contains">\Classes\Drive</TargetObject>
 <TargetObject condition="contains">\Classes\Folder</TargetObject>
 <TargetObject condition="contains">\CurrentVersion\Shell</TargetObject>
 <TargetObject condition="contains">\Group Policy\Scripts</TargetObject>
 <TargetObject condition="contains">\Internet Explorer\Extensions</TargetObject>
 <TargetObject condition="contains">\Internet Explorer\Toolbar</TargetObject>
 <TargetObject condition="contains">\Security\Trusted Documents\</TargetObject>
 <TargetObject condition="contains">\Security\Trusted Documents\TrustRecords</TargetObject>
 <TargetObject condition="contains">\ShellEx\ContextMenuHandlers</TargetObject>
 <TargetObject condition="contains">\shell\install\command</TargetObject>
 <TargetObject condition="contains">\shell\open\command</TargetObject>
 <TargetObject condition="contains">\shell\open\ddeexec</TargetObject>
 <TargetObject condition="contains">\software\microsoft\internet explorer\Styles\MaxScriptStatements</TargetObject>
 <TargetObject condition="contains">\software\microsoft\internet explorer\desktop\components\Source</TargetObject>
 <TargetObject condition="contains">\software\microsoft\internet explorer\explorer bars\</TargetObject>
 <TargetObject condition="contains">\software\microsoft\internet explorer\toolbar\WebBrowser\ITBarLayout</TargetObject>
 <TargetObject condition="contains">\software\microsoft\internet explorer\urlsearchhooks\</TargetObject>
 <TargetObject condition="contains">\software\microsoft\windows script\settings\amsienable</TargetObject>
 <TargetObject condition="contains">\software\wow6432node\microsoft\internet explorer\toolbar\WebBrowser\ITBarLayout</TargetObject>
 <TargetObject condition="contains">software\microsoft\Office test\special\perf\</TargetObject>
 <TargetObject condition="contains">software\microsoft\windows\currentversion\explorer\recentdocs\.docx\</TargetObject>
 <TargetObject condition="contains">software\microsoft\windows\currentversion\explorer\recentdocs\.xlsx\</TargetObject>
 <TargetObject condition="contains">{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}</TargetObject>
 <TargetObject condition="end with">\FriendlyName</TargetObject>
 <TargetObject condition="end with">\ImagePath</TargetObject>
 <TargetObject condition="end with">\ProxyServer</TargetObject>
 <TargetObject condition="end with">\ServiceDll</TargetObject>
 <TargetObject condition="end with">\Start</TargetObject>
 <TargetObject condition="end with">\UrlUpdateInfo</TargetObject>
 <TargetObject condition="is">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\InProgress\(Default)</TargetObject>
 <TargetObject condition="is">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Setup\ServiceStartup</TargetObject>
 <TargetObject name="T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLaunch</TargetObject>
 <TargetObject name="T1559.002,office" condition="end with">\Excel\Security\DisableDDEServerLookup</TargetObject>
 <TargetObject name="T1559.002,office" condition="end with">\Word\Security\AllowDDE</TargetObject>
 <TargetObject name="T1562,office" condition="end with">\DisableAttachementsInPV</TargetObject>
 <TargetObject name="T1562,office" condition="end with">\DisableInternetFilesInPV</TargetObject>
 <TargetObject name="T1562,office" condition="end with">\DisableUnsafeLocationsInPV</TargetObject>
 <TargetObject name="T1562,office" condition="end with">\VBAWarnings</TargetObject>
 <TargetObject name="UACMe Dir Prep" condition="contains all">HKLM;Environment</TargetObject>
 <TargetObject name="UACMe Dir Prep" condition="contains all">HKU;Environment</TargetObject>
 <TargetObject name="technique_id=T1003,technique_name=Credential Dumping" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\</TargetObject>
 <TargetObject name="technique_id=T1003,technique_name=Credential Dumping" condition="contains">\Control\SecurityProviders\WDigest</TargetObject>
 <TargetObject name="technique_id=T1003.002,technique_name=Security Account Manager" condition="contains">System\CurrentControlSet\Services\VSS</TargetObject>
 <TargetObject name="technique_id=T1021.001,technique_name=Remote Desktop Protocol" condition="is">HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\MaxInstanceCount</TargetObject>
 <TargetObject name="technique_id=T1021.001,technique_name=Remote Desktop Protocol" condition="is">HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\RaunSolicit</TargetObject>
 <TargetObject name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="end with">\PsGetSID\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="end with">\PsLoggedOn\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1037,technique_name=Boot or Logon Initialization Scripts" condition="contains">\Windows\System\Scripts</TargetObject>
 <TargetObject name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="contains all">HKLM\SYSTEM\;Control\WMI\EtwMaxLoggers</TargetObject>
 <TargetObject name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="contains all">HKLM\SYSTEM\;Control\WMI\Security</TargetObject>
 <TargetObject name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="contains all">HKLM\SYSTEM\;Control\WMI\autologger\senseauditlogger</TargetObject>
 <TargetObject name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="contains all">HKLM\SYSTEM\;Control\WMI\autologger\senseeventlog</TargetObject>
 <TargetObject name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="contains">SYSTEM\CurrentControlSet\Control\CrashControl</TargetObject>
 <TargetObject name="technique_id=T1053,technique_name=Scheduled Task" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree</TargetObject>
 <TargetObject name="technique_id=T1053,technique_name=Scheduled Task" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\</TargetObject>
 <TargetObject name="technique_id=T1053,technique_name=Scheduled Task" condition="contains all">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks;Actions</TargetObject>
 <TargetObject name="technique_id=T1057,technique_name=Process Discovery" condition="end with">\PsInfo\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1057,technique_name=Process Discovery" condition="end with">\PsList\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1098,technique_name=Account Manipulation" condition="contains">\services\Netlogon\Parameters\DisablePasswordChange</TargetObject>
 <TargetObject name="technique_id=T1098,technique_name=Account Manipulation" condition="end with">\PsPasswd\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1105,technique_name=Ingress Tool Transfer" condition="end with">\PsFile\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1112,technique_name=Modify Registry" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\Shadow</TargetObject>
 <TargetObject name="technique_id=T1112,technique_name=Modify Registry" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fDenyTSConnections</TargetObject>
 <TargetObject name="technique_id=T1112,technique_name=Modify Registry" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\fSingleSessionPerUser</TargetObject>
 <TargetObject name="technique_id=T1112,technique_name=Modify Registry" condition="begin with">HKLM\SYSTEM\CurrentControlSet\services\TermService\Parameters\ServiceDll</TargetObject>
 <TargetObject name="technique_id=T1137.004,technique_name=Outlook Home Page" condition="contains all">software\microsoft\office\;\outlook\security\</TargetObject>
 <TargetObject name="technique_id=T1137.004,technique_name=Outlook Home Page" condition="contains all">software\microsoft\office\;\outlook\today\</TargetObject>
 <TargetObject name="technique_id=T1137.004,technique_name=Outlook Home Page" condition="contains all">software\microsoft\office\;\outlook\webview\;\</TargetObject>
 <TargetObject name="technique_id=T1137.006,technique_name=Office Add-ins" condition="contains all">\Microsoft\Office;\Outlook\Addins</TargetObject>
 <TargetObject name="technique_id=T1137.006,technique_name=Office Add-ins" condition="contains all">\Microsoft\Office;\PowerPoint\Addins</TargetObject>
 <TargetObject name="technique_id=T1137.006,technique_name=Office Add-ins" condition="contains">\Software\Microsoft\VSTO\Security\Inclusion</TargetObject>
 <TargetObject name="technique_id=T1137.006,technique_name=Office Add-ins" condition="contains">\Software\Microsoft\VSTO\SolutionMetadata</TargetObject>
 <TargetObject name="technique_id=T1210,technique_name=Exploitation of Remote Services" condition="contains all">HKLM\SOFTWARE\Microsoft\Windows;\CurrentVersion\Print\Connections</TargetObject>
 <TargetObject name="technique_id=T1210,technique_name=Exploitation of Remote Services" condition="contains all">HKLM\System;\control\print\monitors</TargetObject>
 <TargetObject name="technique_id=T1218,technique_name=Signed Binary Proxy Execution" condition="begin with">HKLM\Software\Microsoft\WAB\DLLPath</TargetObject>
 <TargetObject name="technique_id=T1546.001,technique_name=Change Default File Association" condition="contains">\Explorer\FileExts</TargetObject>
 <TargetObject name="technique_id=T1546.007,technique_name=Netsh Helper DLL" condition="contains">SOFTWARE\Microsoft\Netsh</TargetObject>
 <TargetObject name="technique_id=T1546.008,technique_name=Accessibility Features" condition="contains">\Environment\</TargetObject>
 <TargetObject name="technique_id=T1546.009,technique_name=AppCert DLLs" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls</TargetObject>
 <TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="contains all">HKLM\SOFTWARE\;Microsoft\Windows NT\CurrentVersion\Windows\Appinit_Dlls</TargetObject>
 <TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="contains all">HKLM\SOFTWARE\;Microsoft\Windows NT\CurrentVersion\Windows\loadappinit_dlls</TargetObject>
 <TargetObject name="technique_id=T1546.010,technique_name=Appinit DLLs" condition="contains all">\SYSTEM\;\Services\DNS\Parameters\ServerLevelPluginDll</TargetObject>
 <TargetObject name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom</TargetObject>
 <TargetObject name="technique_id=T1546.011,technique_name=Application Shimming" condition="contains">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB</TargetObject>
 <TargetObject name="technique_id=T1546.012,technique_name=Image File Execution Options Injection" condition="begin with">HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
 <TargetObject name="technique_id=T1546.012,technique_name=Image File Execution Options Injection" condition="begin with">HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</TargetObject>
 <TargetObject name="technique_id=T1546.015,technique_name=Component Object Model Hijacking" condition="contains all">Classes\CLSID\;TreatAs</TargetObject>
 <TargetObject name="technique_id=T1546.015,technique_name=Component Object Model Hijacking" condition="contains all">Software\Classes\CLSID;inprocserver32</TargetObject>
 <TargetObject name="technique_id=T1546.015,technique_name=Component Object Model Hijacking" condition="contains all">Software\Classes\CLSID;localserver32</TargetObject>
 <TargetObject name="technique_id=T1546.015,technique_name=Component Object Model Hijacking" condition="contains">software\classes\clsid\{083863f1-70de-11d0-bd40-00a0c911ce86}\instance</TargetObject>
 <TargetObject name="technique_id=T1546.015,technique_name=Component Object Model Hijacking" condition="contains">software\classes\clsid\{7ed96837-96f0-4812-b211-f13c24117ed3}\instance</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\InitialProgram</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="begin with">hklm\software\microsoft\command processor\autorun</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains all">HKLM\SYSTEM\;Control\Session Manager\BootExecute</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains all">HKLM\SYSTEM\;Control\Session Manager\excludefromknowndlls</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains all">HKLM\SYSTEM\;Control\Session Manager\safedllsearchmode</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains all">HKLM\SYSTEM\;Control\Session Manager\setupexecute</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains all">software\microsoft\windows nt\currentversion\accessibility\ATs\;\StartExe</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders\Startup</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU\</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">\CurrentVersion\Run</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">\Policies\Explorer\Run</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">software\microsoft\windows nt\currentversion\windows\run\</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">software\microsoft\windows\currentversion\explorer\shell folders\common startup</TargetObject>
 <TargetObject name="technique_id=T1547.001,technique_name=Registry Run Keys / Start Folder" condition="contains">software\microsoft\windows\currentversion\explorer\shell folders\startup</TargetObject>
 <TargetObject name="technique_id=T1547.002,technique_name=Authentication Package" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication</TargetObject>
 <TargetObject name="technique_id=T1547.002,technique_name=Authentication Package" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\NtlmMinClientSec</TargetObject>
 <TargetObject name="technique_id=T1547.002,technique_name=Authentication Package" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL</TargetObject>
 <TargetObject name="technique_id=T1547.003,technique_name=Time Providers" condition="contains">HKLM\System\CurrentControlSet\Services\W32Time\TimeProviders</TargetObject>
 <TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify</TargetObject>
 <TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell</TargetObject>
 <TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Specialaccounts\userlist</TargetObject>
 <TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Uihostl</TargetObject>
 <TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit</TargetObject>
 <TargetObject name="technique_id=T1547.004,technique_name=Winlogon Helper DLL" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\VmApplet</TargetObject>
 <TargetObject name="technique_id=T1547.005,technique_name=Security Support Provider" condition="contains">SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe</TargetObject>
 <TargetObject name="technique_id=T1547.010,technique_name=Boot or Logon Autostart Execution - Port Monitors" condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports</TargetObject>
 <TargetObject name="technique_id=T1547.010,technique_name=Boot or Logon Autostart Execution - Port Monitors" condition="contains">\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Ports</TargetObject>
 <TargetObject name="technique_id=T1547.010,technique_name=Port Monitors" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors</TargetObject>
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\UacDisableNotify</TargetObject>
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify</TargetObject>
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA</TargetObject>
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="begin with">HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy</TargetObject>
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">Classes\exefile\shell\runas\command\isolatedCommand</TargetObject>
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command</TargetObject>
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">\mscfile\shell\open\command</TargetObject>
 <TargetObject name="technique_id=T1548.002,technique_name=Bypass User Access Control" condition="contains">ms-settings\shell\open\command</TargetObject>
 <TargetObject name="technique_id=T1553.003,technique_name=SIP and Trust Provider Hijacking" condition="begin with">HKLM\SOFTWARE\Microsoft\Cryptography\OID</TargetObject>
 <TargetObject name="technique_id=T1553.003,technique_name=SIP and Trust Provider Hijacking" condition="begin with">HKLM\SOFTWARE\Microsoft\Cryptography\Offload\ExpoOffload</TargetObject>
 <TargetObject name="technique_id=T1553.003,technique_name=SIP and Trust Provider Hijacking" condition="begin with">HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust</TargetObject>
 <TargetObject name="technique_id=T1553.003,technique_name=SIP and Trust Provider Hijacking" condition="begin with">HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID</TargetObject>
 <TargetObject name="technique_id=T1553.003,technique_name=SIP and Trust Provider Hijacking" condition="begin with">HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust</TargetObject>
 <TargetObject name="technique_id=T1553.004,technique_name=Install Root Certificate" condition="begin with">HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates</TargetObject>
 <TargetObject name="technique_id=T1553.004,technique_name=Install Root Certificate" condition="contains">\Microsoft\SystemCertificates\CA\Certificates</TargetObject>
 <TargetObject name="technique_id=T1553.004,technique_name=Install Root Certificate" condition="contains">\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\AllAlertsDisabled</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\DisableMonitoring</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Microsoft\Security Center\FirewallOverride</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiVirus</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\SpyNetReporting</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\software\microsoft\Windows Advanced Threat Protection\TelLib</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\software\policies\microsoft\windows advanced threat protection\</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\software\policies\microsoft\windowsfirewall\;\authorizedapplications</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\software\policies\microsoft\windowsfirewall\;\authorizedapplications\list</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="begin with">HKLM\software\policies\microsoft\windowsfirewall\;\globallyopenports</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="contains all">HKLM\software\microsoft\microsoft antimalware\exclusions\</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="contains all">software\microsoft\powershell\;\shellids\microsoft.powershell\executionpolicy</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="contains">SYSTEM\CurrentControlSet\services\Sysmon</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="contains">SYSTEM\CurrentControlSet\services\SysmonDrv</TargetObject>
 <TargetObject name="technique_id=T1562.001,technique_name=Disable or Modify Tools" condition="end with">\PsKill\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1562.002,technique_name=Disable Windows Event Logging" condition="contains all">\SYSTEM\;\Service\EventLog;MaxSize</TargetObject>
 <TargetObject name="technique_id=T1562.002,technique_name=Disable Windows Event Logging" condition="contains all">\SYSTEM\;\Service\EventLog;Retention</TargetObject>
 <TargetObject name="technique_id=T1562.006,technique_name=Impair Defenses - Indicator Blocking" condition="end with">SOFTWARE\Microsoft\.NETFramework\ETWEnabled</TargetObject>
 <TargetObject name="technique_id=T1569.002,technique_name=Service Execution" condition="end with">\PsExec\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1569.002,technique_name=Service Execution" condition="end with">\PsLogList\EulaAccepted</TargetObject>
 <TargetObject name="technique_id=T1569.002,technique_name=Service Execution" condition="end with">\PsService\EulaAccepted</TargetObject>
 <TargetObject name="technique_name=Outlook Server 95/98 Identity Keys" condition="contains">Identities</TargetObject>
 <TargetObject name="undefined" condition="end with">\PsShutDown\EulaAccepted</TargetObject>
 <TargetObject name="undefined" condition="end with">\PsSuspend\EulaAccepted</TargetObject>
 </RegistryEvent>
 </RuleGroup>
 <!-- Event ID 12,13,14 == RegObject added/deleted, RegValue Set, RegObject Renamed - Excludes -->
 <RuleGroup groupRelation="or">
 <RegistryEvent onmatch="exclude">
 <Rule groupRelation="and">
 <Image condition="image">svchost.exe</Image>
 <TargetObject condition="begin with">HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\DNSRegisteredAdapters</TargetObject>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="image">svchost.exe</Image>
 <TargetObject condition="begin with">HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces</TargetObject>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Program Files\Microsoft Monitoring Agent\Agent\HealthService.exe</Image>
 <TargetObject condition="begin with">HKLM\System\CurrentControlSet\Services\HealthService\Parameters\Management Groups</TargetObject>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="image">svchost.exe</Image>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks</TargetObject>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</Image>
 <TargetObject condition="is">HKLM\System\CurrentControlSet\Services\Tcpip\Parameters</TargetObject>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="is">C:\Windows\system32\lsass.exe</Image>
 <TargetObject condition="contains">HKLM\System\CurrentControlSet\Services</TargetObject>
 </Rule>
 <Rule groupRelation="and">
 <TargetObject condition="contains">SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization</TargetObject>
 <Image condition="is">C:\Windows\System32\svchost.exe</Image>
 </Rule>
 <EventType condition="is">CreateKey</EventType>
 <Image condition="begin with">C:\$WINDOWS.~BT\</Image>
 <Image condition="begin with">C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security </Image>
 <Image condition="begin with">C:\Program Files\Common Files\McAfee\Engine\scanners</Image>
 <Image condition="begin with">C:\Program Files\Kaspersky Lab\Kaspersky Internet Security </Image>
 <Image condition="begin with">C:\Program Files\SentinelOne\Sentinel Agent</Image>
 <Image condition="end with">Office\root\integration\integrator.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\aciseposture.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Ivanti\Workspace Control\pfwsmgr.exe</Image>
 <Image condition="is">C:\Program Files (x86)\Webroot\WRSA.exe</Image>
 <Image condition="is">C:\Program Files (x86)\ownCloud\owncloud.exe</Image>
 <Image condition="is">C:\Program Files\Common Files\McAfee\AVSolution\mcshield.exe</Image>
 <Image condition="is">C:\Program Files\Common Files\McAfee\Engine\AMCoreUpdater\amupdate.exe</Image>
 <Image condition="is">C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe</Image>
 <Image condition="is">C:\Program Files\Cylance\Desktop\CylanceSvc.exe</Image>
 <Image condition="is">C:\Program Files\Cylance\Optics\CyOptics.exe</Image>
 <Image condition="is">C:\Program Files\McAfee\Agent\masvc.exe</Image>
 <Image condition="is">C:\Program Files\McAfee\Agent\x86\McScript_InUse.exe</Image>
 <Image condition="is">C:\Program Files\McAfee\Agent\x86\macompatsvc.exe</Image>
 <Image condition="is">C:\Program Files\McAfee\Agent\x86\mfemactl.exe</Image>
 <Image condition="is">C:\Program Files\McAfee\Endpoint Encryption Agent\MfeEpeHost.exe</Image>
 <Image condition="is">C:\Program Files\McAfee\Endpoint Security\Adaptive Threat Protection\mfeatp.exe</Image>
 <Image condition="is">C:\Program Files\McAfee\Endpoint Security\Endpoint Security Platform\mfeesp.exe</Image>
 <Image condition="is">C:\Program Files\McAfee\Endpoint Security\Threat Prevention\mfeensppl.exe</Image>
 <Image condition="is">C:\Program Files\Microsoft Application Virtualization\Client\AppVClient.exe</Image>
 <Image condition="is">C:\Program Files\RES Software\Workspace Manager\pfwsmgr.exe</Image>
 <Image condition="is">C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe</Image>
 <Image condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</Image>
 <Image condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\SenseCncProxy.exe</Image>
 <Image condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\SenseIR.exe</Image>
 <Image condition="is">C:\Program Files\Windows Defender\MsMpEng.exe</Image>
 <Image condition="is">C:\Program Files\ownCloud\owncloud.exe</Image>
 <Image condition="is">C:\WINDOWS\system32\backgroundTaskHost.exe</Image>
 <Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image>
 <Image condition="is">C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe</Image>
 <Image condition="is">System</Image>
 <TargetObject condition="begin with">HKLM\COMPONENTS</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\</TargetObject>
 <TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Publishers\</TargetObject>
 <TargetObject condition="contains all">SOFTWARE;\Microsoft\EnterpriseCertificates\Disallowed</TargetObject>
 <TargetObject condition="contains all">SOFTWARE;\Microsoft\SystemCertificates\Disallowed</TargetObject>
 <TargetObject condition="contains">Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing</TargetObject>
 <TargetObject condition="contains">\Control\WMI\Autologger\</TargetObject>
 <TargetObject condition="contains">\OpenWithProgids</TargetObject>
 <TargetObject condition="contains">\{CAFEEFAC-</TargetObject>
 <TargetObject condition="contains">_Classes\AppX</TargetObject>
 <TargetObject condition="end with">HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit</TargetObject>
 <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit</TargetObject>
 <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\AuditPolicy</TargetObject>
 <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Audit\PerUserAuditing\System</TargetObject>
 <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Domains</TargetObject>
 <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SspiCache</TargetObject>
 <TargetObject condition="end with">HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc\Start</TargetObject>
 <TargetObject condition="end with">Internet Explorer\Toolbar\Locked</TargetObject>
 <TargetObject condition="end with">ShellBrowser</TargetObject>
 <TargetObject condition="end with">Toolbar\ShellBrowser\ITBar7Layout</TargetObject>
 <TargetObject condition="end with">Toolbar\WebBrowser</TargetObject>
 <TargetObject condition="end with">Toolbar\WebBrowser\ITBar7Height</TargetObject>
 <TargetObject condition="end with">\Components\TrustedInstaller</TargetObject>
 <TargetObject condition="end with">\Components\TrustedInstaller\Events</TargetObject>
 <TargetObject condition="end with">\Components\Wlansvc</TargetObject>
 <TargetObject condition="end with">\Components\Wlansvc\Events</TargetObject>
 <TargetObject condition="end with">\CurrentVersion\App Paths</TargetObject>
 <TargetObject condition="end with">\CurrentVersion\Image File Execution Options</TargetObject>
 <TargetObject condition="end with">\CurrentVersion\Shell Extensions\Approved</TargetObject>
 <TargetObject condition="end with">\CurrentVersion\Shell Extensions\Cached</TargetObject>
 <TargetObject condition="end with">\Directory\shellex</TargetObject>
 <TargetObject condition="end with">\Directory\shellex\DragDropHandlers</TargetObject>
 <TargetObject condition="end with">\Drive\shellex</TargetObject>
 <TargetObject condition="end with">\Drive\shellex\DragDropHandlers</TargetObject>
 <TargetObject condition="end with">\Lsa\OfflineJoin\CurrentValue</TargetObject>
 <TargetObject condition="end with">\OpenWithList</TargetObject>
 <TargetObject condition="end with">\OpenWithList\MRUList</TargetObject>
 <TargetObject condition="end with">\UserChoice</TargetObject>
 <TargetObject condition="end with">\UserChoice\Hash</TargetObject>
 <TargetObject condition="end with">\UserChoice\ProgId</TargetObject>
 <TargetObject condition="end with">\services\BITS\Start</TargetObject>
 <TargetObject condition="end with">\services\DeviceAssociationService\Start</TargetObject>
 <TargetObject condition="end with">\services\TrustedInstaller\Start</TargetObject>
 <TargetObject condition="end with">\services\UsoSvc\Start</TargetObject>
 <TargetObject condition="end with">\services\clr_optimization_v2.0.50727_32\Start</TargetObject>
 <TargetObject condition="end with">\services\clr_optimization_v2.0.50727_64\Start</TargetObject>
 <TargetObject condition="end with">\services\clr_optimization_v4.0.30319_32\Start</TargetObject>
 <TargetObject condition="end with">\services\clr_optimization_v4.0.30319_64\Start</TargetObject>
 <TargetObject condition="end with">\services\tunnel\Start</TargetObject>
 <TargetObject condition="end with">} 0xFFFF</TargetObject>
 <TargetObject condition="end with">}\PreviousPolicyAreas</TargetObject>
 <TargetObject condition="is">HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates</TargetObject>
 <TargetObject condition="is">HKLM\System\CurrentControlSet\Services\SmsRouter\State\Registration\Ids</TargetObject>
 <TargetObject condition="is">HKLM\System\CurrentControlSet\Services\Tcpip\Parameters</TargetObject>
 <TargetObject condition="is">HKLM\System\CurrentControlSet\Services\W32Time\Config\LastKnownGoodTime</TargetObject>
 </RegistryEvent>
 </RuleGroup>
 <!-- Event ID 15 == FileStream Created - Includes -->
 <RuleGroup groupRelation="or">
 <FileCreateStreamHash onmatch="include">
 <Rule name="technique_id=T1189,technique_name=Drive-by Compromise" groupRelation="and">
 <TargetFilename condition="end with">:Zone.Identifier</TargetFilename>
 <Contents condition="contains any">blob:;about:internet</Contents>
 </Rule>
 <TargetFilename condition="contains">AppData</TargetFilename>
 <TargetFilename condition="contains">Content.Outlook</TargetFilename>
 <TargetFilename condition="contains">Downloads</TargetFilename>
 <TargetFilename condition="contains">ProgramData</TargetFilename>
 <TargetFilename condition="contains">Temp</TargetFilename>
 <TargetFilename condition="contains">Temp\7z</TargetFilename>
 <TargetFilename condition="contains">Users</TargetFilename>
 <TargetFilename condition="end with">.bat</TargetFilename>
 <TargetFilename condition="end with">.cmd</TargetFilename>
 <TargetFilename condition="end with">.dll</TargetFilename>
 <TargetFilename condition="end with">.exe</TargetFilename>
 <TargetFilename condition="end with">.hta</TargetFilename>
 <TargetFilename condition="end with">.lnk</TargetFilename>
 <TargetFilename condition="end with">.reg</TargetFilename>
 <TargetFilename condition="end with">.vb</TargetFilename>
 <TargetFilename condition="end with">.vbe</TargetFilename>
 <TargetFilename condition="end with">.vbs</TargetFilename>
 <TargetFilename condition="end with">Temp\debug.bin</TargetFilename>
 <TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">.ps1</TargetFilename>
 <TargetFilename name="technique_id=T1059.001,technique_name=PowerShell" condition="end with">.ps2</TargetFilename>
 </FileCreateStreamHash>
 </RuleGroup>
 <!-- Event ID 17,18 == PipeEvent. Log Named pipe created & Named pipe connected - Includes -->
 <RuleGroup groupRelation="or">
 <PipeEvent onmatch="include">
 <Rule groupRelation="and">
 <PipeName condition="begin with">\</PipeName>
 <EventType>CreatePipe</EventType>
 </Rule>
 <Rule groupRelation="and">
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\msse-</PipeName>
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="end with">-server</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <PipeName name="technique_id=T1059.001,technique_name=PowerShell" condition="begin with">\PSHost</PipeName>
 <Image condition="is not">powershell.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <PipeName name="technique_id=T1059.001,technique_name=PowerShell" condition="begin with">\PSHost</PipeName>
 <Image condition="is not">powershell_ise.exe</Image>
 </Rule>
 <Rule groupRelation="and">
 <PipeName condition="begin with">\TSVCPIPE</PipeName>
 </Rule>
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\PSEXESVC</PipeName>
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\atsvc</PipeName>
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\gruntsvc</PipeName>
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\msagent_</PipeName>
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\msf-pipe</PipeName>
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\status_</PipeName>
 <PipeName name="technique_id=T1021.002,technique_name=SMB/Windows Admin Shares" condition="begin with">\svcctl</PipeName>
 <PipeName name="technique_id=T1021.004,technique_name=Remote Services: SSH" condition="begin with">\postex_ssh_</PipeName>
 <PipeName name="technique_id=T1033,technique_name=System Owner/User Discovery" condition="begin with">\winreg</PipeName>
 <PipeName name="technique_id=T1049,technique_name=System Network Connections Discovery" condition="begin with">\srvsvc</PipeName>
 <PipeName name="technique_id=T1055; Possible Cobalt Strike post-exploitation jobs." condition="begin with">\postex_</PipeName>
 </PipeEvent>
 </RuleGroup>
 <!-- Event ID 17,18 == PipeEvent. Log Named pipe created & Named pipe connected - Excludes -->
 <RuleGroup groupRelation="or">
 <PipeEvent onmatch="exclude">
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Common Files\Adobe\ARM\1.0\AdobeARM.exe</Image>
 <PipeName condition="begin with">\32B6B37A-4A7D-4e00-95F2-</PipeName>
 <PipeName condition="end with">thsnYaVieBoda</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe</Image>
 <PipeName condition="begin with">\com.adobe.reader.rna.;\mojo</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Common Files\Adobe\AdobeGCClient\AGMService.exe</Image>
 <PipeName condition="begin with">\gc_pipe_</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Common Files\Adobe\Creative Cloud Libraries\libs\node.exe</Image>
 <PipeName condition="begin with">\uv\</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all"> C:\Users\;\AppData\Local\Programs\Call Manager\Call Manager.exe</Image>
 <PipeName condition="begin with">\crashpad_;\mojo.;\uv\</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Google\Update\Install\;setup.exe</Image>
 <PipeName condition="begin with">\crashpad_</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Google\Chrome\Application\chrome.exe</Image>
 <PipeName condition="begin with">\mojo.</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Google\Chrome\Application\;\Installer\chrmstp.exe</Image>
 <PipeName condition="begin with">\crashpad_</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Microsoft\Edge\Application\msedge.exe</Image>
 <PipeName condition="begin with">\LOCAL\mojo.</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Microsoft\Edge\Application\msedge.exe</Image>
 <PipeName condition="begin with">\LOCAL\chrome.sync.</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Microsoft\Edge\Application\msedge.exe</Image>
 <PipeName condition="begin with">\LOCAL\crashpad_</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Microsoft Office\root\Office16\OUTLOOK.EXE</Image>
 <PipeName condition="is">\MsFteWds</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Users\;\AppData\Local\Microsoft\Teams\current\Teams.exe</Image>
 <PipeName condition="begin with">\mojo.</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Users\;\AppData\Local\Microsoft\Teams\current\Teams.exe</Image>
 <PipeName condition="begin with">\chrome.sync.</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Mozilla Firefox\firefox.exe</Image>
 <PipeName condition="begin with">\cubeb-pipe-</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Mozilla Firefox\firefox.exe</Image>
 <PipeName condition="begin with">\chrome.</PipeName>
 </Rule>
 <Rule groupRelation="and">
 <Image condition="contains all">C:\Program Files;\Mozilla Firefox\firefox.exe</Image>
 <PipeName condition="begin with">\gecko-crash-server-pipe.</PipeName>
 </Rule>
 <Image condition="contains all">C:\Program Files;\Citrix\ICA Client\Receiver\Receiver.exe</Image>
 <Image condition="contains all">C:\Program Files;\Citrix\ICA Client\SelfServicePlugin\SelfService.exe</Image>
 <Image condition="contains all">C:\Program Files;\Citrix\ICA Client\concentr.exe</Image>
 <Image condition="contains all">C:\Program Files;\Citrix\ICA Client\wfcrun32.exe</Image>
 <Image condition="contains all">C:\Program Files;\FireEye\xagt\xagt.exe</Image>
 <Image condition="contains all">C:\Program Files;\Qualys\QualysAgent\QualysAgent.exe</Image>
 <Image condition="contains all">C:\Users\;\AppData\Local\Citrix\ICA Client\SelfServicePlugin\SelfService.exe</Image>
 <Image condition="contains all">C:\Users\;\AppData\Local\Citrix\ICA Client\receiver\Receiver.exe</Image>
 <Image condition="end with">PostgreSQL\9.6\bin\postgres.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\CMAgent\OfcCMAgent.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\LWCS\LWCSService.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiOnClose.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WEB_OSCE\WEB\CGI\cgiRqHotFix.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\WSS\iCRCService.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\Web\Service\DbServer.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\OfcLogReceiverSvc.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\ofcservice.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\osceintegrationservice.exe</Image>
 <Image condition="end with">Program Files (x86)\Trend Micro\OfficeScan\PCCSRV\web\service\verconn.exe</Image>
 <Image condition="end with">Program Files\SplunkUniversalForwarder\bin\splunk-MonitorNoHandle.exe</Image>
 <Image condition="end with">Program Files\SplunkUniversalForwarder\bin\splunk.exe</Image>
 <Image condition="end with">Program Files\SplunkUniversalForwarder\bin\splunkd.exe</Image>
 <Image condition="end with">Program Files\Trend\SPROTECT\x64\tsc.exe</Image>
 <Image condition="end with">Program Files\Trend\SPROTECT\x64\tsc64.exe</Image>
 <Image condition="is">"C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe"</Image>
 <Image condition="is">Program Files (x86)\Microsoft SQL Server\110\DTS\binn\dtexec.exe</Image>
 <Image condition="is">Program Files\Qlik\Sense\Engine\Engine.exe</Image>
 <Image condition="is">c:\windows\system32\inetsrv\w3wp.exe</Image>
 <PipeName condition="begin with">\Vivisimo Velocity</PipeName>
 <PipeName condition="contains">Anonymous Pipe</PipeName>
 <PipeName condition="contains">\pgsignal_</PipeName>
 <PipeName condition="is">\OfcServerNamePipe</PipeName>
 <PipeName condition="is">\SQLLocal\COMMVAULT</PipeName>
 <PipeName condition="is">\SQLLocal\INSTANCE01</PipeName>
 <PipeName condition="is">\SQLLocal\MSSQLSERVER</PipeName>
 <PipeName condition="is">\SQLLocal\RTC</PipeName>
 <PipeName condition="is">\SQLLocal\RTCLOCAL</PipeName>
 <PipeName condition="is">\SQLLocal\SQLEXPRESS</PipeName>
 <PipeName condition="is">\SQLLocal\TMSM</PipeName>
 <PipeName condition="is">\Trend Micro Endpoint Encryption ToolBox Command Handler Manager</PipeName>
 <PipeName condition="is">\Trend Micro OSCE Command Handler Manager</PipeName>
 <PipeName condition="is">\Trend Micro OSCE Command Handler2 Manager</PipeName>
 <PipeName condition="is">\lsass</PipeName>
 <PipeName condition="is">\ntapvsrq</PipeName>
 <PipeName condition="is">\spoolss</PipeName>
 <PipeName condition="is">\srvsvc</PipeName>
 <PipeName condition="is">\winreg</PipeName>
 <PipeName condition="is">\wkssvc</PipeName>
 </PipeEvent>
 </RuleGroup>
 <!-- Event ID 19,20,21, == WmiEvent. Log all WmiEventFilter, WmiEventConsumer, WmiEventConsumerToFilter activity - Includes -->
 <RuleGroup groupRelation="or">
 <WmiEvent onmatch="include">
 <Operation name="technique_id=T1047,technique_name=Windows Management Instrumentation" condition="is">Created</Operation>
 </WmiEvent>
 </RuleGroup>
 <!-- Event ID 22 == DNS Queries and their results Excludes -->
 <RuleGroup groupRelation="or">
 <!--Default to log all and exclude a few common processes-->
 <DnsQuery onmatch="exclude">
 <Rule groupRelation="and">
 <Image condition="is">C:\ProgramData\LogiShrd\LogiOptions\Software\Current\updater.exe</Image>
 <QueryName condition="end with">.logitech.com</QueryName>
 </Rule>
 <Image condition="contains all">C:\Program Files\SentinelOne\Sentinel Agent;\SentinelAgent.exe</Image>
 <Image condition="contains all">C:\Windows\SystemApps\Microsoft.Windows.Search;SearchApp.exe</Image>
 <Image condition="is">C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe</Image>
 <QueryName condition="end with">-pushp.svc.ms</QueryName>
 <QueryName condition="end with">.1rx.io</QueryName>
 <QueryName condition="end with">.2mdn.net</QueryName>
 <QueryName condition="end with">.activedirectory.windowsazure.com</QueryName>
 <QueryName condition="end with">.adadvisor.net</QueryName>
 <QueryName condition="end with">.adap.tv</QueryName>
 <QueryName condition="end with">.addthis.com</QueryName>
 <QueryName condition="end with">.adform.net</QueryName>
 <QueryName condition="end with">.adnxs.com</QueryName>
 <QueryName condition="end with">.adroll.com</QueryName>
 <QueryName condition="end with">.adrta.com</QueryName>
 <QueryName condition="end with">.adsafeprotected.com</QueryName>
 <QueryName condition="end with">.adsrvr.org</QueryName>
 <QueryName condition="end with">.advertising.com</QueryName>
 <QueryName condition="end with">.akadns.net</QueryName>
 <QueryName condition="end with">.amazon-adsystem.com</QueryName>
 <QueryName condition="end with">.amazon-adsystem.com</QueryName>
 <QueryName condition="end with">.amazontrust.com</QueryName>
 <QueryName condition="end with">.analytics.yahoo.com</QueryName>
 <QueryName condition="end with">.aol.com</QueryName>
 <QueryName condition="end with">.aria.microsoft.com</QueryName>
 <QueryName condition="end with">.arpa.</QueryName>
 <QueryName condition="end with">.arpa</QueryName>
 <QueryName condition="end with">.aspnetcdn.com</QueryName>
 <QueryName condition="end with">.b-msedge.net</QueryName>
 <QueryName condition="end with">.betrad.com</QueryName>
 <QueryName condition="end with">.bidswitch.net</QueryName>
 <QueryName condition="end with">.bing.com</QueryName>
 <QueryName condition="end with">.casalemedia.com</QueryName>
 <QueryName condition="end with">.chartbeat.net</QueryName>
 <QueryName condition="end with">.cnn.com</QueryName>
 <QueryName condition="end with">.convertro.com</QueryName>
 <QueryName condition="end with">.criteo.com</QueryName>
 <QueryName condition="end with">.criteo.net</QueryName>
 <QueryName condition="end with">.crwdcntrl.net</QueryName>
 <QueryName condition="end with">.demdex.net</QueryName>
 <QueryName condition="end with">.digicert.com</QueryName>
 <QueryName condition="end with">.domdex.com</QueryName>
 <QueryName condition="end with">.dotomi.com</QueryName>
 <QueryName condition="end with">.doubleclick.net</QueryName>
 <QueryName condition="end with">.doubleverify.com</QueryName>
 <QueryName condition="end with">.emxdgt.com</QueryName>
 <QueryName condition="end with">.exelator.com</QueryName>
 <QueryName condition="end with">.fp.measure.office.com</QueryName>
 <QueryName condition="end with">.globalsign.com</QueryName>
 <QueryName condition="end with">.globalsign.net</QueryName>
 <QueryName condition="end with">.google-analytics.com</QueryName>
 <QueryName condition="end with">.googleadservices.com</QueryName>
 <QueryName condition="end with">.googlesyndication.com</QueryName>
 <QueryName condition="end with">.googletagmanager.com</QueryName>
 <QueryName condition="end with">.googlevideo.com</QueryName>
 <QueryName condition="end with">.gstatic.com</QueryName>
 <QueryName condition="end with">.gvt1.com</QueryName>
 <QueryName condition="end with">.gvt2.com</QueryName>
 <QueryName condition="end with">.hotmail.com</QueryName>
 <QueryName condition="end with">.ib-ibi.com</QueryName>
 <QueryName condition="end with">.jivox.com</QueryName>
 <QueryName condition="end with">.live.com</QueryName>
 <QueryName condition="end with">.live.net</QueryName>
 <QueryName condition="end with">.localmachine</QueryName>
 <QueryName condition="end with">.mathtag.com</QueryName>
 <QueryName condition="end with">.microsoft.com</QueryName>
 <QueryName condition="end with">.microsoftonline.com</QueryName>
 <QueryName condition="end with">.microsoftstore.com</QueryName>
 <QueryName condition="end with">.moatads.com</QueryName>
 <QueryName condition="end with">.moatpixel.com</QueryName>
 <QueryName condition="end with">.mookie1.com</QueryName>
 <QueryName condition="end with">.mozaws.net</QueryName>
 <QueryName condition="end with">.mozilla.com</QueryName>
 <QueryName condition="end with">.mozilla.net</QueryName>
 <QueryName condition="end with">.mozilla.org</QueryName>
 <QueryName condition="end with">.ms-acdc.office.com</QueryName>
 <QueryName condition="end with">.msauth.net</QueryName>
 <QueryName condition="end with">.msedge.net</QueryName>
 <QueryName condition="end with">.msftauth.net</QueryName>
 <QueryName condition="end with">.msftncsi.com</QueryName>
 <QueryName condition="end with">.msn.com</QueryName>
 <QueryName condition="end with">.msocdn.com</QueryName>
 <QueryName condition="end with">.myvisualiq.net</QueryName>
 <QueryName condition="end with">.netflix.com</QueryName>
 <QueryName condition="end with">.netmng.com</QueryName>
 <QueryName condition="end with">.nexac.com</QueryName>
 <QueryName condition="end with">.openx.net</QueryName>
 <QueryName condition="end with">.opinsights.azure.com</QueryName>
 <QueryName condition="end with">.optimizely.com</QueryName>
 <QueryName condition="end with">.outbrain.com</QueryName>
 <QueryName condition="end with">.pardot.com</QueryName>
 <QueryName condition="end with">.phx.gbl</QueryName>
 <QueryName condition="end with">.pinterest.com</QueryName>
 <QueryName condition="end with">.pki.goog</QueryName>
 <QueryName condition="end with">.pubmatic.com</QueryName>
 <QueryName condition="end with">.quantcount.com</QueryName>
 <QueryName condition="end with">.quantserve.com</QueryName>
 <QueryName condition="end with">.revsci.net</QueryName>
 <QueryName condition="end with">.rfihub.net</QueryName>
 <QueryName condition="end with">.rlcdn.com</QueryName>
 <QueryName condition="end with">.rubiconproject.com</QueryName>
 <QueryName condition="end with">.s-microsoft.com</QueryName>
 <QueryName condition="end with">.scdn.co</QueryName>
 <QueryName condition="end with">.scorecardresearch.com</QueryName>
 <QueryName condition="end with">.serving-sys.com</QueryName>
 <QueryName condition="end with">.sharethrough.com</QueryName>
 <QueryName condition="end with">.simpli.fi</QueryName>
 <QueryName condition="end with">.sitescout.com</QueryName>
 <QueryName condition="end with">.skype.com</QueryName>
 <QueryName condition="end with">.skype.net</QueryName>
 <QueryName condition="end with">.smartadserver.com</QueryName>
 <QueryName condition="end with">.snapads.com</QueryName>
 <QueryName condition="end with">.spotify.com</QueryName>
 <QueryName condition="end with">.spotify.map.fastly.net</QueryName>
 <QueryName condition="end with">.spotxchange.com</QueryName>
 <QueryName condition="end with">.stackassets.com</QueryName>
 <QueryName condition="end with">.steamcontent.com</QueryName>
 <QueryName condition="end with">.taboola.com</QueryName>
 <QueryName condition="end with">.taboola.map.fastly.net</QueryName>
 <QueryName condition="end with">.tapad.com</QueryName>
 <QueryName condition="end with">.tidaltv.com</QueryName>
 <QueryName condition="end with">.trafficmanager.net</QueryName>
 <QueryName condition="end with">.tremorhub.com</QueryName>
 <QueryName condition="end with">.tribalfusion.com</QueryName>
 <QueryName condition="end with">.turn.com</QueryName>
 <QueryName condition="end with">.twimg.com</QueryName>
 <QueryName condition="end with">.tynt.com</QueryName>
 <QueryName condition="end with">.typekit.net</QueryName>
 <QueryName condition="end with">.usertrust.com</QueryName>
 <QueryName condition="end with">.w55c.net</QueryName>
 <QueryName condition="end with">.windows.com</QueryName>
 <QueryName condition="end with">.windows.net.nsatc.net</QueryName>
 <QueryName condition="end with">.windowsupdate.com</QueryName>
 <QueryName condition="end with">.xboxlive.com</QueryName>
 <QueryName condition="end with">.ytimg.com</QueryName>
 <QueryName condition="end with">.zorosrv.com</QueryName>
 <QueryName condition="end with">ocsp.identrust.com</QueryName>
 <QueryName condition="end with">office365.com</QueryName>
 <QueryName condition="is">1rx.io</QueryName>
 <QueryName condition="is">acdc-direct.office.com</QueryName>
 <QueryName condition="is">adservice.google.com</QueryName>
 <QueryName condition="is">ajax.googleapis.com</QueryName>
 <QueryName condition="is">amazontrust.com</QueryName>
 <QueryName condition="is">ampcid.google.com</QueryName>
 <QueryName condition="is">cdnjs.cloudflare.com</QueryName>
 <QueryName condition="is">cdnjs.cloudflare.com</QueryName>
 <QueryName condition="is">clients1.google.com</QueryName>
 <QueryName condition="is">clients2.google.com</QueryName>
 <QueryName condition="is">clients3.google.com</QueryName>
 <QueryName condition="is">clients4.google.com</QueryName>
 <QueryName condition="is">clients5.google.com</QueryName>
 <QueryName condition="is">clients6.google.com</QueryName>
 <QueryName condition="is">clientservices.googleapis.com</QueryName>
 <QueryName condition="is">crl.verisign.com</QueryName>
 <QueryName condition="is">cscasha2.ocsp-certum.com</QueryName>
 <QueryName condition="is">fonts.googleapis.com</QueryName>
 <QueryName condition="is">googleadapis.l.google.com</QueryName>
 <QueryName condition="is">imasdk.googleapis.com</QueryName>
 <QueryName condition="is">l.google.com</QueryName>
 <QueryName condition="is">localhost</QueryName>
 <QueryName condition="is">login.windows.net</QueryName>
 <QueryName condition="is">management.azure.com</QueryName>
 <QueryName condition="is">ml314.com</QueryName>
 <QueryName condition="is">msocsp.com</QueryName>
 <QueryName condition="is">mtalk.google.com</QueryName>
 <QueryName condition="is">ocsp.comodoca.com</QueryName>
 <QueryName condition="is">ocsp.entrust.net</QueryName>
 <QueryName condition="is">ocsp.godaddy.com</QueryName>
 <QueryName condition="is">ocsp.int-x3.letsencrypt.org</QueryName>
 <QueryName condition="is">ocsp.msocsp.com</QueryName>
 <QueryName condition="is">ocsp.sectigo.com</QueryName>
 <QueryName condition="is">ocsp.verisign.com</QueryName>
 <QueryName condition="is">osi.office.net</QueryName>
 <QueryName condition="is">outlook.office.com</QueryName>
 <QueryName condition="is">outlook.office365.com</QueryName>
 <QueryName condition="is">pki-goog.l.google.com</QueryName>
 <QueryName condition="is">pki.goog</QueryName>
 <QueryName condition="is">portal.azure.com</QueryName>
 <QueryName condition="is">safebrowsing.googleapis.com</QueryName>
 <QueryName condition="is">statics.teams.cdn.office.net</QueryName>
 <QueryName condition="is">status.rapidssl.com</QueryName>
 <QueryName condition="is">status.thawte.com</QueryName>
 <QueryName condition="is">subca.ocsp-certum.com</QueryName>
 <QueryName condition="is">substrate.office.com</QueryName>
 <QueryName condition="is">update.googleapis.com</QueryName>
 <QueryName condition="is">www.googletagservices.com</QueryName>
 </DnsQuery>
 </RuleGroup>

	<!--SYSMON EVENT ID 255 : ERROR-->
		<!--"This event is generated when an error occurred within Sysmon. They can happen if the system is under heavy load
			and certain tasked could not be performed or a bug exists in the Sysmon service. You can report any bugs on the
			Sysinternals forum or over Twitter (@markrussinovich)."-->
		<!--Cannot be filtered.-->

	</EventFiltering>
</Sysmon>

Стандартный конфигурационный файл Filebeat

Mon, 01 Jan 0001 00:00:00 +0000

Для ОС Windows:

filebeat.inputs:
 # MS IIS
 - type: log
 enabled: true
 paths:
 - C:\inetpub\logs\LogFiles\*\*.log
 exclude_lines: ['^#']
 tags: ["ms-iis", "access-full"]
 ignore_older: 72h

 # MS EXCHANGE
 - type: log
 paths:
 # Mailbox servers:
 # - MSGTRK files for the Transport service
 # - MSGTRMD files for the Mailbox Transport Delivery service
 # - MSGTRMS files for the Mailbox Transport Submission service

 # Transport service on Edge Transport servers:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\MessageTracking\*

 enabled: true
 exclude_lines: ["^#"]
 tags: ["exchange", "msgtrk"]

 - type: log
 paths:
 # Mailbox servers:
 # Front End Transport service Receive connectors:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\*
 # Front End Transport service Send connectors:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpSend\*

 # Transport service Receive connectors:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive\*
 # Transport service Send connectors:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpSend\*

 # Mailbox Transport Delivery service (Receive Connectors):
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpReceive\Delivery\*

 # Mailbox Transport Submission service Send connectors:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpSend\Submission\*
 # Mailbox Transport Submission service Side effect messages:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Mailbox\ProtocolLog\SmtpSend\Delivery\*

 # Transport service on Edge Transport servers Receive connectors:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Edge\ProtocolLog\SmtpReceive\*
 # Transport service on Edge Transport servers Receive connectors:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Edge\ProtocolLog\SmtpSend\*

 enabled: true
 exclude_lines: ["^#"]
 tags: ["exchange", "smtp"]

 - type: log
 paths:
 - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Egde\AgentLog\*

 enabled: true
 exclude_lines: ["^#"]
 tags: ["exchange", "antispam"]

output.logstash:
 ssl.enabled: true
 ssl.verification_mode: none

Стандартный конфигурационный файл Packetbeat

Mon, 01 Jan 0001 00:00:00 +0000

Для ОС Windows:

# On Windows, you must also download and install a packet sniffing library, such as Npcap, that implements the libpcap interfaces.
packetbeat.interfaces.device: pcap

output.logstash:
 ssl.enabled: true
 ssl.verification_mode: none

Для ОС Linux:

packetbeat.interfaces.device: any

output.logstash:
 ssl.enabled: true
 ssl.verification_mode: none

Стандартный конфигурационный файл Auditbeat

Mon, 01 Jan 0001 00:00:00 +0000

Для ОС Windows:

auditbeat.modules:
- module: file_integrity
 paths:
 - "C:\\Windows\\System32"
 include_files: []
 scan_at_start: true
 scan_rate_per_sec: 50 MiB
 max_file_size: 100 MiB
 hash_types: [sha1]
 recursive: false

output.logstash:
 ssl.enabled: true
 ssl.verification_mode: none

Для ОС Linux:

# =========================== Modules configuration ============================
auditbeat.modules:

- module: auditd
 # Load audit rules from separate files. Same format as audit.rules(7).
 audit_rule_files: ['${path.config}/audit.rules.d/*.conf']
 audit_rules: |
 # https://github.com/bfuzzy/auditd-attack/blob/master/auditd-attack.rules
 # https://github.com/Neo23x0/auditd/blob/master/audit.rules

 # Self Auditing ---------------------------------------------------------------

 ## Audit the audit logs
 ### Successful and unsuccessful attempts to read information from the audit records
 -w /var/log/audit/ -p wra -k auditlog
 -w /var/log/audit/ -p wra -k T1005_Data_From_Local_System_audit_log
 -w /var/audit/ -p wra -k T1005_Data_From_Local_System_audit_log

 ## Auditd configuration
 ### Modifications to audit configuration that occur while the audit collection functions are operating
 -w /etc/audit/ -p wa -k auditconfig
 -w /etc/libaudit.conf -p wa -k auditconfig
 -w /etc/audisp/ -p wa -k audispconfig

 ## Monitor for use of audit management tools
 -w /sbin/auditctl -p x -k audittools
 -w /sbin/auditd -p x -k audittools
 -w /usr/sbin/auditd -p x -k audittools
 -w /usr/sbin/augenrules -p x -k audittools

 ## Access to all audit trails

 -a always,exit -F path=/usr/sbin/ausearch -F perm=x -k T1005_Data_From_Local_System_audit_log
 -a always,exit -F path=/usr/sbin/aureport -F perm=x -k T1005_Data_From_Local_System_audit_log
 -a always,exit -F path=/usr/sbin/aulast -F perm=x -k T1005_Data_From_Local_System_audit_log
 -a always,exit -F path=/usr/sbin/aulastlogin -F perm=x -k T1005_Data_From_Local_System_audit_log
 -a always,exit -F path=/usr/sbin/auvirt -F perm=x -k T1005_Data_From_Local_System_audit_log

 # Filters ---------------------------------------------------------------------

 ### We put these early because audit is a first match wins system.

 ## Ignore SELinux AVC records
 -a always,exclude -F msgtype=AVC

 ## Ignore current working directory records
 -a always,exclude -F msgtype=CWD

 ## Ignore EOE records (End Of Event, not needed)
 -a always,exclude -F msgtype=EOE

 ## Cron jobs fill the logs with stuff we normally don't want (works with SELinux)
 -a never,user -F subj_type=crond_t
 -a never,exit -F subj_type=crond_t

 ## This prevents chrony from overwhelming the logs (if chrony installed)
 #-a never,exit -F arch=b32 -S adjtimex -F auid=unset -F uid=chrony -F subj_type=chronyd_t
 #-a never,exit -F arch=b64 -S adjtimex -F auid=unset -F uid=chrony -F subj_type=chronyd_t

 ## This is not very interesting and wastes a lot of space if the server is public facing
 -a always,exclude -F msgtype=CRYPTO_KEY_USER

 ## VMware tools
 -a never,exit -F arch=b32 -S fork -F success=0 -F path=/usr/lib/vmware-tools -F subj_type=initrc_t -F exit=-2
 -a never,exit -F arch=b64 -S fork -F success=0 -F path=/usr/lib/vmware-tools -F subj_type=initrc_t -F exit=-2

 -a never,exit -F arch=b32 -S all -F exe=/usr/bin/vmtoolsd
 -a never,exit -F arch=b64 -S all -F exe=/usr/bin/vmtoolsd

 ### High Volume Event Filter (especially on Linux Workstations)
 -a never,exit -F arch=b32 -F dir=/dev/shm -k sharedmemaccess
 -a never,exit -F arch=b64 -F dir=/dev/shm -k sharedmemaccess
 # if LVM installed
 # -a never,exit -F arch=b32 -F dir=/var/lock/lvm -k locklvm
 # -a never,exit -F arch=b64 -F dir=/var/lock/lvm -k locklvm

 ## FileBeat
 -a never,exit -F arch=b32 -F path=/opt/filebeat -k filebeat
 -a never,exit -F arch=b64 -F path=/opt/filebeat -k filebeat

 ## More information on how to filter events
 ### https://access.redhat.com/solutions/2482221

 # Rules -----------------------------------------------------------------------

 ## Kernel parameters
 -w /etc/sysctl.conf -p wa -k sysctl
 -w /etc/sysctl.d -p wa -k sysctl

 ## Kernel module loading and unloading
 -a always,exit -F perm=x -F auid!=-1 -F path=/sbin/insmod -k modules -k T1215_Kernel_Modules_and_Extensions
 -a always,exit -F perm=x -F auid!=-1 -F path=/sbin/modprobe -k modules -k T1215_Kernel_Modules_and_Extensions
 -a always,exit -F perm=x -F auid!=-1 -F path=/sbin/rmmod -k modules -k T1215_Kernel_Modules_and_Extensions
 -a always,exit -F arch=b64 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules -k T1215_Kernel_Modules_and_Extensions
 -a always,exit -F arch=b32 -S finit_module -S init_module -S delete_module -F auid!=-1 -k modules -k T1215_Kernel_Modules_and_Extensions

 ## Modprobe configuration
 -w /etc/modprobe.conf -p wa -k modprobe -k T1215_Kernel_Modules_and_Extensions
 -w /etc/modprobe.d -p wa -k modprobe -k T1215_Kernel_Modules_and_Extensions

 ## KExec usage (all actions)
 -a always,exit -F arch=b64 -S kexec_load -k KEXEC
 -a always,exit -F arch=b32 -S sys_kexec_load -k KEXEC

 ## Special files
 -a always,exit -F arch=b32 -S mknod -S mknodat -k specialfiles
 -a always,exit -F arch=b64 -S mknod -S mknodat -k specialfiles

 ## Mount operations (only attributable)
 ## Media Export Related Events
 #-a always,exit -F arch=b32 -S mount -F auid>=500 -F auid!=4294967295
 #-a always,exit -F arch=b64 -S mount -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S mount -S umount2 -F auid>=1000 -F auid!=-1 -k mount -k T1052_Exfiltration_Over_Physical_Medium
 -a always,exit -F arch=b32 -S mount -S umount -S umount2 -F auid>=1000 -F auid!=-1 -k mount -k T1052_Exfiltration_Over_Physical_Medium

 ## Change swap (only attributable)
 -a always,exit -F arch=b64 -S swapon -S swapoff -F auid!=-1 -k swap
 -a always,exit -F arch=b32 -S swapon -S swapoff -F auid!=-1 -k swap

 ## Time Related Events
 -a always,exit -F arch=b32 -S adjtimex -S settimeofday -S clock_settime -k time -k T1099_Timestomp
 -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -k time -k T1099_Timestomp
 # if NTP daemon is installed
 # -a always,exit -F arch=b32 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time -k T1099_Timestomp
 # -a always,exit -F arch=b64 -F uid!=ntp -S adjtimex -S settimeofday -S clock_settime -k time -k T1099_Timestomp
 ### Local time zone
 -w /etc/localtime -p wa -k localtime -k T1099_Timestomp

 ## Stunnel
 -w /usr/sbin/stunnel -p x -k stunnel -k T1079_Multilayer_Encryption
 -w /usr/bin/stunnel -p x -k stunnel -k T1079_Multilayer_Encryption

 ## Cron configuration & scheduled jobs related events
 -w /etc/cron.allow -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/cron.deny -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/cron.d/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/cron.daily/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/cron.hourly/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/cron.monthly/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/cron.weekly/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/crontab -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /var/spool/cron/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /var/spool/cron/crontabs/ -k cron -k T1168_Local_Job_Scheduling
 -w /etc/inittab -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/init.d/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/init/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/at.allow -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/at.deny -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /var/spool/at/ -p wa -k cron -k T1168_Local_Job_Scheduling
 -w /etc/anacrontab -p wa -k cron -k T1168_Local_Job_Scheduling

 ## User, group, password databases
 -w /etc/group -p wa -k T1087_Account_Discovery
 -w /etc/passwd -p wa -k TT1087_Account_Discovery
 -w /etc/gshadow -k T1087_Account_Discovery
 -w /etc/shadow -k T1087_Account_Discovery
 -w /etc/security/opasswd -k T1087_Account_Discovery

 ## Account Related Events
 ## Sudoers file changes
 -w /etc/sudoers -p wa -k actions -k T1078_Valid_Accounts
 -w /etc/sudoers.d/ -p wa -k actions -k T1078_Valid_Accounts

 ## Passwd
 -w /usr/bin/passwd -p x -k passwd_modification -k T1078_Valid_Accounts

 ## Tools to change group identifiers
 -w /usr/sbin/groupadd -p x -k group_modification -k T1078_Valid_Accounts
 -w /usr/sbin/groupmod -p x -k group_modification -k T1078_Valid_Accounts
 -w /usr/sbin/addgroup -p x -k group_modification -k T1078_Valid_Accounts
 -w /usr/sbin/useradd -p x -k user_modification -k T1078_Valid_Accounts
 -w /usr/sbin/userdel -p x -k user_modification -k T1078_Valid_Accounts
 -w /usr/sbin/usermod -p x -k user_modification -k T1078_Valid_Accounts
 -w /usr/sbin/adduser -p x -k user_modification -k T1078_Valid_Accounts

 ## Login configuration and information
 ## Login Related Events
 -w /etc/login.defs -p wa -k login -k T1082_System_Information_Discovery
 -w /etc/securetty -p wa -k login -k T1082_System_Information_Discovery
 -w /var/log/faillog -p wa -k login -k T1021_Remote_Services -k T1082_System_Information_Discovery
 -w /var/log/lastlog -p wa -k login -k T1021_Remote_Services -k T1082_System_Information_Discovery
 -w /var/log/tallylog -p wa -k login -k T1082_System_Information_Discovery -k T1021_Remote_Services

 ## Network Environment
 ### Changes to hostname
 -a always,exit -F arch=b32 -S sethostname -S setdomainname -k network_modifications
 -a always,exit -F arch=b64 -S sethostname -S setdomainname -k network_modifications

 ### Detect Remote Shell Use
 -a always,exit -F arch=b32 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell"
 -a always,exit -F arch=b64 -F exe=/bin/bash -F success=1 -S connect -k "remote_shell"
 -a always,exit -F arch=b32 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell"
 -a always,exit -F arch=b64 -F exe=/usr/bin/bash -F success=1 -S connect -k "remote_shell"

 ### Successful IPv4 Connections
 -a always,exit -F arch=b64 -S connect -F a2=16 -F success=1 -F key=network_connect_4
 -a always,exit -F arch=b32 -S connect -F a2=16 -F success=1 -F key=network_connect_4

 ### Successful IPv6 Connections
 -a always,exit -F arch=b64 -S connect -F a2=28 -F success=1 -F key=network_connect_6
 -a always,exit -F arch=b32 -S connect -F a2=28 -F success=1 -F key=network_connect_6

 ### Changes to other files
 # RHEL style configuration
 # -w /etc/sysconfig/network -p wa -k network_modifications
 # -w /etc/sysconfig/network-scripts -p w -k network_modifications
 -w /etc/hosts -p wa -k network_modifications
 -w /etc/network/ -p wa -k network
 -a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -k network_modifications

 ### Changes to issue
 -w /etc/issue -p wa -k etcissue
 -w /etc/issue.net -p wa -k etcissue

 ## System startup scripts
 -w /etc/inittab -p wa -k init
 -w /etc/init.d/ -p wa -k init
 -w /etc/init/ -p wa -k init

 ## Library search paths
 -w /etc/ld.so.conf -p wa -k libpath
 -w /etc/ld.so.conf.d -p wa -k libpath

 ## Systemwide library preloads (LD_PRELOAD)
 -w /etc/ld.so.preload -p wa -k systemwide_preloads

 ## Pam configuration
 ## Pam Related Events
 -w /etc/pam.d/ -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
 -w /etc/security/limits.conf -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
 -w /etc/security/limits.d -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
 -w /etc/security/pam_env.conf -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
 -w /etc/security/namespace.conf -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
 -w /etc/security/namespace.d -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
 -w /etc/security/namespace.init -p wa -k pam -k T1071_Standard_Application_Layer_Protocol
 -w /etc/pam.d/common-password -p wa -k T1201_Password_Policy_Discovery

 ## Mail configuration
 -w /etc/aliases -p wa -k mail
 -w /etc/postfix/ -p wa -k mail
 -w /etc/exim4/ -p wa -k mail

 ## SSH configuration
 ## SSH Related Events
 -w /etc/ssh/sshd_config -k sshd -k T1021_Remote_Services
 -w /etc/ssh/sshd_config.d -k sshd -k T1021_Remote_Services

 ## root ssh key tampering
 -w /root/.ssh -p wa -k rootkey

 # Systemd
 -w /bin/systemctl -p x -k systemd
 -w /etc/systemd/ -p wa -k systemd
 -w /usr/lib/systemd -p wa -k systemd

 ## SELinux events that modify the system's Mandatory Access Controls (MAC)
 -w /etc/selinux/ -p wa -k mac_policy

 ## Critical elements access failures
 -a always,exit -F arch=b64 -S open -F dir=/etc -F success=0 -k unauthedfileaccess
 -a always,exit -F arch=b64 -S open -F dir=/bin -F success=0 -k unauthedfileaccess
 -a always,exit -F arch=b64 -S open -F dir=/sbin -F success=0 -k unauthedfileaccess
 -a always,exit -F arch=b64 -S open -F dir=/usr/bin -F success=0 -k unauthedfileaccess
 -a always,exit -F arch=b64 -S open -F dir=/usr/sbin -F success=0 -k unauthedfileaccess
 -a always,exit -F arch=b64 -S open -F dir=/var -F success=0 -k unauthedfileaccess
 -a always,exit -F arch=b64 -S open -F dir=/home -F success=0 -k unauthedfileaccess
 -a always,exit -F arch=b64 -S open -F dir=/srv -F success=0 -k unauthedfileaccess

 ## Process ID change (switching accounts) applications
 -w /bin/su -p x -k priv_esc -k T1169_Sudo
 -w /usr/bin/sudo -p x -k priv_esc -k T1169_Sudo
 -w /etc/sudoers -p rw -k priv_esc -k T1169_Sudo
 -w /etc/sudoers.d -p rw -k priv_esc -k T1169_Sudo

 ## Power state
 -w /sbin/shutdown -p x -k power
 -w /sbin/poweroff -p x -k power
 -w /sbin/reboot -p x -k power
 -w /sbin/halt -p x -k power

 ## Session initiation information
 ## Session Related Events
 -w /var/run/utmp -p wa -k session -k T1108_Redundant_Access
 -w /var/log/btmp -p wa -k session -k T1108_Redundant_Access
 -w /var/log/wtmp -p wa -k session -k T1108_Redundant_Access

 ## Discretionary Access Control (DAC) modifications
 -a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S chmod -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S chown -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S fchmod -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S fchmodat -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S fchown -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S fchownat -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S fremovexattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S fsetxattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S lchown -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S lremovexattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S lsetxattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S removexattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b32 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b32 -S setxattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S chmod -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S chown -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S fchmod -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S fchmod -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S fchmodat -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S fchmodat -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S fchown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S fchown -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S fchownat -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S fchownat -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S fremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S fremovexattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S fsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S fsetxattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S lchown -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S lchown -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S lremovexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S lremovexattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S lsetxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S lsetxattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S removexattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S removexattr -F auid>=500 -F auid!=4294967295
 -a always,exit -F arch=b64 -S setxattr -F auid>=1000 -F auid!=-1 -k perm_mod -k T1166_Seuid_and_Setgid
 #-a always,exit -F arch=b64 -S setxattr -F auid>=500 -F auid!=4294967295

 # Special Rules ---------------------------------------------------------------

 ## Reconnaissance
 -w /usr/bin/whoami -p x -k recon -k T1033_System_Owner_User_Discovery
 -w /usr/bin/id -p x -k recon
 -w /bin/hostname -p x -k recon
 -w /bin/uname -p x -k recon
 -w /etc/issue -p r -k recon
 -w /etc/hostname -p r -k recon -k T1082_System_Information_Discovery

 ## Suspicious activity
 -w /usr/bin/ss -p x -k susp_activity
 -w /usr/bin/netstat -p x -k susp_activity
 -w /usr/bin/wireshark -p x -k T1049_System_Network_Connections_discovery
 -w /usr/bin/tshark -p x -k T1049_System_Network_Connections_discovery
 -w /usr/bin/rawshark -p x -k T1049_System_Network_Connections_discovery
 -w /usr/bin/nmap -p x -k susp_activity

 ## T1219 Remote Access Tools

 -w /usr/bin/wget -p x -k T1219_Remote_Access_Tools
 -w /usr/bin/curl -p x -k T1219_Remote_Access_Tools
 -w /usr/bin/base64 -p x -k T1219_Remote_Access_Tools
 -w /bin/nc -p x -k T1219_Remote_Access_Tools
 -w /bin/netcat -p x -k T1219_Remote_Access_Tools
 -w /usr/bin/ncat -p x -k T1219_Remote_Access_Tools
 -w /usr/bin/ssh -p x -k T1219_Remote_Access_Tools
 -w /usr/bin/socat -p x -k T1219_Remote_Access_Tools
 -w /usr/bin/rdesktop -p x -k T1219_Remote_Access_Tools
 -w /usr/local/bin/rdesktop -p x -k T1219_Remote_Access_Tools
 -w /usr/bin/xfreerdp -p x -k T1219_Remote_Access_Tools
 -w /usr/local/bin/xfreerdp -p x -k T1219_Remote_Access_Tools
 -w /usr/bin/wlfreerdp -p x -k T1219_Remote_Access_Tools

 ## T1105 remote file copy

 -w /usr/bin/scp -p x -k T1105_remote_file_copy
 -w /usr/bin/sftp -p x -k T1105_remote_file_copy
 -w /usr/bin/ftp -p x -k T1105_remote_file_copy

 ## T1002 Data Compressed

 -w /usr/bin/zip -p x -k T1002_Data_Compressed
 -w /usr/bin/gzip -p x -k T1002_Data_Compressed
 -w /usr/bin/tar -p x -k T1002_Data_Compressed
 -w /usr/bin/bzip2 -p x -k T1002_Data_Compressed

 -w /usr/bin/lzip -p x -k T1002_Data_Compressed
 -w /usr/local/bin/lzip -p x -k T1002_Data_Compressed

 -w /usr/bin/lz4 -p x -k T1002_Data_Compressed
 -w /usr/local/bin/lz4 -p x -k T1002_Data_Compressed

 -w /usr/bin/lzop -p x -k T1002_Data_Compressed
 -w /usr/local/bin/lzop -p x -k T1002_Data_Compressed

 -w /usr/bin/plzip -p x -k T1002_Data_Compressed
 -w /usr/local/bin/plzip -p x -k T1002_Data_Compressed

 -w /usr/bin/pbzip2 -p x -k T1002_Data_Compressed
 -w /usr/local/bin/pbzip2 -p x -k T1002_Data_Compressed

 -w /usr/bin/lbzip2 -p x -k T1002_Data_Compressed
 -w /usr/local/bin/lbzip2 -p x -k T1002_Data_Compressed

 -w /usr/bin/pixz -p x -k T1002_Data_Compressed
 -w /usr/local/bin/pixz -p x -k T1002_Data_Compressed

 -w /usr/bin/pigz -p x -k T1002_Data_Compressed
 -w /usr/local/bin/pigz -p x -k T1002_Data_Compressed
 -w /usr/bin/unpigz -p x -k T1002_Data_Compressed
 -w /usr/local/bin/unpigz -p x -k T1002_Data_Compressed

 -w /usr/bin/zstd -p x -k T1002_Data_Compressed
 -w /usr/local/bin/zstd -p x -k T1002_Data_Compressed

 ## Added to catch netcat on Ubuntu
 -w /bin/nc.openbsd -p x -k susp_activity
 -w /bin/nc.traditional -p x -k susp_activity

 ## Sbin suspicious activity
 -w /sbin/iptables -p x -k sbin_susp -k T1082_System_Information_Discovery
 -w /sbin/ip6tables -p x -k sbin_susp -k T1082_System_Information_Discovery
 -w /sbin/ifconfig -p x -k sbin_susp -k T1082_System_Information_Discovery
 -w /usr/sbin/arptables -p x -k sbin_susp -k T1082_System_Information_Discovery
 -w /usr/sbin/ebtables -p x -k sbin_susp
 -w /sbin/xtables-nft-multi -p x -k sbin_susp
 -w /usr/sbin/nft -p x -k sbin_susp
 -w /usr/sbin/tcpdump -p x -k T1049_System_Network_Connections_discovery
 -w /usr/sbin/traceroute -p x -k T1049_System_Network_Connections_discovery
 -w /usr/sbin/ufw -p x -k sbin_susp -k T1082_System_Information_Discovery

 ## dbus-send invocation
 ### may indicate privilege escalation CVE-2021-3560
 -w /usr/bin/dbus-send -p x -k dbus_send
 -w /usr/bin/gdbus -p x -k gdubs_call

 ## pkexec invocation
 ### may indicate privilege escalation CVE-2021-4034
 -w /usr/bin/pkexec -p x -k pkexec

 ## Suspicious shells
 -w /bin/ash -p x -k susp_shell
 -w /bin/bash -p x -k susp_shell
 -w /bin/csh -p x -k susp_shell
 -w /bin/dash -p x -k susp_shell
 -w /bin/busybox -p x -k susp_shell
 -w /bin/ksh -p x -k susp_shell
 -w /bin/fish -p x -k susp_shell
 -w /bin/tcsh -p x -k susp_shell
 -w /bin/tclsh -p x -k susp_shell
 -w /bin/zsh -p x -k susp_shell
 -w /bin/xonsh -p x -k susp_shell
 -w /usr/local/bin/xonsh -p x -k susp_shell
 -w /bin/open -p x -k susp_shell
 -w /bin/sh -p x -k susp_shell
 -w /bin/rbash -p x -k susp_shell

 ### https://clustershell.readthedocs.io/

 # -w /bin/clush -p x -k susp_shell
 # -w /usr/local/bin/clush -p x -k susp_shell
 # -w /etc/clustershell/clush.conf -p x -k susp_shell

 ### https://github.com/tmux/tmux

 -w /bin/tmux -p x -k susp_shell
 -w /usr/local/bin/tmux -p x -k susp_shell

 ### https://github.com/xxh/xxh

 -w /bin/xxh -p x -k susp_shell
 -w /usr/local/bin/xxh -p x -k susp_shell

 ## Shell/profile configurations
 -w /etc/profile.d/ -p wa -k shell_profiles
 -w /etc/profile -p wa -k shell_profiles
 -w /etc/shells -p wa -k shell_profiles
 -w /etc/bashrc -p wa -k shell_profiles
 -w /etc/csh.cshrc -p wa -k shell_profiles
 -w /etc/csh.login -p wa -k shell_profiles
 -w /etc/fish/ -p wa -k shell_profiles
 -w /etc/zsh/ -p wa -k shell_profiles

 ### https://github.com/xxh/xxh

 -w /usr/local/bin/xxh.bash -p x -k susp_shell
 -w /usr/local/bin/xxh.xsh -p x -k susp_shell
 -w /usr/local/bin/xxh.zsh -p x -k susp_shell

 ## Injection
 ### These rules watch for code injection by the ptrace facility.
 ### This could indicate someone trying to do something bad or just debugging
 -a always,exit -F arch=b32 -S ptrace -F a0=0x4 -k T1055_Process_Injection
 -a always,exit -F arch=b64 -S ptrace -F a0=0x4 -k T1055_Process_Injection
 -a always,exit -F arch=b32 -S ptrace -F a0=0x5 -k T1055_Process_Injection
 -a always,exit -F arch=b64 -S ptrace -F a0=0x5 -k T1055_Process_Injection
 -a always,exit -F arch=b32 -S ptrace -F a0=0x6 -k T1055_Process_Injection
 -a always,exit -F arch=b64 -S ptrace -F a0=0x6 -k T1055_Process_Injection
 -a always,exit -F arch=b32 -S ptrace -k T1055_Process_Injection
 -a always,exit -F arch=b64 -S ptrace -k T1055_Process_Injection

 ## Anonymous File Creation
 ### These rules watch the use of memfd_create
 ### "memfd_create" creates anonymous file and returns a file descriptor to access it
 ### When combined with "fexecve" can be used to stealthily run binaries in memory without touching disk
 -a always,exit -F arch=b64 -S memfd_create -F key=anon_file_create
 -a always,exit -F arch=b32 -S memfd_create -F key=anon_file_create


 ## Privilege Abuse
 ### The purpose of this rule is to detect when an admin may be abusing power by looking in user's home dir.
 -a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=-1 -C auid!=obj_uid -k power_abuse -k T1169_Sudo
 #-a always,exit -F dir=/home -F uid=0 -F auid>=1000 -F auid!=4294967295 -C auid!=obj_uid

 # Socket Creations
 # will catch both IPv4 and IPv6

 -a always,exit -F arch=b32 -S socket -F a0=2 -k T1011_Exfiltration_Over_Other_Network_Medium
 -a always,exit -F arch=b64 -S socket -F a0=2 -k T1011_Exfiltration_Over_Other_Network_Medium

 -a always,exit -F arch=b32 -S socket -F a0=10 -k T1011_Exfiltration_Over_Other_Network_Medium
 -a always,exit -F arch=b64 -S socket -F a0=10 -k T1011_Exfiltration_Over_Other_Network_Medium

 # Software Management ---------------------------------------------------------
 # RPM (Redhat/CentOS)
 -w /usr/bin/rpm -p x -k T1072_third_party_software
 -w /usr/bin/yum -p x -k T1072_third_party_software

 # DNF (Fedora/RedHat 8/CentOS 8)
 -w /usr/bin/dnf -p x -k T1072_third_party_softwared

 # YAST/Zypper/RPM (SuSE)
 -w /sbin/yast -p x -k T1072_third_party_software
 -w /sbin/yast2 -p x -k T1072_third_party_software
 -w /bin/rpm -p x -k T1072_third_party_software
 -w /usr/bin/zypper -k T1072_third_party_software

 # DPKG / APT-GET (Debian/Ubuntu)
 -w /usr/bin/dpkg -p x -k T1072_third_party_software
 -w /usr/bin/apt -p x -k T1072_third_party_software
 -w /usr/bin/apt-add-repository -p x -k T1072_third_party_software
 -w /usr/bin/apt-get -p x -k T1072_third_party_software
 -w /usr/bin/aptitude -p x -k T1072_third_party_software
 -w /usr/bin/wajig -p x -k T1072_third_party_software
 -w /usr/bin/snap -p x -k T1072_third_party_software

 # PIP(3) (Python installs)

 -w /usr/bin/pip -p x -k T1072_third_party_software
 -w /usr/local/bin/pip -p x -k T1072_third_party_software
 -w /usr/bin/pip3 -p x -k T1072_third_party_software
 -w /usr/local/bin/pip3 -p x -k T1072_third_party_software

 # npm
 ## T1072 third party software
 ## https://www.npmjs.com
 ## https://docs.npmjs.com/cli/v6/commands/npm-audit

 -w /usr/bin/npm -p x -k T1072_third_party_software

 # Comprehensive Perl Archive Network (CPAN) (CPAN installs)
 ## T1072 third party software
 ## https://www.cpan.org

 -w /usr/bin/cpan -p x -k T1072_third_party_software

 # Ruby (RubyGems installs)
 ## T1072 third party software
 ## https://rubygems.org

 -w /usr/bin/gem -p x -k T1072_third_party_software

 # LuaRocks (Lua installs)
 ## T1072 third party software
 ## https://luarocks.org

 # -w /usr/bin/luarocks -p x -k T1072_third_party_software

 # Pacman (Arch Linux)
 ## https://wiki.archlinux.org/title/Pacman
 ## T1072 third party software
 -w /etc/pacman.conf -p x -k T1072_third_party_software
 -w /etc/pacman.d -p x -k T1072_third_party_software

 # Special Software ------------------------------------------------------------

 ## GDS specific secrets
 # if Puppet installed
 # -w /etc/puppet/ssl -p wa -k puppet_ssl

 ## IBM Bigfix BESClient
 # -a always,exit -F arch=b64 -S open -F dir=/opt/BESClient -F success=0 -k soft_besclient
 # -w /var/opt/BESClient/ -p wa -k soft_besclient

 ## CHEF https://www.chef.io/chef/
 # -w /etc/chef -p wa -k soft_chef

 ## Salt
 ## https://saltproject.io/
 ## https://docs.saltproject.io/en/latest/ref/configuration/master.html
 # -w /etc/salt -p wa -k soft_salt
 # -w /usr/local/etc/salt -p wa -k soft_salt

 ## Otter
 ## https://inedo.com/otter
 # -w /etc/otter -p wa -k soft_otter

 ## T1081 Credentials In Files
 -w /usr/bin/grep -p x -k T1081_Credentials_In_Files
 -w /usr/bin/egrep -p x -k T1081_Credentials_In_Files
 -w /usr/bin/ugrep -p x -k T1081_Credentials_In_Files
 ### macOS
 -w /usr/local/bin/grep -p x -k T1081_Credentials_In_Files
 -w /usr/local/bin/egrep -p x -k T1081_Credentials_In_Files
 -w /usr/local/bin/ugrep -p x -k T1081_Credentials_In_Files

 ### https://github.com/tmbinc/bgrep
 -w /usr/bin/bgrep -p x -k T1081_Credentials_In_Files
 ### macOS
 -w /usr/local/bin/bgrep -p x -k T1081_Credentials_In_Files

 ### https://github.com/BurntSushi/ripgrep
 -w /usr/bin/rg -p x -k T1081_Credentials_In_Files
 ### macOS
 -w /usr/local/bin/rg -p x -k T1081_Credentials_In_Files

 ### https://github.com/monochromegane/the_platinum_searcher
 -w /usr/bin/pt -p x -k T1081_Credentials_In_Files
 ### macOS
 -w /usr/local/bin/pt -p x -k T1081_Credentials_In_Files

 ### https://github.com/gvansickle/ucg
 -w /usr/bin/ucg -p x -k T1081_Credentials_In_Files
 ### macOS
 -w /usr/local/bin/ucg -p x -k T1081_Credentials_In_Files

 ### https://github.com/ggreer/the_silver_searcher
 -w /usr/bin/ag -p x -k T1081_Credentials_In_Files
 ### macOS
 -w /usr/local/bin/ag -p x -k T1081_Credentials_In_Files

 ### https://github.com/beyondgrep/ack3
 ### https://beyondgrep.com
 -w /usr/bin/ack -p x -k T1081_Credentials_In_Files
 -w /usr/local/bin/ack -p x -k T1081_Credentials_In_Files
 -w /usr/bin/semgrep -p x -k T1081_Credentials_In_Files
 ### macOS
 -w /usr/local/bin/semgrep -p x -k T1081_Credentials_In_Files

 ## Docker
 # -w /usr/bin/dockerd -k docker
 # -w /usr/bin/docker -k docker
 # -w /usr/bin/docker-containerd -k docker
 # -w /usr/bin/docker-runc -k docker
 # -w /var/lib/docker -k docker
 # -w /etc/docker -k docker
 # -w /etc/sysconfig/docker -k docker
 # -w /etc/sysconfig/docker-storage -k docker
 # -w /usr/lib/systemd/system/docker.service -k docker
 # -w /usr/lib/systemd/system/docker.socket -k docker

 ## Virtualization stuff
 -w /usr/bin/qemu-system-x86_64 -p x -k qemu-system-x86_64 -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/bin/qemu-img -p x -k qemu-img -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/bin/qemu-kvm -p x -k qemu-kvm -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/bin/qemu -p x -k qemu -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/bin/virtualbox -p x -k virtualbox -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/bin/virt-manager -p x -k virt-manager -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/bin/VBoxManage -p x -k VBoxManage -k T1497_Virtualization_Sandbox_Evasion_System_Checks

 #### VirtualBox

 -w /usr/local/bin/VirtualBox -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/VirtualBoxVM -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/VBoxManage -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/VBoxVRDP -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/VBoxHeadless -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/vboxwebsrv -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/VBoxBugReport -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/VBoxBalloonCtrl -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/VBoxAutostart -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/VBoxDTrace -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/vbox-img -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks

 ### Parallels Desktop

 -w /usr/local/bin/prl_convert -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/prl_disk_tool -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/prl_perf_ctl -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/prlcore2dmp -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/prlctl -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/prlexec -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/prlsrvctl -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks

 ### qemu on macOS

 -w /usr/local/bin/qemu-edid -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/qemu-img -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/qemu-io -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/qemu-nbd -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks
 -w /usr/local/bin/qemu-system-x86_64 -p x -k T1497_Virtualization_Sandbox_Evasion_System_Checks

 ## Kubelet
 -w /usr/bin/kubelet -k kubelet

 # ipc system call T1559_Inter-Process_Communication
 # /usr/include/linux/ipc.h

 ## msgctl (non x86)
 # -a always,exit -S ipc -F a0=14 -k T1559_Inter-Process_Communication
 ## msgget (non x86)
 # -a always,exit -S ipc -F a0=13 -k T1559_Inter-Process_Communication
 ## Use these lines on x86_64, ia64 instead
 -a always,exit -F arch=b64 -S msgctl -k T1559_Inter-Process_Communication
 -a always,exit -F arch=b64 -S msgget -k T1559_Inter-Process_Communication

 ## semctl (non x86)
 # -a always,exit -S ipc -F a0=3 -k T1559_Inter-Process_Communication
 ## semget (non x86)
 # -a always,exit -S ipc -F a0=2 -k T1559_Inter-Process_Communication
 ## semop (non x86)
 # -a always,exit -S ipc -F a0=1 -k T1559_Inter-Process_Communication
 ## semtimedop (non x86)
 # -a always,exit -S ipc -F a0=4 -k T1559_Inter-Process_Communication
 ## Use these lines on x86_64, ia64 instead
 -a always,exit -F arch=b64 -S semctl -k T1559_Inter-Process_Communication
 -a always,exit -F arch=b64 -S semget -k T1559_Inter-Process_Communication
 -a always,exit -F arch=b64 -S semop -k T1559_Inter-Process_Communication
 -a always,exit -F arch=b64 -S semtimedop -k T1559_Inter-Process_Communication

 ## shmctl
 # -a always,exit -S ipc -F a0=24 -k T1559_Inter-Process_Communication
 ## shmget
 # -a always,exit -S ipc -F a0=23 -k T1559_Inter-Process_Communication
 ## Use these lines on x86_64, ia64 instead
 -a always,exit -F arch=b64 -S shmctl -k T1559_Inter-Process_Communication
 -a always,exit -F arch=b64 -S shmget -k T1559_Inter-Process_Communication

 # High Volume Events ----------------------------------------------------------

 ## Remove them if they cause to much volume in your environment

 ## Root command executions
 -a always,exit -F arch=b64 -F euid=0 -F auid>=1000 -F auid!=4294967295 -S execve -k rootcmd
 -a always,exit -F arch=b32 -F euid=0 -F auid>=1000 -F auid!=4294967295 -S execve -k rootcmd

 ## File Deletion Events by User
 -a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete
 -a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=1000 -F auid!=-1 -k delete

 ## File Access
 ### Unauthorized Access (unsuccessful)
 -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access
 -a always,exit -F arch=b32 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access
 -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EACCES -F auid>=1000 -F auid!=-1 -k file_access
 -a always,exit -F arch=b64 -S creat -S open -S openat -S open_by_handle_at -S truncate -S ftruncate -F exit=-EPERM -F auid>=1000 -F auid!=-1 -k file_access

 ### Unsuccessful Creation
 -a always,exit -F arch=b32 -S creat,link,mknod,mkdir,symlink,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation
 -a always,exit -F arch=b64 -S mkdir,creat,link,symlink,mknod,mknodat,linkat,symlinkat -F exit=-EACCES -k file_creation
 -a always,exit -F arch=b32 -S link,mkdir,symlink,mkdirat -F exit=-EPERM -k file_creation
 -a always,exit -F arch=b64 -S mkdir,link,symlink,mkdirat -F exit=-EPERM -k file_creation

 ### Unsuccessful Modification
 -a always,exit -F arch=b32 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification
 -a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EACCES -k file_modification
 -a always,exit -F arch=b32 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification
 -a always,exit -F arch=b64 -S rename -S renameat -S truncate -S chmod -S setxattr -S lsetxattr -S removexattr -S lremovexattr -F exit=-EPERM -k file_modification

 ## File Deletion by User Related Events T1107_File_Deletion T1070_Indicator_Removal_on_Host
 -a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k T1107_File_Deletion
 -a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k T1107_File_Deletion
 -a always,exit -F arch=b32 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid=0 -k T1070_Indicator_Removal_on_Host
 -a always,exit -F arch=b64 -S rmdir -S unlink -S unlinkat -S rename -S renameat -F auid=0 -k T1070_Indicator_Removal_on_Host

 ## 32bit API Exploitation
 ### If you are on a 64 bit platform, everything _should_ be running
 ### in 64 bit mode. This rule will detect any use of the 32 bit syscalls
 ### because this might be a sign of someone exploiting a hole in the 32
 ### bit API.
 -a always,exit -F arch=b32 -S all -k 32bit_api

 # Register incoming network connections
 -a always,exit -S accept -k network_connection

 #Log all commands (Noisy) T1059_CommandLine_Interface
 #-a always,exit -F arch=b64 -S execve -k T1059_CommandLine_Interface
 #-a always,exit -F arch=b32 -S execve -k T1059_CommandLine_Interface

 # Other techniques

 ## Shell configuration Persistence Related Events T1156_bash_profile_and_bashrc
 -w /etc/profile.d/ -k T1156_bash_profile_and_bashrc
 -w /etc/profile -k T1156_bash_profile_and_bashrc
 -w /etc/shells -k T1156_bash_profile_and_bashrc
 -w /etc/bashrc -k T1156_bash_profile_and_bashrc
 -w /etc/csh.cshrc -k T1156_bash_profile_and_bashrc
 -w /etc/csh.login -k T1156_bash_profile_and_bashrc

 ## Data Copy(Local) T1005_Data_from_Local_System
 -w /usr/bin/cp -p x -k T1005_Data_from_Local_System
 -w /usr/bin/dd -p x -k T1005_Data_from_Local_System

 ## Privleged Command Execution Related Events
 -a always,exit -F arch=b64 -F euid=0 -S execve -k T1078_Valid_Accounts
 -a always,exit -F arch=b32 -F euid=0 -S execve -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/userdel -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/bin/ping -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/bin/umount -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/bin/mount -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/bin/su -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/bin/chgrp -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/bin/ping6 -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/sbin/pam_timestamp_check -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/sbin/unix_chkpwd -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/sbin/pwck -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/suexec -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/usermod -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/newusers -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/groupdel -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/semanage -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/usernetctl -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/ccreds_validate -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/sbin/userhelper -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 ##-a always,exit -F path=/usr/libexec/openssh/ssh-keysign -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/Xorg -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/rlogin -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/sudoedit -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/at -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/rsh -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/gpasswd -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/kgrantpty -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/crontab -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/sudo -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/staprun -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/rcp -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/passwd -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/chsh -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/chfn -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/chage -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/newgrp -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/newrole -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts
 -a always,exit -F path=/usr/bin/kpac_dhcp_helper -F perm=x -F auid>=500 -F auid!=4294967295 -k T1078_Valid_Accounts

 ##C2 Releated Events
 #Log 64 bit processes (a2!=6e filters local unix socket calls)
 -a always,exit -F arch=b64 -S connect -F a2!=110 -k T1043_Commonly_Used_Port

 #Log 32 bit processes (a0=3 means only outbound sys_connect calls)
 -a always,exit -F arch=b32 -S socketcall -F a0=3 -k T1043_Commonly_Used_Port

 ## Priv Escalation Related Events
 -a always,exit -F arch=b64 -C auid!=uid -S execve -k T1166_Seuid_and_Setgid
 -a always,exit -F arch=b32 -C auid!=uid -S execve -k T1166_Seuid_and_Setgid
 -a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -k T1166_Seuid_and_Setgid
 -a always,exit -F arch=b32 -S setuid -S setgid -S setreuid -S setregid -k T1166_Seuid_and_Setgid
 -a always,exit -F arch=b64 -S setuid -S setgid -S setreuid -S setregid -F exit=EPERM -k T1166_Seuid_and_Setgid
 -a always,exit -F arch=b32 -S setuid -S setgid -S setreuid -S setregid -F exit=EPERM -k T1166_Seuid_and_Setgid
 -w /usr/bin/ -p wa -k T1068_Exploitation_for_Privilege_Escalation

 ## Recon Related Events
 -w /usr/sbin/nologin -k T1087_Account_Discovery
 -w /sbin/nologin -k T1087_Account_Discovery
 -w /etc/resolv.conf -k T1016_System_Network_Configuration_Discovery
 -w /etc/hosts.allow -k T1016_System_Network_Configuration_Discovery
 -w /etc/hosts.deny -k T1016_System_Network_Configuration_Discovery
 -w /usr/bin/ps -p x -k T1057_Process_Discovery

- module: file_integrity
 paths:
 - /bin
 - /usr/bin
 - /sbin
 - /usr/sbin
 - /etc

# ================================= Processors =================================

# Configure processors to enhance or manipulate events generated by the beat.

processors:
 - add_host_metadata: ~
 - add_cloud_metadata: ~
 - add_docker_metadata: ~

output.logstash:
 ssl.enabled: true
 ssl.verification_mode: none

Стандартный конфигурационный файл Metricbeat

Mon, 01 Jan 0001 00:00:00 +0000

Для ОС Windows:

metricbeat.modules:
- module: system
 metricsets:
 - cpu # CPU usage
 - memory # Memory usage
 - network # Network IO
 - process # Per process metrics
 - process_summary # Process summary
 - uptime # System Uptime
 - socket_summary # Socket summary
 # - core # Per CPU core usage
 # - diskio # Disk IO
 # - filesystem # File system usage for each mountpoint
 # - fsstat # File system summary metrics
 # - raid # Raid
 # - socket # Sockets and connection info (linux only)
 # - service # systemd service information
 enabled: true
 period: 10s
 processes: ['.*']
 # Configure the metric types that are included by these metricsets.
 cpu.metrics: ["percentages","normalized_percentages"] # The other available option is ticks.
 core.metrics: ["percentages"] # The other available option is ticks.
 process.include_top_n:
 enabled: true
 by_cpu: 10
 by_memory: 10

output.logstash:
 ssl.enabled: true
 ssl.verification_mode: none

Стандартный конфигурационный файл Journalbeat

Mon, 01 Jan 0001 00:00:00 +0000

Для ОС Linux:

journalbeat.inputs:
 paths: []

output.logstash:
 ssl.enabled: true
 ssl.verification_mode: none

Метрики компонентов Платформы

Mon, 01 Jan 0001 00:00:00 +0000

Список неспецифических метрик, которые отслеживает сервис Watchdog и записывает в индекс core-кластера performance-*.

Метрика	Описание	Тип компонента	Имя компонента
сontainer_status	состояние docker контейнера компонента. Возможные значения: created, restarting, running, paused, exited, dead, unknown	core	console, dashboards, database, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
grabber	wec
cluster-node	<имя узла>
container_block_input	объем данных в байтах, записанных контейнером на блочные устройства хоста	core	console, dashboards, database, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
grabber	wec
cluster-node	<имя узла>
container_block_output	объем данных в байтах, считанных контейнером на блочные устройства хоста	core	console, dashboards, database, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
grabber	wec
cluster-node	<имя узла>
container_cpuperc	процент ЦПУ хоста, используемых контейнером	core	console, dashboards, database, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
grabber	wec
cluster-node	<имя узла>
container_memperc	процент памяти хоста, используемых контейнером	core	console, dashboards, database, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
grabber	wec
cluster-node	<имя узла>
container_memusage	общий объем памяти, который использует контейнер	core	console, dashboards, database, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
grabber	wec
cluster-node	<имя узла>
container_pids	количество процессов или потоков, созданных контейнером	core	console, dashboards, database, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
grabber	wec
cluster-node	<имя узла>
api_status	проверка, что компонент запущен и отвечает по API	core	console, dashboards, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
cluster-node	<имя узла>
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
errors_count	количество ошибок в журнале приложения компонента	core	console, dashboards, database, frontend, broker
service	gateway, census, ioc-watcher, reporter, signal, ueba, watchdog
receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
grabber	wec
cluster-node	<имя узла>
eps	количество поступающих на ресивер событий в секунду	receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
active_sources	количество уникальных хостов (по host.name), от которых были события на последние 7 дней
process_cpu_percent	процент потребления ЦПУ ресивером
process_cpu_load_average_1m	среднее потребление процессора за 1 минуту от количества поступающих от источников событий
process_cpu_load_average_5m	среднее потребление процессора за 5 минут от количества поступающих от источников событий
process_cpu_load_average_15m	среднее потребление процессора за 15 минут от количества поступающих от источников событий
reloads_failures	количество отказов при перезагрузке (количество неудачных попыток перезагрузки)
jvm_mem_heap_committed_in_bytes	объем памяти в байтах, доступный для использования кучей
jvm_mem_heap_max_in_bytes	максимальный объем памяти в байтах, доступный для использования кучей	receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
cluster-node	<имя узла>
jvm_mem_heap_used_in_bytes	объем памяти в байтах, используемая в данный момент кучей	receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
cluster-node	<имя узла>
jvm_mem_heap_used_percent	процент памяти, используемой в данный момент кучей	receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
cluster-node	<имя узла>
jvm_uptime_in_millis	время работы jvm (Java Virtual Machine) в миллисекундах	receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
cluster-node	<имя узла>
jvm_mem_non_heap_committed_in_bytes	объем доступной памяти без кучи в байтах	receiver	wec, jdbc, syslog, beats, netflow, snmp, custom
jvm_mem_non_heap_used_in_bytes	объем используемой памяти без кучи в байтах
os_available_processors	количество доступных процессоров
events_filtered	количество событий, прошедших через фильтры
events_in	события, принятый ресивером
events_out	события, отправленные ресивером во Opensearch и другие системы
events_queue_push_duration_in_millis	время ожидания событий в очереди ресивера в миллисекундах
events_duration_in_millis	время обработки событий в ресивере в миллисекундах
free_in_bytes	общее количество нераспределенных байт в кластере	cluster	<имя кластера>
total_in_bytes	общий размер всех файловых хранилищ в байтах в кластере
cluster_name	имя кластера
status	текущий статус кластера. Возможные значения: green, yellow, red
timed_out	булевое значение. Если false, то ответ возвращается в течение периода времени, заданного параметром timeout (по умолчанию 30 с)
number_of_nodes	количество узлов в кластере
number_of_data_nodes	количество узлов, являющихся выделенными узлами данных
active_primary_shards	количество активных первичных шардов
active_shards	общее количество активных первичных и реплик шардов
relocating_shards	количество перемещенных шардов
initializing_shards	количество шардов, находящихся в стадии инициализации
unassigned_shards	количество нераспределенных шардов
delayed_unassigned_shards	количество отложенных шардов
number_of_pending_tasks	количество изменений на уровне кластера, которые еще не были выполнены
number_of_in_flight_fetch	количество незавершенных операций
task_max_waiting_in_queue_millis	время в миллисекундах, прошедшее с момента ожидания выполнения самой ранней инициированной задачи
active_shards_percent_as_number	процент активных шардов
max_shard_size	максимальный размер шарда в кластере в байтах
indices_shards_total	общее количество шардов в кластере
indices_shards_primaries	количество первичных шардов в кластере
indices_shards_replicas	количество реплик шардов в кластере
indices_docs_count	количество документов в индексах в кластере	cluster	<имя кластера>
cluster-node	<имя узла>
indices_count	количество индексов в кластере	cluster	<имя кластера>
http_current_open	количество открытых в данный момент HTTP-соединений	cluster-node	<имя узла>
http_total_opened	общее количество HTTP-соединений, открытых за все время
fs_total_free_in_bytes	общее количество нераспределенных байт во всем файловом хранилище
fs_total_total_in_bytes	общий размер всех файловых хранилищ в байтах
fs_total_available_in_bytes	общее количество байт, доступных данной jvm (Java Virtual Machine) на всех файловых хранилищах. Это фактический объем свободного дискового пространства, который может использовать узел Opensearch
indices_merges_total_size_in_bytes	общий размер объединений документов в байтах
indices_fielddata_memory_size_in_bytes	общий объем памяти в байтах, используемый для кэша полевых данных во всех шардах, назначенных узлу
indices_indexing_index_time_in_millis	общее время в миллисекундах, затраченное на выполнение операций индексирования
indices_indexing_index_total	общее количество операций индексирования
indices_indexing_index_failed	количество неудачных операций индексирования
indices_indexing_throttle_time_in_millis	общее время в миллисекундах, затраченное на операции throttling
jvm_gc_collectors_old_collection_count	количество сборщиков мусора jvm (Java Virtual Machine), собирающих объекты старого поколения
jvm_gc_collectors_old_collection_time_in_millis	общее время в миллисекундах, затраченное jvm (Java Virtual Machine) на сбор объектов старого поколения
jvm_gc_collectors_young_collection_count	количество сборщиков мусора jvm (Java Virtual Machine), собирающих объекты молодого поколения
jvm_gc_collectors_young_collection_time_in_millis	общее время в миллисекундах, затраченное jvm (Java Virtual Machine) на сбор объектов молодого поколения
jvm_mem_pools_old_used_in_bytes	объем памяти в байтах, используемой кучей старого поколения
jvm_mem_pools_survivor_used_in_bytes	объем памяти в байтах, используемой пространством survivor (оставшимся пространством для узла)
jvm_mem_pools_young_used_in_bytes	объем памяти в байтах, используемой кучей молодого поколения
thread_pool_write_active	количество активных потоков на запись в пуле потоков
thread_pool_write_completed	количество задач, выполненных исполнителем пула потоков на запись
thread_pool_write_rejected	количество задач, невыполненных исполнителем пула потоков на запись
shards_count	количество шардов на узел кластера
primary_shards_count	количество шардов по всем первичным хранилищам
replica_shards_count	количество шардов по всем репликам
cpu_load_1m	потребление ЦПУ компонентами Alertix в течение 1 минуты	system	cpu
cpu_load_5m	потребление ЦПУ компонентами Alertix в течение 5 минут
cpu_load_15m	потребление ЦПУ компонентами Alertix в течение 15 минут
availability	доступность хоста по сети	system	network
total_bytes	весь объем оперативной памяти на хосте	system	memory
весь объем памяти в байтах, который есть на диске	disk	<имя диска>
used_bytes	используемый объем оперативной памяти на хосте	system	memory
занятый на диске объем памяти в байтах	disk	<имя диска>
used_percent	процент потребления оперативной памяти на хосте	system	memory
процент занятого места на диске	disk	<имя диска>
filebeat_status	активен ли процесс filebeat’а	system	process

Метрика

Описание

Тип компонента

Имя компонента

сontainer_status

состояние docker контейнера компонента. Возможные значения: created, restarting, running, paused, exited, dead, unknown

core

console, dashboards, database, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

grabber

wec

cluster-node

<имя узла>

container_block_input

объем данных в байтах, записанных контейнером на блочные устройства хоста

core

console, dashboards, database, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

grabber

wec

cluster-node

<имя узла>

container_block_output

объем данных в байтах, считанных контейнером на блочные устройства хоста

core

console, dashboards, database, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

grabber

wec

cluster-node

<имя узла>

container_cpuperc

процент ЦПУ хоста, используемых контейнером

core

console, dashboards, database, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

grabber

wec

cluster-node

<имя узла>

container_memperc

процент памяти хоста, используемых контейнером

core

console, dashboards, database, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

grabber

wec

cluster-node

<имя узла>

container_memusage

общий объем памяти, который использует контейнер

core

console, dashboards, database, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

grabber

wec

cluster-node

<имя узла>

container_pids

количество процессов или потоков, созданных контейнером

core

console, dashboards, database, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

grabber

wec

cluster-node

<имя узла>

api_status

проверка, что компонент запущен и отвечает по API

core

console, dashboards, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

cluster-node

<имя узла>

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

errors_count

количество ошибок в журнале приложения компонента

core

console, dashboards, database, frontend, broker

service

gateway, census, ioc-watcher, reporter, signal, ueba, watchdog

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

grabber

wec

cluster-node

<имя узла>

eps

количество поступающих на ресивер событий в секунду

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

active_sources

количество уникальных хостов (по host.name), от которых были события на последние 7 дней

process_cpu_percent

процент потребления ЦПУ ресивером

process_cpu_load_average_1m

среднее потребление процессора за 1 минуту от количества поступающих от источников событий

process_cpu_load_average_5m

среднее потребление процессора за 5 минут от количества поступающих от источников событий

process_cpu_load_average_15m

среднее потребление процессора за 15 минут от количества поступающих от источников событий

reloads_failures

количество отказов при перезагрузке (количество неудачных попыток перезагрузки)

jvm_mem_heap_committed_in_bytes

объем памяти в байтах, доступный для использования кучей

jvm_mem_heap_max_in_bytes

максимальный объем памяти в байтах, доступный для использования кучей

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

cluster-node

<имя узла>

jvm_mem_heap_used_in_bytes

объем памяти в байтах, используемая в данный момент кучей

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

cluster-node

<имя узла>

jvm_mem_heap_used_percent

процент памяти, используемой в данный момент кучей

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

cluster-node

<имя узла>

jvm_uptime_in_millis

время работы jvm (Java Virtual Machine) в миллисекундах

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

cluster-node

<имя узла>

jvm_mem_non_heap_committed_in_bytes

объем доступной памяти без кучи в байтах

receiver

wec, jdbc, syslog, beats, netflow, snmp, custom

jvm_mem_non_heap_used_in_bytes

объем используемой памяти без кучи в байтах

os_available_processors

количество доступных процессоров

events_filtered

количество событий, прошедших через фильтры

events_in

события, принятый ресивером

events_out

события, отправленные ресивером во Opensearch и другие системы

events_queue_push_duration_in_millis

время ожидания событий в очереди ресивера в миллисекундах

events_duration_in_millis

время обработки событий в ресивере в миллисекундах

free_in_bytes

общее количество нераспределенных байт в кластере

cluster

<имя кластера>

total_in_bytes

общий размер всех файловых хранилищ в байтах в кластере

cluster_name

имя кластера

status

текущий статус кластера. Возможные значения: green, yellow, red

timed_out

булевое значение. Если false, то ответ возвращается в течение периода времени, заданного параметром timeout (по умолчанию 30 с)

number_of_nodes

количество узлов в кластере

number_of_data_nodes

количество узлов, являющихся выделенными узлами данных

active_primary_shards

количество активных первичных шардов

active_shards

общее количество активных первичных и реплик шардов

relocating_shards

количество перемещенных шардов

initializing_shards

количество шардов, находящихся в стадии инициализации

unassigned_shards

количество нераспределенных шардов

delayed_unassigned_shards

количество отложенных шардов

number_of_pending_tasks

количество изменений на уровне кластера, которые еще не были выполнены

number_of_in_flight_fetch

количество незавершенных операций

task_max_waiting_in_queue_millis

время в миллисекундах, прошедшее с момента ожидания выполнения самой ранней инициированной задачи

active_shards_percent_as_number

процент активных шардов

max_shard_size

максимальный размер шарда в кластере в байтах

indices_shards_total

общее количество шардов в кластере

indices_shards_primaries

количество первичных шардов в кластере

indices_shards_replicas

количество реплик шардов в кластере

indices_docs_count

количество документов в индексах в кластере

cluster

<имя кластера>

cluster-node

<имя узла>

indices_count

количество индексов в кластере

cluster

<имя кластера>

http_current_open

количество открытых в данный момент HTTP-соединений

cluster-node

<имя узла>

http_total_opened

общее количество HTTP-соединений, открытых за все время

fs_total_free_in_bytes

общее количество нераспределенных байт во всем файловом хранилище

fs_total_total_in_bytes

общий размер всех файловых хранилищ в байтах

fs_total_available_in_bytes

общее количество байт, доступных данной jvm (Java Virtual Machine) на всех файловых хранилищах. Это фактический объем свободного дискового пространства, который может использовать узел Opensearch

indices_merges_total_size_in_bytes

общий размер объединений документов в байтах

indices_fielddata_memory_size_in_bytes

общий объем памяти в байтах, используемый для кэша полевых данных во всех шардах, назначенных узлу

indices_indexing_index_time_in_millis

общее время в миллисекундах, затраченное на выполнение операций индексирования

indices_indexing_index_total

общее количество операций индексирования

indices_indexing_index_failed

количество неудачных операций индексирования

indices_indexing_throttle_time_in_millis

общее время в миллисекундах, затраченное на операции throttling

jvm_gc_collectors_old_collection_count

количество сборщиков мусора jvm (Java Virtual Machine), собирающих объекты старого поколения

jvm_gc_collectors_old_collection_time_in_millis

общее время в миллисекундах, затраченное jvm (Java Virtual Machine) на сбор объектов старого поколения

jvm_gc_collectors_young_collection_count

количество сборщиков мусора jvm (Java Virtual Machine), собирающих объекты молодого поколения

jvm_gc_collectors_young_collection_time_in_millis

общее время в миллисекундах, затраченное jvm (Java Virtual Machine) на сбор объектов молодого поколения

jvm_mem_pools_old_used_in_bytes

объем памяти в байтах, используемой кучей старого поколения

jvm_mem_pools_survivor_used_in_bytes

объем памяти в байтах, используемой пространством survivor (оставшимся пространством для узла)

jvm_mem_pools_young_used_in_bytes

объем памяти в байтах, используемой кучей молодого поколения

thread_pool_write_active

количество активных потоков на запись в пуле потоков

thread_pool_write_completed

количество задач, выполненных исполнителем пула потоков на запись

thread_pool_write_rejected

количество задач, невыполненных исполнителем пула потоков на запись

shards_count

количество шардов на узел кластера

primary_shards_count

количество шардов по всем первичным хранилищам

replica_shards_count

количество шардов по всем репликам

cpu_load_1m

потребление ЦПУ компонентами Alertix в течение 1 минуты

system

cpu

cpu_load_5m

потребление ЦПУ компонентами Alertix в течение 5 минут

cpu_load_15m

потребление ЦПУ компонентами Alertix в течение 15 минут

availability

доступность хоста по сети

system

network

total_bytes

весь объем оперативной памяти на хосте

system

memory

весь объем памяти в байтах, который есть на диске

disk

<имя диска>

used_bytes

используемый объем оперативной памяти на хосте

system

memory

занятый на диске объем памяти в байтах

disk

<имя диска>

used_percent

процент потребления оперативной памяти на хосте

system

memory

процент занятого места на диске

disk

<имя диска>

filebeat_status

активен ли процесс filebeat’а

system

process

Список специфических метрик, которые отслеживает сервис Watchdog и записывает в индекс core-кластера performance-*.