@panguard-ai/panguard-guard 0.2.0 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bundled-rules/sigma-rules/.gitkeep +0 -0
- package/bundled-rules/sigma-rules/auto-generated/.meta.json +626 -0
- package/bundled-rules/sigma-rules/auto-generated/.rules-meta.json +44 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-02d66266.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-09c197b6.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-0a127b82.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-12c6cf09.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-138e2c5f.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-144f04b0.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-14dc41fc.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-259e088a.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-2dda51a5.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-318e5d10.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-34e186b7.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-356ceb2d.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3747a529.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3acc1e4c.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3b84adb8.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3d47b8a5.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3d9474c8.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3fdeaae2.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-50391b7a.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-64108d99.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-6806d87e.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-683bc02e.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-6b908472.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-6ccc9a9a.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-704f2829.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-728445a5.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-7d2469e4.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-7efc680b.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-80413854.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-8455faa8.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-84c22235.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-991097d5.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-a2a7dea0.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-a329a8c4.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-a4953a0c.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-b761f239.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-bccd0386.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-c6523317.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-c7456969.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-c89d1856.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-cb47afe1.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-d11c2adf.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-d13720b9.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-da034fdb.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-db92510a.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-e53836a4.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-e6f9a231.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-ee8e125d.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-f07e4017.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-f942a244.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-0845d54d.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-0b4ed6f6.yml +36 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-14646374.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-2b848b90.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-3d49d056.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-4a75e716.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-4e615e9c.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-5d00f27d.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-7057b8cd.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-7a268eb0.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-84de0f98.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-85cb64d7.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-944eb289.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-a2a922f5.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-a474bd30.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-a91d74a0.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-cb4008a5.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/code-injection-dbfc8a28.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-036c2eb1.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-03c4921b.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-0addc01d.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-0bc5027f.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-107c1f90.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-115ab758.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-13d42ad1.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-14b0eb11.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-16959437.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1725c2c2.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1a0dc0f4.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1bee9f5b.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1c405735.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1ca77d8b.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1d1c77dd.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1f68550b.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-22ecedeb.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-24baa0ae.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-256ecb74.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-25bd2efe.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-25c6aeb7.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-27a2a5df.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-282267f9.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-2b2b3747.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-2c99fa05.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-2e2e2e02.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-2f00759d.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-31879597.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-3301a600.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-389aacd4.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-39971646.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-3a8d0580.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-3bdcabe7.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-3e84ee4e.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-405501b3.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4125f348.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-41778138.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-42eac79d.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-439aa913.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-439c24c2.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-445f7b15.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-46dd7c5d.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-47f12d88.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4934a48a.yml +37 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-49e18986.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4b2afaf1.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4caa5d95.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4d4d059c.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-53f1019a.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-547096cc.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-58082bd6.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-5913cff2.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-5c6724dc.yml +37 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-5e87663b.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-606d29b9.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-615a8500.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-64513e90.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-6479e1f8.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-694a3155.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-6986f459.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-701cd005.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-705b7ddc.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7540d6a2.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7578a3f1.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-767ee7bf.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-76f4d848.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-77c52089.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-785b27dc.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-789bc8e8.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-78e838c0.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7b13727a.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7b6b35f9.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7be9aa34.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7ce9773d.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7d255250.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7d2e697b.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7d9e1c44.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-801b1ea0.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-80237d88.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-84146bbe.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-854bf852.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-87abfc75.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-88ac6c67.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-8971aea2.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-8a36aeab.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-8bea53a0.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-8c61719c.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-91a4d292.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-9a7c5141.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-9dcabe45.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a00e7fab.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a56d633b.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a58e9280.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a76d6236.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a909099c.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a9aeda43.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ab88960f.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ab9a6a29.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b1135712.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b23685a3.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b3a260b5.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b415ea95.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b44fc412.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b67ef9ae.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-bb7467e3.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-be26bbf9.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-bea1e186.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-bee27591.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c0d169f4.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c1429b8a.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c35202ab.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c5fa17de.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c77d1205.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d20ff181.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d2b2c47a.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d2ea50c9.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d5bb587d.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d9724ebf.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-da7906d5.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-db923bd6.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-dc97961c.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e47af373.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e59c9fd6.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e6305166.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e692f110.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e7561649.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e8acd6e5.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e90bce79.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-eb633a58.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ede541e9.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-eecd41b6.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ef94112f.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-f2d856ef.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-fd251129.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-fd858b65.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-fdbedfe1.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ff8450c2.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-020bdb36.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-1d4b21fe.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-22bf04f6.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-233dc2d5.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-2b276aeb.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-38e9f4c9.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-39e97031.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-43816c70.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-4c88f42c.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-4d41006d.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-4e18b6fc.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-4fc32a3a.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-552ccecf.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-598e1872.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-5ad40bc7.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-653bb09d.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-695aa6d8.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-6b1caed0.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-714a6b2d.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-71fe2100.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-8f89e62a.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-907f9977.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-96165540.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-a47f0dc2.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-b3723d58.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-b4e8f19d.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-bb942c55.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-e9739f9a.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-ebc3cf71.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-edd90efc.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-ee42f7bb.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-f18bf98a.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/deserialization-f4a2abfd.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-0540e34a.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-3c2785c0.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-3f91abe4.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-41242eb2.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-425435ad.yml +37 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-4f0d9f9c.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-52c4553d.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-961c1ff6.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-9a960136.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-a011aaec.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-b0c12e08.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-c3407187.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-ce3414fa.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/file-upload-e9b2aec2.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-0d595ff0.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-13ac93b6.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-1e071abf.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-31c8f4ff.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-3ab138af.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-3af6bc7b.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-51d17890.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-6222e61f.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-6997f187.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-6c20a64c.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-71dec8d6.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-742435ee.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-8b926322.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-9af66900.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-9e4daa75.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-a22eed69.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-bde1f1b4.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-c10a3f0b.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-cda6b9d9.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-d87ab272.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-dc7d8ce2.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-ef23476d.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/idor-fe58fb79.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-0c2cfaae.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-0fb3614a.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-113331d9.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-23658a38.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-307f795a.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-33cfe63d.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-34ea3e0d.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-397c516e.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-3eb28506.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-448c4463.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-4a5e7ab9.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-4cc8371f.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-4f164f69.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-5ca4023f.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-668a20c1.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-66ca91d6.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-70291d91.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-707cf74d.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-733ddaff.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-85c2f361.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-8b130c20.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-8b5aea05.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-91f58f71.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-95986365.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-9ffb9771.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-a2790c52.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-a631203f.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-acd64119.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-b1110f0f.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-b18e89b9.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-ba345f86.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-c2b460d8.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-c336d5f3.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-c483f919.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-e717f021.yml +30 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-f3cc6d1d.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-f933d96b.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-3587b23b.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-707748e6.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-83c5ec37.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-9c5a1730.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-c9b9a0ce.yml +27 -0
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-f3348dbb.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-fe767343.yml +29 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-0134dedd.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-01def89d.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-02fc2412.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-0680a80c.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-074b1e83.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-075f9810.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-0933813f.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-177ef252.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-1a027479.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-1a538e86.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-1e8f03b5.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-2aac6249.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-2bfd830c.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-2d756d9c.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-312356d9.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-324e06ed.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-3592dc14.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-401b9477.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-407fcfa5.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-45860981.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-4af16c70.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-5089220f.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-51153e8b.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-51610460.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-519bddf2.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-5688190f.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-5768227f.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-598d6cd9.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-59d3dc24.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-621e9bfa.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-68c7bea8.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-6ff7dd35.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-714bf167.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-75db3810.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-762efbc9.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-77f64705.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-7bf12581.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-7f11b0d1.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-7f83bac0.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-7fe47ed2.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-85142fbb.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-8ddf496b.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-8f4c7f3f.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-92a9a648.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-950d10c6.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-95585823.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-9b8c4cd5.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-9c95efee.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-a16ba6d6.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-a195f003.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-a545772f.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ab6d4242.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-acd4da74.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ad6dc18c.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-aef21f28.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ba468813.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-c2194df8.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-c311c71f.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-c50d056f.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-c83fe33e.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-cbc4a350.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-cd35d87f.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-cf854f5c.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d2e70938.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d3f875d2.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d4185585.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d6bd80d4.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d6d9ef47.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d70f1769.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-dcd510d2.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-dcd893b1.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e0de5670.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e2932a2b.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e522e7da.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e8488ccc.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e99ac225.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ea081abf.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ea7049b4.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-eb1ee0b9.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ebe846e0.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ebfee8c4.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ef92a1f5.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f0fa97af.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f20107a7.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f28974bc.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f4dcf5d6.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f5e9f08b.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f65ac6e1.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f6aaa151.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-fdf57346.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-fdf8800a.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ff4b15ca.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-19dfac97.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-1b41874d.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-1e8f1c5a.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-23be78c7.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-35d4bbb6.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-3b577514.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-3d4905ab.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-4a98e459.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-4caa41ad.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-5624d62d.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-5686bd46.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-65b70af5.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-67e16bd4.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-683d742c.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-6cad1f41.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-7bae5a5d.yml +31 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-7f116375.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-8a7cfde6.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-8d65ff6d.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-9afdaba5.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-b0b913bd.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-b11aa59e.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-b2af7b55.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-b416fb55.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-b94b78e3.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-be106e71.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-bf0caccd.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-bfffdf4b.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-c908d124.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-cc3dd488.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-cfe39537.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-d1c3220e.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-d2d09846.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-d9a18b81.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-e465adf1.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-e4eb5d6d.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-eec9cffc.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-f0f9d121.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-f289000c.yml +32 -0
- package/bundled-rules/sigma-rules/auto-generated/sqli-f788f751.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-00ae35c6.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-016ea544.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-07d8c729.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-09c81b6a.yml +33 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-16b94ee0.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-1815e00b.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-1935a79a.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-1e4da2f1.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-2ebcdf25.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-2f968702.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-343b5e41.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-358214d1.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-366be59d.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-36bd4777.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-483e525f.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-49a097a8.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-5e0eff26.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-7077e8fa.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-70fdb2cd.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-73e7995c.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-7a58b206.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-7ce75b91.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-84d3755e.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-9b123631.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-9f94f916.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-b51bc3c2.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-bc20f525.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-cdc61dcd.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-e7d70aae.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-eab49130.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-efc68985.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-f1aeace6.yml +35 -0
- package/bundled-rules/sigma-rules/auto-generated/ssrf-f8f39001.yml +34 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-01606bc8.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-0f5f70a8.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-0fb9f252.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-16524865.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-189723e0.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-1c2f1712.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-1ec71dde.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-1efa9c30.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-21e5eb26.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-23621a1c.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-27f10ee7.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-29df071e.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-2e4de213.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-2fd7b071.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-3097ef82.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-30e10280.yml +37 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-319b5d4c.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-324461ad.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-34c0f631.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-376a26d0.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-3f6e9e38.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-44173677.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-442dc36b.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-46a6d330.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-50d4c136.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-5119be94.yml +37 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-5138d9af.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-52259250.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-5a7b75a5.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-5da5c562.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-5e0acd20.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-5f2e1485.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-61bf8d4b.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-66cf0fa3.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-6c0a16b0.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-6e77e7db.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-75abec44.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-912198ad.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-919ce319.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-956d51c5.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-97a8015a.yml +37 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-98d357f3.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-9b651733.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-9cdea131.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-9cf740eb.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-9e4f8557.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-a10a224f.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-a19cd758.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-a51a1104.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-ac094443.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-ae667fcd.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-af477c24.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-b1e89c09.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-b51d034c.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-b75a9bc6.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-b80267dd.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-b8dc3a4a.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-b999aeb5.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-bc5278bd.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-bd9710ff.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-c3560984.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-c5eb1dde.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-c85c6a04.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-c91ca363.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-cd0dd77b.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-cdc5ddc9.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-cdfd9e86.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-d41f9681.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-d76f5bb1.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-d9c2392d.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-dc0d3e3b.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-e0c75616.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-e24e73f9.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-e6e3094e.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-e95ff02e.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-eae4cb36.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-eb6c2227.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-f117429c.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-f53973c8.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-f6b89d1f.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-fd1134cb.yml +38 -0
- package/bundled-rules/sigma-rules/auto-generated/xss-fea47922.yml +39 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-0291de69.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-10732b3f.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-115dfd46.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-2685c7c8.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-296fcc81.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-2a18b1d7.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-2a74e50f.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-2c11c12c.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-3bf77c07.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-3d897854.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-3dba4046.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-408fd30e.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-448ec952.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-499abe33.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-5137adea.yml +27 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-518b805f.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-52be17d9.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-5a1aefac.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-5d278c48.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-6074a288.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-6d5a0025.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-6ea4eba9.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-8817e845.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-91325d0e.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-a23a538e.yml +27 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-a2c36fd6.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-a56af19a.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-abec61f4.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-b30924ad.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-b52850cb.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-be4027c2.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-ce24d838.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-dd7d0cc8.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-e3ca9d19.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-e7d11844.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-e9fc5dce.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-f3e972b5.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-f9082757.yml +28 -0
- package/bundled-rules/sigma-rules/auto-generated/xxe-fb331fe1.yml +28 -0
- package/bundled-rules/sigma-rules/community/README.md +1 -0
- package/bundled-rules/sigma-rules/community/VERSION +5 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_global_permissions_change_detected.yml +29 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_global_secret_scanning_rule_deleted.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml +26 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_log_configuration_update_detected.yml +23 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_project_secret_scanning_allowlist_added.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_secret_scanning_exempt_repository_detected.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_secret_scanning_rule_deleted.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_unauthorized_access_detected.yml +23 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml +26 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml +31 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml +30 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml +31 -0
- package/bundled-rules/sigma-rules/community/application/django/appframework_django_exceptions.yml +36 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_delete_action_invoked.yml +27 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_disable_high_risk_configuration.yml +38 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml +30 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_fork_private_repos_enabled_or_cleared.yml +27 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_new_org_member.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_new_secret_created.yml +29 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_outside_collaborator_detected.yml +31 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_pages_site_changed_to_public.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_push_protection_bypass_detected.yml +23 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_push_protection_disabled.yml +30 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_repo_or_org_transferred.yml +31 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_repository_archive_status_changed.yml +27 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_secret_scanning_feature_disabled.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_self_hosted_runner_changes_detected.yml +45 -0
- package/bundled-rules/sigma-rules/community/application/github/audit/github_ssh_certificate_config_changed.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/jvm/java_jndi_injection_exploitation_attempt.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/jvm/java_local_file_read.yml +26 -0
- package/bundled-rules/sigma-rules/community/application/jvm/java_ognl_injection_exploitation_attempt.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/jvm/java_rce_exploitation_attempt.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/jvm/java_xxe_exploitation_attempt.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml +42 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml +39 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_events_deleted.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml +30 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml +29 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml +35 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml +26 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml +32 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml +27 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml +29 -0
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/nodejs/nodejs_rce_exploitation_attempt.yml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_ftp_login_attempt.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_git_clone_request.yml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_http_get.yml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_http_post_login_attempt.yml +23 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_httpproxy_login_attempt.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_mssql_login_sqlauth.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_mssql_login_winauth.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_mysql_login_attempt.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_ntp_monlist.yml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_nmap_fin_scan.yaml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_nmap_null_scan.yaml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_nmap_os_scan.yaml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_nmap_xmas_scan.yaml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_syn_scan.yaml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_rdp_connection_attempt.yaml +24 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_redis_command.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_sip_request.yml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_smb_file_open.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_snmp_cmd.yml +24 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_ssh_login_attempt.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_ssh_new_connection.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_telnet_login_attempt.yml +27 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_tftp_request.yml +22 -0
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_vnc_connection_attempt.yml +22 -0
- package/bundled-rules/sigma-rules/community/application/python/app_python_sql_exceptions.yml +25 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml +34 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_atsvc_recon.yml +30 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_dcsync_attack.yml +32 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_efs_abuse.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_eventlog_recon.yml +26 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml +41 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml +37 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml +32 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_dcom_or_wmi.yml +34 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml +40 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml +38 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml +26 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml +34 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_sasec_recon.yml +30 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/ruby/appframework_ruby_on_rails_exceptions.yml +29 -0
- package/bundled-rules/sigma-rules/community/application/spring/spring_application_exceptions.yml +28 -0
- package/bundled-rules/sigma-rules/community/application/spring/spring_spel_injection.yml +23 -0
- package/bundled-rules/sigma-rules/community/application/sql/app_sqlinjection_errors.yml +31 -0
- package/bundled-rules/sigma-rules/community/application/velocity/velocity_ssti_injection.yml +26 -0
- package/bundled-rules/sigma-rules/community/category/antivirus/av_exploiting.yml +49 -0
- package/bundled-rules/sigma-rules/community/category/antivirus/av_hacktool.yml +70 -0
- package/bundled-rules/sigma-rules/community/category/antivirus/av_password_dumper.yml +60 -0
- package/bundled-rules/sigma-rules/community/category/antivirus/av_ransomware.yml +58 -0
- package/bundled-rules/sigma-rules/community/category/antivirus/av_relevant_files.yml +79 -0
- package/bundled-rules/sigma-rules/community/category/antivirus/av_webshell.yml +86 -0
- package/bundled-rules/sigma-rules/community/category/database/db_anomalous_query.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_bucket_deleted.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_without_mfa.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_guardduty_detector_deleted_or_updated.yml +47 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml +33 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_new_acl_entries.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_pua_trufflehog.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_region_enabled.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml +31 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_vpc_flow_logs_deleted.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_config_disable_recording.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_console_getsignintoken.yml +29 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_delete_identity.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_delete_saml_provider.yml +32 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ec2_import_key_pair_activity.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml +29 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml +31 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_enum_buckets.yml +31 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_guardduty_disruption.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_iam_backdoor_users_keys.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml +32 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_kms_import_key_material.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_lambda_function_url.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_new_lambda_layer_attached.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_rds_change_master_password.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_root_account_usage.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml +36 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_sso_idp_change.yml +34 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml +29 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_susp_saml_activity.yml +36 -0
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_update_login_profile.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_ad_user_added_to_admin_role.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_application_deleted.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_application_gateway_modified_or_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_application_security_group_modified_or_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_device_no_longer_managed_or_compliant.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml +29 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_dns_zone_modified_or_deleted.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_firewall_rule_collection_modified_or_deleted.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_granting_permission_detection.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml +35 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml +34 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml +41 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml +36 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml +33 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_pods_deleted.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_role_access.yml +36 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml +33 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml +31 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml +32 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_mfa_disabled.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_firewall_policy_modified_or_deleted.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_firewall_rule_modified_or_deleted.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_p2s_vpn_modified_or_deleted.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_security_modified_or_deleted.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_virtual_device_modified_or_deleted.yml +35 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_new_cloudshell_created.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_owner_removed_from_application_or_service_principal.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_rare_operations.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_service_principal_created.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_service_principal_removed.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_subscription_permissions_elevation_via_activitylogs.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_suppression_rule_created.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_virtual_network_modified_or_deleted.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_vpn_connection_modified_or_deleted.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_account_created_deleted.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_users_added_to_device_admin_roles.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_credential_added.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_delegated_permissions_all_users.yml +21 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_end_user_consent.yml +21 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_end_user_consent_blocked.yml +21 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_owner_added.yml +21 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_permissions_msft.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_privileged_permissions.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_role_added.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_uri_modifications.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_auditlogs_laps_credential_dumping.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_change_to_authentication_method.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_federation_modified.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_guest_invite_failure.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_guest_to_member.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_pim_activation_approve_deny.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_pim_alerts_disabled.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_pim_change_settings.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_privileged_account_creation.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml +29 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_tap_added.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_user_password_change.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_anomalous_token.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_activity.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_atypical_travel.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_impossible_travel.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_inbox_forwarding_rule.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_leaked_credentials.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address_suspicious.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_new_coutry_region.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_prt_access.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_unfamilar_sign_in.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_account_stale.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_invalid_license.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_role_assigned_outside_of_pim.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_role_frequent_activation.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_role_no_mfa_required.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_role_not_used.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_too_many_global_admins.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_account_lockout.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_auth_failure_increase.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_auth_sucess_increase.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_auth_to_important_apps_using_single_factor_auth.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml +31 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_sign_ins_from_noncompliant_devices.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml +31 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_app_device_code_authentication.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_app_ropc_authentication.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_blocked_account_attempt.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_conditional_access_failure.yml +29 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml +35 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_login_to_disabled_account.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_mfa_denies.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_mfa_interrupted.yml +32 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_unusual_authentication_interruption.yml +32 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml +29 -0
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_users_authenticating_to_other_azure_ad_tenants.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_access_policy_deleted.yml +32 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_breakglass_container_workload_deployed.yml +29 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_bucket_enumeration.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_bucket_modified_or_deleted.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_dlp_re_identifies_sensitive_information.yml +22 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml +42 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_kubernetes_cronjob.yml +31 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml +34 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_service_account_modified.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_vpn_tunnel_modified_or_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_application_access_levels_modified.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_application_removed.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_granted_domain_api_access.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_mfa_disabled.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_role_modified_or_deleted.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_role_privilege_deleted.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_user_granted_admin_privileges.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/audit/microsoft365_bypass_conditional_access.yml +31 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/audit/microsoft365_disabling_mfa.yml +23 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml +30 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml +27 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml +26 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_impossible_travel_activity.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_logon_from_risky_ip_address.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_pst_export_alert.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml +28 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml +24 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml +25 -0
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml +25 -0
- package/bundled-rules/sigma-rules/community/identity/cisco_duo/cisco_duo_mfa_bypass_via_bypass_code.yml +26 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_admin_activity_from_proxy_query.yml +23 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_admin_role_assigned_to_user_or_group.yml +27 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_admin_role_assignment_created.yml +21 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_api_token_created.yml +22 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_api_token_revoked.yml +23 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_application_modified_or_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_application_sign_on_policy_modified_or_deleted.yml +24 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_fastpass_phishing_detection.yml +25 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_identity_provider_created.yml +23 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_mfa_reset_or_deactivated.yml +27 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_network_zone_deactivated_or_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_new_behaviours_admin_console.yml +30 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_password_in_alternateid_field.yml +34 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_policy_modified_or_deleted.yml +26 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_policy_rule_modified_or_deleted.yml +25 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_security_threat_detected.yml +23 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_suspicious_activity_enduser_report.yml +22 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_unauthorized_access_to_app.yml +22 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_user_account_locked_out.yml +23 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_user_created.yml +20 -0
- package/bundled-rules/sigma-rules/community/identity/okta/okta_user_session_start_via_anonymised_proxy.yml +23 -0
- package/bundled-rules/sigma-rules/community/identity/onelogin/onelogin_assumed_another_user.yml +21 -0
- package/bundled-rules/sigma-rules/community/identity/onelogin/onelogin_user_account_locked.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_binary_padding.yml +39 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_change_file_time_attr.yml +42 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_chattr_immutable_removal.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_clipboard_collection.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_clipboard_image_collection.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_coinminer.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_data_compressed.yml +32 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_data_exfil_wget.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_dd_delete_file.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_file_or_folder_permissions.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_find_cred_in_files.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_hidden_files_directories.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_hidden_zip_files_steganography.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_masquerading_crond.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml +45 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_network_sniffing.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_screencapture_import.yml +40 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_screencaputre_xwd.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_steghide_embed_steganography.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_steghide_extract_steganography.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_susp_cmds.yml +36 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_susp_histfile_operations.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_susp_service_reload_or_restart.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_system_shutdown_reboot.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_unzip_hidden_zip_files_steganography.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_user_discovery.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_audio_capture.yml +32 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_disable_aslr_protection.yml +40 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_password_policy_discovery.yml +45 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_susp_c2_commands.yml +49 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_system_info_discovery.yml +47 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_auditing_config_change.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_hidden_binary_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_ld_so_preload_mod.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_logging_config_change.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_magic_system_request_key.yml +41 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_system_info_discovery2.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_systemd_service_creation.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml +54 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/service_stop/lnx_auditd_disable_system_firewall.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml +41 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_create_account.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_load_module_insmod.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_network_service_scanning.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_split_file_into_pieces.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml +44 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_susp_special_file_creation_via_mknod_syscall.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_web_rce.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/clamav/lnx_clamav_relevant_message.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/cron/lnx_cron_crontab_file_modification.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml +22 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_apt_equationgroup_lnx.yml +82 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_buffer_overflows.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_clear_syslog.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_file_copy.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_ldso_preload_injection.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_potential_susp_ebpf_activity.yml +21 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_privileged_user_creation.yml +36 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shell_clear_cmd_history.yml +47 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shell_susp_commands.yml +59 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shell_susp_log_entries.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shell_susp_rev_shells.yml +45 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shellshock.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_susp_dev_tcp.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_susp_jexboss.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_symlink_etc_passwd.yml +22 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/sshd/lnx_sshd_susp_ssh.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/syslog/lnx_syslog_susp_named.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml +38 -0
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_doas_conf_creation.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_persistence_cron_files.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_persistence_sudoers_files.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml +21 -0
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_wget_download_file_in_tmp_dir.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml +43 -0
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml +51 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_at_command.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_auditctl_clear_rules.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_av_kaspersky_av_disabled.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml +38 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_base64_decode.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_base64_execution.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_bash_interactive_shell.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_cap_setgid.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_cap_setuid.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_capa_discovery.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_chroot_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_clear_logs.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_clear_syslog.yml +87 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_clipboard_collection.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_crontab_removal.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_crypto_mining.yml +42 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_curl_usage.yml +22 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_curl_wget_exec_tmp.yml +36 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_dd_process_injection.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_disable_ufw.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_doas_execution.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_env_shell_invocation.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml +32 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml +32 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_file_deletion.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_find_shell_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml +36 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_git_shell_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_groupdel.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_install_root_certificate.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_install_suspicious_packages.yml +49 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml +41 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_local_account.yml +52 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_local_groups.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml +21 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_mount_hidepid.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml +59 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_nohup.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml +36 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_proxy_connection.yml +23 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml +43 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml +36 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml +38 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_python_reverse_shell.yml +32 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml +38 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml +46 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_remove_package.yml +42 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml +44 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml +37 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_security_software_discovery.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml +83 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml +26 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_setgid_setuid.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml +36 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_chmod_directories.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml +38 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml +42 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml +28 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml +32 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_find_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_git_clone.yml +41 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_history_delete.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_history_recon.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml +97 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_java_children.yml +32 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml +43 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_process_reading_sudoers.yml +34 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml +50 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml +31 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml +35 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_system_info_discovery.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml +30 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_system_network_discovery.yml +33 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_systemctl_mask_power_settings.yml +32 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_touch_susp.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml +22 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml +27 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_userdel.yml +24 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml +25 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml +42 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_webshell_detection.yml +50 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml +29 -0
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml +24 -0
- package/bundled-rules/sigma-rules/community/macos/file_event/file_event_macos_emond_launch_daemon.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/file_event/file_event_macos_susp_startup_item_created.yml +30 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_applescript.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_base64_decode.yml +23 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_binary_padding.yml +31 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_change_file_time_attr.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml +32 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_clear_system_logs.yml +31 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_clipboard_data_via_osascript.yml +29 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_create_account.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_create_hidden_account.yml +33 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_creds_from_keychain.yml +30 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_csrutil_disable.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_csrutil_status.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_disable_security_tools.yml +43 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml +32 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml +30 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml +30 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml +32 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_find_cred_in_files.yml +25 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_gui_input_capture.yml +40 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_hdiutil_create.yml +23 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_hdiutil_mount.yml +28 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml +44 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_ioreg_discovery.yml +47 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_jamf_susp_child.yml +26 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_jamf_usage.yml +31 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml +34 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_launchctl_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_local_account.yml +42 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_local_groups.yml +33 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_network_service_scanning.yml +30 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_network_sniffing.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_nscurl_usage.yml +32 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml +42 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_osacompile_runonly_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml +31 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml +30 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_remote_access_tools_meshagent_arguments.yml +30 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml +39 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml +31 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_remote_system_discovery.yml +46 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml +25 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_screencapture.yml +23 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_security_software_discovery.yml +39 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_space_after_filename.yml +24 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml +22 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml +78 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml +55 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_find_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml +29 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml +25 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml +28 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_system_network_discovery.yml +34 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_suspicious_applet_behaviour.yml +24 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_swvers_discovery.yml +29 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml +32 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml +29 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_sysctl_discovery.yml +37 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml +38 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml +25 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml +46 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml +27 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml +28 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml +26 -0
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml +47 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_clear_logs.yml +24 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_collect_data.yml +31 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_crypto_actions.yml +26 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_disable_logging.yml +23 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_discovery.yml +40 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_dos.yml +24 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_file_deletion.yml +25 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_input_capture.yml +22 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_local_accounts.yml +23 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_modify_config.yml +34 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_moving_data.yml +30 -0
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_net_sniff.yml +23 -0
- package/bundled-rules/sigma-rules/community/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml +32 -0
- package/bundled-rules/sigma-rules/community/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml +32 -0
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_external_service_interaction_domains.yml +55 -0
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_mal_cobaltstrike.yml +26 -0
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_pua_cryptocoin_mining_xmr.yml +42 -0
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_susp_b64_queries.yml +23 -0
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_susp_telegram_api.yml +24 -0
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_susp_txt_exec_strings.yml +26 -0
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_wannacry_killswitch_domain.yml +26 -0
- package/bundled-rules/sigma-rules/community/network/firewall/net_firewall_cleartext_protocols.yml +89 -0
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_admin_account_created.yml +25 -0
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_firewall_address_object.yml +25 -0
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml +25 -0
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_local_user_created.yml +27 -0
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml +28 -0
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml +28 -0
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml +28 -0
- package/bundled-rules/sigma-rules/community/network/huawei/bgp/huawei_bgp_auth_failed.yml +32 -0
- package/bundled-rules/sigma-rules/community/network/juniper/bgp/juniper_bgp_missing_md5.yml +32 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml +55 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml +40 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml +31 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml +25 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_default_cobalt_strike_certificate.yml +22 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml +38 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_mining_pools.yml +100 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_nkn.yml +24 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_susp_zbit_flag.yml +56 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_torproxy.yml +72 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_http_executable_download_from_webdav.yml +27 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_http_susp_file_ext_from_susp_tld.yml +85 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_http_webdav_put_request.yml +30 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_rdp_public_listener.yml +33 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_atsvc_task.yml +32 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml +28 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_lm_namedpipe.yml +42 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_susp_psexec.yml +33 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml +37 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml +35 -0
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_susp_kerberos_rc4.yml +25 -0
- package/bundled-rules/sigma-rules/community/web/product/apache/web_apache_segfault.yml +22 -0
- package/bundled-rules/sigma-rules/community/web/product/apache/web_apache_threading_error.yml +24 -0
- package/bundled-rules/sigma-rules/community/web/product/nginx/web_nginx_core_dump.yml +22 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_download_susp_dyndns.yml +112 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml +115 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_download_susp_tlds_whitelist.yml +66 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_downloadcradle_webdav.yml +24 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml +26 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_hello_world_user_agent.yml +24 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_hktl_baby_shark_default_agent_url.yml +21 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml +60 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml +27 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml +32 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_pwndrop.yml +23 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_raw_paste_service_access.yml +31 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_susp_flash_download_loc.yml +28 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml +23 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_telegram_api.yml +30 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_apt.yml +65 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_base64_encoded.yml +27 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml +35 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml +33 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_cryptominer.yml +26 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_empty.yml +25 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_frameworks.yml +57 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_hacktool.yml +73 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_malware.yml +142 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_powershell.yml +23 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_rclone.yml +21 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_susp.yml +50 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_susp_base64.yml +25 -0
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_webdav_external_execution.yml +55 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml +27 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_iis_tilt_shortname_scan.yml +31 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_java_payload_in_access_logs.yml +36 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_jndi_exploit.yml +41 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_path_traversal_exploitation_attempt.yml +29 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_source_code_enumeration.yml +22 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_sql_injection_in_access_logs.yml +60 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_ssti_in_access_logs.yml +35 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_susp_useragents.yml +28 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_susp_windows_path_uri.yml +28 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_webshell_regeorg.yml +31 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_win_webshells_in_access_logs.yml +62 -0
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_xss_in_access_logs.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/Other/win_av_relevant_match.yml +111 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/application_error/win_application_error_lsass_crash.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/application_error/win_application_error_msmpeng_crash.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/msiinstaller/win_msi_install_from_susp_locations.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_add_sysadmin_account.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_destructive_query.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_command_exec.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_file_transfer.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appmodel_runtime/win_appmodel_runtime_sysinternals_tools_appx_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_downloaded_from_file_sharing_domains.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_deployment_failed_signing_requirements.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_in_staging_directory.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_policy_block.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxpackaging_server_full_trust_package_installation.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxpackaging_server_unsigned_package_installation.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/appxpackaging_om/win_appxpackaging_om_sups_appx_signature.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml +75 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml +121 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_blocked_protected_process_file.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/diagnosis/scripted/win_diagnosis_scripted_load_remote_diagcab.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_anonymfiles_com.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_mal_cobaltstrike.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_mega_nz.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_put_io.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_tor_onion.yml +75 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_ufile_io.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_server/win_dns_server_failed_dns_zone_transfer.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_server/win_dns_server_susp_server_level_plugin_dll.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/driverframeworks/win_usb_device_plugged.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_add_rule.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_delete_all_rules.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_failed_load_gpo.yml +20 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_reset_config.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_setting_change.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/iis-configuration/win_iis_logging_http_disabled.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/iis-configuration/win_iis_module_added.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/iis-configuration/win_iis_module_removed.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/ldap/win_ldap_recon.yml +91 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_transportagent.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_transportagent_failed.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/ntlm/win_susp_ntlm_auth.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/ntlm/win_susp_ntlm_rdp.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_access_token_abuse.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_admin_rdp_login.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_overpass_the_hash.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_rdp_localhost_login.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_rottenpotato.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_wmi_login.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml +96 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_account_discovery.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_ad_object_writedac_access.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_ad_replication_non_machine_account.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_ad_user_enumeration.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability_eku.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_add_remove_computer.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_admin_share_access.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_alert_active_directory_user_control.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_alert_ad_user_backdoors.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_alert_enable_weak_encryption.yml +89 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_alert_ruler.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_atsvc_task.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_audit_log_cleared.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_camera_microphone_access.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_cobaltstrike_service_installs.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_codeintegrity_check_failure.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dce_rpc_smb_spoolss_named_pipe.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dcom_iertutil_dll_hijack.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dcsync.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_default_domain_gpo_modification.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_device_installation_blocked.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_disable_event_auditing.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_disable_event_auditing_critical.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dot_net_etw_tamper.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dpapi_domain_backupkey_extraction.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dpapi_domain_masterkey_backup_attempt.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_external_device.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_gpo_scheduledtasks.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_hidden_user_creation.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_hktl_edr_silencer.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_hktl_nofilter.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_impacket_psexec.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_impacket_secretdump.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_rundll_services_security.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_use_mshta_services_security.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_iso_mount.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_kerberoasting_activity.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_kerberos_asrep_roasting.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_lm_namedpipe.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_lsass_access_non_system_account.yml +57 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_mal_creddumper.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_mal_wceaux_dll.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_metasploit_authentication.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_net_ntlm_downgrade.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_not_allowed_rdp_access.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_password_policy_enumerated.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_pcap_drivers.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_petitpotam_network_share.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_possible_dc_shadow.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_powershell_script_installed_as_service.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_protected_storage_service_access.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_rdp_reverse_tunnel.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_registry_permissions_weakness_check.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_remote_powershell_session.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_replay_attack_detected.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_scm_database_handle_failure.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_scm_database_privileged_operation.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_service_install_remote_access_software.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_service_installation_by_unusal_client.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_signal_sensitive_config_access.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_add_domain_trust.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_add_sid_history.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_computer_name.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_dsrm_password_change.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_failed_logon_reasons.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_group_policy_abuse_privilege_addition.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_kerberos_manipulation.yml +57 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_ldap_dataexchange.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_local_anon_logon_created.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_lsass_dump.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_lsass_dump_generic.yml +114 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_net_recon_activity.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_outbound_kerberos_connection.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_psexec.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_rc4_kerberos.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_scheduled_task_creation.yml +61 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_scheduled_task_update.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_time_modification.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_svcctl_remote_service.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_syskey_registry_access.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_tap_driver_installation.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_transf_files_with_cred_data_via_network_shares.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_added_to_local_administrators.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_creation.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_driver_loaded.yml +57 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_logoff.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_vssaudit_secevent_source_registration.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_windows_defender_exclusions_write_access.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_wmi_persistence.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_workstation_was_locked.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security_mitigations/win_security_mitigations_defender_load_unsigned_dll.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/security_mitigations/win_security_mitigations_unsigned_dll_from_susp_location.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/shell_core/win_shell_core_susp_packages_installed.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/lsasrv/win_system_lsasrv_ntlmv1.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_certification_authority/win_system_adcs_enrollment_request_denied.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config_failed.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_eventlog/win_system_susp_eventlog_cleared.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_ntfs/win_system_volume_shadow_copy_mount.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_wer_systemerrorreporting/win_system_crash_dump_created.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/netlogon/win_system_vul_cve_2020_1472.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_obfuscated_iex_services.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_krbrelayup_service_installation.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_mal_creddumper.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_moriya_rootkit.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_powershell_script_installed_as_service.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_anydesk.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_csexecsvc.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_hacktools.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_mesh_agent.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_netsupport_manager.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_paexec.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy_runner.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_pua_proceshacker.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_remcom.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_remote_access_software.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_remote_utilities.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_susp.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_sysinternals_psexec.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_tacticalrmm.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_tap_driver.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_uncommon.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_terminated_unexpectedly.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_susp_rtcore64_service_install.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder_pattern.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/win_alert_mimikatz_keywords.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_antimalware_platform_expired.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_asr_lsass_access.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_config_change_exclusion_added.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_config_change_sample_submission_consent.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_history_delete.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_malware_and_pua_scan_disabled.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_real_time_protection_errors.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_restored_quarantine_file.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_threat.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_virus_scan_disabled.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/builtin/wmi/win_wmi_persistence.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_keepass.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_powershell_lsass.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml +98 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml +118 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_target_image.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_ads_executable.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_creation_internet_file.yml +87 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_susp_extension.yml +72 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_unusual_extension.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_hktl_generic_download.yml +136 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_anonymfiles_com.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_appinstaller.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_cloudflared_communication.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_common_malware_hosting_services.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_devtunnels_communication.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_domain_azurewebsites.yml +112 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_finger.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_mal_cobaltstrike.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_mega_nz.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_onelaunch_update_service.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_quickassist.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_regsvr32_dns_query.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml +175 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml +107 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_tor_onion_domain_query.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_ufile_io_query.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_mal_drivers.yml +813 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_mal_drivers_names.yml +93 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_pua_process_hacker.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_pua_system_informer.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_susp_temp_use.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_vuln_drivers.yml +4456 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_vuln_drivers_names.yml +298 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_vuln_hevd_driver.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_vuln_winring0_driver.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_windivert.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_credential_manager_access.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_credhist.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_dpapi_master_key_access.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_gpo_files.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml +202 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_teams_sensitive_files.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_backup_file.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_event_log_files.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_own_image.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_powershell_command_history.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_prefetch.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_teamviewer_logs.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_advanced_ip_scanner.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_anydesk_artefact.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_anydesk_writing_susp_binaries.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_aspnet_temp_files.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_bloodhound_collection.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_create_non_existent_dlls.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_deno.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_new_shim_database.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_scr_binary_file.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_system_dll_files.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_system_file.yml +144 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_unquoted_service_path.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_csexec_service.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_csharp_compile_artefact.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_dcom_iertutil_dll_hijack.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_desktop_ini_created_by_uncommon_process.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_dll_sideloading_space_path.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_dump_file_susp_creation.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_errorhandler_persistence.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_exchange_webshell_drop.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_gotoopener_artefact.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_dumpert.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_krbrelay_remote_ioc.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_nppspy.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_powerup_dllhijacking.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_remote_cred_dump.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_safetykatz.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_impacket_file_indicators.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml +61 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_iphlpapi_dll_sideloading.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_iso_file_mount.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_iso_file_recent.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_lsass_shtinkering.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_lsass_werfault_dump.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_mal_adwind.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_mal_octopus_scanner.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_msdt_susp_directories.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_mysqld_uncommon_file_creation.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_net_cli_artefact.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_new_files_in_uncommon_appdata_folder.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_new_scr_file.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ntds_dit_creation.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ntds_exfil_tools.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_addin_persistence.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_macro_files_created.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_macro_files_downloaded.yml +62 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_outlook_newform.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_outlook_susp_file_creation_in_temp_dir.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_publisher_files_in_susp_locations.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_startup_persistence.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_susp_file_extension.yml +69 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_pcre_net_temp_file.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_perflogs_susp_files.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml +61 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_drop_powershell.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_exploit_scripts.yml +282 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_module_creation.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_module_susp_creation.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_rclone_config_files.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_regedit_print_as_pdf.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_remcom_service.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_artefact.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_remote_file.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ripzip_attack.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sam_dump.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sed_file_creation.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_shell_write_susp_directory.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml +83 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_startup_folder_file_write.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_colorcpl.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_desktop_txt.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_desktopimgdownldr_file.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_diagcab.yml +20 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_double_extension.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_executable_creation.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_get_variable.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml +77 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location.yml +71 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml +58 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_powershell_profile.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_public_folder_extension.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_spool_drivers_color_drop.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_system_interactive_powershell.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_task_write.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_teamviewer_remote_session.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_vscode_powershell_profile.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_wdac_policy_creation.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_windows_terminal_profile.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_winsxs_binary_creation.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_livekd_default_dump_name.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_livekd_driver.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_livekd_driver_susp_creation.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_procmon_driver_susp_creation.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_psexec_service.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_taskmgr_lsass_dump.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_tsclient_filewrite_startup.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_consent_comctl32.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_idiagnostic_profile.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_ieinstal.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_ntfs_reparse_point.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_winsat.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_wmp.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_vhd_download_via_browsers.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_vscode_tunnel_remote_creation_artefacts.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_vscode_tunnel_renamed_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_webshell_creation_detect.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_werfault_dll_hijacking.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_winrar_file_creation_in_startup_folder.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_winrm_awl_bypass.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wmiexec_default_filename.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wpbbin_persistence.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_writing_local_admin_share.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/file/file_rename/file_rename_win_ransomware.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_clfs_load.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_amsi_suspicious_process.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml +58 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_credui_uncommon_process_load.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml +60 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_system_management_automation_susp_load.yml +94 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_tttracer_module_load.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_unsigned_node_load.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_vss_ps_susp_load.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_vssapi_susp_load.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_vsstrace_susp_load.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_hktl_sharpevtmute.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_hktl_silenttrinity_stager.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_iexplore_dcom_iertutil_dll_hijack.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_lsass_unsigned_image_load.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_dotnet_assembly_dll_load.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_dotnet_clr_dll_load.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_dotnet_gac_dll_load.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_excel_xll_susp_load.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_outlook_outlvba_load.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_powershell_dll_load.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_vbadll_load.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_rundll32_remote_share_load.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_7za.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_antivirus.yml +101 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_appverifui.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_aruba_networks_virtual_intranet_access.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_avkkid.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_ccleaner_du.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_ccleaner_reactivator.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_chrome_frame_helper.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_classicexplorer32.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_comctl32.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_coregen.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_dbgcore.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_dbghelp.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_dbgmodel.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_eacore.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_edputil.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_from_non_system_location.yml +511 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_goopdate.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_gup_libcurl.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_iviewers.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_jli.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_jsschhlp.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_keyscrambler.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_libvlc.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_mfdetours.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_mfdetours_unsigned.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_mpsvc.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_mscorsvc.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_non_existent_dlls.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_office_dlls.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_python.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_rcdll.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_rjvplatform_default_location.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_rjvplatform_non_default_location.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_robform.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_shell_chrome_api.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_shelldispatch.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_smadhook.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_solidpdfcreator.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_third_party.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_ualapi.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vivaldi_elf.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vmguestlib.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vmmap_dbghelp_signed.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vmmap_dbghelp_unsigned.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vmware_xfer.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_waveedit.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_wazuh.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_windows_defender.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_wwlib.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_baaupdate_dll_load.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_clickonce_unsigned_module_loaded.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_dll_load_system_process.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_python_image_load.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_unsigned_dll.yml +77 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_thor_unsigned_execution.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_uac_bypass_iscsicpl.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_uac_bypass_via_dism.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_win_mmc_loads_script_engine_dll.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_win_trusted_path_bypass.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wmi_persistence_commandline_event_consumer.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wsman_provider_image_load.yml +76 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_addinutil_initiated.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_adws_unusual_connection.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_certutil_initiated_connection.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_cmstp_initiated_connection.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_dialer_initiated_connection.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_azurewebsites.yml +147 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_btunnels.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml +251 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_dead_drop_resolvers.yml +246 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_devtunnels.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_dropbox_api.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml +111 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml +82 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_mega_nz.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_ngrok.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_notion_api_susp_communication.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_portmap.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_eqnedt.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_finger.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_imewdbld.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_notepad.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml +317 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_office_uncommon_ports.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_python.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml +80 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_rdp_to_http.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_regasm_network_activity.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_regsvr32_network_activity.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_rundll32_net_connections.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_binary_no_cmdline.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_file_sharing_domains_susp_folders.yml +78 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_initiated_uncommon_or_suspicious_locations.yml +77 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_malware_callback_port.yml +94 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_malware_callback_ports_uncommon.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_winlogon_net_connections.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_wordpad_uncommon_ports.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_wscript_cscript_local_connection.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_wscript_cscript_outbound_connection.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_wuauclt_network_connection.yml +58 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml +74 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_coercedpotato.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_diagtrack_eop.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_efspotato.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_powershell_execution_pipe.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_pua_csexec_default_pipe.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_scrcons_wmi_consumer_namedpipe.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_exe_calling_ps.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_powercat.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_remotefxvgpudisablement_abuse.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_susp_download.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_susp_get_nettcpconnection.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml +81 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_active_directory_module_dll_import.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_clear_powershell_history.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_decompress_commands.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_exploit_scripts.yml +278 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_get_clipboard.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_hktl_evil_winrm_execution.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml +252 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_ad_group_reco.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_download.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_invocation_specific.yml +80 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_local_group_reco.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml +58 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_amsi_null_bits_bypass.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_audio_exfiltration.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_automated_collection.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_capture_screenshots.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_copy_item_system_directory.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_cor_profiler.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_create_local_user.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_directorysearcher.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_download_com_cradles.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_dsinternals_cmdlets.yml +90 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_exchange_mailbox_smpt_forwarding_rule.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_export_certificate.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_acl_service.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_adgroup.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_import_module_susp_dirs.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_install_unsigned_appx_packages.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_keylogging.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_localuser.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml +260 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_msxml_com.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml +106 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_packet_capture.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_powershell_web_access_installation.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml +133 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_psasyncshell.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_psattack.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_remotefxvgpudisablement_abuse.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_root_certificate_installed.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_set_acl.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_set_acl_susp_location.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_shellintel_malicious_commandlets.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_software_discovery.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_ace_tampering.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_ad_group_reco.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_download.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_extracting.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_get_process.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_gettypefromclsid.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_invocation_generic.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_invocation_specific.yml +81 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_iofilestream.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_keywords.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_local_group_reco.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_mounted_share_deletion.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_recon_export.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_smb_share_reco.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_start_process.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_unblock_file.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_write_eventlog.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml +86 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_test_netconnection.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_timestomp.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_user_profile_tampering.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win32_nteventlogfile_usage.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_wmi_persistence.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_wmi_unquoted_service_search.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_wmimplant.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_x509enrollment.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_xml_iex.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_cmstp_execution_by_access.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_generic_access.yml +110 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_littlecorporal_generated_maldoc.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_sysmonente.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_memdump.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_python_based_tool.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_seclogon_access.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_susp_access_flag.yml +125 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_werfault.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml +57 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_susp_all_access_uncommon_target.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml +73 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_svchost_credential_dumping.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_svchost_susp_access_request.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_7zip_exfil_dmp_files.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_7zip_password_compression.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_acccheckconsole_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_adplus_memory_dump.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_appvlp_uncommon_child_process.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_at_interactive_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml +61 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_attrib_hiding_files.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_autorun_registry_modified_via_wmic.yml +62 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_baaupdate_susp_child_process.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bash_command_execution.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bash_file_execution.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bcdedit_susp_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bcp_export_data.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitlockertogo_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml +77 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml +75 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml +71 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml +60 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_load_extension.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_inline_file_download.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_tor_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certoc_download.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certoc_download_direct_ip.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certoc_load_dll.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certreq_download.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_certificate_installation.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_decode.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_download.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml +78 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml +75 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_encode.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_export_pfx.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_ntlm_coercion.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_citrix_trolleyexpress_procdump.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_clip_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cloudflared_quicktunnel_execution.yml +88 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_assoc_execution.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_assoc_tamper_exe_file_association.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_copy_dmp_from_share.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_del_execution.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_dir_execution.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_http_appdata.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml +78 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_net_use_and_exec_combo.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml +66 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_ntdllpipe_redirect.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_path_traversal.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_redirection_susp_folder.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_stdin_redirect.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_type_arbitrary_file_download.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_unusual_parent.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmdkey_recon.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_configsecuritypolicy_download_file.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_legacy_option.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_path_traversal.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_uncommon_parent.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_control_panel_item.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml +62 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml +73 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csc_susp_parent.yml +86 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csi_execution.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csvde_export.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_cookie_hijacking.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml +81 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions.yml +78 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml +97 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_insecure_connection.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_local_file_read.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_susp_download.yml +72 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_customshellhost_susp_exec.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_defaultpack_uncommon_child_process.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_defender_default_action_modified.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_defender_remove_context_menu.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_desktopimgdownldr_remote_file_download.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_desktopimgdownldr_susp_execution.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_device_credential_deployment.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dfsvc_suspicious_child_processes.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dirlister_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dism_enable_powershell_web_access_feature.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dism_remove.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dll_sideload_vmware_xfer.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dns_susp_child_process.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dnscmd_discovery.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dotnetdump_memory_dump.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_driverquery_recon.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_driverquery_usage.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dsacls_password_spray.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dumpminitool_execution.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dxcap_arbitrary_binary_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_esentutl_params.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_esentutl_webcache.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_eventvwr_susp_child_process.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_expand_cabinet_files.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_explorer_nouaccheck.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_download.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_lnk.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_lsass.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_recon_everyone.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml +69 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_finger_execution.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_forfiles_child_process_masquerading.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_forfiles_proxy_execution_.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_format_uncommon_filesystem_load.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fsutil_usage.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gfxdownloadwrapper_arbitrary_file_download.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_git_susp_clone.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_googleupdate_susp_child_process.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpg4win_decryption.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpg4win_encryption.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpresult_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gup_arbitrary_binary_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gup_download.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gup_susp_child_process.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gup_suspicious_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hh_chm_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hh_chm_remote_download_or_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hh_susp_execution.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_adcspwn.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_c3_rundll32_pattern.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_certify.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_certipy.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_cmd.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_covenant.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml +77 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_crackmapexec_patterns.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_crackmapexec_powershell_obfuscation.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_createminidump.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_dinjector.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_doppelganger.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_dumpert.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_edr_freeze.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_edrsilencer.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_evil_winrm.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml +112 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_gmer.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_handlekatz.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_hashcat.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_hollowreaper.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_hydra.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml +68 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml +75 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_impersonate.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_inveigh.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_koadic.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_krbrelay.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_krbrelayup.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_lazagne.yml +140 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_localpotato.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_pchunter.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_powertool.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_purplesharp_indicators.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_pypykatz.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_quarks_pwdump.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_rubeus.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_safetykatz.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharp_dpapi_execution.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharp_ldap_monitor.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpersist.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpevtmute.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpmove.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpsuccessor_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpup.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpview.yml +141 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sysmoneop.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_uacme.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_wce.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_winpeas.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_winpwn.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_wmiexec_default_powershell.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_wsass.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_xordump.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_zipexec.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hostname_execution.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hvci_registry_tampering.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hwp_exploits.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hxtsr_masquerading.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_icacls_deny.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ieexec_download.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_appcmd_http_logging.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_appcmd_susp_rewrite_rule.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_connection_strings_decryption.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_logs_deletion.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ilasm_il_code_compilation.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_imagingdevices_unusual_parents.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_imewbdld_download.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_installutil_download.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_keytool_susp_child_process.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml +60 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_remote_debugging.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_susp_child_process.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_susp_child_process_2.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_jsc_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_kavremover_uncommon_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_kd_execution.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_keyscrambler_susp_child_process.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ksetup_password_change_user.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ldifde_export.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ldifde_file_load.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lodctr_performance_counter_tampering.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_logman_disable_eventlog.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_extrac32.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_gpscript.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_openconsole.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_openwith.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pcalua.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pcwutl.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pester.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pester_1.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_printbrm.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pubprn.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_register_app.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_remote.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_replace.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_settingsynchost.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_sftp.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_tracker.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_utilityfunctions.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_wfc.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolscript_register_app.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lsass_process_clone.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mftrace_child_process.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mmc_mmc20_lateral_movement.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mmc_rlo_abuse_pattern.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mode_codepage_russian.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mofcomp_execution.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mpcmdrun_dll_sideload_defender.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mpcmdrun_remove_windows_defender_definition.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msdt_answer_file_exec.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msdt_susp_parent.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msedge_proxy_download.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_http.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_javascript.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_lethalhta_technique.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_susp_child_processes.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_susp_execution.yml +74 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_dll.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_embedding.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_install_remote.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_masquerading.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_web_install.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msix_ai_stub_execution.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msohtmed_download.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mspub_download.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msra_process_injection.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_rdp_hijack_shadowing.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_remote_connection.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_run_local_rpd_file_susp_parent.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msxsl_execution.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml +58 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_share_unmount.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_start_service.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_stop_service.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_mount_admin_share.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_mount_share.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_password_plaintext.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_user_add.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_user_add_never_expire.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml +68 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_view_share_and_sessions_enum.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_add_rule.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml +61 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_allow_rdp.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_delete_rule.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_disable.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_set_rule.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_packet_capture.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_port_forwarding_3389.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_nltest_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_nltest_recon.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_node_abuse.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_nslookup_domain_discovery.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_nslookup_poweshell_download.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ntdsutil_usage.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_driver_install_susp.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_exec_susp_locations.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr_susp.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_response_file.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_response_file_susp.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_onenote_embedded_script_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml +125 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_outlook_execution_from_temp.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_spawn_exe_from_users_directory.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_susp_child_processes.yml +135 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_winword_dll_load.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_offlinescannershell_mpclient_sideloading.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml +57 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_php_inline_command_execution.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ping_hex_ip.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pktmon_execution.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_plink_port_forwarding.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_plink_susp_tunneling.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powercfg_execution.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_amsi_null_bits_bypass.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_audio_capture.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_encoded_obfusc.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml +79 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_iex.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml +76 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cl_invocation.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cl_loadassembly.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cl_mutexverifiers.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_console_history_file_access.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_create_service.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_decrypt_pattern.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml +86 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_disable_firewall.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_disable_ie_features.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_downgrade_attack.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_com_cradles.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_cradle_obfuscated.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_dll.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_iex.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_patterns.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_susp_file_sharing_domains.yml +71 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_dsinternals_cmdlets.yml +89 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_email_exfil.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_encode.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_exec_data_file.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_export_certificate.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_frombase64string.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_frombase64string_archive.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_get_localgroup_member_recon.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_getprocess_lsass.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_import_module_susp_dirs.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_invocation_specific.yml +73 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_direct_ip.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_download.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_kerberos_kerberos_ticket_request_via_cli.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml +250 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_msexchange_transport_agent.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_public_folder.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_remove_mppreference.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_reverse_shell_connection.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_run_script_from_ads.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_run_script_from_input_stream.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_sam_access.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_script_engine_parent.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_service_dacl_modification_set_service.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_set_acl.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_set_acl_susp_location.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_set_service_disabled.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_stop_service.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_download_patterns.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml +133 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_parent_process.yml +61 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_uninstall_defender_feature.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml +174 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_zip_compress.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_presentationhost_download.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_presentationhost_uncommon_location_exec.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_print_remote_file_copy.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_protocolhandler_download.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_adfind_execution.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml +66 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_advancedrun.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_chisel.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_cleanwipe.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_crassus.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_csexec.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_defendercheck.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_ditsnap.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_frp.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_iox.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_kdu_driver_tool.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_netcat.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_netscan.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_ngrok.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nimgrab.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nimscan.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nircmd.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nircmd_as_system.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nps.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nsudo.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_pingcastle.yml +185 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml +90 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_process_hacker.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_radmin.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_rclone_execution.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_restic.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_runxcmd.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_seatbelt.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_system_informer.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_trufflehog.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_webbrowserpassview.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_python_adidnsdump.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_python_inline_command_execution.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_python_pty_spawn.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_query_session_exfil.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_quickassist_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rar_compress_data.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rar_compression_with_password.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rar_susp_greedy_compression.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rasdial_execution.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reagentc_disable_windows_recovery_environment.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_add_run_key.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_add_safeboot.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_bitlocker.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_delete_runmru.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_delete_safeboot.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_delete_services.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_direct_asep_registry_keys_modification.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_disable_defender_wmi_autologger.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_enable_windows_recall.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_lsa_ppl_protection_disabled.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_machineguid.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_modify_group_policy_settings.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_nolmhash.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_query_registry.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml +68 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_screensaver.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_software_discovery.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_susp_paths.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_volsnap_disable.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml +72 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_write_protect_for_storage_disabled.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regasm_no_flag_or_dll_execution.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_extension_execution.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_location_execution.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_export_keys.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_import_keys.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_trustedinstaller.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regini_ads.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regini_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_export_of_thirdparty_creds.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_install_reg_debugger_backdoor.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_logon_script.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_new_network_provider.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_office_disable_python_security_warnings.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_privilege_escalation_via_service_key.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_set_unsecure_powershell_policy.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_typed_paths_persistence.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_flags_anomaly.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_network_pattern.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_remote_share.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_1.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_2.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_extensions.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_piped_password_via_cli.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_silent_install.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_susp_exec.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_arguments.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_exec.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_netsupport.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_netsupport_susp_exec.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_renamed_meshagent_execution.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_rurat_non_default_location.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_simple_help.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_ultraviewer.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_time_discovery.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_adfind.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_autohotkey.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_autoit.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_binary.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml +88 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_boinc.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_browsercore.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_cloudflared.yml +88 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_createdump.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_curl.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_dctask64.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_ftp.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_gpg4win.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_jusched.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_mavinject.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_megasync.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_msdt.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_msteams.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_netsupport_rat.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_nircmd.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_office_processes.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_paexec.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_pingcastle.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_plink.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_pressanykey.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_rurat.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_sysinternals_debugview.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_sysinternals_psexec_service.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_vmnat.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_whoami.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_ads_stored_dll_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_inline_vbs.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_installscreensaver.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_keymgr.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_no_params.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_ntlmrelay.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml +58 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_registered_com_objects.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_run_locations.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_shell32_susp_execution.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_shelldispatch_potential_abuse.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_spawn_explorer.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml +107 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_execution_with_image_extension.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_ordinal_execution.yml +68 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_shimcache_flush.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_sys.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_udl_exec.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_unc_path.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_user32_dll.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_webdav_client_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_runonce_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_create_service.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_disable_service.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_new_kernel_driver.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_sdset_modification.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_service_path_modification.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_service_tamper_for_persistence.yml +57 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_stop_service.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_change.yml +74 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_creation.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_creation_temp_folder.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_delete.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_delete_all.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_disable.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_env_folder.yml +78 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_folder_combos.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_one_time_only_midnight_task.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_openssh_tunnelling.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml +69 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_system.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_system_process.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_scrcons_susp_child_process.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sdclt_child_process.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_secedit_execution.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_security_susp_node_js_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_servu_susp_child_process.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_setup16_custom_lst_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_shutdown_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_shutdown_logoff.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sigverif_uncommon_child_process.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sndvol_susp_child_processes.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_soundrecorder_audio_capture.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_speechruntime_child_process.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_splwow64_cli_anomaly.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml +82 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_squirrel_download.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml +70 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ssh_port_forward.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ssh_rdp_tunneling.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_16bit_application.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_add_user_local_admin_group.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_add_user_privileged_group.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop_group.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_always_install_elevated_windows_installer.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_appx_execution.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_automated_collection.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml +60 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_browser_launch_from_document_reader_process.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode_img.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_clickfix_filefix_execution.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_clickfix_filefix_whitespace_padding.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_commandline_path_traversal_evasion.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml +72 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml +62 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_data_exfiltration_via_cli.yml +71 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_disable_raccine.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_double_extension.yml +88 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_double_extension_parent.yml +63 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_download_office_domain.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_dumpstack_log_evasion.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_elavated_msi_spawned_shell.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_electron_app_children.yml +66 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml +61 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml +73 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_embed_exe_lnk.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_1.yml +997 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_2.yml +1014 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml +1020 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_4.yml +765 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml +76 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml +117 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_execution_path.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_file_characteristics.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml +72 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml +77 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_image_missing.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_inline_base64_mz_header.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_inline_node_js_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml +82 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_jwt_token_search.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_lnk_exec_hidden_cmd.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ms_appinstaller_download.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_network_command.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_network_sniffing.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_no_image_name.yml +20 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_non_exe_image.yml +80 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_non_priv_reg_or_ps.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntds.yml +72 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_nteventlogfile_usage.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml +57 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_parents.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_powershell_execution_via_dll.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_priv_escalation_via_named_pipe.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_private_keys_recon.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_privilege_escalation_cli_patterns.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_progname.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_recon.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_recycle_bin_fake_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_registry_modification_of_ms_setting_protocol_handler.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_remote_desktop_tunneling.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml +58 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_script_exec_from_temp.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_service_creation.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_service_dir.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_service_tamper.yml +295 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml +66 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_sysnative.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml +109 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml +103 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_sysvol_access.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_userinit_child.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_velociraptor_child_process.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_whoami_as_param.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_workfolders.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_execution_with_no_cli_flags.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_masqueraded_execution.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_uncommon_parent_process.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_adexplorer_susp_execution.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_eula_accepted.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_livekd_execution.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_procdump.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexec_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexec_paexec_escalate_system.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexec_remote_execution.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexesvc.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psservice.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_pssuspend_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_pssuspend_susp_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_sdelete.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_sysmon_config_update.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_sysmon_uninstall.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml +239 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysprep_appdata.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_systeminfo_execution.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_takeown_recursive_own.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tapinstall_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tar_compression.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tar_extraction.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_taskkill_sep.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_taskmgr_localsystem.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_taskmgr_susp_child_process.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_teams_suspicious_command_line_cred_access.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tpmvscmgr_add_virtual_smartcard.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tscon_localsystem.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tscon_rdp_session_hijacking.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_cleanmgr.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_consent_comctl32.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_dismhost.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_eventvwr_recentviews.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_idiagnostic_profile.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_ieinstal.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_ntfs_reparse_point.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_pkgmgr_dism.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_sdclt.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_winsat.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_wmp.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ultravnc.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ultravnc_susp_execution.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uninstall_crowdstrike_falcon.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vaultcmd_list_creds.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vbscript_registry_modification.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_verclsid_runs_com.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_virtualbox_execution.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml +57 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vsdiagnostics_execution_proxy.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vshadow_exec.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_w32tm.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wab_unusual_parents.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_chopper.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_hacking.yml +101 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml +115 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml +88 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_tool_recon.yml +52 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_werfault_lsass_shtinkering.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_werfaultsecure_abuse.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wget_download_direct_ip.yml +61 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml +95 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wget_download_susp_locations.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_where_browser_data_recon.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_all_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_output.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_priv_discovery.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winget_add_custom_source.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrar_uncommon_folder_execution.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrm_awl_bypass.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrm_remote_powershell_session_process.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrm_susp_child_process.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrs_local_command_execution.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrshost_command_execution.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winzip_password_compression.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmi_password_never_expire.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmi_persistence_script_event_consumer.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_process_creation.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_computersystem.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_csproduct.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_group.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_process.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_product.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_service.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_volume.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_remote_execution.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_service_manipulation.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml +55 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_terminate_application.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_uninstall_application.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml +85 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wpbbin_potential_persistence.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wscript_cscript_dropper.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_kali_linux_installation.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_kali_linux_usage.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_windows_binaries_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wusa_susp_parent_execution.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_xwizard_runwizard_com_object_exec.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/process_tampering/proc_tampering_susp_process_hollowing.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/raw_access_thread/raw_access_thread_susp_disk_access_using_uncommon_tools.yml +71 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml +64 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_defender_context_menu.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_disable_credential_guard.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_enable_windows_recall.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml +97 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_runmru.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_add_local_hidden_user.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_defender_threat_action_modified.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_esentutl_volume_shadow_copy_service_keys.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_hack_wce_reg.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_hybridconnectionmgr_svc_installation.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_mal_azorult.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_modify_screensaver_binary_path.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_office_test_regadd.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_office_trust_record_modification.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_portproxy_registry_key.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_runkey_winekey.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_runonce_persistence.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_stickykey_like_backdoor.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_atbroker_change.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_download_run_key.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_set_enable_anonymous_connection.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml +54 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_add_port_monitor.yml +46 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_aedebug_persistence.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_amsi_com_hijack.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_amsi_disable.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml +59 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml +79 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml +62 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml +181 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml +102 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml +86 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml +119 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bginfo_custom_db.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bginfo_custom_wmi_query.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_change_rdp_port.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_change_security_zones.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_chrome_extension.yml +132 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_cobaltstrike_service_installs.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_comhijack_sdclt.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_crashdump_disabled.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_create_minint_key.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml +53 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_credential_guard_disabled.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_defender_exclusions.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_desktop_background_change.yml +60 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_devdrv_disallow_antivirus_filter.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_administrative_share.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_defender_firewall.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_function_user.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_privacy_settings_experience.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_security_center_notifications.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_system_restore.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_windows_defender_service.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_windows_event_log_access.yml +50 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_windows_firewall.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_winevt_logging.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disabled_microsoft_defender_eventlog.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disabled_pua_protection_on_microsoft_defender.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disabled_tamper_protection_on_microsoft_defender.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disallowrun_execution.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml +48 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dns_server_level_plugin_dll.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dsrm_tampering.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_enable_periodic_backup.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_enable_windows_recall.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_enabling_turnoffcheck.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_evtx_file_key_tamper.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_exploit_guard_susp_allowed_apps.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_fax_change_service_user.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_fax_dll_persistance.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_file_association_exefile.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_filefix_typedpath_commands.yml +65 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hhctrl_persistence.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hidden_extention.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hide_file.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hide_function_user.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hide_scheduled_task_via_index_tamper.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hvci_disallowed_images.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_ime_non_default_extension.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_ime_suspicious_paths.yml +47 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_legalnotice_susp_message.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_lsass_usermode_dumping.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_net_cli_ngenassemblyusagelog.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_netsh_help_dll_persistence_susp_location.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml +37 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_new_application_appcompat.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_new_network_provider.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_odbc_driver_registered.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_odbc_driver_registered_susp.yml +49 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_disable_protected_view_features.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_disable_python_security_warnings.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_enable_dde.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_trust_record_susp_location.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml +45 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_amsi_providers.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_app_paths.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_appx_debugger.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_chm.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_com_hijacking_builtin.yml +85 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_com_key_linking.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_globalflags.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_ie.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_ifilter.yml +71 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_lsa_extension.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_mpnotify.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_mycomputer.yml +22 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_natural_language.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_office_vsto.yml +67 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml +43 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_reflectdebugger.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_scrobj_dll.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_shim_database.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_shim_database_uncommon_location.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_typed_paths.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_xll.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_policies_associations_tamper.yml +38 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_potential_clickfix_execution.yml +75 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_potential_oci_dll_redirection.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_as_service.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_enablescripts_enabled.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_execution_policy.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula.yml +68 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula.yml +39 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_renamed_sysinternals_eula_accepted.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_runmru_susp_command_execution.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_sentinelone_shell_context_tampering.yml +29 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_servicedll_hijack.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_services_etw_tamper.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_set_nopolicies_user.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_sip_persistence.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_sophos_av_tamper.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_special_accounts.yml +35 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_suppress_defender_notifications.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml +34 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_printer_driver.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml +69 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_runmru_space_character.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_service_installed.yml +36 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_shell_open_keys_modification_patterns.yml +42 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml +44 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml +56 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_wfp_filter_added.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_suspicious_env_variables.yml +60 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_taskcache_entry.yml +77 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_telemetry_persistence.yml +51 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml +40 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_terminal_server_tampering.yml +85 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_timeproviders_dllname.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_tls_protocol_old_version_enabled.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_treatas_persistence.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_turn_on_dev_features.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_bypass_winsat.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_bypass_wmp.yml +24 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_disable.yml +30 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_disable_notification.yml +32 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_disable_secure_desktop_prompt.yml +31 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_vbs_payload_stored.yml +41 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_windows_defender_tamper.yml +66 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_winget_enable_local_manifest.yml +23 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_winlogon_notify_key.yml +26 -0
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_config_modification.yml +25 -0
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_config_modification_error.yml +33 -0
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_config_modification_status.yml +27 -0
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_file_block_executable.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_file_block_shredding.yml +20 -0
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_file_executable_detected.yml +21 -0
- package/bundled-rules/sigma-rules/community/windows/wmi_event/sysmon_wmi_event_subscription.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/wmi_event/sysmon_wmi_susp_encoded_scripts.yml +28 -0
- package/bundled-rules/sigma-rules/community/windows/wmi_event/sysmon_wmi_susp_scripting.yml +39 -0
- package/bundled-rules/sigma-rules/custom/account-creation.yml +73 -0
- package/bundled-rules/sigma-rules/custom/admin-panel-access.yml +52 -0
- package/bundled-rules/sigma-rules/custom/anomalous-network.yml +51 -0
- package/bundled-rules/sigma-rules/custom/api-rate-abuse.yml +66 -0
- package/bundled-rules/sigma-rules/custom/brute-force.yml +24 -0
- package/bundled-rules/sigma-rules/custom/cloud-api-abuse.yml +113 -0
- package/bundled-rules/sigma-rules/custom/config-file-access.yml +48 -0
- package/bundled-rules/sigma-rules/custom/container-escape.yml +88 -0
- package/bundled-rules/sigma-rules/custom/credential-dumping.yml +78 -0
- package/bundled-rules/sigma-rules/custom/cron-persistence.yml +66 -0
- package/bundled-rules/sigma-rules/custom/crypto-mining.yml +95 -0
- package/bundled-rules/sigma-rules/custom/data-exfiltration.yml +91 -0
- package/bundled-rules/sigma-rules/custom/directory-traversal.yml +41 -0
- package/bundled-rules/sigma-rules/custom/dns-zone-transfer.yml +43 -0
- package/bundled-rules/sigma-rules/custom/email-exfil.yml +56 -0
- package/bundled-rules/sigma-rules/custom/file-integrity.yml +55 -0
- package/bundled-rules/sigma-rules/custom/file-permission-change.yml +52 -0
- package/bundled-rules/sigma-rules/custom/firewall-disable.yml +52 -0
- package/bundled-rules/sigma-rules/custom/kernel-module-load.yml +74 -0
- package/bundled-rules/sigma-rules/custom/log-tampering.yml +84 -0
- package/bundled-rules/sigma-rules/custom/memory-dump.yml +80 -0
- package/bundled-rules/sigma-rules/custom/mysql-injection.yml +51 -0
- package/bundled-rules/sigma-rules/custom/port-scanning.yml +78 -0
- package/bundled-rules/sigma-rules/custom/privilege-escalation.yml +63 -0
- package/bundled-rules/sigma-rules/custom/process-injection.yml +59 -0
- package/bundled-rules/sigma-rules/custom/ransomware-indicators.yml +78 -0
- package/bundled-rules/sigma-rules/custom/rdp-brute-force.yml +72 -0
- package/bundled-rules/sigma-rules/custom/registry-persistence.yml +43 -0
- package/bundled-rules/sigma-rules/custom/reverse-shell.yml +69 -0
- package/bundled-rules/sigma-rules/custom/scheduled-task-creation.yml +53 -0
- package/bundled-rules/sigma-rules/custom/service-creation.yml +71 -0
- package/bundled-rules/sigma-rules/custom/ssh-key-theft.yml +54 -0
- package/bundled-rules/sigma-rules/custom/ssh-lateral-movement.yml +71 -0
- package/bundled-rules/sigma-rules/custom/supply-chain-attack.yml +94 -0
- package/bundled-rules/sigma-rules/custom/suspicious-dns.yml +79 -0
- package/bundled-rules/sigma-rules/custom/suspicious-download.yml +54 -0
- package/bundled-rules/sigma-rules/custom/suspicious-network-tool.yml +56 -0
- package/bundled-rules/sigma-rules/custom/suspicious-powershell.yml +95 -0
- package/bundled-rules/sigma-rules/custom/suspicious-process.yml +57 -0
- package/bundled-rules/sigma-rules/custom/suspicious-user-agent.yml +46 -0
- package/bundled-rules/sigma-rules/custom/timestomping.yml +50 -0
- package/bundled-rules/sigma-rules/custom/tor-connection.yml +75 -0
- package/bundled-rules/sigma-rules/custom/vpn-anomaly.yml +62 -0
- package/bundled-rules/sigma-rules/custom/web-shell-upload.yml +80 -0
- package/bundled-rules/sigma-rules/custom/xss-attempt.yml +55 -0
- package/bundled-rules/yara-rules/.gitkeep +0 -0
- package/bundled-rules/yara-rules/auto-generated/auth-bypass-panguard_auth_bypass_cisa-kev.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/auth-bypass-panguard_auth_bypass_exploitd.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/auth-bypass-panguard_auth_bypass_github-a.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/code-injection-panguard_code_injection_2701701.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/code-injection-panguard_code_injection_github-a.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/code-injection-panguard_code_injection_nvd:CVE-.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_3456148.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_3584149.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_cisa-kev.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_exploitd.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_github-a.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_nvd:CVE-.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/deserialization-panguard_deserialization_cisa-kev.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/deserialization-panguard_deserialization_github-a.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_cisa-kev.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_exploitd.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_github-a.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_nvd:CVE-.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_3066548.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_3360293.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_3463719.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_cisa-kev.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_exploitd.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_github-a.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_nvd:CVE-.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/path-traversal-panguard_path_traversal_cisa-kev.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/path-traversal-panguard_path_traversal_exploitd.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/path-traversal-panguard_path_traversal_github-a.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_3277276.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_3293803.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_cisa-kev.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_exploitd.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_github-a.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/ssrf-panguard_ssrf_cisa-kev.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/ssrf-panguard_ssrf_exploitd.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/ssrf-panguard_ssrf_github-a.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_3424998.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_3447021.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_cisa-kev.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_exploitd.yar +22 -0
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_github-a.yar +23 -0
- package/bundled-rules/yara-rules/auto-generated/xxe-panguard_xxe_cisa-kev.yar +21 -0
- package/bundled-rules/yara-rules/auto-generated/xxe-panguard_xxe_exploitd.yar +21 -0
- package/bundled-rules/yara-rules/community/VERSION +19 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Autumn_Backdoor.yar +36 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Autumn_Backdoor_Loader.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Confucius_B.yar +28 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Cotx_RAT.yar +56 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/EE_Dropper.yar +30 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/EE_Loader.yar +33 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/NikiCert.yar +26 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/NikiGo.yar +36 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/NikiHTTP.yar +37 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/RokRAT.yar +41 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/RoyalRoad_RTF.yar +28 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/StormDNS.yar +36 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Unk_Mythic_Loader.yar +37 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Andromeda.yar +41 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/ArechClient.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/ArechClient_Campaign_July2021.yar +25 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/AuroraStealer.yar +58 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/AveMaria.yar +31 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/BazarBackdoor.yar +28 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/BazarLoader.yar +32 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/BroEx.yar +50 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/CrunchyRoll.yar +25 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Ganelp.yar +39 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/IcedID.yar +64 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/JSSLoader.yar +37 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Jupyter.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/KeyBase.yar +37 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/LNKR.yar +162 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Monero_Compromise.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/OfflRouter.yar +29 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Oyster.yar +34 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Parallax.yar +32 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Prometei.yar +103 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Pulsar_RAT.yar +29 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/PureZip.yar +26 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/PurpleFox.yar +106 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/RedLine.yar +165 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/RedLine_Campaign_June2021.yar +25 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/SaintBot.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/ShinnyShield.yar +42 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/SystemBC.yar +62 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Unk_BR_Banker.yar +38 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Unk_Crime_Downloader_1.yar +29 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Unk_Crime_Downloader_2.yar +31 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Unk_DesktopLoader.yar +29 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/ZLoader.yar +46 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/AutoIT.yar +60 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Costura_Protobuf.yar +25 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/DotNet_Reactor.yar +38 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/EnigmaStub.yar +30 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Generic_Phishing_PDF.yar +26 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/GrimResource.yar +29 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Hidden.yar +32 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/IEuser_author_doc.yar +25 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/ISO_exec.yar +24 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/LNK_Ruleset.yar +465 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/MalScript_Tricks.yar +25 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/MiniTor.yar +38 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/OLEfile_in_CAD_FAS_LSP.yar +30 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/OneNote_BuildPath.yar +24 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/PyInstaller.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Rclone.yar +31 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Specialist_Repack_Doc.yar +24 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/VMProtectStub.yar +31 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Webshell_in_image.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/WinRAR_ADS_Traversal.yar +31 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/oAuth_Phishing_PDF.yar +26 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Adaptix_Beacon.yar +51 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Adfind.yar +31 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/CreateMiniDump.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/DefenderControl.yar +29 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Extract_MachineKey_SharePoint.yar +51 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/GhostShell_SharePoint.yar +39 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Gmer.yar +28 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Gmer_Driver.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/HiddenVNC.yar +29 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/IISRaid.yar +31 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/IIS_Backdoor.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Impacket.yar +43 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/KPortScan.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/LaZagne.yar +30 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Mythic.yar +165 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/NLBrute.yar +23 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Orca.yar +64 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/PowerTool.yar +33 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/RDPWrap.yar +29 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Responder.yar +39 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/SharpAdidnsdump.yar +39 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/SharpHostInfo.yar +36 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Windows_Credentials_Editor.yar +46 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Avaddon.yar +36 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/BlackKingDom.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/CryLock.yar +33 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Darkside.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/DearCry.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Ekans.yar +28 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Fusion.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Maze.yar +40 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Pysa.yar +30 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/REvil_Cert.yar +26 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/REvil_Dropper.yar +41 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/RagnarLocker.yar +27 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Satan_Mutexes.yar +34 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Sfile.yar +42 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Warlock.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/WhiteBlack.yar +26 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/WickrMe.yar +35 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/WinLock.yar +38 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/XiaoBa.yar +28 -0
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Zeppelin.yar +33 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara +89 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32svc_Exe_v1_49_to_v4_x.yara +77 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara +128 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara +1665 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bind64_Bin_v2_5_through_v4_x.yara +109 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bind_Bin_v2_5_through_v4_x.yara +111 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_Dll_v4_0_to_v4_x.yara +60 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_x64_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_x64_Dll_v4_0_to_v4_x.yara +64 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_Dll_v1_49_to_v3_14_and_Sleeve_Bypassuac_Dll_v4_0_to_v4_x.yara +94 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_x64_Dll_v3_3_to_v3_14_and_Sleeve_Bypassuac_x64_Dll_v4_0_and_v4_x.yara +86 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_Dll_v3_11_to_v3_14.yara +151 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14.yara +118 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x.yara +33 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_Dll_v2_1_to_v4_x.yara +120 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49.yara +116 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Dnsstager_Bin_v1_47_through_v4_x.yara +78 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_Dll_v4_x.yara +68 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_X64_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_X64_Dll_v4_x.yara +71 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager64_Bin_v3_2_through_v4_x.yara +90 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager_Bin_v2_5_through_v4_x.yara +95 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager64_Bin_v3_2_through_v4_x.yara +85 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager_Bin_v2_5_through_v4_x.yara +93 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Reverse64_Bin_v2_5_through_v4_x.yara +99 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Reverse_Bin_v2_5_through_v4_x.yara +104 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Smbstager_Bin_v2_5_through_v4_x.yara +95 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_Py_v3_3_to_v4_x.yara +36 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_Sct_v3_3_to_v4_x.yara +38 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_Vbs_v3_3_to_v4_x.yara +41 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template__x32_x64_Ps1_v1_45_to_v2_5_and_v3_11_to_v3_14.yara +43 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13.yara +37 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_x86_Vba_v3_8_to_v4_x.yara +37 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__32bit_v2_x_to_4_x.yara +38 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__64bit_v3_12_to_4_x.yara +39 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara +555 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/Sliver/Sliver__Implant_32bit.yara +81 -0
- package/bundled-rules/yara-rules/community/chronicle/YARA/Sliver/Sliver__Implant_64bit.yara +84 -0
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_knownbad_certs.yar +9004 -0
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_knownbad_id.yar +1739 -0
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_office.yar +953 -0
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_packed.yar +804 -0
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_rmm.yar +580 -0
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_suspicious.yar +2633 -0
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_tools.yar +1908 -0
- package/bundled-rules/yara-rules/community/ditekshen/yara/malware.yar +11957 -0
- package/bundled-rules/yara-rules/community/eset/animalfarm/animalfarm.yar +96 -0
- package/bundled-rules/yara-rules/community/eset/badiis/badiis.yar +552 -0
- package/bundled-rules/yara-rules/community/eset/groundbait/prikormka.yar +141 -0
- package/bundled-rules/yara-rules/community/eset/invisimole/invisimole.yar +297 -0
- package/bundled-rules/yara-rules/community/eset/keydnap/keydnap.yar +86 -0
- package/bundled-rules/yara-rules/community/eset/kobalos/kobalos.yar +73 -0
- package/bundled-rules/yara-rules/community/eset/moose/linux-moose.yar +110 -0
- package/bundled-rules/yara-rules/community/eset/mozi/mozi.yar +51 -0
- package/bundled-rules/yara-rules/community/eset/mumblehard/mumblehard_packer.yar +47 -0
- package/bundled-rules/yara-rules/community/eset/nukesped_lazarus/rich_headers_IconicPayloads_3CX.yar +23 -0
- package/bundled-rules/yara-rules/community/eset/potao/PotaoNew.yara +108 -0
- package/bundled-rules/yara-rules/community/eset/rakos/rakos.yar +53 -0
- package/bundled-rules/yara-rules/community/eset/redline/redline.yar +172 -0
- package/bundled-rules/yara-rules/community/eset/sparklinggoblin/SparklingGoblin.yar +489 -0
- package/bundled-rules/yara-rules/community/eset/sshdoor/sshdoor.yar +572 -0
- package/bundled-rules/yara-rules/community/eset/stantinko/stantinko.yar +255 -0
- package/bundled-rules/yara-rules/community/eset/ta410/ta410.yar +741 -0
- package/bundled-rules/yara-rules/community/eset/turla/carbon.yar +69 -0
- package/bundled-rules/yara-rules/community/eset/turla/gazer.yar +85 -0
- package/bundled-rules/yara-rules/community/eset/turla/turla-outlook.yar +169 -0
- package/bundled-rules/yara-rules/community/eset/windigo/ebury.yar +97 -0
- package/bundled-rules/yara-rules/community/eset/windigo/helimod.yar +105 -0
- package/bundled-rules/yara-rules/community/eset/windigo/windigo-onimiki.yar +59 -0
- package/bundled-rules/yara-rules/community/eset/winnti_group/skip20_sqllang_hook.yar +69 -0
- package/bundled-rules/yara-rules/community/intezer/APT15.yar +48 -0
- package/bundled-rules/yara-rules/community/intezer/AgeLocker.yar +19 -0
- package/bundled-rules/yara-rules/community/intezer/ChinaZ_Managers.yar +60 -0
- package/bundled-rules/yara-rules/community/intezer/DarkComet.yar +262 -0
- package/bundled-rules/yara-rules/community/intezer/Doki_Attack.yar +17 -0
- package/bundled-rules/yara-rules/community/intezer/EvilGnome.yar +49 -0
- package/bundled-rules/yara-rules/community/intezer/Gh0stRAT.yar +37 -0
- package/bundled-rules/yara-rules/community/intezer/GreedyAntd.yar +13 -0
- package/bundled-rules/yara-rules/community/intezer/HiddenWasp.yar +44 -0
- package/bundled-rules/yara-rules/community/intezer/IPStorm.yar +18 -0
- package/bundled-rules/yara-rules/community/intezer/Iranian_Wipers.yar +111 -0
- package/bundled-rules/yara-rules/community/intezer/Lazarus_2020.yar +32 -0
- package/bundled-rules/yara-rules/community/intezer/NexePirateSteal.yar +13 -0
- package/bundled-rules/yara-rules/community/intezer/QNAPCrypt.yar +19 -0
- package/bundled-rules/yara-rules/community/intezer/RedDelta.yar +59 -0
- package/bundled-rules/yara-rules/community/intezer/Rekoobe.yar +16 -0
- package/bundled-rules/yara-rules/community/intezer/RussianAPT.yar +7634 -0
- package/bundled-rules/yara-rules/community/intezer/Trickbot.yar +184 -0
- package/bundled-rules/yara-rules/community/intezer/WatchBog.yar +25 -0
- package/bundled-rules/yara-rules/community/intezer/xe_group.yar +168 -0
- package/bundled-rules/yara-rules/community/jpcert/APT10/apt10.yara +254 -0
- package/bundled-rules/yara-rules/community/jpcert/APT29/apt29.yara +87 -0
- package/bundled-rules/yara-rules/community/jpcert/BlackTech/blacktech.yara +458 -0
- package/bundled-rules/yara-rules/community/jpcert/Darkhotel/darkhotel.yara +88 -0
- package/bundled-rules/yara-rules/community/jpcert/DragonOK/dragonok.yara +28 -0
- package/bundled-rules/yara-rules/community/jpcert/Kimsuky/Kimsuky.yara +73 -0
- package/bundled-rules/yara-rules/community/jpcert/Lazarus/applejeus.yara +34 -0
- package/bundled-rules/yara-rules/community/jpcert/Lazarus/contagiousinterview.yara +34 -0
- package/bundled-rules/yara-rules/community/jpcert/Lazarus/crypthunter.yara +349 -0
- package/bundled-rules/yara-rules/community/jpcert/Lazarus/lazarus.yara +705 -0
- package/bundled-rules/yara-rules/community/jpcert/Tick/tick.yara +323 -0
- package/bundled-rules/yara-rules/community/jpcert/other/3proxy.yara +15 -0
- package/bundled-rules/yara-rules/community/jpcert/other/IcedID.yara +20 -0
- package/bundled-rules/yara-rules/community/jpcert/other/MedusaLocker.yara +17 -0
- package/bundled-rules/yara-rules/community/jpcert/other/Remcos.yara +16 -0
- package/bundled-rules/yara-rules/community/jpcert/other/RestyLink.yara +107 -0
- package/bundled-rules/yara-rules/community/jpcert/other/StealthWorker.yara +14 -0
- package/bundled-rules/yara-rules/community/jpcert/other/TokyoX.yara +28 -0
- package/bundled-rules/yara-rules/community/jpcert/other/Voldemort.yara +50 -0
- package/bundled-rules/yara-rules/community/jpcert/other/adminer.yara +19 -0
- package/bundled-rules/yara-rules/community/jpcert/other/agenttesla.yara +33 -0
- package/bundled-rules/yara-rules/community/jpcert/other/antiupx.yara +45 -0
- package/bundled-rules/yara-rules/community/jpcert/other/ares.yara +25 -0
- package/bundled-rules/yara-rules/community/jpcert/other/asyncrat.yara +20 -0
- package/bundled-rules/yara-rules/community/jpcert/other/azorult.yara +15 -0
- package/bundled-rules/yara-rules/community/jpcert/other/b374k.yara +18 -0
- package/bundled-rules/yara-rules/community/jpcert/other/bebloh.yara +16 -0
- package/bundled-rules/yara-rules/community/jpcert/other/brc4.yara +19 -0
- package/bundled-rules/yara-rules/community/jpcert/other/cobaltstrike.yara +33 -0
- package/bundled-rules/yara-rules/community/jpcert/other/cve202120837.yara +33 -0
- package/bundled-rules/yara-rules/community/jpcert/other/darkcloud.yara +18 -0
- package/bundled-rules/yara-rules/community/jpcert/other/donut.yara +20 -0
- package/bundled-rules/yara-rules/community/jpcert/other/doplugs.yara +55 -0
- package/bundled-rules/yara-rules/community/jpcert/other/doraemon.yara +32 -0
- package/bundled-rules/yara-rules/community/jpcert/other/dtsft.yara +53 -0
- package/bundled-rules/yara-rules/community/jpcert/other/emotet.yara +18 -0
- package/bundled-rules/yara-rules/community/jpcert/other/filesman.yara +27 -0
- package/bundled-rules/yara-rules/community/jpcert/other/flubot.yara +18 -0
- package/bundled-rules/yara-rules/community/jpcert/other/formbook.yara +15 -0
- package/bundled-rules/yara-rules/community/jpcert/other/foxwso.yara +14 -0
- package/bundled-rules/yara-rules/community/jpcert/other/getrdoor.yara +19 -0
- package/bundled-rules/yara-rules/community/jpcert/other/gobrat.yara +185 -0
- package/bundled-rules/yara-rules/community/jpcert/other/hawkeye.yara +15 -0
- package/bundled-rules/yara-rules/community/jpcert/other/huiloader.yara +25 -0
- package/bundled-rules/yara-rules/community/jpcert/other/inetget.yara +30 -0
- package/bundled-rules/yara-rules/community/jpcert/other/ivanti_connect_secure.yara +16 -0
- package/bundled-rules/yara-rules/community/jpcert/other/lodeinfo.yara +558 -0
- package/bundled-rules/yara-rules/community/jpcert/other/lokibot.yara +16 -0
- package/bundled-rules/yara-rules/community/jpcert/other/machOdownloader.yara +47 -0
- package/bundled-rules/yara-rules/community/jpcert/other/maldocinpdf.yara +20 -0
- package/bundled-rules/yara-rules/community/jpcert/other/nanocore.yara +15 -0
- package/bundled-rules/yara-rules/community/jpcert/other/netwire.yara +18 -0
- package/bundled-rules/yara-rules/community/jpcert/other/nimfilecoder.yara +51 -0
- package/bundled-rules/yara-rules/community/jpcert/other/njrat.yara +14 -0
- package/bundled-rules/yara-rules/community/jpcert/other/noderat.yara +15 -0
- package/bundled-rules/yara-rules/community/jpcert/other/pangolin8rat.yara +95 -0
- package/bundled-rules/yara-rules/community/jpcert/other/phpfilemanager.yara +16 -0
- package/bundled-rules/yara-rules/community/jpcert/other/phpmal.yara +71 -0
- package/bundled-rules/yara-rules/community/jpcert/other/plugx.yara +25 -0
- package/bundled-rules/yara-rules/community/jpcert/other/poisonivy.yara +15 -0
- package/bundled-rules/yara-rules/community/jpcert/other/poohlydown.yara +13 -0
- package/bundled-rules/yara-rules/community/jpcert/other/pskiller_sys.yara +130 -0
- package/bundled-rules/yara-rules/community/jpcert/other/pulsesecure.yara +31 -0
- package/bundled-rules/yara-rules/community/jpcert/other/qbot.yara +21 -0
- package/bundled-rules/yara-rules/community/jpcert/other/quasar.yara +21 -0
- package/bundled-rules/yara-rules/community/jpcert/other/seaspy.yara +28 -0
- package/bundled-rules/yara-rules/community/jpcert/other/shellcode.yara +124 -0
- package/bundled-rules/yara-rules/community/jpcert/other/smokeloader.yara +15 -0
- package/bundled-rules/yara-rules/community/jpcert/other/spygrace.yara +35 -0
- package/bundled-rules/yara-rules/community/jpcert/other/sqroot.yara +206 -0
- package/bundled-rules/yara-rules/community/jpcert/other/stealc.yara +32 -0
- package/bundled-rules/yara-rules/community/jpcert/other/steelclover.yara +36 -0
- package/bundled-rules/yara-rules/community/jpcert/other/stonemite.yara +16 -0
- package/bundled-rules/yara-rules/community/jpcert/other/sysrvbot.yara +61 -0
- package/bundled-rules/yara-rules/community/jpcert/other/tool.yara +22 -0
- package/bundled-rules/yara-rules/community/jpcert/other/ursnif.yara +32 -0
- package/bundled-rules/yara-rules/community/jpcert/other/vboxuserrat.yara +51 -0
- package/bundled-rules/yara-rules/community/jpcert/other/veletrix.yara +43 -0
- package/bundled-rules/yara-rules/community/jpcert/other/waterpamola.yara +131 -0
- package/bundled-rules/yara-rules/community/jpcert/other/webrcs.yara +47 -0
- package/bundled-rules/yara-rules/community/jpcert/other/webview2loader.yara +32 -0
- package/bundled-rules/yara-rules/community/jpcert/other/windealer.yara +42 -0
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/other/yara-rules_mal_drivers_strict.yar +855 -0
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/other/yara-rules_vuln_drivers.yar +12131 -0
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/other/yara-rules_vuln_drivers_strict_renamed.yar +12131 -0
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/yara-rules_mal_drivers.yar +855 -0
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/yara-rules_vuln_drivers_strict.yar +12131 -0
- package/bundled-rules/yara-rules/community/mandiant/all-yara.yar +2947 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_2.yar +23 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_2.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/ALLTHETHINGS/production/yara/Loader_MSIL_AllTheThings_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/BASICPIPESHELL/production/yara/APT_Backdoor_PS1_BASICPIPESHELL_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/BEACON/supplemental/yara/Loader_Win_Generic_17.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/BEACON/supplemental/yara/Loader_Win_Generic_18.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/BEACON/supplemental/yara/Trojan_Raw_Generic_4.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/BEACON/supplemental/yara/Trojan_Win_Generic_101.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_1.yar +25 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_2.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/COREHOUND/production/yara/HackTool_MSIL_CoreHound_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Backdoor_Win_DShell_1.yar +191 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Backdoor_Win_DShell_3.yar +90 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_1.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_2.yar +21 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_3.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/supplemental/yara/APT_Backdoor_Win_DShell_2.yar +132 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DTRIM/production/yara/APT_HackTool_MSIL_DTRIM_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/HackTool_MSIL_HOLSTER_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_2.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_3.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/MSIL_Launcher_DUEDLLIGENCE_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_1.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_2.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_2.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_22.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_23.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_2.yar +21 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/G2JS/production/yara/Builder_MSIL_G2JS_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/G2JS/production/yara/Hunting_B64Engine_DotNetToJScript_Dos.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/G2JS/production/yara/Hunting_DotNetToJScript_Functions.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/G2JS/production/yara/Hunting_GadgetToJScript_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/GETDOMAINPASSWORDPOLICY/production/yara/HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/GPOHUNT/production/yara/APT_HackTool_MSIL_GPOHUNT_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/IMPACKETOBF (Smbexec)/production/yara/HackTool_PY_ImpacketObfuscation_1.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/IMPACKETOBF (Wmiexec)/production/yara/HackTool_PY_ImpacketObfuscation_2.yar +21 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/INVEIGHZERO/production/yara/HackTool_MSIL_INVEIGHZERO_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/JUSTASK/production/yara/APT_HackTool_MSIL_JUSTASK_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/KEEFARCE/production/yara/HackTool_MSIL_KeeFarce_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/KEEPERSIST/production/yara/HackTool_MSIL_KeePersist_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/LNKSMASHER/production/yara/Dropper_LNK_LNKSmasher_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/LNKSMASHER/supplemental/yara/Hunting_LNK_Win_GenericLauncher.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/LUALOADER/production/yara/APT_HackTool_MSIL_LUALOADER_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_2.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Builder_PY_MATRYOSHKA_1.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Builder_Win64_MATRYOSHKA_1.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Dropper_Win64_MATRYOSHKA_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Dropper_Win_MATRYOSHKA_1.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_1.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_2.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Loader_Win_MATRYOSHKA_1.yar +24 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/MEMCOMP/production/yara/Loader_MSIL_InMemoryCompilation_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/NETASSEMBLYINJECT/production/yara/Loader_MSIL_NETAssemblyInject_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/NETSHSHELLCODERUNNER/production/yara/Loader_MSIL_NetshShellCodeRunner_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/NOAMCI/production/yara/APT_HackTool_MSIL_NOAMCI_1.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_MSIL_PGF_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_MSIL_PGF_2.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_1.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_2.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_3.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_4.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_5.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_1.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_2.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_3.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_4.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_5.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win_PGF_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win_PGF_2.yar +21 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PREPSHELLCODE/production/yara/HackTool_MSIL_PrepShellcode_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PUPPYHOUND/production/yara/HackTool_MSIL_PuppyHound_1.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PUPPYHOUND/production/yara/HackTool_MSIL_SharpHound_3.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_2.yar +27 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_1.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_2.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Controller_Linux_REDFLARE_1.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Downloader_Win32_REDFLARE_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Downloader_Win64_REDFLARE_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Keylogger_Win32_REDFLARE_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Keylogger_Win64_REDFLARE_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Raw32_REDFLARE_1.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Raw64_REDFLARE_1.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_2.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_1.yar +17 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_2.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_1.yar +21 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_2.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_3.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_4.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_5.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_7.yar +21 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_8.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/supplemental/yara/APT_Trojan_Linux_REDFLARE_1.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/supplemental/yara/APT_Trojan_Win_REDFLARE_6.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_MacOS_GORAT_1.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_1.yar +23 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_2.yar +34 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_3.yar +39 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_4.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_5.yar +23 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GoRat_Memory.yar +27 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Module_PowerShell_1.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Plugin_DOTNET_1.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/RESUMEPLEASE/production/yara/Trojan_Macro_RESUMEPLEASE_1.yar +21 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REVOLVER/production/yara/APT_HackTool_MSIL_REVOLVER_1.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/REVOLVER/production/yara/APT_Loader_MSIL_REVOLVER_1.yar +14 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/RUBEUS/production/yara/HackTool_MSIL_Rubeus_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SAFETYKATZ/production/yara/HackTool_MSIL_SAFETYKATZ_4.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_2.yar +23 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPGENERATOR/production/yara/Builder_MSIL_SharpGenerator_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_2.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_3.yar +31 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_4.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPPGREP/production/yara/Tool_MSIL_SharpGrep_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSACK/production/yara/APT_HackTool_MSIL_SHARPSACK_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSCHTASK/production/yara/HackTool_MSIL_SharpSchtask_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSECTIONINJECTION/production/yara/Loader_MSIL_CSharpSectionInjection_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_1.yar +24 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_2.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSTOMP/production/yara/HackTool_MSIL_SharpStomp_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPUTILS/production/yara/Tool_MSIL_CSharpUtils_1.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPY/production/yara/Loader_MSIL_SharPy_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPZEROLOGON/production/yara/HackTool_MSIL_SHARPZEROLOGON_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SINFULOFFICE/production/yara/Builder_MSIL_SinfulOffice_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/SINFULOFFICE/supplemental/yara/Methodology_OLE_CHARENCODING_2.yar +23 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/APT_HackTool_MSIL_TITOSPECIAL_1.yar +20 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_1.yar +27 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_2.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/HackTool_Win32_AndrewSpecial_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/HackTool_Win64_AndrewSpecial_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_1.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_2.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_1.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_2.yar +22 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/production/yara/Loader_MSIL_RuralBishop_3.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/production/yara/Loader_MSIL_TrimBishop_1.yar +26 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_DNSOVERHTTPS_C2_1.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_PRAT_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_REDTEAMMATERIALS_1.yar +16 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDACL_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDNS_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPGOPHER_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNATIVEZIPPER_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNFS_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPPATCHCHECK_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPSQLCLIENT_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPTEMPLATE_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPWEBCRAWLER_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_CredSnatcher_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_WCMDump_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/supplemental/yara/Loader_MSIL_Generic_1.yar +21 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_19.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_20.yar +19 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/WILDCHILD/production/yara/APT_Loader_MSIL_WILDCHILD_1.yar +18 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/WILDCHILD/production/yara/Dropper_HTA_WildChild_1.yar +24 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/WILDCHILD/production/yara/Loader_MSIL_WildChild_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/WMIRUNNER/production/yara/Loader_MSIL_WMIRunner_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/WMISHARP/production/yara/HackTool_MSIL_WMISharp_1.yar +15 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/WMISPY/production/yara/APT_HackTool_MSIL_WMISPY_2.yar +24 -0
- package/bundled-rules/yara-rules/community/mandiant/rules/WMISPY/production/yara/HackTool_MSIL_WMIspy_1.yar +15 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara +128 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara +149 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara +91 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara +169 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.NjRAT.yara +266 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.OrcusRAT.yara +134 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.ResolverRAT.yara +94 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.Veaty.yara +84 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.AutoColor.yara +177 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.BPFDoor.yara +326 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.ChaosRAT.yara +270 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.GTPDOOR.yara +264 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.GobRAT.yara +168 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.Krasue.yara +127 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.Linodas.yara +216 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.NoodRAT.yara +162 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.PondRAT.yara +99 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.PygmyGoat.yara +135 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.Sshdinjector.yara +197 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.WolfsBane.yara +124 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Trojan.ChinaZ.yara +246 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win32.Backdoor.Konni.yara +190 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.BackConnect.yara +154 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.EggStremeFuel.yara +144 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.Konni.yara +205 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.Minodo.yara +110 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.MiyaRAT.yara +264 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.SideTwist.yara +154 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.Voldemort.yara +208 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.wmRAT.yara +144 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/certificate/blocklist.yara +17288 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/downloader/Win32.Downloader.dlMarlboro.yara +79 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/exploit/Win32.Exploit.CVE20200601.yara +253 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/ByteCode.MSIL.Infostealer.GomorrahStealer.yara +111 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win32.Infostealer.LumarStealer.yara +190 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win32.Infostealer.MultigrainPOS.yara +88 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win32.Infostealer.ProjectHookPOS.yara +98 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win32.Infostealer.StealC.yara +57 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win64.Infostealer.Daolpu.yara +322 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win64.Infostealer.Skuld.yara +192 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win64.Infostealer.WeaselStore.yara +198 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/pua/Win32.PUA.Domaiq.yara +169 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Apis.yara +75 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara +90 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Cring.yara +66 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara +73 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.EAF.yara +89 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara +74 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara +97 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara +69 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara +61 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara +89 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara +96 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Hog.yara +70 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Invert.yara +66 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara +96 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara +68 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara +75 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara +86 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara +81 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Oct.yara +68 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara +68 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara +79 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara +64 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Retis.yara +74 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara +96 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara +106 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara +69 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara +75 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Venom.yara +68 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara +77 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara +69 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara +70 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara +59 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.GwisinLocker.yara +354 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.Helldown.yara +127 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.KillDisk.yara +144 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.LuckyJoe.yara +146 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.RedAlert.yara +146 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.5ss5c.yara +267 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.ASN1Encoder.yara +136 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Acepy.yara +69 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Afrodita.yara +119 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ako.yara +152 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Alcatraz.yara +91 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.AnteFrigus.yara +210 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Archiveus.yara +50 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Armage.yara +128 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Atlas.yara +99 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Avaddon.yara +148 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.AvosLocker.yara +108 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BKRansomware.yara +79 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Babuk.yara +117 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BadBlock.yara +100 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Badbeeteam.yara +137 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Balaclava.yara +113 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Bam2021.yara +167 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BananaCrypt.yara +103 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BandarChor.yara +97 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BitCrypt.yara +112 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BlackBasta.yara +531 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BlackCat.yara +109 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BlackMoon.yara +70 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Blitzkrieg.yara +127 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BlueLocker.yara +130 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BrainCrypt.yara +121 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Buran.yara +91 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.ChiChi.yara +66 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Cicada3301.yara +309 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Cincoo.yara +78 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Clop.yara +109 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Conti.yara +74 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Cryakl.yara +64 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Crypmic.yara +56 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Crypren.yara +144 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoBit.yara +113 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoFortress.yara +162 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoJoker.yara +140 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoLocker.yara +154 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoWall.yara +312 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Crysis.yara +108 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Cuba.yara +126 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CyberVolk.yara +293 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DMALocker.yara +149 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DMR.yara +214 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DarkSide.yara +94 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DearCry.yara +96 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Defray.yara +157 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Delphimorix.yara +67 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DenizKizi.yara +88 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DesuCrypt.yara +93 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Dharma.yara +108 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DirtyDecrypt.yara +112 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.District.yara +194 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DogeCrypt.yara +114 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Dragon.yara +149 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Dualshot.yara +112 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Elpaco.yara +316 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Encoded01.yara +141 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Erica.yara +76 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FCT.yara +86 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FLKR.yara +71 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FarAttack.yara +93 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FenixLocker.yara +143 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ferrlock.yara +131 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Flamingo.yara +54 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FuxSocy.yara +114 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GPGQwerty.yara +83 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GandCrab.yara +892 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GarrantyDecrypt.yara +79 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Gibon.yara +122 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GlobeImposter.yara +171 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Gomer.yara +106 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Good.yara +82 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Gpcode.yara +67 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GusCrypter.yara +129 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HDDCryptor.yara +157 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HDMR.yara +161 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HakunaMatata.yara +373 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Henry.yara +80 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HentaiOniichan.yara +140 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Hermes.yara +284 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Horsedeal.yara +106 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HowAreYou.yara +205 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HydraCrypt.yara +174 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.IFN643.yara +90 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.InfoDot.yara +115 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.JSWorm.yara +93 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Jamper.yara +110 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Jemd.yara +105 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Jormungand.yara +135 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.JuicyLemon.yara +116 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Kangaroo.yara +91 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.KawaiiLocker.yara +135 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.KillDisk.yara +80 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Knot.yara +118 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Kovter.yara +141 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Koxic.yara +87 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Kraken.yara +151 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ladon.yara +101 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.LeChiffre.yara +123 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.LockBit.yara +282 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Lolkek.yara +106 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.LooCipher.yara +87 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Lorenz.yara +252 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MRAC.yara +69 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MZP.yara +147 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Mafia.yara +142 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Magniber.yara +114 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Major.yara +261 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Makop.yara +99 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Maktub.yara +116 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Marlboro.yara +117 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MarsJoke.yara +157 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Matsnu.yara +116 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MedusaLocker.yara +174 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Meow.yara +84 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Monalisa.yara +83 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Montserrat.yara +118 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Motocos.yara +75 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MountLocker.yara +86 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.NB65.yara +68 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.NanoLocker.yara +79 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Nefilim.yara +150 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Nemty.yara +205 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Networm.yara +103 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.NotPetya.yara +73 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Oni.yara +82 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.OphionLocker.yara +105 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ouroboros.yara +175 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Outsider.yara +88 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.PXJ.yara +158 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Paradise.yara +81 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Pay2Key.yara +99 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Petya.yara +58 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Plague17.yara +263 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.PrincessLocker.yara +92 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Prometey.yara +156 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.RagnarLocker.yara +108 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ragnarok.yara +110 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ransoc.yara +114 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.RansomPlus.yara +95 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ransomexx.yara +147 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Redeemer.yara +105 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.RegretLocker.yara +206 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.RetMyData.yara +79 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Reveton.yara +118 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Revil.yara +101 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Rokku.yara +147 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ryuk.yara +199 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sage.yara +77 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sanwai.yara +71 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sarbloh.yara +88 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Satan.yara +152 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Satana.yara +123 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Saturn.yara +105 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sepsis.yara +126 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Serpent.yara +122 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.SevenSevenSeven.yara +148 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.ShadowCryptor.yara +89 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sherminator.yara +157 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sifrelendi.yara +67 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sifreli.yara +119 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sigrun.yara +111 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Skystars.yara +97 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Spora.yara +124 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TBLocker.yara +85 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TargetCompany.yara +141 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TechandStrat.yara +106 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TeleCrypt.yara +109 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Termite.yara +151 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Teslacrypt.yara +665 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Teslarvng.yara +137 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Thanatos.yara +85 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TorrentLocker.yara +98 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.VHDLocker.yara +152 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.VanHelsing.yara +464 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.VegaLocker.yara +100 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Velso.yara +230 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.WannaCry.yara +135 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.WaspLocker.yara +76 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Wastedlocker.yara +86 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.WinWord64.yara +215 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.WsIR.yara +73 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Xorist.yara +150 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Zeoticus.yara +90 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Zeppelin.yara +109 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.ZeroCrypt.yara +94 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Zhen.yara +176 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Zoldon.yara +107 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Ako.yara +173 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Albabat.yara +139 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.AntiWar.yara +146 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.AwesomeScott.yara +101 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.BlackBasta.yara +293 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Cactus.yara +190 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Curator.yara +94 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.DST.yara +170 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.HermeticRansom.yara +105 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.HotCoffee.yara +111 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Nokoyawa.yara +104 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Pandora.yara +95 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.RedRoman.yara +82 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Rook.yara +122 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.SeedLocker.yara +91 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Seth.yara +122 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Solaso.yara +171 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Vovalex.yara +81 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Warlock.yara +162 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara +91 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Wintenzz.yara +83 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/rootkit/Linux.Rootkit.Pumakit.yara +161 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Linux.Trojan.AcidRain.yara +67 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Linux.Trojan.BiBiWiper.yara +76 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.BiBiWiper.yara +102 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.CaddyWiper.yara +95 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.Dridex.yara +80 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.Emotet.yara +182 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.HermeticWiper.yara +50 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.IsaacWiper.yara +76 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.PathWiper.yara +280 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.TrickBot.yara +46 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Linux.Virus.Vit.yara +36 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Awfull.yara +33 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Cmay.yara +73 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.DeadCode.yara +76 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Elerad.yara +33 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Greenp.yara +46 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Mocket.yara +58 -0
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Negt.yara +94 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_Derusbi.yar +248 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_KimSuky_dllbckdr.yar +50 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_MiniASP_pdb.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_Operation_SoftCell.yar +308 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_Tortoiseshell_Syskit.yar +40 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_Troj_HermWiper.yar +27 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_acidbox.yar +98 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_auriga_biscuit.yar +39 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_babar_pdb.yar +35 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_blackenergy_pdb.yar +38 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_decade_of_RATs.yar +221 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_elise_pdb.yar +29 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_gdocupload_pdb.yar +32 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_hangover.yar +229 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_hikit_rootkit_pdb.yar +28 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_karkoff_dnspionaje.yar +30 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_lagulon_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_manitsme_trojan_pdb.yar +36 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_milum_wildpressure.yar +29 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_mirage_pdb.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_operation_aurora.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_operation_skeleton.yar +33 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_operation_troy.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_turla_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/APT/APT_winnti.yar +27 -0
- package/bundled-rules/yara-rules/community/trellix/APT/enfal_pdb.yar +29 -0
- package/bundled-rules/yara-rules/community/trellix/APT/flamer_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/APT/gauss_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/APT/ixeshe_bled_pdb.yar +24 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALDOC_rtf_bluetea_builder.yar +31 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_Eicar.yar +22 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_MsWordExploit_DOC.yar +24 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_NionSpy.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_Rovnix.yar +38 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_Shifu.yar +24 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_VPNfilter.yar +41 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_alina_pos_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_backdoor_havex_pdb.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_backdoor_kankan_pdb.yar +27 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_backdoor_katorxa_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_blackpos_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_browser_fox_adware.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_chickdos_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_cobaltstrike.yar +38 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_cutwail.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_downloader_darkmegi.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_dridex_p2p_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_dropper_demekaf_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_emotet.yar +32 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_festi_botnet_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_fritzfrog.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_inabot_worm_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_jatboss.yar +36 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_kelhios_botnet_pdb.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_likseput_backdoor_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_liquorbot.yar +23 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_mangzamel_trojan_pdb.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_masslogger_stealer.yar +63 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_medfos_pdb.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_redline.yar +38 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_rietspoof_loader.yar +22 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_screenlocker_5h311_1nj3c706.yar +33 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_shellcode_mykins_botnet.yar +27 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_vbs_mykins_botnet.yar +29 -0
- package/bundled-rules/yara-rules/community/trellix/malware/MAL_cyax_sharp_loader.yar +16 -0
- package/bundled-rules/yara-rules/community/trellix/miners/MINER_Monero.yar +44 -0
- package/bundled-rules/yara-rules/community/trellix/miners/Trojan_CoinMiner.yar +23 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Anatova.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Avoslocker.yar +27 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_BabukLocker_Jan2021.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Babuk_Packed_Feb2021.yar +30 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_BadRabbit.yar +101 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Bitpaymer.yar +72 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Buran.yar +27 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_CTBLocker.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_ClopRansomNote.yar +34 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_CryptoNar.yar +36 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Cryptolocker.yar +81 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Darkside.yar +47 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Exorcist.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_GPGQwerty.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Kraken.yar +108 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Linux_HelloKitty0721.yar +28 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Lockbit2.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_LockerGoga.yar +36 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Loocipher.yar +46 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_MONGOLOCK.yar +42 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_MegaCortex.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_NEFILIM.yar +98 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Nemty.yar +80 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Pico.yar +37 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_PureLocker.yar +25 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_RobbinHood.yar +38 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Ryuk.yar +113 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_SamSam.yar +105 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Shiva.yar +37 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Sodinokibi.yar +53 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Suncrypt.yar +50 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_acroware.yar +29 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_amba.yar +41 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_coronavirus.yar +80 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_egregor.yar +31 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_jeff_dev.yar +28 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_locdoor.yar +32 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_makop.yar +32 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_mountlocker.yar +32 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_netwalker.yar +140 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_ragnarlocker.yar +45 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_shrug2.yar +30 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_snake_ransomware.yar +26 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_termite.yar +32 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_thiefquest.yar +46 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_wannaren.yar +34 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_wastedlocker.yar +32 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_xinof.yar +82 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Conti.yar +37 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Maze.yar +40 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Mespinoza.yar +27 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_ThunderX.yar +46 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Vovalex1.yar +42 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Win_BlackCat_public.yar +24 -0
- package/bundled-rules/yara-rules/community/trellix/ransomware/ransom_BlackKingDom.yar +49 -0
- package/bundled-rules/yara-rules/community/trellix/stealer/STEALER_EmiratesStatement.yar +24 -0
- package/bundled-rules/yara-rules/community/trellix/stealer/STEALER_Lokibot.yar +40 -0
- package/bundled-rules/yara-rules/community/trellix/stealer/STEALER_credstealer.yar +24 -0
- package/bundled-rules/yara-rules/community/volexity/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar +89 -0
- package/bundled-rules/yara-rules/community/volexity/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar +87 -0
- package/bundled-rules/yara-rules/community/volexity/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar +120 -0
- package/bundled-rules/yara-rules/community/volexity/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar +112 -0
- package/bundled-rules/yara-rules/community/volexity/2021/2021-12-06 - XEGroup/indicators/yara.yar +208 -0
- package/bundled-rules/yara-rules/community/volexity/2022/2022-03-22 GIMMICK/indicators/yara.yar +86 -0
- package/bundled-rules/yara-rules/community/volexity/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar +84 -0
- package/bundled-rules/yara-rules/community/volexity/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar +230 -0
- package/bundled-rules/yara-rules/community/volexity/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar +52 -0
- package/bundled-rules/yara-rules/community/volexity/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar +86 -0
- package/bundled-rules/yara-rules/community/volexity/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar +165 -0
- package/bundled-rules/yara-rules/community/volexity/2023/2023-03-07 AVBurner/yara.yar +40 -0
- package/bundled-rules/yara-rules/community/volexity/2023/2023-03-30 3CX/indicators/rules.yar +152 -0
- package/bundled-rules/yara-rules/community/volexity/2023/2023-06-28 POWERSTAR/indicators/rules.yar +150 -0
- package/bundled-rules/yara-rules/community/volexity/2023/2023-09-22 EvilBamboo/indicators/rules.yar +472 -0
- package/bundled-rules/yara-rules/community/volexity/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar +114 -0
- package/bundled-rules/yara-rules/community/volexity/2024/2024-02-13 CharmingCypress/rules.yar +352 -0
- package/bundled-rules/yara-rules/community/volexity/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar +116 -0
- package/bundled-rules/yara-rules/community/volexity/2024/2024-06-13 DISGOMOJI/indicators/rules.yar +267 -0
- package/bundled-rules/yara-rules/community/volexity/2024/2024-08-02 StormBamboo/rules.yar +383 -0
- package/bundled-rules/yara-rules/community/volexity/2024/2024-11-15 BrazenBamboo/rules.yar +613 -0
- package/bundled-rules/yara-rules/community/volexity/2025/2025-10-08 UTA0388/rules.yar +134 -0
- package/bundled-rules/yara-rules/community/withsecure/Andariel2025/andariel.yara +152 -0
- package/bundled-rules/yara-rules/community/withsecure/DUCKTAIL/ducktail_artifacts.yar +20 -0
- package/bundled-rules/yara-rules/community/withsecure/DUCKTAIL/ducktail_dotnet_core_infostealer.yar +103 -0
- package/bundled-rules/yara-rules/community/withsecure/DUCKTAIL/ducktail_exceldna_packed.yara +27 -0
- package/bundled-rules/yara-rules/community/withsecure/DUCKTAIL/ducktail_nativeaot.yara +22 -0
- package/bundled-rules/yara-rules/community/withsecure/Kapeka/kapeka_backdoor.yar +21 -0
- package/bundled-rules/yara-rules/community/withsecure/SILKLOADER/silkloader.yar +20 -0
- package/bundled-rules/yara-rules/community/withsecure/TangleCrypt/TangleCrypt_YARA.yar +27 -0
- package/bundled-rules/yara-rules/custom/malware-indicators.yar +83 -0
- package/bundled-rules/yara-rules/custom/suspicious-scripts.yar +72 -0
- package/bundled-rules/yara-rules/custom/webshells.yar +61 -0
- package/dist/agent/analyze-agent.d.ts +3 -1
- package/dist/agent/analyze-agent.d.ts.map +1 -1
- package/dist/agent/analyze-agent.js +75 -3
- package/dist/agent/analyze-agent.js.map +1 -1
- package/dist/agent/atr-action-handlers.d.ts +65 -0
- package/dist/agent/atr-action-handlers.d.ts.map +1 -0
- package/dist/agent/atr-action-handlers.js +327 -0
- package/dist/agent/atr-action-handlers.js.map +1 -0
- package/dist/agent/detect-agent.d.ts +2 -0
- package/dist/agent/detect-agent.d.ts.map +1 -1
- package/dist/agent/detect-agent.js +21 -2
- package/dist/agent/detect-agent.js.map +1 -1
- package/dist/agent/report-agent.d.ts.map +1 -1
- package/dist/agent/report-agent.js +11 -0
- package/dist/agent/report-agent.js.map +1 -1
- package/dist/agent/respond-agent.d.ts +51 -3
- package/dist/agent/respond-agent.d.ts.map +1 -1
- package/dist/agent/respond-agent.js +274 -8
- package/dist/agent/respond-agent.js.map +1 -1
- package/dist/agent-client/index.d.ts +44 -0
- package/dist/agent-client/index.d.ts.map +1 -1
- package/dist/agent-client/index.js +69 -0
- package/dist/agent-client/index.js.map +1 -1
- package/dist/bridges/trap-bridge.d.ts +20 -0
- package/dist/bridges/trap-bridge.d.ts.map +1 -0
- package/dist/bridges/trap-bridge.js +96 -0
- package/dist/bridges/trap-bridge.js.map +1 -0
- package/dist/cli/dashboard-renderer.d.ts +57 -0
- package/dist/cli/dashboard-renderer.d.ts.map +1 -0
- package/dist/cli/dashboard-renderer.js +143 -0
- package/dist/cli/dashboard-renderer.js.map +1 -0
- package/dist/cli/index.d.ts +1 -1
- package/dist/cli/index.d.ts.map +1 -1
- package/dist/cli/index.js +272 -20
- package/dist/cli/index.js.map +1 -1
- package/dist/cli/interactive-handler.d.ts +46 -0
- package/dist/cli/interactive-handler.d.ts.map +1 -0
- package/dist/cli/interactive-handler.js +135 -0
- package/dist/cli/interactive-handler.js.map +1 -0
- package/dist/collectors/index.d.ts +10 -0
- package/dist/collectors/index.d.ts.map +1 -0
- package/dist/collectors/index.js +11 -0
- package/dist/collectors/index.js.map +1 -0
- package/dist/collectors/log-collector.d.ts +124 -0
- package/dist/collectors/log-collector.d.ts.map +1 -0
- package/dist/collectors/log-collector.js +422 -0
- package/dist/collectors/log-collector.js.map +1 -0
- package/dist/collectors/log-parsers.d.ts +47 -0
- package/dist/collectors/log-parsers.d.ts.map +1 -0
- package/dist/collectors/log-parsers.js +322 -0
- package/dist/collectors/log-parsers.js.map +1 -0
- package/dist/config.d.ts +6 -0
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +141 -9
- package/dist/config.js.map +1 -1
- package/dist/correlation/event-correlator.d.ts +77 -0
- package/dist/correlation/event-correlator.d.ts.map +1 -0
- package/dist/correlation/event-correlator.js +492 -0
- package/dist/correlation/event-correlator.js.map +1 -0
- package/dist/dashboard/index.d.ts +20 -31
- package/dist/dashboard/index.d.ts.map +1 -1
- package/dist/dashboard/index.js +845 -151
- package/dist/dashboard/index.js.map +1 -1
- package/dist/dashboard/relay-client.d.ts +76 -0
- package/dist/dashboard/relay-client.d.ts.map +1 -0
- package/dist/dashboard/relay-client.js +352 -0
- package/dist/dashboard/relay-client.js.map +1 -0
- package/dist/engines/atr-drafter.d.ts +89 -0
- package/dist/engines/atr-drafter.d.ts.map +1 -0
- package/dist/engines/atr-drafter.js +369 -0
- package/dist/engines/atr-drafter.js.map +1 -0
- package/dist/engines/atr-engine.d.ts +113 -0
- package/dist/engines/atr-engine.d.ts.map +1 -0
- package/dist/engines/atr-engine.js +378 -0
- package/dist/engines/atr-engine.js.map +1 -0
- package/dist/engines/skill-watcher.d.ts +74 -0
- package/dist/engines/skill-watcher.d.ts.map +1 -0
- package/dist/engines/skill-watcher.js +247 -0
- package/dist/engines/skill-watcher.js.map +1 -0
- package/dist/engines/skill-whitelist.d.ts +122 -0
- package/dist/engines/skill-whitelist.d.ts.map +1 -0
- package/dist/engines/skill-whitelist.js +290 -0
- package/dist/engines/skill-whitelist.js.map +1 -0
- package/dist/guard-engine.d.ts +54 -0
- package/dist/guard-engine.d.ts.map +1 -1
- package/dist/guard-engine.js +472 -11
- package/dist/guard-engine.js.map +1 -1
- package/dist/index.d.ts +24 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +26 -2
- package/dist/index.js.map +1 -1
- package/dist/investigation/index.d.ts +36 -3
- package/dist/investigation/index.d.ts.map +1 -1
- package/dist/investigation/index.js +81 -4
- package/dist/investigation/index.js.map +1 -1
- package/dist/investigation/llm-planner.d.ts +55 -0
- package/dist/investigation/llm-planner.d.ts.map +1 -0
- package/dist/investigation/llm-planner.js +197 -0
- package/dist/investigation/llm-planner.js.map +1 -0
- package/dist/investigation/tool-descriptions.d.ts +60 -0
- package/dist/investigation/tool-descriptions.d.ts.map +1 -0
- package/dist/investigation/tool-descriptions.js +205 -0
- package/dist/investigation/tool-descriptions.js.map +1 -0
- package/dist/memory/anomaly-scorer.d.ts +128 -0
- package/dist/memory/anomaly-scorer.d.ts.map +1 -0
- package/dist/memory/anomaly-scorer.js +274 -0
- package/dist/memory/anomaly-scorer.js.map +1 -0
- package/dist/memory/baseline-stats.d.ts +74 -0
- package/dist/memory/baseline-stats.d.ts.map +1 -0
- package/dist/memory/baseline-stats.js +219 -0
- package/dist/memory/baseline-stats.js.map +1 -0
- package/dist/memory/baseline.d.ts +37 -1
- package/dist/memory/baseline.d.ts.map +1 -1
- package/dist/memory/baseline.js +148 -4
- package/dist/memory/baseline.js.map +1 -1
- package/dist/memory/index.d.ts +4 -1
- package/dist/memory/index.d.ts.map +1 -1
- package/dist/memory/index.js +3 -1
- package/dist/memory/index.js.map +1 -1
- package/dist/metrics.d.ts +36 -0
- package/dist/metrics.d.ts.map +1 -0
- package/dist/metrics.js +107 -0
- package/dist/metrics.js.map +1 -0
- package/dist/monitors/dpi-monitor.d.ts +118 -0
- package/dist/monitors/dpi-monitor.d.ts.map +1 -0
- package/dist/monitors/dpi-monitor.js +518 -0
- package/dist/monitors/dpi-monitor.js.map +1 -0
- package/dist/monitors/index.d.ts +18 -0
- package/dist/monitors/index.d.ts.map +1 -0
- package/dist/monitors/index.js +13 -0
- package/dist/monitors/index.js.map +1 -0
- package/dist/monitors/memory-scanner.d.ts +108 -0
- package/dist/monitors/memory-scanner.d.ts.map +1 -0
- package/dist/monitors/memory-scanner.js +396 -0
- package/dist/monitors/memory-scanner.js.map +1 -0
- package/dist/monitors/rootkit-detector.d.ts +126 -0
- package/dist/monitors/rootkit-detector.d.ts.map +1 -0
- package/dist/monitors/rootkit-detector.js +517 -0
- package/dist/monitors/rootkit-detector.js.map +1 -0
- package/dist/monitors/syscall-monitor.d.ts +116 -0
- package/dist/monitors/syscall-monitor.d.ts.map +1 -0
- package/dist/monitors/syscall-monitor.js +519 -0
- package/dist/monitors/syscall-monitor.js.map +1 -0
- package/dist/notify/index.d.ts +2 -0
- package/dist/notify/index.d.ts.map +1 -1
- package/dist/notify/index.js +11 -1
- package/dist/notify/index.js.map +1 -1
- package/dist/notify/line.d.ts +16 -0
- package/dist/notify/line.d.ts.map +1 -0
- package/dist/notify/line.js +76 -0
- package/dist/notify/line.js.map +1 -0
- package/dist/notify/webhook.d.ts +16 -0
- package/dist/notify/webhook.d.ts.map +1 -0
- package/dist/notify/webhook.js +78 -0
- package/dist/notify/webhook.js.map +1 -0
- package/dist/playbook/engine.d.ts +136 -0
- package/dist/playbook/engine.d.ts.map +1 -0
- package/dist/playbook/engine.js +318 -0
- package/dist/playbook/engine.js.map +1 -0
- package/dist/playbook/index.d.ts +13 -0
- package/dist/playbook/index.d.ts.map +1 -0
- package/dist/playbook/index.js +12 -0
- package/dist/playbook/index.js.map +1 -0
- package/dist/playbook/parser.d.ts +49 -0
- package/dist/playbook/parser.d.ts.map +1 -0
- package/dist/playbook/parser.js +170 -0
- package/dist/playbook/parser.js.map +1 -0
- package/dist/playbook/schema.d.ts +84 -0
- package/dist/playbook/schema.d.ts.map +1 -0
- package/dist/playbook/schema.js +48 -0
- package/dist/playbook/schema.js.map +1 -0
- package/dist/summary/daily-summary.d.ts +60 -0
- package/dist/summary/daily-summary.d.ts.map +1 -0
- package/dist/summary/daily-summary.js +217 -0
- package/dist/summary/daily-summary.js.map +1 -0
- package/dist/threat-cloud/index.d.ts +64 -1
- package/dist/threat-cloud/index.d.ts.map +1 -1
- package/dist/threat-cloud/index.js +188 -11
- package/dist/threat-cloud/index.js.map +1 -1
- package/dist/types.d.ts +121 -3
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/package.json +19 -4
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AASjD,MAAM,MAAM,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAexD,0DAA0D;AAC1D,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,oEAAoE;AACpE,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;;;GAGG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,GAA2C,IAAI,CAAC;IACtD,SAAS,GAAkB,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,CAAkB;IACxB,YAAY,GAAqB,EAAE,CAAC;IACpC,SAAS,GAAqB,EAAE,CAAC;IACxB,eAAe,GAAG,GAAG,CAAC;IACtB,IAAI,CAAS;IACtB,SAAS,GAA+B,IAAI,CAAC;IACrD,8CAA8C;IAC7B,SAAS,CAAS;IACnC,kCAAkC;IAC1B,UAAU,GAAgC,IAAI,GAAG,EAAE,CAAC;IAE5D,YAAY,IAAY;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG;YACZ,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,CAAC;YACT,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;YAClB,gBAAgB,EAAE,CAAC;YACnB,kBAAkB,EAAE,CAAC;YACrB,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,EAAE;SACnB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAyB;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAEvE,6CAA6C;YAC7C,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoB,EAAE,MAAc,EAAE,KAAa,EAAE,EAAE;gBAChF,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;oBACtB,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,yDAAyD;gBACzD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;oBACrE,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,uDAAuD;gBACvD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;gBACxC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7E,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;oBACzD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC;qBACjC,MAAM,CAAC,GAAG,GAAG,sCAAsC,CAAC;qBACpD,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAEpB,MAAM,CAAC,KAAK,CACV,sCAAsC;oBACpC,wBAAwB;oBACxB,yBAAyB;oBACzB,yBAAyB,SAAS,MAAM;oBACxC,MAAM,CACT,CAAC;gBAEF,MAAM,MAAM,GAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC1E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAE3B,+BAA+B;gBAC/B,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;oBACxB,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,MAAM;oBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACjC,kCAAkC;oBAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;wBACxD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;oBACtB,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBAC9C,MAAM,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,IAAI,WAAW,CAAC,CAAC;gBAC3E,MAAM,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBACvD,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;oBACrB,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;oBAC1C,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAgC;QAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,IAAI,CAAC,MAAM;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAAqB;QAC7B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACpD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAAsB;QAC/B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,KAAqB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAC1E,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;YAC9B,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,oCAAoC;IACpC,8EAA8E;IAE9E;;OAEG;IACH,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,aAAa,CAAC,GAAoB,EAAE,GAAmB;QAC7D,0BAA0B;QAC1B,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC9D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;QAC7E,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAChD,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,gHAAgH,CACjH,CAAC;QAEF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAE3B,4DAA4D;QAC5D,6BAA6B;QAC7B,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,2DAA2D;QAC3D,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3F,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC;YAEtE,IAAI,aAAa,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,aAAa;gBAChB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1C,MAAM;YACR,KAAK,iBAAiB;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBACnD,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM;YACR;gBACE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,4CAA4C;IACpC,cAAc,CAAC,EAAU;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC;IACvC,CAAC;IAEO,UAAU,CAAC,GAAmB;QACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC;IAEO,YAAY,CAAC,GAAmB,EAAE,IAAa,EAAE,UAAU,GAAG,GAAG;QACvE,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,8EAA8E;IAC9E,qCAAqC;IACrC,8EAA8E;IAEtE,YAAY,CAAC,MAAgB,EAAE,KAAqB;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAAqB;QACrC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAED,wDAAwD;IAChD,aAAa,CAAC,OAAe;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAc,CAAC;QAEnB,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,oBAAoB;YACtC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACrB,CAAC;aAAM,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YAChB,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YAChB,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,8EAA8E;AAC9E,wCAAwC;AACxC,8EAA8E;AAE9E,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA6Gf,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQjD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAA0B,MAAM,mBAAmB,CAAC;AAEjF,MAAM,MAAM,GAAG,YAAY,CAAC,0BAA0B,CAAC,CAAC;AAexD,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACpC,MAAM,cAAc,GAAG,EAAE,CAAC;AAS1B;;GAEG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,GAA2C,IAAI,CAAC;IACtD,SAAS,GAAkB,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,CAAkB;IACxB,YAAY,GAAqB,EAAE,CAAC;IACpC,SAAS,GAAqB,EAAE,CAAC;IACxB,eAAe,GAAG,GAAG,CAAC;IACtB,IAAI,CAAS;IACtB,SAAS,GAA+B,IAAI,CAAC;IACpC,SAAS,CAAS;IAC3B,UAAU,GAAgC,IAAI,GAAG,EAAE,CAAC;IACpD,WAAW,GAAgC,IAAI,CAAC;IACvC,WAAW,CAAoC;IAEhE,YAAY,IAAY,EAAE,WAAmC;QAC3D,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG;YACZ,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,CAAC;YACT,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;YAClB,eAAe,EAAE,CAAC;YAClB,gBAAgB,EAAE,CAAC;YACnB,kBAAkB,EAAE,CAAC;YACrB,aAAa,EAAE,CAAC;YAChB,UAAU,EAAE,CAAC;YACb,cAAc,EAAE,EAAE;SACnB,CAAC;IACJ,CAAC;IAED,eAAe,CAAC,MAAyB;QACvC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAEvE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAoB,EAAE,MAAc,EAAE,KAAa,EAAE,EAAE;gBAChF,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;oBACtB,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;oBAC1C,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;oBACjD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;gBACxC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7E,MAAM,CAAC,IAAI,CAAC,mCAAmC,MAAM,EAAE,CAAC,CAAC;oBACzD,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;gBAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;oBACT,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC;qBACjC,MAAM,CAAC,GAAG,GAAG,sCAAsC,CAAC;qBACpD,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAEpB,MAAM,CAAC,KAAK,CACV,sCAAsC;oBACpC,wBAAwB;oBACxB,yBAAyB;oBACzB,yBAAyB,SAAS,MAAM;oBACxC,MAAM,CACT,CAAC;gBAEF,MAAM,MAAM,GAAa,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC1E,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAE3B,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;oBACxB,IAAI,EAAE,eAAe;oBACrB,IAAI,EAAE,IAAI,CAAC,MAAM;oBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;oBACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;wBACxD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;oBACtB,CAAC;gBACH,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC,CAAC,CAAC;gBAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAChC,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBAC9C,MAAM,CAAC,IAAI,CAAC,yCAAyC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAEvD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC1C,CAAC;gBAED,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACP,YAAY;gBACd,CAAC;YACH,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAEvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;oBACrB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;oBACjC,OAAO,EAAE,CAAC;gBACZ,CAAC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,MAAgC;QAC3C,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QAC5C,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,eAAe;YACrB,IAAI,EAAE,IAAI,CAAC,MAAM;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,SAAS,CAAC,KAAqB;QAC7B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YACpD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,OAAsB;QAC/B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC;YACb,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,iBAAiB,CAAC,KAAqB;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAClC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAC1E,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC;YAC9B,QAAQ,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,wBAAwB;IACxB,8EAA8E;IAE9E,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,aAAa,CAAC,GAAoB,EAAE,GAAmB;QAC7D,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9E,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,oBAAoB,CAAC,CAAC;QACpE,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,6BAA6B,CAAC,CAAC;QAC7E,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzC,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACnD,GAAG,CAAC,SAAS,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;QAChD,GAAG,CAAC,SAAS,CACX,yBAAyB,EACzB,gHAAgH,CACjH,CAAC;QAEF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;YACV,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAE3B,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3F,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC;YAEtE,IAAI,aAAa,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;gBACnD,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnC,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,aAAa;gBAChB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBAC1C,MAAM;YACR,KAAK,iBAAiB;gBACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,eAAe;gBAClB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBACnD,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACnB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC3C,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM;YACR,KAAK,aAAa;gBAChB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC1B,MAAM;YACR,KAAK,gBAAgB;gBACnB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACpC,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC9B,CAAC;gBACD,MAAM;YACR,KAAK,YAAY;gBACf,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;gBACzB,MAAM;YACR,KAAK,mBAAmB;gBACtB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC1B,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACvC,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;gBACjC,CAAC;gBACD,MAAM;YACR,KAAK,uBAAuB;gBAC1B,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACxD,MAAM,CAAC,KAAK,CAAC,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACpG,IAAI,CAAC,GAAG,CAAC,WAAW;wBAAE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC;gBACjF,CAAC,CAAC,CAAC;gBACH,MAAM;YACR;gBACE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,EAAU;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC;IACvC,CAAC;IAEO,UAAU,CAAC,GAAmB;QACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC1B,CAAC;IAEO,YAAY,CAAC,GAAmB,EAAE,IAAa,EAAE,UAAU,GAAG,GAAG;QACvE,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,8EAA8E;IAC9E,yBAAyB;IACzB,8EAA8E;IAEtE,eAAe,CAAC,GAAmB;QACzC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC;QAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAElG,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6F,CAAC;YACzH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;YACjG,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,MAAM,CAAC;YACjG,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,GAAmB;QAC3C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE;YACrB,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,IAAI;YACrB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;SAC1C,CAAC,CAAC;IACL,CAAC;IAEO,kBAAkB,CAAC,GAAoB,EAAE,GAAmB;QAClE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBACxD,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAK7B,CAAC;gBAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACpH,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBAED,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;gBAC3G,IAAI,MAAM,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjE,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC3D,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAU,EAAE,CAAC;gBACjC,MAAM,aAAa,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,EAAE,QAAQ,IAAI,QAAQ,CAAC;gBACzE,MAAM,aAAa,GAAgB;oBACjC,GAAG,MAAM;oBACT,EAAE,EAAE;wBACF,QAAQ,EAAE,aAA2D;wBACrE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;wBAC7C,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,EAAE,QAAQ;wBAChD,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,EAAE,MAAM;qBAC3C;iBACF,CAAC;gBAEF,UAAU,CAAC,aAAa,CAAC,CAAC;gBAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,qBAAqB;IACrB,8EAA8E;IAEtE,MAAM,CAAC,kBAAkB,CAAC,GAAW;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,8CAA8C;IAC9C,8EAA8E;IAEtE,cAAc,CAAC,GAAmB;QACxC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAElC,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAA0B,CAAC;gBACpF,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE;YACrB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,CAAC;YACtC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC;YAClC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC;YACpC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC;YAC7C,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,CAAC;YACvD,mBAAmB,EAAE,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,CAAC;YACzD,QAAQ;YACR,iBAAiB,EAAE,CAAC;YACpB,kBAAkB,EAAE,MAAM,EAAE,mBAAmB,KAAK,SAAS;SAC9D,CAAC,CAAC;IACL,CAAC;IAEO,oBAAoB,CAAC,GAAmB;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;QAElC,IAAI,KAAK,GAAG,EAAE,aAAa,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;QACtE,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;QAC3D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAKxD,CAAC;gBACF,KAAK,GAAG;oBACN,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,CAAC;oBACvC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB,IAAI,CAAC;oBACjD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,CAAC;iBAChC,CAAC;gBACF,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;QAED,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1D,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,EAAE,wBAAwB,KAAK,KAAK,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,EAAE,mBAAmB,IAAI,4BAA4B,CAAC;QAE7E,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE;YACrB,OAAO,EAAE,MAAM,EAAE,mBAAmB,KAAK,SAAS;YAClD,QAAQ;YACR,aAAa;YACb,GAAG,KAAK;YACR,QAAQ;YACR,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAEO,qBAAqB,CAAC,GAAoB,EAAE,GAAmB;QACrE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;gBACf,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBACxD,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG7B,CAAC;gBAEF,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1F,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE,GAAG,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAU,EAAE,CAAC;gBACjC,MAAM,aAAa,GAAgB;oBACjC,GAAG,MAAM;oBACT,wBAAwB,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,wBAAwB;oBACjF,mBAAmB,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,mBAAmB;iBACnE,CAAC;gBAEF,UAAU,CAAC,aAAa,CAAC,CAAC;gBAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5C,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAC,GAAmB;QACxD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAClF,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAE5D,IAAI,SAAS,GAA6C,EAAE,CAAC;QAC7D,IAAI,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;gBACjD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0D,CAAC;gBACtF,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAE7D,IAAI,SAAS,GAMR,EAAE,CAAC;QAER,IAAI,CAAC;YACH,qEAAqE;YACrE,8EAA8E;YAC9E,MAAM,SAAS,GAA4B,MAAM,MAAM,CAAC,kCAAkC,CAAC,CAAC;YAC5F,MAAM,QAAQ,GAAG,SAAS,CAAC,mBAAmB,CAA6F,CAAC;YAC5I,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,MAAM,QAAQ,EAAE,CAAC;gBACpC,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC/B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;oBACpB,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,WAAW,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBACzC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM;iBACvD,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,QAAQ,EAAE,SAAS;gBACnB,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;aACjB,CAAC,CAAC,CAAC;QACN,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,SAAS,CAAC,MAAM;YACvB,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM;YACxD,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM;SACtD,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,oBAAoB;IACpB,8EAA8E;IAEtE,YAAY,CAAC,MAAgB,EAAE,KAAqB;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,KAAqB;QACrC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,KAA2C,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,0BAA0B;IAC1B,8EAA8E;IAEtE,gBAAgB,CAAC,MAA6B;QACpD,MAAM,WAAW,GAAsB;YACrC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC;QAEF,IAAI,CAAC,WAAW,GAAG,IAAI,oBAAoB,CAAC,WAAW,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE;YACpC,MAAM,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE;YACvC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC1C,MAAM,CAAC,IAAI,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAA4B,EAAE,EAAE;YAC9D,MAAM,CAAC,KAAK,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,aAAa,CAAC,OAAe;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,MAAc,CAAC;QAEnB,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;QACrB,CAAC;aAAM,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YAChB,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClC,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;YAChB,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1C,CAAC;CACF;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA+gBf,CAAC"}
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Dashboard Relay Client - Connects the local dashboard to a remote Manager
|
|
3
|
+
* Dashboard Relay Client - 將本地 dashboard 連接到遠端 Manager
|
|
4
|
+
*
|
|
5
|
+
* Establishes a WebSocket connection upstream to the Manager's relay endpoint,
|
|
6
|
+
* forwarding all local dashboard events and receiving commands from the Manager.
|
|
7
|
+
*
|
|
8
|
+
* Uses Node.js built-in http module with native RFC 6455 WebSocket handshake
|
|
9
|
+
* (same approach as dashboard/index.ts).
|
|
10
|
+
*
|
|
11
|
+
* @module @panguard-ai/panguard-guard/dashboard/relay-client
|
|
12
|
+
*/
|
|
13
|
+
import { EventEmitter } from 'node:events';
|
|
14
|
+
export interface RelayClientConfig {
|
|
15
|
+
/** Manager URL to connect to / 要連接的 Manager URL */
|
|
16
|
+
readonly managerUrl: string;
|
|
17
|
+
/** Agent ID for identification / 用於識別的 Agent ID */
|
|
18
|
+
readonly agentId: string;
|
|
19
|
+
/** Auth token / 認證 token */
|
|
20
|
+
readonly token: string;
|
|
21
|
+
/** Reconnect interval in ms / 重連間隔(毫秒) */
|
|
22
|
+
readonly reconnectInterval?: number;
|
|
23
|
+
}
|
|
24
|
+
/**
|
|
25
|
+
* Dashboard relay client -- connects the local dashboard to a remote Manager
|
|
26
|
+
* Dashboard relay client -- 將本地 dashboard 連接到遠端 Manager
|
|
27
|
+
*/
|
|
28
|
+
export declare class DashboardRelayClient extends EventEmitter {
|
|
29
|
+
private readonly config;
|
|
30
|
+
private readonly reconnectBaseMs;
|
|
31
|
+
private socket;
|
|
32
|
+
private connected;
|
|
33
|
+
private reconnectAttempts;
|
|
34
|
+
private reconnectTimer;
|
|
35
|
+
private intentionalDisconnect;
|
|
36
|
+
constructor(config: RelayClientConfig);
|
|
37
|
+
/** Check if connected / 檢查是否已連接 */
|
|
38
|
+
get isConnected(): boolean;
|
|
39
|
+
/**
|
|
40
|
+
* Connect to Manager relay endpoint / 連接到 Manager relay 端點
|
|
41
|
+
*
|
|
42
|
+
* Initiates a WebSocket upgrade request to:
|
|
43
|
+
* ws://{managerUrl}/api/dashboard/relay/{agentId}
|
|
44
|
+
*/
|
|
45
|
+
connect(): void;
|
|
46
|
+
/**
|
|
47
|
+
* Disconnect from Manager / 斷開與 Manager 的連接
|
|
48
|
+
*/
|
|
49
|
+
disconnect(): void;
|
|
50
|
+
/**
|
|
51
|
+
* Send a dashboard event upstream / 向上游發送 dashboard 事件
|
|
52
|
+
*/
|
|
53
|
+
sendEvent(event: Record<string, unknown>): void;
|
|
54
|
+
/** Initiate WebSocket upgrade connection / 發起 WebSocket 升級連接 */
|
|
55
|
+
private initiateConnection;
|
|
56
|
+
/** Build the relay WebSocket URL / 建構 relay WebSocket URL */
|
|
57
|
+
private buildRelayUrl;
|
|
58
|
+
/** Handle incoming WebSocket data from Manager / 處理從 Manager 收到的 WebSocket 資料 */
|
|
59
|
+
private handleIncomingData;
|
|
60
|
+
/** Extract payload from a WebSocket frame (server frames are unmasked) / 從 WebSocket 框架提取載荷 */
|
|
61
|
+
private extractPayload;
|
|
62
|
+
/** Send a pong frame in response to a ping / 回應 ping 發送 pong 框架 */
|
|
63
|
+
private sendPong;
|
|
64
|
+
/** Handle socket close event / 處理 socket 關閉事件 */
|
|
65
|
+
private handleSocketClose;
|
|
66
|
+
/** Schedule a reconnection attempt with exponential backoff / 排程指數退避重連 */
|
|
67
|
+
private scheduleReconnect;
|
|
68
|
+
/** Update connected state and emit events / 更新連接狀態並發送事件 */
|
|
69
|
+
private setConnected;
|
|
70
|
+
/**
|
|
71
|
+
* Create a masked WebSocket text frame (client->server must be masked per RFC 6455)
|
|
72
|
+
* 建立帶遮罩的 WebSocket 文字框架(客戶端->伺服器依 RFC 6455 必須帶遮罩)
|
|
73
|
+
*/
|
|
74
|
+
private createMaskedWSFrame;
|
|
75
|
+
}
|
|
76
|
+
//# sourceMappingURL=relay-client.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"relay-client.d.ts","sourceRoot":"","sources":["../../src/dashboard/relay-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAc3C,MAAM,WAAW,iBAAiB;IAChC,mDAAmD;IACnD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,YAAY;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,iBAAiB,CAAK;IAC9B,OAAO,CAAC,cAAc,CAA8C;IACpE,OAAO,CAAC,qBAAqB,CAAS;gBAE1B,MAAM,EAAE,iBAAiB;IAiBrC,mCAAmC;IACnC,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;;;;OAKG;IACH,OAAO,IAAI,IAAI;IAUf;;OAEG;IACH,UAAU,IAAI,IAAI;IA2BlB;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAqB/C,gEAAgE;IAChE,OAAO,CAAC,kBAAkB;IAsF1B,6DAA6D;IAC7D,OAAO,CAAC,aAAa;IASrB,iFAAiF;IACjF,OAAO,CAAC,kBAAkB;IAqC1B,+FAA+F;IAC/F,OAAO,CAAC,cAAc;IAmCtB,mEAAmE;IACnE,OAAO,CAAC,QAAQ;IAehB,iDAAiD;IACjD,OAAO,CAAC,iBAAiB;IAiBzB,0EAA0E;IAC1E,OAAO,CAAC,iBAAiB;IAoBzB,2DAA2D;IAC3D,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,CAAC,mBAAmB;CAgC5B"}
|
|
@@ -0,0 +1,352 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Dashboard Relay Client - Connects the local dashboard to a remote Manager
|
|
3
|
+
* Dashboard Relay Client - 將本地 dashboard 連接到遠端 Manager
|
|
4
|
+
*
|
|
5
|
+
* Establishes a WebSocket connection upstream to the Manager's relay endpoint,
|
|
6
|
+
* forwarding all local dashboard events and receiving commands from the Manager.
|
|
7
|
+
*
|
|
8
|
+
* Uses Node.js built-in http module with native RFC 6455 WebSocket handshake
|
|
9
|
+
* (same approach as dashboard/index.ts).
|
|
10
|
+
*
|
|
11
|
+
* @module @panguard-ai/panguard-guard/dashboard/relay-client
|
|
12
|
+
*/
|
|
13
|
+
import { EventEmitter } from 'node:events';
|
|
14
|
+
import { request as httpRequest } from 'node:http';
|
|
15
|
+
import { request as httpsRequest } from 'node:https';
|
|
16
|
+
import { randomBytes } from 'node:crypto';
|
|
17
|
+
import { createLogger } from '@panguard-ai/core';
|
|
18
|
+
const logger = createLogger('panguard-guard:dashboard-relay');
|
|
19
|
+
/** Maximum reconnect backoff in milliseconds / 最大重連延遲(毫秒) */
|
|
20
|
+
const MAX_RECONNECT_MS = 30_000;
|
|
21
|
+
/** Default reconnect interval in milliseconds / 預設重連間隔(毫秒) */
|
|
22
|
+
const DEFAULT_RECONNECT_MS = 2_000;
|
|
23
|
+
/**
|
|
24
|
+
* Dashboard relay client -- connects the local dashboard to a remote Manager
|
|
25
|
+
* Dashboard relay client -- 將本地 dashboard 連接到遠端 Manager
|
|
26
|
+
*/
|
|
27
|
+
export class DashboardRelayClient extends EventEmitter {
|
|
28
|
+
config;
|
|
29
|
+
reconnectBaseMs;
|
|
30
|
+
socket = null;
|
|
31
|
+
connected = false;
|
|
32
|
+
reconnectAttempts = 0;
|
|
33
|
+
reconnectTimer = null;
|
|
34
|
+
intentionalDisconnect = false;
|
|
35
|
+
constructor(config) {
|
|
36
|
+
super();
|
|
37
|
+
if (!config.managerUrl) {
|
|
38
|
+
throw new Error('managerUrl is required / managerUrl 為必要參數');
|
|
39
|
+
}
|
|
40
|
+
if (!config.agentId) {
|
|
41
|
+
throw new Error('agentId is required / agentId 為必要參數');
|
|
42
|
+
}
|
|
43
|
+
if (!config.token) {
|
|
44
|
+
throw new Error('token is required / token 為必要參數');
|
|
45
|
+
}
|
|
46
|
+
this.config = config;
|
|
47
|
+
this.reconnectBaseMs = config.reconnectInterval ?? DEFAULT_RECONNECT_MS;
|
|
48
|
+
}
|
|
49
|
+
/** Check if connected / 檢查是否已連接 */
|
|
50
|
+
get isConnected() {
|
|
51
|
+
return this.connected;
|
|
52
|
+
}
|
|
53
|
+
/**
|
|
54
|
+
* Connect to Manager relay endpoint / 連接到 Manager relay 端點
|
|
55
|
+
*
|
|
56
|
+
* Initiates a WebSocket upgrade request to:
|
|
57
|
+
* ws://{managerUrl}/api/dashboard/relay/{agentId}
|
|
58
|
+
*/
|
|
59
|
+
connect() {
|
|
60
|
+
if (this.connected || this.socket) {
|
|
61
|
+
logger.warn('Already connected or connecting / 已經連接或正在連接');
|
|
62
|
+
return;
|
|
63
|
+
}
|
|
64
|
+
this.intentionalDisconnect = false;
|
|
65
|
+
this.initiateConnection();
|
|
66
|
+
}
|
|
67
|
+
/**
|
|
68
|
+
* Disconnect from Manager / 斷開與 Manager 的連接
|
|
69
|
+
*/
|
|
70
|
+
disconnect() {
|
|
71
|
+
this.intentionalDisconnect = true;
|
|
72
|
+
if (this.reconnectTimer) {
|
|
73
|
+
clearTimeout(this.reconnectTimer);
|
|
74
|
+
this.reconnectTimer = null;
|
|
75
|
+
}
|
|
76
|
+
if (this.socket) {
|
|
77
|
+
try {
|
|
78
|
+
// Send close frame (opcode 0x08) / 發送關閉框架
|
|
79
|
+
const closeFrame = Buffer.alloc(6);
|
|
80
|
+
closeFrame[0] = 0x88; // FIN + close opcode
|
|
81
|
+
closeFrame[1] = 0x80; // masked, 0 payload
|
|
82
|
+
// Write 4 masking key bytes (all zero is fine for close)
|
|
83
|
+
this.socket.write(closeFrame);
|
|
84
|
+
this.socket.destroy();
|
|
85
|
+
}
|
|
86
|
+
catch {
|
|
87
|
+
/* ignore close errors / 忽略關閉錯誤 */
|
|
88
|
+
}
|
|
89
|
+
this.socket = null;
|
|
90
|
+
}
|
|
91
|
+
this.setConnected(false);
|
|
92
|
+
this.reconnectAttempts = 0;
|
|
93
|
+
}
|
|
94
|
+
/**
|
|
95
|
+
* Send a dashboard event upstream / 向上游發送 dashboard 事件
|
|
96
|
+
*/
|
|
97
|
+
sendEvent(event) {
|
|
98
|
+
if (!this.connected || !this.socket) {
|
|
99
|
+
logger.debug('Cannot send event: not connected / 無法發送事件:未連接');
|
|
100
|
+
return;
|
|
101
|
+
}
|
|
102
|
+
try {
|
|
103
|
+
const data = JSON.stringify(event);
|
|
104
|
+
const payload = Buffer.from(data, 'utf-8');
|
|
105
|
+
const frame = this.createMaskedWSFrame(payload);
|
|
106
|
+
this.socket.write(frame);
|
|
107
|
+
}
|
|
108
|
+
catch (err) {
|
|
109
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
110
|
+
logger.warn(`Failed to send relay event: ${message} / 發送 relay 事件失敗`);
|
|
111
|
+
}
|
|
112
|
+
}
|
|
113
|
+
// ---------------------------------------------------------------------------
|
|
114
|
+
// Private helpers / 私有輔助函數
|
|
115
|
+
// ---------------------------------------------------------------------------
|
|
116
|
+
/** Initiate WebSocket upgrade connection / 發起 WebSocket 升級連接 */
|
|
117
|
+
initiateConnection() {
|
|
118
|
+
const url = this.buildRelayUrl();
|
|
119
|
+
let parsedUrl;
|
|
120
|
+
try {
|
|
121
|
+
parsedUrl = new URL(url);
|
|
122
|
+
}
|
|
123
|
+
catch {
|
|
124
|
+
logger.error(`Invalid relay URL: ${url} / 無效的 relay URL`);
|
|
125
|
+
this.emit('error', new Error(`Invalid relay URL: ${url}`));
|
|
126
|
+
return;
|
|
127
|
+
}
|
|
128
|
+
const isHttps = parsedUrl.protocol === 'https:' || parsedUrl.protocol === 'wss:';
|
|
129
|
+
const doRequest = isHttps ? httpsRequest : httpRequest;
|
|
130
|
+
const port = parsedUrl.port || (isHttps ? '443' : '80');
|
|
131
|
+
const wsKey = randomBytes(16).toString('base64');
|
|
132
|
+
const req = doRequest({
|
|
133
|
+
hostname: parsedUrl.hostname,
|
|
134
|
+
port: Number(port),
|
|
135
|
+
path: parsedUrl.pathname,
|
|
136
|
+
method: 'GET',
|
|
137
|
+
headers: {
|
|
138
|
+
'Upgrade': 'websocket',
|
|
139
|
+
'Connection': 'Upgrade',
|
|
140
|
+
'Sec-WebSocket-Key': wsKey,
|
|
141
|
+
'Sec-WebSocket-Version': '13',
|
|
142
|
+
'Authorization': `Bearer ${this.config.token}`,
|
|
143
|
+
'X-Agent-Id': this.config.agentId,
|
|
144
|
+
},
|
|
145
|
+
timeout: 10_000,
|
|
146
|
+
});
|
|
147
|
+
req.on('upgrade', (_res, socket, _head) => {
|
|
148
|
+
this.socket = socket;
|
|
149
|
+
this.reconnectAttempts = 0;
|
|
150
|
+
this.setConnected(true);
|
|
151
|
+
logger.info(`Relay connected to Manager for agent ${this.config.agentId} / ` +
|
|
152
|
+
`Relay 已連接到 Manager`);
|
|
153
|
+
socket.on('data', (data) => {
|
|
154
|
+
this.handleIncomingData(data);
|
|
155
|
+
});
|
|
156
|
+
socket.on('close', () => {
|
|
157
|
+
this.handleSocketClose();
|
|
158
|
+
});
|
|
159
|
+
socket.on('error', (err) => {
|
|
160
|
+
logger.warn(`Relay socket error: ${err.message} / Relay 連線錯誤`);
|
|
161
|
+
this.handleSocketClose();
|
|
162
|
+
});
|
|
163
|
+
});
|
|
164
|
+
req.on('error', (err) => {
|
|
165
|
+
logger.warn(`Relay connection failed: ${err.message} / Relay 連接失敗`);
|
|
166
|
+
this.emit('error', err);
|
|
167
|
+
this.scheduleReconnect();
|
|
168
|
+
});
|
|
169
|
+
req.on('timeout', () => {
|
|
170
|
+
req.destroy();
|
|
171
|
+
logger.warn('Relay connection timed out / Relay 連接逾時');
|
|
172
|
+
this.scheduleReconnect();
|
|
173
|
+
});
|
|
174
|
+
// Response without upgrade means the server rejected / 非升級回應表示伺服器拒絕
|
|
175
|
+
req.on('response', (res) => {
|
|
176
|
+
logger.warn(`Relay upgrade rejected with status ${res.statusCode} / ` +
|
|
177
|
+
`Relay 升級被拒絕,狀態碼 ${res.statusCode}`);
|
|
178
|
+
this.emit('error', new Error(`Upgrade rejected: HTTP ${res.statusCode}`));
|
|
179
|
+
this.scheduleReconnect();
|
|
180
|
+
});
|
|
181
|
+
req.end();
|
|
182
|
+
}
|
|
183
|
+
/** Build the relay WebSocket URL / 建構 relay WebSocket URL */
|
|
184
|
+
buildRelayUrl() {
|
|
185
|
+
const base = this.config.managerUrl.replace(/\/+$/, '');
|
|
186
|
+
// Convert ws:// -> http:// and wss:// -> https:// for Node.js http module
|
|
187
|
+
const httpBase = base
|
|
188
|
+
.replace(/^ws:/, 'http:')
|
|
189
|
+
.replace(/^wss:/, 'https:');
|
|
190
|
+
return `${httpBase}/api/dashboard/relay/${this.config.agentId}`;
|
|
191
|
+
}
|
|
192
|
+
/** Handle incoming WebSocket data from Manager / 處理從 Manager 收到的 WebSocket 資料 */
|
|
193
|
+
handleIncomingData(data) {
|
|
194
|
+
if (data.length < 2)
|
|
195
|
+
return;
|
|
196
|
+
const firstByte = data[0] ?? 0;
|
|
197
|
+
const opcode = firstByte & 0x0f;
|
|
198
|
+
// Ping frame -> respond with pong / Ping 框架 -> 回應 pong
|
|
199
|
+
if (opcode === 0x09) {
|
|
200
|
+
this.sendPong(data);
|
|
201
|
+
return;
|
|
202
|
+
}
|
|
203
|
+
// Pong frame -> ignore / Pong 框架 -> 忽略
|
|
204
|
+
if (opcode === 0x0a) {
|
|
205
|
+
return;
|
|
206
|
+
}
|
|
207
|
+
// Close frame -> handle disconnection / 關閉框架 -> 處理斷線
|
|
208
|
+
if (opcode === 0x08) {
|
|
209
|
+
this.handleSocketClose();
|
|
210
|
+
return;
|
|
211
|
+
}
|
|
212
|
+
// Text frame -> parse and emit / 文字框架 -> 解析並發送事件
|
|
213
|
+
if (opcode === 0x01) {
|
|
214
|
+
try {
|
|
215
|
+
const payload = this.extractPayload(data);
|
|
216
|
+
if (payload) {
|
|
217
|
+
const message = JSON.parse(payload.toString('utf-8'));
|
|
218
|
+
this.emit('message', message);
|
|
219
|
+
}
|
|
220
|
+
}
|
|
221
|
+
catch {
|
|
222
|
+
logger.debug('Failed to parse incoming relay message / 無法解析收到的 relay 訊息');
|
|
223
|
+
}
|
|
224
|
+
}
|
|
225
|
+
}
|
|
226
|
+
/** Extract payload from a WebSocket frame (server frames are unmasked) / 從 WebSocket 框架提取載荷 */
|
|
227
|
+
extractPayload(data) {
|
|
228
|
+
if (data.length < 2)
|
|
229
|
+
return null;
|
|
230
|
+
const secondByte = data[1] ?? 0;
|
|
231
|
+
const masked = (secondByte & 0x80) !== 0;
|
|
232
|
+
let payloadLength = secondByte & 0x7f;
|
|
233
|
+
let offset = 2;
|
|
234
|
+
if (payloadLength === 126) {
|
|
235
|
+
if (data.length < 4)
|
|
236
|
+
return null;
|
|
237
|
+
payloadLength = data.readUInt16BE(2);
|
|
238
|
+
offset = 4;
|
|
239
|
+
}
|
|
240
|
+
else if (payloadLength === 127) {
|
|
241
|
+
if (data.length < 10)
|
|
242
|
+
return null;
|
|
243
|
+
payloadLength = Number(data.readBigUInt64BE(2));
|
|
244
|
+
offset = 10;
|
|
245
|
+
}
|
|
246
|
+
if (masked) {
|
|
247
|
+
// Server frames should not be masked, but handle gracefully
|
|
248
|
+
// 伺服器框架不應被遮罩,但優雅處理
|
|
249
|
+
if (data.length < offset + 4 + payloadLength)
|
|
250
|
+
return null;
|
|
251
|
+
const maskKey = data.subarray(offset, offset + 4);
|
|
252
|
+
offset += 4;
|
|
253
|
+
const payload = Buffer.alloc(payloadLength);
|
|
254
|
+
for (let i = 0; i < payloadLength; i++) {
|
|
255
|
+
payload[i] = (data[offset + i] ?? 0) ^ (maskKey[i % 4] ?? 0);
|
|
256
|
+
}
|
|
257
|
+
return payload;
|
|
258
|
+
}
|
|
259
|
+
if (data.length < offset + payloadLength)
|
|
260
|
+
return null;
|
|
261
|
+
return data.subarray(offset, offset + payloadLength);
|
|
262
|
+
}
|
|
263
|
+
/** Send a pong frame in response to a ping / 回應 ping 發送 pong 框架 */
|
|
264
|
+
sendPong(_pingData) {
|
|
265
|
+
if (!this.socket)
|
|
266
|
+
return;
|
|
267
|
+
try {
|
|
268
|
+
// Construct a masked pong frame / 建構帶遮罩的 pong 框架
|
|
269
|
+
const pongFrame = Buffer.alloc(6);
|
|
270
|
+
pongFrame[0] = 0x8a; // FIN + pong opcode
|
|
271
|
+
pongFrame[1] = 0x80; // masked, 0 payload length
|
|
272
|
+
// 4 bytes masking key (zeros)
|
|
273
|
+
this.socket.write(pongFrame);
|
|
274
|
+
}
|
|
275
|
+
catch {
|
|
276
|
+
/* ignore pong errors / 忽略 pong 錯誤 */
|
|
277
|
+
}
|
|
278
|
+
}
|
|
279
|
+
/** Handle socket close event / 處理 socket 關閉事件 */
|
|
280
|
+
handleSocketClose() {
|
|
281
|
+
if (this.socket) {
|
|
282
|
+
try {
|
|
283
|
+
this.socket.destroy();
|
|
284
|
+
}
|
|
285
|
+
catch {
|
|
286
|
+
/* ignore */
|
|
287
|
+
}
|
|
288
|
+
this.socket = null;
|
|
289
|
+
}
|
|
290
|
+
this.setConnected(false);
|
|
291
|
+
if (!this.intentionalDisconnect) {
|
|
292
|
+
this.scheduleReconnect();
|
|
293
|
+
}
|
|
294
|
+
}
|
|
295
|
+
/** Schedule a reconnection attempt with exponential backoff / 排程指數退避重連 */
|
|
296
|
+
scheduleReconnect() {
|
|
297
|
+
if (this.intentionalDisconnect || this.reconnectTimer)
|
|
298
|
+
return;
|
|
299
|
+
const delay = Math.min(this.reconnectBaseMs * Math.pow(2, this.reconnectAttempts), MAX_RECONNECT_MS);
|
|
300
|
+
this.reconnectAttempts++;
|
|
301
|
+
logger.info(`Scheduling relay reconnect in ${delay}ms (attempt ${this.reconnectAttempts}) / ` +
|
|
302
|
+
`排程 relay 重連於 ${delay}ms 後(第 ${this.reconnectAttempts} 次嘗試)`);
|
|
303
|
+
this.reconnectTimer = setTimeout(() => {
|
|
304
|
+
this.reconnectTimer = null;
|
|
305
|
+
this.initiateConnection();
|
|
306
|
+
}, delay);
|
|
307
|
+
}
|
|
308
|
+
/** Update connected state and emit events / 更新連接狀態並發送事件 */
|
|
309
|
+
setConnected(value) {
|
|
310
|
+
const changed = this.connected !== value;
|
|
311
|
+
this.connected = value;
|
|
312
|
+
if (changed) {
|
|
313
|
+
this.emit(value ? 'connected' : 'disconnected');
|
|
314
|
+
}
|
|
315
|
+
}
|
|
316
|
+
/**
|
|
317
|
+
* Create a masked WebSocket text frame (client->server must be masked per RFC 6455)
|
|
318
|
+
* 建立帶遮罩的 WebSocket 文字框架(客戶端->伺服器依 RFC 6455 必須帶遮罩)
|
|
319
|
+
*/
|
|
320
|
+
createMaskedWSFrame(payload) {
|
|
321
|
+
const length = payload.length;
|
|
322
|
+
const maskKey = randomBytes(4);
|
|
323
|
+
let header;
|
|
324
|
+
if (length < 126) {
|
|
325
|
+
header = Buffer.alloc(6);
|
|
326
|
+
header[0] = 0x81; // FIN + text opcode
|
|
327
|
+
header[1] = 0x80 | length; // masked + length
|
|
328
|
+
maskKey.copy(header, 2);
|
|
329
|
+
}
|
|
330
|
+
else if (length < 65536) {
|
|
331
|
+
header = Buffer.alloc(8);
|
|
332
|
+
header[0] = 0x81;
|
|
333
|
+
header[1] = 0x80 | 126; // masked + 126 indicator
|
|
334
|
+
header.writeUInt16BE(length, 2);
|
|
335
|
+
maskKey.copy(header, 4);
|
|
336
|
+
}
|
|
337
|
+
else {
|
|
338
|
+
header = Buffer.alloc(14);
|
|
339
|
+
header[0] = 0x81;
|
|
340
|
+
header[1] = 0x80 | 127; // masked + 127 indicator
|
|
341
|
+
header.writeBigUInt64BE(BigInt(length), 2);
|
|
342
|
+
maskKey.copy(header, 10);
|
|
343
|
+
}
|
|
344
|
+
// Mask the payload / 遮罩載荷
|
|
345
|
+
const maskedPayload = Buffer.alloc(length);
|
|
346
|
+
for (let i = 0; i < length; i++) {
|
|
347
|
+
maskedPayload[i] = (payload[i] ?? 0) ^ (maskKey[i % 4] ?? 0);
|
|
348
|
+
}
|
|
349
|
+
return Buffer.concat([header, maskedPayload]);
|
|
350
|
+
}
|
|
351
|
+
}
|
|
352
|
+
//# sourceMappingURL=relay-client.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"relay-client.js","sourceRoot":"","sources":["../../src/dashboard/relay-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,gCAAgC,CAAC,CAAC;AAE9D,6DAA6D;AAC7D,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,8DAA8D;AAC9D,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAanC;;;GAGG;AACH,MAAM,OAAO,oBAAqB,SAAQ,YAAY;IACnC,MAAM,CAAoB;IAC1B,eAAe,CAAS;IACjC,MAAM,GAAkB,IAAI,CAAC;IAC7B,SAAS,GAAG,KAAK,CAAC;IAClB,iBAAiB,GAAG,CAAC,CAAC;IACtB,cAAc,GAAyC,IAAI,CAAC;IAC5D,qBAAqB,GAAG,KAAK,CAAC;IAEtC,YAAY,MAAyB;QACnC,KAAK,EAAE,CAAC;QAER,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,iBAAiB,IAAI,oBAAoB,CAAC;IAC1E,CAAC;IAED,mCAAmC;IACnC,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;OAKG;IACH,OAAO;QACL,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC;QACnC,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,UAAU;QACR,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;QAElC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC7B,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,0CAA0C;gBAC1C,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACnC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,qBAAqB;gBAC3C,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,oBAAoB;gBAC1C,yDAAyD;gBACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,kCAAkC;YACpC,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,KAA8B;QACtC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC9D,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,+BAA+B,OAAO,kBAAkB,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,2BAA2B;IAC3B,8EAA8E;IAE9E,gEAAgE;IACxD,kBAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,IAAI,SAAc,CAAC;QAEnB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,kBAAkB,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC;QACjF,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC;QACvD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,SAAS,CACnB;YACE,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;YAClB,IAAI,EAAE,SAAS,CAAC,QAAQ;YACxB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,SAAS,EAAE,WAAW;gBACtB,YAAY,EAAE,SAAS;gBACvB,mBAAmB,EAAE,KAAK;gBAC1B,uBAAuB,EAAE,IAAI;gBAC7B,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE;gBAC9C,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;aAClC;YACD,OAAO,EAAE,MAAM;SAChB,CACF,CAAC;QAEF,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAc,EAAE,KAAa,EAAE,EAAE;YACxD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;YAC3B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YAExB,MAAM,CAAC,IAAI,CACT,wCAAwC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK;gBAC9D,oBAAoB,CACvB,CAAC;YAEF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBACjC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;YAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBAChC,MAAM,CAAC,IAAI,CAAC,uBAAuB,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC;gBAC/D,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC7B,MAAM,CAAC,IAAI,CACT,4BAA4B,GAAG,CAAC,OAAO,eAAe,CACvD,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACvD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,oEAAoE;QACpE,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,IAAI,CACT,sCAAsC,GAAG,CAAC,UAAU,KAAK;gBACvD,mBAAmB,GAAG,CAAC,UAAU,EAAE,CACtC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC;IAED,6DAA6D;IACrD,aAAa;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxD,0EAA0E;QAC1E,MAAM,QAAQ,GAAG,IAAI;aAClB,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;aACxB,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9B,OAAO,GAAG,QAAQ,wBAAwB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IAClE,CAAC;IAED,iFAAiF;IACzE,kBAAkB,CAAC,IAAY;QACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO;QAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC;QAEhC,uDAAuD;QACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,uCAAuC;QACvC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,qDAAqD;QACrD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,iDAAiD;QACjD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC1C,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;oBACtD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;IAED,+FAA+F;IACvF,cAAc,CAAC,IAAY;QACjC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEjC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,aAAa,GAAG,UAAU,GAAG,IAAI,CAAC;QACtC,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,IAAI,aAAa,KAAK,GAAG,EAAE,CAAC;YAC1B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YACjC,aAAa,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YACrC,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;aAAM,IAAI,aAAa,KAAK,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;gBAAE,OAAO,IAAI,CAAC;YAClC,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;YAChD,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;QAED,IAAI,MAAM,EAAE,CAAC;YACX,4DAA4D;YAC5D,mBAAmB;YACnB,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,aAAa;gBAAE,OAAO,IAAI,CAAC;YAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,CAAC;YACZ,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;YAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,EAAE,CAAC,EAAE,EAAE,CAAC;gBACvC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,GAAG,aAAa;YAAE,OAAO,IAAI,CAAC;QACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC,CAAC;IACvD,CAAC;IAED,mEAAmE;IAC3D,QAAQ,CAAC,SAAiB;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,IAAI,CAAC;YACH,iDAAiD;YACjD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAClC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,oBAAoB;YACzC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,2BAA2B;YAChD,8BAA8B;YAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IAED,iDAAiD;IACzC,iBAAiB;QACvB,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAEzB,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,0EAA0E;IAClE,iBAAiB;QACvB,IAAI,IAAI,CAAC,qBAAqB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAE9D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAC1D,gBAAgB,CACjB,CAAC;QACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,CAAC,IAAI,CACT,iCAAiC,KAAK,eAAe,IAAI,CAAC,iBAAiB,MAAM;YAC/E,gBAAgB,KAAK,UAAU,IAAI,CAAC,iBAAiB,OAAO,CAC/D,CAAC;QAEF,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,2DAA2D;IACnD,YAAY,CAAC,KAAc;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QAEvB,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,mBAAmB,CAAC,OAAe;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,MAAc,CAAC;QAEnB,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,oBAAoB;YACtC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC,kBAAkB;YAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,MAAM,GAAG,KAAK,EAAE,CAAC;YAC1B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,yBAAyB;YACjD,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1B,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;YACjB,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,CAAC,yBAAyB;YACjD,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3B,CAAC;QAED,0BAA0B;QAC1B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;IAChD,CAAC;CACF"}
|
|
@@ -0,0 +1,89 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Local ATR Rule Drafter
|
|
3
|
+
* 本地 ATR 規則草稿產生器
|
|
4
|
+
*
|
|
5
|
+
* Uses the Guard's own LLM (already configured via env vars or llm.enc)
|
|
6
|
+
* to draft ATR rules from locally detected patterns, then submits
|
|
7
|
+
* proposals to Threat Cloud for community consensus.
|
|
8
|
+
*
|
|
9
|
+
* This runs entirely on the user's machine using the user's own LLM API key.
|
|
10
|
+
* No additional cost to the Panguard project.
|
|
11
|
+
*
|
|
12
|
+
* @module @panguard-ai/panguard-guard/engines/atr-drafter
|
|
13
|
+
*/
|
|
14
|
+
import type { SecurityEvent } from '@panguard-ai/core';
|
|
15
|
+
import type { AnalyzeLLM } from '../types.js';
|
|
16
|
+
import type { ThreatCloudClient } from '../threat-cloud/index.js';
|
|
17
|
+
/** Drafter configuration */
|
|
18
|
+
export interface ATRDrafterConfig {
|
|
19
|
+
/** Minimum events before considering drafting a rule (default: 5) */
|
|
20
|
+
minEvents: number;
|
|
21
|
+
/** Minimum distinct IPs (default: 2) */
|
|
22
|
+
minDistinctIPs: number;
|
|
23
|
+
/** Time window for pattern accumulation in ms (default: 6 hours) */
|
|
24
|
+
windowMs: number;
|
|
25
|
+
/** Max proposals to submit per cycle (default: 3) */
|
|
26
|
+
maxProposalsPerCycle: number;
|
|
27
|
+
/** LLM provider name for metadata */
|
|
28
|
+
llmProvider: string;
|
|
29
|
+
/** LLM model name for metadata */
|
|
30
|
+
llmModel: string;
|
|
31
|
+
}
|
|
32
|
+
export declare class ATRDrafter {
|
|
33
|
+
private readonly llm;
|
|
34
|
+
private readonly threatCloud;
|
|
35
|
+
private readonly config;
|
|
36
|
+
private readonly patterns;
|
|
37
|
+
private readonly submittedPatterns;
|
|
38
|
+
private cycleTimer;
|
|
39
|
+
constructor(llm: AnalyzeLLM, threatCloud: ThreatCloudClient, config?: Partial<ATRDrafterConfig>);
|
|
40
|
+
/**
|
|
41
|
+
* Record a detected threat event for pattern accumulation.
|
|
42
|
+
* Called by GuardEngine after a threat is detected.
|
|
43
|
+
* 記錄偵測到的威脅事件用於模式累積
|
|
44
|
+
*/
|
|
45
|
+
recordDetection(event: SecurityEvent, verdict: {
|
|
46
|
+
conclusion: string;
|
|
47
|
+
confidence: number;
|
|
48
|
+
mitreTechniques?: string[];
|
|
49
|
+
atrRulesMatched?: string[];
|
|
50
|
+
}): void;
|
|
51
|
+
/**
|
|
52
|
+
* Start periodic drafting cycle.
|
|
53
|
+
* 啟動定期草稿產生週期
|
|
54
|
+
*/
|
|
55
|
+
start(): void;
|
|
56
|
+
/**
|
|
57
|
+
* Stop the drafting cycle.
|
|
58
|
+
* 停止草稿產生週期
|
|
59
|
+
*/
|
|
60
|
+
stop(): void;
|
|
61
|
+
/**
|
|
62
|
+
* Run a single draft cycle: find mature patterns, draft rules, submit proposals.
|
|
63
|
+
* 執行單次草稿週期:找成熟模式 → 產生規則 → 提交提案
|
|
64
|
+
*/
|
|
65
|
+
runDraftCycle(): Promise<{
|
|
66
|
+
drafted: number;
|
|
67
|
+
submitted: number;
|
|
68
|
+
}>;
|
|
69
|
+
private draftAndReview;
|
|
70
|
+
/**
|
|
71
|
+
* Call LLM with an AbortController timeout.
|
|
72
|
+
* Throws if the LLM does not respond within LLM_TIMEOUT_MS.
|
|
73
|
+
*/
|
|
74
|
+
private callLLMWithTimeout;
|
|
75
|
+
/**
|
|
76
|
+
* Validate that a YAML string is a well-formed ATR rule with required fields.
|
|
77
|
+
* Returns null on success, or an error description on failure.
|
|
78
|
+
*/
|
|
79
|
+
validateATRYaml(ruleContent: string): string | null;
|
|
80
|
+
private buildDraftPrompt;
|
|
81
|
+
private buildReviewPrompt;
|
|
82
|
+
extractYaml(text: string): string;
|
|
83
|
+
private cleanupOldPatterns;
|
|
84
|
+
/** Get current pattern count (for status display) */
|
|
85
|
+
getPatternCount(): number;
|
|
86
|
+
/** Get submitted proposal count */
|
|
87
|
+
getSubmittedCount(): number;
|
|
88
|
+
}
|
|
89
|
+
//# sourceMappingURL=atr-drafter.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"atr-drafter.d.ts","sourceRoot":"","sources":["../../src/engines/atr-drafter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AA6BlE,4BAA4B;AAC5B,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,cAAc,EAAE,MAAM,CAAC;IACvB,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAqBD,qBAAa,UAAU;IAOnB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAP9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmC;IAC5D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IACvD,OAAO,CAAC,UAAU,CAA+C;gBAG9C,GAAG,EAAE,UAAU,EACf,WAAW,EAAE,iBAAiB,EAC/C,MAAM,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC;IAKpC;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE;QAC7C,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5B,GAAG,IAAI;IA+CR;;;OAGG;IACH,KAAK,IAAI,IAAI;IAiBb;;;OAGG;IACH,IAAI,IAAI,IAAI;IAOZ;;;OAGG;IACG,aAAa,IAAI,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;YA0ExD,cAAc;IAoD5B;;;OAGG;YACW,kBAAkB;IAmBhC;;;OAGG;IACH,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAgCnD,OAAO,CAAC,gBAAgB;IA+BxB,OAAO,CAAC,iBAAiB;IAiBzB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAsCjC,OAAO,CAAC,kBAAkB;IAU1B,qDAAqD;IACrD,eAAe,IAAI,MAAM;IAIzB,mCAAmC;IACnC,iBAAiB,IAAI,MAAM;CAG5B"}
|