@panguard-ai/panguard-guard 1.3.0 → 1.4.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/index.js +7 -6
- package/dist/cli/index.js.map +1 -1
- package/dist/dashboard/index.d.ts.map +1 -1
- package/dist/dashboard/index.js +108 -60
- package/dist/dashboard/index.js.map +1 -1
- package/dist/engines/atr-drafter.d.ts.map +1 -1
- package/dist/engines/atr-drafter.js +21 -52
- package/dist/engines/atr-drafter.js.map +1 -1
- package/dist/engines/atr-rule-creation-standard.d.ts +40 -0
- package/dist/engines/atr-rule-creation-standard.d.ts.map +1 -0
- package/dist/engines/atr-rule-creation-standard.js +250 -0
- package/dist/engines/atr-rule-creation-standard.js.map +1 -0
- package/dist/engines/skill-watcher.d.ts +24 -0
- package/dist/engines/skill-watcher.d.ts.map +1 -1
- package/dist/engines/skill-watcher.js +190 -68
- package/dist/engines/skill-watcher.js.map +1 -1
- package/dist/event-processor.d.ts.map +1 -1
- package/dist/event-processor.js +3 -1
- package/dist/event-processor.js.map +1 -1
- package/dist/license/index.d.ts +12 -44
- package/dist/license/index.d.ts.map +1 -1
- package/dist/license/index.js +26 -134
- package/dist/license/index.js.map +1 -1
- package/dist/rule-loader.d.ts.map +1 -1
- package/dist/rule-loader.js +1 -3
- package/dist/rule-loader.js.map +1 -1
- package/dist/types.d.ts +1 -1
- package/dist/types.d.ts.map +1 -1
- package/package.json +7 -7
- package/bundled-rules/sigma-rules/.gitkeep +0 -0
- package/bundled-rules/sigma-rules/auto-generated/.meta.json +0 -626
- package/bundled-rules/sigma-rules/auto-generated/.rules-meta.json +0 -44
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-02d66266.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-09c197b6.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-0a127b82.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-12c6cf09.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-138e2c5f.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-144f04b0.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-14dc41fc.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-259e088a.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-2dda51a5.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-318e5d10.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-34e186b7.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-356ceb2d.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3747a529.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3acc1e4c.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3b84adb8.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3d47b8a5.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3d9474c8.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-3fdeaae2.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-50391b7a.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-64108d99.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-6806d87e.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-683bc02e.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-6b908472.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-6ccc9a9a.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-704f2829.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-728445a5.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-7d2469e4.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-7efc680b.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-80413854.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-8455faa8.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-84c22235.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-991097d5.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-a2a7dea0.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-a329a8c4.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-a4953a0c.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-b761f239.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-bccd0386.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-c6523317.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-c7456969.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-c89d1856.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-cb47afe1.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-d11c2adf.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-d13720b9.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-da034fdb.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-db92510a.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-e53836a4.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-e6f9a231.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-ee8e125d.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-f07e4017.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/auth-bypass-f942a244.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/code-injection-0845d54d.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-0b4ed6f6.yml +0 -36
- package/bundled-rules/sigma-rules/auto-generated/code-injection-14646374.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-2b848b90.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-3d49d056.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-4a75e716.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-4e615e9c.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/code-injection-5d00f27d.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/code-injection-7057b8cd.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-7a268eb0.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-84de0f98.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/code-injection-85cb64d7.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/code-injection-944eb289.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-a2a922f5.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-a474bd30.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-a91d74a0.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/code-injection-cb4008a5.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/code-injection-dbfc8a28.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/command-injection-036c2eb1.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-03c4921b.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-0addc01d.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-0bc5027f.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-107c1f90.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-115ab758.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-13d42ad1.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-14b0eb11.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-16959437.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1725c2c2.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1a0dc0f4.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1bee9f5b.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1c405735.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1ca77d8b.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1d1c77dd.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-1f68550b.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-22ecedeb.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-24baa0ae.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-256ecb74.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-25bd2efe.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-25c6aeb7.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-27a2a5df.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-282267f9.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-2b2b3747.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-2c99fa05.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-2e2e2e02.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-2f00759d.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-31879597.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-3301a600.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-389aacd4.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-39971646.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-3a8d0580.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-3bdcabe7.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-3e84ee4e.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-405501b3.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4125f348.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-41778138.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-42eac79d.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-439aa913.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-439c24c2.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-445f7b15.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-46dd7c5d.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-47f12d88.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4934a48a.yml +0 -37
- package/bundled-rules/sigma-rules/auto-generated/command-injection-49e18986.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4b2afaf1.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4caa5d95.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-4d4d059c.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-53f1019a.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-547096cc.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-58082bd6.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-5913cff2.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-5c6724dc.yml +0 -37
- package/bundled-rules/sigma-rules/auto-generated/command-injection-5e87663b.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-606d29b9.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-615a8500.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-64513e90.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-6479e1f8.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-694a3155.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-6986f459.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-701cd005.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-705b7ddc.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7540d6a2.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7578a3f1.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-767ee7bf.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-76f4d848.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-77c52089.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-785b27dc.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-789bc8e8.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-78e838c0.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7b13727a.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7b6b35f9.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7be9aa34.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7ce9773d.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7d255250.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7d2e697b.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-7d9e1c44.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-801b1ea0.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-80237d88.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-84146bbe.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-854bf852.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-87abfc75.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-88ac6c67.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-8971aea2.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-8a36aeab.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-8bea53a0.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-8c61719c.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-91a4d292.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-9a7c5141.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-9dcabe45.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a00e7fab.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a56d633b.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a58e9280.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a76d6236.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a909099c.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-a9aeda43.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ab88960f.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ab9a6a29.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b1135712.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b23685a3.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b3a260b5.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b415ea95.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b44fc412.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-b67ef9ae.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-bb7467e3.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-be26bbf9.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-bea1e186.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-bee27591.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c0d169f4.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c1429b8a.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c35202ab.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c5fa17de.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-c77d1205.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d20ff181.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d2b2c47a.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d2ea50c9.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d5bb587d.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-d9724ebf.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-da7906d5.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-db923bd6.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-dc97961c.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e47af373.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e59c9fd6.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e6305166.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e692f110.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e7561649.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e8acd6e5.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-e90bce79.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-eb633a58.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ede541e9.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-eecd41b6.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ef94112f.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-f2d856ef.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-fd251129.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-fd858b65.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/command-injection-fdbedfe1.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/command-injection-ff8450c2.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/deserialization-020bdb36.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/deserialization-1d4b21fe.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/deserialization-22bf04f6.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-233dc2d5.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-2b276aeb.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/deserialization-38e9f4c9.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-39e97031.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-43816c70.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-4c88f42c.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-4d41006d.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-4e18b6fc.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/deserialization-4fc32a3a.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-552ccecf.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-598e1872.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-5ad40bc7.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-653bb09d.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/deserialization-695aa6d8.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-6b1caed0.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-714a6b2d.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-71fe2100.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-8f89e62a.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/deserialization-907f9977.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-96165540.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-a47f0dc2.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-b3723d58.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-b4e8f19d.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-bb942c55.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-e9739f9a.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/deserialization-ebc3cf71.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-edd90efc.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-ee42f7bb.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-f18bf98a.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/deserialization-f4a2abfd.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/file-upload-0540e34a.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-3c2785c0.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/file-upload-3f91abe4.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/file-upload-41242eb2.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-425435ad.yml +0 -37
- package/bundled-rules/sigma-rules/auto-generated/file-upload-4f0d9f9c.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-52c4553d.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-961c1ff6.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/file-upload-9a960136.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-a011aaec.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-b0c12e08.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-c3407187.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-ce3414fa.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/file-upload-e9b2aec2.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/idor-0d595ff0.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-13ac93b6.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-1e071abf.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-31c8f4ff.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-3ab138af.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/idor-3af6bc7b.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/idor-51d17890.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-6222e61f.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-6997f187.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-6c20a64c.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-71dec8d6.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-742435ee.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-8b926322.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-9af66900.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-9e4daa75.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/idor-a22eed69.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-bde1f1b4.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-c10a3f0b.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-cda6b9d9.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/idor-d87ab272.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/idor-dc7d8ce2.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-ef23476d.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/idor-fe58fb79.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-0c2cfaae.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-0fb3614a.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-113331d9.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-23658a38.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-307f795a.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-33cfe63d.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-34ea3e0d.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-397c516e.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-3eb28506.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-448c4463.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-4a5e7ab9.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-4cc8371f.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-4f164f69.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-5ca4023f.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-668a20c1.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-66ca91d6.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-70291d91.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-707cf74d.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-733ddaff.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-85c2f361.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-8b130c20.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-8b5aea05.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-91f58f71.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-95986365.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-9ffb9771.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-a2790c52.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-a631203f.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-acd64119.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-b1110f0f.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-b18e89b9.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-ba345f86.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-c2b460d8.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-c336d5f3.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-c483f919.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-e717f021.yml +0 -30
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-f3cc6d1d.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/information-disclosure-f933d96b.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-3587b23b.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-707748e6.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-83c5ec37.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-9c5a1730.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-c9b9a0ce.yml +0 -27
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-f3348dbb.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/open-redirect-fe767343.yml +0 -29
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-0134dedd.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-01def89d.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-02fc2412.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-0680a80c.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-074b1e83.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-075f9810.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-0933813f.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-177ef252.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-1a027479.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-1a538e86.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-1e8f03b5.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-2aac6249.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-2bfd830c.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-2d756d9c.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-312356d9.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-324e06ed.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-3592dc14.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-401b9477.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-407fcfa5.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-45860981.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-4af16c70.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-5089220f.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-51153e8b.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-51610460.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-519bddf2.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-5688190f.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-5768227f.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-598d6cd9.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-59d3dc24.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-621e9bfa.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-68c7bea8.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-6ff7dd35.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-714bf167.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-75db3810.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-762efbc9.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-77f64705.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-7bf12581.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-7f11b0d1.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-7f83bac0.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-7fe47ed2.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-85142fbb.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-8ddf496b.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-8f4c7f3f.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-92a9a648.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-950d10c6.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-95585823.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-9b8c4cd5.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-9c95efee.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-a16ba6d6.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-a195f003.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-a545772f.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ab6d4242.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-acd4da74.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ad6dc18c.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-aef21f28.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ba468813.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-c2194df8.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-c311c71f.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-c50d056f.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-c83fe33e.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-cbc4a350.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-cd35d87f.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-cf854f5c.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d2e70938.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d3f875d2.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d4185585.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d6bd80d4.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d6d9ef47.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-d70f1769.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-dcd510d2.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-dcd893b1.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e0de5670.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e2932a2b.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e522e7da.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e8488ccc.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-e99ac225.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ea081abf.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ea7049b4.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-eb1ee0b9.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ebe846e0.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ebfee8c4.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ef92a1f5.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f0fa97af.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f20107a7.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f28974bc.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f4dcf5d6.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f5e9f08b.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f65ac6e1.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-f6aaa151.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-fdf57346.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-fdf8800a.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/path-traversal-ff4b15ca.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-19dfac97.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-1b41874d.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-1e8f1c5a.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-23be78c7.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-35d4bbb6.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-3b577514.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-3d4905ab.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/sqli-4a98e459.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-4caa41ad.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/sqli-5624d62d.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-5686bd46.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/sqli-65b70af5.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/sqli-67e16bd4.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-683d742c.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-6cad1f41.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-7bae5a5d.yml +0 -31
- package/bundled-rules/sigma-rules/auto-generated/sqli-7f116375.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-8a7cfde6.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-8d65ff6d.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-9afdaba5.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-b0b913bd.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/sqli-b11aa59e.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/sqli-b2af7b55.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-b416fb55.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-b94b78e3.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/sqli-be106e71.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/sqli-bf0caccd.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/sqli-bfffdf4b.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-c908d124.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-cc3dd488.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-cfe39537.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-d1c3220e.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-d2d09846.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-d9a18b81.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-e465adf1.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-e4eb5d6d.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-eec9cffc.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-f0f9d121.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-f289000c.yml +0 -32
- package/bundled-rules/sigma-rules/auto-generated/sqli-f788f751.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/ssrf-00ae35c6.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/ssrf-016ea544.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-07d8c729.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-09c81b6a.yml +0 -33
- package/bundled-rules/sigma-rules/auto-generated/ssrf-16b94ee0.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-1815e00b.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-1935a79a.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-1e4da2f1.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-2ebcdf25.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-2f968702.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/ssrf-343b5e41.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-358214d1.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-366be59d.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-36bd4777.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-483e525f.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-49a097a8.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-5e0eff26.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-7077e8fa.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-70fdb2cd.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-73e7995c.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/ssrf-7a58b206.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/ssrf-7ce75b91.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/ssrf-84d3755e.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-9b123631.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/ssrf-9f94f916.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-b51bc3c2.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/ssrf-bc20f525.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-cdc61dcd.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-e7d70aae.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/ssrf-eab49130.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-efc68985.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-f1aeace6.yml +0 -35
- package/bundled-rules/sigma-rules/auto-generated/ssrf-f8f39001.yml +0 -34
- package/bundled-rules/sigma-rules/auto-generated/xss-01606bc8.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-0f5f70a8.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-0fb9f252.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-16524865.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-189723e0.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-1c2f1712.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-1ec71dde.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-1efa9c30.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-21e5eb26.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-23621a1c.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-27f10ee7.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-29df071e.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-2e4de213.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-2fd7b071.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-3097ef82.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-30e10280.yml +0 -37
- package/bundled-rules/sigma-rules/auto-generated/xss-319b5d4c.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-324461ad.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-34c0f631.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-376a26d0.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-3f6e9e38.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-44173677.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-442dc36b.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-46a6d330.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-50d4c136.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-5119be94.yml +0 -37
- package/bundled-rules/sigma-rules/auto-generated/xss-5138d9af.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-52259250.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-5a7b75a5.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-5da5c562.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-5e0acd20.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-5f2e1485.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-61bf8d4b.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-66cf0fa3.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-6c0a16b0.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-6e77e7db.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-75abec44.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-912198ad.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-919ce319.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-956d51c5.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-97a8015a.yml +0 -37
- package/bundled-rules/sigma-rules/auto-generated/xss-98d357f3.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-9b651733.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-9cdea131.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-9cf740eb.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-9e4f8557.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-a10a224f.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-a19cd758.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-a51a1104.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-ac094443.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-ae667fcd.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-af477c24.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-b1e89c09.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-b51d034c.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-b75a9bc6.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-b80267dd.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-b8dc3a4a.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-b999aeb5.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-bc5278bd.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-bd9710ff.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-c3560984.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-c5eb1dde.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-c85c6a04.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-c91ca363.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-cd0dd77b.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-cdc5ddc9.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-cdfd9e86.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-d41f9681.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-d76f5bb1.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-d9c2392d.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-dc0d3e3b.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-e0c75616.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-e24e73f9.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-e6e3094e.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-e95ff02e.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-eae4cb36.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-eb6c2227.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-f117429c.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xss-f53973c8.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-f6b89d1f.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-fd1134cb.yml +0 -38
- package/bundled-rules/sigma-rules/auto-generated/xss-fea47922.yml +0 -39
- package/bundled-rules/sigma-rules/auto-generated/xxe-0291de69.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-10732b3f.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-115dfd46.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-2685c7c8.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-296fcc81.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-2a18b1d7.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-2a74e50f.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-2c11c12c.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-3bf77c07.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-3d897854.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-3dba4046.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-408fd30e.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-448ec952.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-499abe33.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-5137adea.yml +0 -27
- package/bundled-rules/sigma-rules/auto-generated/xxe-518b805f.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-52be17d9.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-5a1aefac.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-5d278c48.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-6074a288.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-6d5a0025.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-6ea4eba9.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-8817e845.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-91325d0e.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-a23a538e.yml +0 -27
- package/bundled-rules/sigma-rules/auto-generated/xxe-a2c36fd6.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-a56af19a.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-abec61f4.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-b30924ad.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-b52850cb.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-be4027c2.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-ce24d838.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-dd7d0cc8.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-e3ca9d19.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-e7d11844.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-e9fc5dce.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-f3e972b5.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-f9082757.yml +0 -28
- package/bundled-rules/sigma-rules/auto-generated/xxe-fb331fe1.yml +0 -28
- package/bundled-rules/sigma-rules/community/2010/Exploits/CVE-2010-5278/web_cve_2010_5278_exploitation_attempt.yml +0 -26
- package/bundled-rules/sigma-rules/community/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml +0 -40
- package/bundled-rules/sigma-rules/community/2014/TA/Axiom/proc_creation_win_apt_zxshell.yml +0 -31
- package/bundled-rules/sigma-rules/community/2014/TA/Turla/proc_creation_win_apt_turla_commands_critical.yml +0 -32
- package/bundled-rules/sigma-rules/community/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.yml +0 -35
- package/bundled-rules/sigma-rules/community/2015/Exploits/CVE-2015-1641/proc_creation_win_exploit_cve_2015_1641.yml +0 -26
- package/bundled-rules/sigma-rules/community/2017/Exploits/CVE-2017-0261/proc_creation_win_exploit_cve_2017_0261.yml +0 -28
- package/bundled-rules/sigma-rules/community/2017/Exploits/CVE-2017-11882/proc_creation_win_exploit_cve_2017_11882.yml +0 -29
- package/bundled-rules/sigma-rules/community/2017/Exploits/CVE-2017-8759/proc_creation_win_exploit_cve_2017_8759.yml +0 -29
- package/bundled-rules/sigma-rules/community/2017/Malware/Adwind-RAT/proc_creation_win_malware_adwind.yml +0 -30
- package/bundled-rules/sigma-rules/community/2017/Malware/CosmicDuke/win_security_mal_cosmik_duke_persistence.yml +0 -33
- package/bundled-rules/sigma-rules/community/2017/Malware/Fireball/proc_creation_win_malware_fireball.yml +0 -27
- package/bundled-rules/sigma-rules/community/2017/Malware/Hancitor/proc_access_win_malware_verclsid_shellcode.yml +0 -33
- package/bundled-rules/sigma-rules/community/2017/Malware/NotPetya/proc_creation_win_malware_notpetya.yml +0 -38
- package/bundled-rules/sigma-rules/community/2017/Malware/PlugX/proc_creation_win_malware_plugx_susp_exe_locations.yml +0 -96
- package/bundled-rules/sigma-rules/community/2017/Malware/StoneDrill/win_system_apt_stonedrill.yml +0 -28
- package/bundled-rules/sigma-rules/community/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml +0 -44
- package/bundled-rules/sigma-rules/community/2017/TA/APT10/proc_creation_win_apt_apt10_cloud_hopper.yml +0 -29
- package/bundled-rules/sigma-rules/community/2017/TA/Dragonfly/proc_creation_win_apt_ta17_293a_ps.yml +0 -27
- package/bundled-rules/sigma-rules/community/2017/TA/Equation-Group/net_firewall_apt_equationgroup_c2.yml +0 -30
- package/bundled-rules/sigma-rules/community/2017/TA/Lazarus/proc_creation_win_apt_lazarus_binary_masquerading.yml +0 -29
- package/bundled-rules/sigma-rules/community/2017/TA/Pandemic/registry_event_apt_pandemic.yml +0 -24
- package/bundled-rules/sigma-rules/community/2017/TA/Turla/pipe_created_apt_turla_named_pipes.yml +0 -31
- package/bundled-rules/sigma-rules/community/2017/TA/Turla/win_system_apt_carbonpaper_turla.yml +0 -30
- package/bundled-rules/sigma-rules/community/2017/TA/Turla/win_system_apt_turla_service_png.yml +0 -27
- package/bundled-rules/sigma-rules/community/2018/Exploits/CVE-2018-13379/web_cve_2018_13379_fortinet_preauth_read_exploit.yml +0 -25
- package/bundled-rules/sigma-rules/community/2018/Exploits/CVE-2018-15473/lnx_sshd_exploit_cve_2018_15473.yml +0 -24
- package/bundled-rules/sigma-rules/community/2018/Exploits/CVE-2018-2894/web_cve_2018_2894_weblogic_exploit.yml +0 -26
- package/bundled-rules/sigma-rules/community/2018/Malware/Elise-Backdoor/proc_creation_win_malware_elise.yml +0 -37
- package/bundled-rules/sigma-rules/community/2018/TA/APT27/proc_creation_win_apt_apt27_emissary_panda.yml +0 -33
- package/bundled-rules/sigma-rules/community/2018/TA/APT28/proc_creation_win_apt_sofacy.yml +0 -40
- package/bundled-rules/sigma-rules/community/2018/TA/APT29-CozyBear/file_event_win_apt_cozy_bear_phishing_campaign_indicators.yml +0 -30
- package/bundled-rules/sigma-rules/community/2018/TA/APT29-CozyBear/proc_creation_win_apt_apt29_phishing_campaign_indicators.yml +0 -32
- package/bundled-rules/sigma-rules/community/2018/TA/APT32-Oceanlotus/registry_event_apt_oceanlotus_registry.yml +0 -44
- package/bundled-rules/sigma-rules/community/2018/TA/MuddyWater/proc_creation_win_apt_muddywater_activity.yml +0 -40
- package/bundled-rules/sigma-rules/community/2018/TA/OilRig/proc_creation_win_apt_oilrig_mar18.yml +0 -54
- package/bundled-rules/sigma-rules/community/2018/TA/OilRig/registry_event_apt_oilrig_mar18.yml +0 -41
- package/bundled-rules/sigma-rules/community/2018/TA/OilRig/win_security_apt_oilrig_mar18.yml +0 -42
- package/bundled-rules/sigma-rules/community/2018/TA/OilRig/win_system_apt_oilrig_mar18.yml +0 -43
- package/bundled-rules/sigma-rules/community/2018/TA/Slingshot/proc_creation_win_apt_slingshot.yml +0 -32
- package/bundled-rules/sigma-rules/community/2018/TA/Slingshot/win_security_apt_slingshot.yml +0 -31
- package/bundled-rules/sigma-rules/community/2018/TA/TropicTrooper/proc_creation_win_apt_tropictrooper.yml +0 -21
- package/bundled-rules/sigma-rules/community/2019/Exploits/BearLPE-Exploit/proc_creation_win_exploit_other_bearlpe.yml +0 -33
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-0708/win_security_exploit_cve_2019_0708_scanner_poc.yml +0 -27
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-0708/win_system_exploit_cve_2019_0708.yml +0 -30
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-11510/web_cve_2019_11510_pulsesecure_exploit.yml +0 -23
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-1378/proc_creation_win_exploit_cve_2019_1378.yml +0 -41
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-1388/proc_creation_win_exploit_cve_2019_1388.yml +0 -34
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-14287/lnx_sudo_exploit_cve_2019_14287.yml +0 -33
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-14287/proc_creation_lnx_exploit_cve_2019_14287.yml +0 -28
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-19781/web_cve_2019_19781_citrix_exploit.yml +0 -33
- package/bundled-rules/sigma-rules/community/2019/Exploits/CVE-2019-3398/web_cve_2019_3398_confluence.yml +0 -26
- package/bundled-rules/sigma-rules/community/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml +0 -34
- package/bundled-rules/sigma-rules/community/2019/Malware/Chafer/proxy_malware_chafer_url_pattern.yml +0 -22
- package/bundled-rules/sigma-rules/community/2019/Malware/Dridex/proc_creation_win_malware_dridex.yml +0 -51
- package/bundled-rules/sigma-rules/community/2019/Malware/Dtrack-RAT/proc_creation_win_malware_dtrack.yml +0 -34
- package/bundled-rules/sigma-rules/community/2019/Malware/Emotet/proc_creation_win_malware_emotet.yml +0 -44
- package/bundled-rules/sigma-rules/community/2019/Malware/Formbook/proc_creation_win_malware_formbook.yml +0 -50
- package/bundled-rules/sigma-rules/community/2019/Malware/LockerGoga/proc_creation_win_malware_lockergoga_ransomware.yml +0 -25
- package/bundled-rules/sigma-rules/community/2019/Malware/QBot/proc_creation_win_malware_qbot.yml +0 -32
- package/bundled-rules/sigma-rules/community/2019/Malware/Ryuk/proc_creation_win_malware_ryuk.yml +0 -50
- package/bundled-rules/sigma-rules/community/2019/Malware/Snatch/proc_creation_win_malware_snatch_ransomware.yml +0 -24
- package/bundled-rules/sigma-rules/community/2019/Malware/Ursnif/proxy_malware_ursnif_c2_url.yml +0 -32
- package/bundled-rules/sigma-rules/community/2019/Malware/Ursnif/proxy_malware_ursnif_download_url.yml +0 -26
- package/bundled-rules/sigma-rules/community/2019/Malware/Ursnif/registry_add_malware_ursnif.yml +0 -26
- package/bundled-rules/sigma-rules/community/2019/TA/APC-C-12/proc_creation_win_apt_aptc12_bluemushroom.yml +0 -27
- package/bundled-rules/sigma-rules/community/2019/TA/APT31/proc_creation_win_apt_apt31_judgement_panda.yml +0 -39
- package/bundled-rules/sigma-rules/community/2019/TA/APT40/proxy_apt_apt40_dropbox_tool_ua.yml +0 -25
- package/bundled-rules/sigma-rules/community/2019/TA/Bear-APT-Activity/proc_creation_win_apt_bear_activity_gtr19.yml +0 -31
- package/bundled-rules/sigma-rules/community/2019/TA/EmpireMonkey/proc_creation_win_apt_empiremonkey.yml +0 -26
- package/bundled-rules/sigma-rules/community/2019/TA/EquationGroup/proc_creation_win_apt_equationgroup_dll_u_load.yml +0 -28
- package/bundled-rules/sigma-rules/community/2019/TA/MustangPanda/proc_creation_win_apt_mustangpanda.yml +0 -36
- package/bundled-rules/sigma-rules/community/2019/TA/Operation-Wocao/README.md +0 -9
- package/bundled-rules/sigma-rules/community/2019/TA/Operation-Wocao/proc_creation_win_apt_wocao.yml +0 -46
- package/bundled-rules/sigma-rules/community/2019/TA/Operation-Wocao/win_security_apt_wocao.yml +0 -35
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_exchange_exploit.yml +0 -26
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-0688/web_cve_2020_0688_msexchange.yml +0 -28
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-0688/win_vul_cve_2020_0688.yml +0 -29
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-10148/web_cve_2020_10148_solarwinds_exploit.yml +0 -37
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml +0 -39
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-1048/proc_creation_win_exploit_cve_2020_1048.yml +0 -32
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-1048/registry_set_exploit_cve_2020_1048_new_printer_port.yml +0 -37
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-1350/proc_creation_win_exploit_cve_2020_1350.yml +0 -33
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-1472/proc_creation_win_exploit_cve_2020_1472_zero_poc.yml +0 -38
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-14882/web_cve_2020_14882_weblogic_exploit.yml +0 -27
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-28188/web_cve_2020_28188_terramaster_rce_exploit.yml +0 -35
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-3452/web_cve_2020_3452_cisco_asa_ftd.yml +0 -34
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-5902/web_cve_2020_5902_f5_bigip.yml +0 -32
- package/bundled-rules/sigma-rules/community/2020/Exploits/CVE-2020-8193/web_cve_2020_8193_8195_citrix_exploit.yml +0 -31
- package/bundled-rules/sigma-rules/community/2020/Malware/Blue-Mockingbird/proc_creation_win_malware_blue_mockingbird.yml +0 -35
- package/bundled-rules/sigma-rules/community/2020/Malware/Blue-Mockingbird/registry_set_mal_blue_mockingbird.yml +0 -29
- package/bundled-rules/sigma-rules/community/2020/Malware/ComRAT/proxy_malware_comrat_network_indicators.yml +0 -24
- package/bundled-rules/sigma-rules/community/2020/Malware/Emotet/proc_creation_win_malware_emotet_rundll32_execution.yml +0 -37
- package/bundled-rules/sigma-rules/community/2020/Malware/FlowCloud/registry_event_malware_flowcloud_markers.yml +0 -30
- package/bundled-rules/sigma-rules/community/2020/Malware/Ke3chang-TidePool/proc_creation_win_malware_ke3chang_tidepool.yml +0 -33
- package/bundled-rules/sigma-rules/community/2020/Malware/Maze/proc_creation_win_malware_maze_ransomware.yml +0 -39
- package/bundled-rules/sigma-rules/community/2020/Malware/Trickbot/proc_creation_win_malware_trickbot_wermgr.yml +0 -29
- package/bundled-rules/sigma-rules/community/2020/TA/Evilnum/proc_creation_win_apt_evilnum_jul20.yml +0 -29
- package/bundled-rules/sigma-rules/community/2020/TA/GALLIUM/proc_creation_win_apt_gallium_iocs.yml +0 -65
- package/bundled-rules/sigma-rules/community/2020/TA/GALLIUM/win_dns_analytic_apt_gallium.yml +0 -37
- package/bundled-rules/sigma-rules/community/2020/TA/Greenbug/proc_creation_win_apt_greenbug_may20.yml +0 -52
- package/bundled-rules/sigma-rules/community/2020/TA/Lazarus/proc_creation_win_apt_lazarus_group_activity.yml +0 -60
- package/bundled-rules/sigma-rules/community/2020/TA/Leviathan/registry_event_apt_leviathan.yml +0 -22
- package/bundled-rules/sigma-rules/community/2020/TA/SolarWinds-Supply-Chain/README.md +0 -1
- package/bundled-rules/sigma-rules/community/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_cmds.yml +0 -56
- package/bundled-rules/sigma-rules/community/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_ps.yml +0 -33
- package/bundled-rules/sigma-rules/community/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_vbscript_pattern.yml +0 -31
- package/bundled-rules/sigma-rules/community/2020/TA/SolarWinds-Supply-Chain/web_solarwinds_supernova_webshell.yml +0 -28
- package/bundled-rules/sigma-rules/community/2020/TA/TAIDOOR-RAT/proc_creation_win_apt_taidoor.yml +0 -31
- package/bundled-rules/sigma-rules/community/2020/TA/Winnti/proc_creation_win_apt_winnti_mal_hk_jan20.yml +0 -40
- package/bundled-rules/sigma-rules/community/2020/TA/Winnti/proc_creation_win_apt_winnti_pipemon.yml +0 -32
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/av_exploit_cve_2021_34527_print_nightmare.yml +0 -29
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/file_delete_win_exploit_cve_2021_1675_print_nightmare.yml +0 -28
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/file_event_win_exploit_cve_2021_1675_printspooler.yml +0 -28
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/image_load_exploit_cve_2021_1675_spoolsv_dll_load.yml +0 -33
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/registry_event_cve_2021_1675_mimikatz_printernightmare_drivers.yml +0 -44
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler.yml +0 -42
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/win_exploit_cve_2021_1675_printspooler_operational.yml +0 -29
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/win_security_exploit_cve_2021_1675_printspooler_security.yml +0 -29
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-1675/zeek_dce_rpc_exploit_cve_2021_1675_printnightmare_print_driver_install.yml +0 -41
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-20090/web_cve_2021_20090_2021_20091_arcadyan_router_exploit.yml +0 -42
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-2109/web_cve_2021_2109_weblogic_rce_exploit.yml +0 -28
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-21972/web_cve_2021_21972_vsphere_unauth_rce_exploit.yml +0 -26
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-21978/web_cve_2021_21978_vmware_view_planner_exploit.yml +0 -28
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-22005/web_cve_2021_22005_vmware_file_upload.yml +0 -25
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-22123/web_cve_2021_22123_fortinet_exploit.yml +0 -28
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-22893/web_cve_2021_22893_pulse_secure_rce_exploit.yml +0 -37
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-26084/proc_creation_win_exploit_cve_2021_26084_atlassian_confluence.yml +0 -42
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-26084/web_cve_2021_26084_confluence_rce_exploit.yml +0 -37
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-26814/web_cve_2021_26814_wzuh_rce.yml +0 -24
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-26857/proc_creation_win_exploit_cve_2021_26857_msexchange.yml +0 -28
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-26858/file_event_win_cve_2021_26858_msexchange.yml +0 -34
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-26858/web_cve_2021_26858_iis_rce.yml +0 -38
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-27905/web_cve_2021_27905_apache_solr_exploit.yml +0 -38
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-28480/web_cve_2021_28480_exchange_exploit.yml +0 -26
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-33766/web_cve_2021_33766_msexchange_proxytoken.yml +0 -32
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-33771/file_event_win_cve_2021_31979_cve_2021_33771_exploits.yml +0 -40
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-33771/registry_set_cve_2021_31979_cve_2021_33771_exploits.yml +0 -36
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-35211/proc_creation_win_exploit_cve_2021_35211_servu.yml +0 -31
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-38647/zeek_http_exploit_cve_2021_38647_omigod_no_auth_rce.yml +0 -49
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-4034/lnx_auth_exploit_cve_2021_4034_pwnkit_lpe.yml +0 -28
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-40444/file_event_win_exploit_cve_2021_40444.yml +0 -35
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444.yml +0 -34
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-40444/proc_creation_win_exploit_cve_2021_40444_office_directory_traversal.yml +0 -37
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_adselfservice.yml +0 -26
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-40539/web_cve_2021_40539_manageengine_adselfservice_exploit.yml +0 -31
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-41379/file_event_win_cve_2021_41379_msi_lpe.yml +0 -27
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-41379/proc_creation_win_exploit_cve_2021_41379.yml +0 -39
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-41379/win_vul_cve_2021_41379.yml +0 -26
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-41773/web_cve_2021_41773_apache_path_traversal.yml +0 -42
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-42237/web_cve_2021_42237_sitecore_report_ashx.yml +0 -26
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-42278/win_system_exploit_cve_2021_42278.yml +0 -35
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-42287/win_security_samaccountname_spoofing_cve_2021_42287.yml +0 -30
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-42287/win_system_exploit_cve_2021_42287.yml +0 -33
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-42321/win_exchange_cve_2021_42321.yml +0 -29
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-43798/web_cve_2021_43798_grafana.yml +0 -79
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-44077/file_event_win_cve_2021_44077_poc_default_files.yml +0 -23
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-44228/proc_creation_win_exploit_cve_2021_44228_vmware_horizon_log4j.yml +0 -30
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j.yml +0 -52
- package/bundled-rules/sigma-rules/community/2021/Exploits/CVE-2021-44228/web_cve_2021_44228_log4j_fields.yml +0 -126
- package/bundled-rules/sigma-rules/community/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell.yml +0 -41
- package/bundled-rules/sigma-rules/community/2021/Exploits/ProxyShell-Exploit/web_exchange_proxyshell_successful.yml +0 -33
- package/bundled-rules/sigma-rules/community/2021/Exploits/RazerInstaller-LPE-Exploit/proc_creation_win_exploit_other_razorinstaller_lpe.yml +0 -30
- package/bundled-rules/sigma-rules/community/2021/Exploits/SystemNightmare-Exploit/proc_creation_win_exploit_other_systemnightmare.yml +0 -26
- package/bundled-rules/sigma-rules/community/2021/Exploits/VisualDoor-Exploit/README.md +0 -9
- package/bundled-rules/sigma-rules/community/2021/Exploits/VisualDoor-Exploit/web_sonicwall_jarrewrite_exploit.yml +0 -27
- package/bundled-rules/sigma-rules/community/2021/Malware/BlackByte/proc_creation_win_malware_blackbyte_ransomware.yml +0 -35
- package/bundled-rules/sigma-rules/community/2021/Malware/BlackByte/registry_set_win_malware_blackbyte_privesc_registry.yml +0 -32
- package/bundled-rules/sigma-rules/community/2021/Malware/Conti/proc_creation_win_malware_conti.yml +0 -25
- package/bundled-rules/sigma-rules/community/2021/Malware/Conti/proc_creation_win_malware_conti_7zip.yml +0 -26
- package/bundled-rules/sigma-rules/community/2021/Malware/Conti/proc_creation_win_malware_conti_ransomware_commands.yml +0 -31
- package/bundled-rules/sigma-rules/community/2021/Malware/Conti/proc_creation_win_malware_conti_ransomware_database_dump.yml +0 -35
- package/bundled-rules/sigma-rules/community/2021/Malware/DarkSide/proc_creation_win_malware_darkside_ransomware.yml +0 -30
- package/bundled-rules/sigma-rules/community/2021/Malware/Devil-Bait/README.md +0 -15
- package/bundled-rules/sigma-rules/community/2021/Malware/Devil-Bait/file_event_win_malware_devil_bait_script_drop.yml +0 -31
- package/bundled-rules/sigma-rules/community/2021/Malware/Devil-Bait/proc_creation_win_malware_devil_bait_output_redirect.yml +0 -40
- package/bundled-rules/sigma-rules/community/2021/Malware/Devil-Bait/proxy_malware_devil_bait_c2_communication.yml +0 -25
- package/bundled-rules/sigma-rules/community/2021/Malware/FoggyWeb/image_load_malware_foggyweb_nobelium.yml +0 -23
- package/bundled-rules/sigma-rules/community/2021/Malware/Goofy-Guineapig/README.md +0 -17
- package/bundled-rules/sigma-rules/community/2021/Malware/Goofy-Guineapig/file_event_win_malware_goofy_guineapig_file_indicators.yml +0 -26
- package/bundled-rules/sigma-rules/community/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_broken_cmd.yml +0 -21
- package/bundled-rules/sigma-rules/community/2021/Malware/Goofy-Guineapig/proc_creation_win_malware_goofy_guineapig_googleupdate_uncommon_child_instance.yml +0 -27
- package/bundled-rules/sigma-rules/community/2021/Malware/Goofy-Guineapig/proxy_malware_goofy_gunieapig_c2_communication.yml +0 -21
- package/bundled-rules/sigma-rules/community/2021/Malware/Goofy-Guineapig/win_system_malware_goofy_guineapig_service_persistence.yml +0 -27
- package/bundled-rules/sigma-rules/community/2021/Malware/Moriya-Rootkit/file_event_win_moriya_rootkit.yml +0 -27
- package/bundled-rules/sigma-rules/community/2021/Malware/Netwire/registry_add_malware_netwire.yml +0 -29
- package/bundled-rules/sigma-rules/community/2021/Malware/Pingback/file_event_win_malware_pingback_backdoor.yml +0 -32
- package/bundled-rules/sigma-rules/community/2021/Malware/Pingback/image_load_malware_pingback_backdoor.yml +0 -32
- package/bundled-rules/sigma-rules/community/2021/Malware/Pingback/proc_creation_win_malware_pingback_backdoor.yml +0 -36
- package/bundled-rules/sigma-rules/community/2021/Malware/Small-Sieve/README.md +0 -16
- package/bundled-rules/sigma-rules/community/2021/Malware/Small-Sieve/file_event_win_malware_small_sieve_evasion_typo.yml +0 -31
- package/bundled-rules/sigma-rules/community/2021/Malware/Small-Sieve/proc_creation_win_malware_small_sieve_cli_arg.yml +0 -24
- package/bundled-rules/sigma-rules/community/2021/Malware/Small-Sieve/proxy_malware_small_sieve_telegram_communication.yml +0 -24
- package/bundled-rules/sigma-rules/community/2021/Malware/Small-Sieve/registry_set_malware_small_sieve_evasion_typo.yml +0 -25
- package/bundled-rules/sigma-rules/community/2021/TA/HAFNIUM/proc_creation_win_apt_hafnium.yml +0 -79
- package/bundled-rules/sigma-rules/community/2021/TA/HAFNIUM/web_exchange_exploitation_hafnium.yml +0 -65
- package/bundled-rules/sigma-rules/community/2021/TA/Kaseya-Supply-Chain/proc_creation_win_apt_revil_kaseya.yml +0 -46
- package/bundled-rules/sigma-rules/community/2021/TA/PRIVATELOG/image_load_usp_svchost_clfsw32.yml +0 -25
- package/bundled-rules/sigma-rules/community/2021/TA/SOURGUM/proc_creation_win_apt_sourgrum.yml +0 -40
- package/bundled-rules/sigma-rules/community/2021/TA/UNC2546/web_unc2546_dewmode_php_webshell.yml +0 -30
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-21554/proc_creation_win_exploit_cve_2023_21554_queuejumper.yml +0 -35
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-21587/web_cve_2022_21587_oracle_ebs.yml +0 -30
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-21919/win_system_exploit_cve_2022_21919_or_cve_2021_34484.yml +0 -28
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-22954/proc_creation_win_exploit_cve_2022_22954_vmware_workspace_one_rce.yml +0 -33
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-24527/file_event_win_cve_2022_24527_lpe.yml +0 -28
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-26134/proc_creation_lnx_exploit_cve_2022_26134_atlassian_confluence.yml +0 -41
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-26809/proc_creation_win_exploit_cve_2022_26809_rpcss_child_process_anomaly.yml +0 -31
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-27925/web_cve_2022_27925_exploit.yml +0 -38
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-29072/proc_creation_win_exploit_cve_2022_29072_7zip.yml +0 -47
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-29799/lnx_exploit_cve_2022_27999_cve_2022_27800.yml +0 -29
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-30190/registry_set_exploit_cve_2022_30190_msdt_follina.yml +0 -24
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-31656/web_cve_2022_31656_auth_bypass.yml +0 -26
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-31659/web_cve_2022_31659_vmware_rce.yml +0 -25
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-33891/proc_creation_lnx_exploit_cve_2022_33891_spark_shell_command_injection.yml +0 -28
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-33891/web_cve_2022_33891_spark_shell_command_injection.yml +0 -25
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-36804/web_cve_2022_36804_atlassian_bitbucket_command_injection.yml +0 -29
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-37966/win_system_exploit_cve_2022_37966_kdcsvc_rc4_downgrade.yml +0 -27
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_exploitation.yml +0 -34
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-41082/proxy_cve_2022_36804_exchange_owassrf_poc_exploitation.yml +0 -29
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_exploitation.yml +0 -35
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-41082/web_cve_2022_36804_exchange_owassrf_poc_exploitation.yml +0 -30
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-41120/proc_creation_win_exploit_cve_2022_41120_sysmon_eop.yml +0 -46
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-42475/fortios_sslvpnd_exploit_cve_2022_42475_exploitation_indicators.yml +0 -32
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-44877/web_cve_2022_44877_exploitation_attempt.yml +0 -38
- package/bundled-rules/sigma-rules/community/2022/Exploits/CVE-2022-46169/web_cve_2022_46169_cacti_exploitation_attempt.yml +0 -41
- package/bundled-rules/sigma-rules/community/2022/Malware/BlueSky-Ransomware/win_security_malware_bluesky_ransomware_files_indicators.yml +0 -32
- package/bundled-rules/sigma-rules/community/2022/Malware/Bumblebee/create_remote_thread_win_malware_bumblebee.yml +0 -28
- package/bundled-rules/sigma-rules/community/2022/Malware/ChromeLoader/proc_creation_win_malware_chrome_loader_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/2022/Malware/Emotet/proc_creation_win_malware_emotet_loader_execution.yml +0 -38
- package/bundled-rules/sigma-rules/community/2022/Malware/Hermetic-Wiper/proc_creation_win_malware_hermetic_wiper_activity.yml +0 -32
- package/bundled-rules/sigma-rules/community/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_execution.yml +0 -40
- package/bundled-rules/sigma-rules/community/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_external_drive_exec.yml +0 -40
- package/bundled-rules/sigma-rules/community/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_single_dot_ending_file.yml +0 -25
- package/bundled-rules/sigma-rules/community/2022/Malware/Serpent-Backdoor/proc_creation_win_malware_serpent_backdoor_payload_execution.yml +0 -37
- package/bundled-rules/sigma-rules/community/2022/Malware/SocGholish/proc_creation_win_malware_socgholish_fakeupdates_activity.yml +0 -40
- package/bundled-rules/sigma-rules/community/2022/Malware/win_mssql_sp_maggie.yml +0 -25
- package/bundled-rules/sigma-rules/community/2022/TA/ACTINIUM/proc_creation_win_apt_actinium_persistence.yml +0 -30
- package/bundled-rules/sigma-rules/community/2022/TA/MERCURY/proc_creation_win_apt_mercury.yml +0 -26
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-1389/proxy_exploit_cve_2023_1389_unauth_command_injection_tplink_archer_ax21.yml +0 -33
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-20198/cisco_syslog_cve_2023_20198_ios_xe_web_ui.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-21554/win_cve_2023_21554_msmq_corrupted_packet.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-22518/proc_creation_lnx_exploit_cve_2023_22518_confluence_java_child_proc.yml +0 -41
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-22518/proc_creation_win_exploit_cve_2023_22518_confluence_tomcat_child_proc.yml +0 -43
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-22518/proxy_exploit_cve_2023_22518_confluence_auth_bypass.yml +0 -42
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-22518/web_exploit_cve_2023_22518_confluence_auth_bypass.yml +0 -42
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-2283/lnx_sshd_exploit_cve_2023_2283_libssh_authentication_bypass.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-23397/registry_set_exploit_cve_2023_23397_outlook_reminder_trigger.yml +0 -29
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-23397/win_security_exploit_cve_2023_23397_outlook_remote_file_query.yml +0 -36
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-23397/win_smbclient_connectivity_exploit_cve_2023_23397_outlook_remote_file.yml +0 -91
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-23752/web_cve_2023_23752_joomla_exploit_attempt.yml +0 -26
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-25157/web_cve_2023_25157_geoserver_sql_injection.yml +0 -46
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-25717/web_cve_2023_25717_ruckus_wireless_admin_exploit_attempt.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-27363/file_event_win_cve_2023_27363_foxit_rce.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-27997/web_cve_2023_27997_pre_authentication_rce.yml +0 -34
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/README.md +0 -18
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml +0 -64
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/proc_creation_win_exploit_cve_2023_34362_moveit_transfer_exploitation_activity.yml +0 -33
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_report_creation.yml +0 -32
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_wermgr_creation.yml +0 -34
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36874/proc_creation_win_exploit_cve_2023_36874_fake_wermgr.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36884/file_event_win_exploit_cve_2023_36884_office_windows_html_rce_file_patterns.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_extenstion_ip_pattern_traffic.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_traffic.yml +0 -33
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36884/proxy_exploit_cve_2023_36884_office_windows_html_rce_url_marker_traffic.yml +0 -22
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-36884/win_security_exploit_cve_2023_36884_office_windows_html_rce_share_access_pattern.yml +0 -29
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-38831/file_event_win_exploit_cve_2023_38331_winrar_susp_double_ext.yml +0 -28
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-38831/proc_creation_win_exploit_cve_2023_38831_winrar_child_proc.yml +0 -46
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-40477/file_event_win_exploit_cve_2023_40477_winrar_rev_file_abuse.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-40477/win_application_exploit_cve_2023_40477_winrar_crash.yml +0 -34
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-43261/proxy_exploit_cve_2023_43261_milesight_information_disclosure.yml +0 -33
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-43261/web_exploit_cve_2023_43261_milesight_information_disclosure.yml +0 -34
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise.yml +0 -35
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-46214/web_cve_2023_46214_rce_splunk_enterprise_poc.yml +0 -43
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-46747/proxy_cve_2023_46747_f5_remote_code_execution.yml +0 -38
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-46747/web_cve_2023_46747_f5_remote_code_execution.yml +0 -38
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml +0 -35
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-4966/proxy_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml +0 -35
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit.yml +0 -35
- package/bundled-rules/sigma-rules/community/2023/Exploits/CVE-2023-4966/web_exploit_cve_2023_4966_citrix_sensitive_information_disclosure_exploit_attempt.yml +0 -35
- package/bundled-rules/sigma-rules/community/2023/Exploits/Windows-Server-Unknown-Exploit/proc_creation_win_exploit_other_win_server_undocumented_rce.yml +0 -31
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/README.md +0 -20
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/file_event_win_malware_coldsteel_renamed_cmd.yml +0 -22
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/file_event_win_malware_coldsteel_service_dll_creation.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/image_load_malware_coldsteel_persistence_service_dll.yml +0 -24
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_anonymous_process.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_cleanup.yml +0 -31
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/proc_creation_win_malware_coldsteel_service_persistence.yml +0 -26
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/registry_set_malware_coldsteel_created_users.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/Malware/COLDSTEEL/win_system_malware_coldsteel_persistence_service.yml +0 -28
- package/bundled-rules/sigma-rules/community/2023/Malware/DarkGate/README.md +0 -16
- package/bundled-rules/sigma-rules/community/2023/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_binary_creation.yml +0 -36
- package/bundled-rules/sigma-rules/community/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_autoit3_from_susp_parent_and_location.yml +0 -37
- package/bundled-rules/sigma-rules/community/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_net_user_creation.yml +0 -31
- package/bundled-rules/sigma-rules/community/2023/Malware/Griffon/proc_creation_win_malware_griffon_patterns.yml +0 -24
- package/bundled-rules/sigma-rules/community/2023/Malware/GuLoader/proc_creation_win_malware_guloader_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/Malware/IcedID/proc_creation_win_malware_icedid_rundll32_dllregisterserver.yml +0 -26
- package/bundled-rules/sigma-rules/community/2023/Malware/Pikabot/net_connection_win_malware_pikabot_rundll32_activity.yml +0 -37
- package/bundled-rules/sigma-rules/community/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_combined_commands_execution.yml +0 -46
- package/bundled-rules/sigma-rules/community/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_discovery.yml +0 -38
- package/bundled-rules/sigma-rules/community/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml +0 -38
- package/bundled-rules/sigma-rules/community/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_uncommon_extension.yml +0 -58
- package/bundled-rules/sigma-rules/community/2023/Malware/Qakbot/README.md +0 -19
- package/bundled-rules/sigma-rules/community/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_regsvr32_calc_pattern.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_execution.yml +0 -39
- package/bundled-rules/sigma-rules/community/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_exports.yml +0 -67
- package/bundled-rules/sigma-rules/community/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_fake_dll_execution.yml +0 -39
- package/bundled-rules/sigma-rules/community/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_uninstaller_cleanup.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/Malware/Rhadamanthys/proc_creation_win_malware_rhadamanthys_stealer_dll_launch.yml +0 -31
- package/bundled-rules/sigma-rules/community/2023/Malware/Rorschach/proc_creation_win_malware_rorschach_ransomware_activity.yml +0 -32
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/README.md +0 -23
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/file_event_win_malware_snake_encrypted_payload_ioc.yml +0 -21
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/file_event_win_malware_snake_installers_ioc.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/file_event_win_malware_snake_werfault_creation.yml +0 -28
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_cli_args.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_exec.yml +0 -33
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/proc_creation_win_malware_snake_service_execution.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/registry_event_malware_snake_covert_store_key.yml +0 -19
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/registry_set_malware_snake_encrypted_key.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/Malware/SNAKE/win_system_malware_snake_persistence_service.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/Malware/Ursnif/proc_creation_win_malware_ursnif_cmd_redirection.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/Malware/dns_query_win_malware_socgholish_second_stage_c2.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/README.md +0 -26
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/dns_query_win_malware_3cx_compromise.yml +0 -59
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/image_load_malware_3cx_compromise_susp_dll.yml +0 -53
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/net_connection_win_malware_3cx_compromise_beaconing_activity.yml +0 -59
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_execution.yml +0 -72
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_susp_children.yml +0 -49
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_susp_update.yml +0 -43
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_c2_beacon_activity.yml +0 -57
- package/bundled-rules/sigma-rules/community/2023/TA/3CX-Supply-Chain/proxy_malware_3cx_compromise_susp_ico_requests.yml +0 -38
- package/bundled-rules/sigma-rules/community/2023/TA/Cozy-Bear/image_load_apt_cozy_bear_graphical_proton_dlls.yml +0 -39
- package/bundled-rules/sigma-rules/community/2023/TA/Cozy-Bear/win_security_apt_cozy_bear_scheduled_tasks_name.yml +0 -48
- package/bundled-rules/sigma-rules/community/2023/TA/Cozy-Bear/win_taskscheduler_apt_cozy_bear_graphical_proton_task_names.yml +0 -49
- package/bundled-rules/sigma-rules/community/2023/TA/Diamond-Sleet/README.md +0 -18
- package/bundled-rules/sigma-rules/community/2023/TA/Diamond-Sleet/dns_query_win_apt_diamond_steel_indicators.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/TA/Diamond-Sleet/file_event_win_apt_diamond_sleet_indicators.yml +0 -28
- package/bundled-rules/sigma-rules/community/2023/TA/Diamond-Sleet/image_load_apt_diamond_sleet_side_load.yml +0 -28
- package/bundled-rules/sigma-rules/community/2023/TA/Diamond-Sleet/proc_creation_win_apt_diamond_sleet_indicators.yml +0 -21
- package/bundled-rules/sigma-rules/community/2023/TA/Diamond-Sleet/registry_event_apt_diamond_sleet_scheduled_task.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/TA/Diamond-Sleet/win_security_apt_diamond_sleet_scheduled_task.yml +0 -28
- package/bundled-rules/sigma-rules/community/2023/TA/EquationGroup/net_dns_apt_equation_group_triangulation_c2_coms.yml +0 -40
- package/bundled-rules/sigma-rules/community/2023/TA/EquationGroup/proxy_apt_equation_group_triangulation_c2_coms.yml +0 -40
- package/bundled-rules/sigma-rules/community/2023/TA/FIN7/README.md +0 -16
- package/bundled-rules/sigma-rules/community/2023/TA/FIN7/file_event_win_apt_fin7_powershell_scripts_naming_convention.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/TA/FIN7/posh_ps_apt_fin7_powerhold.yml +0 -28
- package/bundled-rules/sigma-rules/community/2023/TA/FIN7/posh_ps_apt_fin7_powertrash_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/TA/FIN7/proc_creation_win_apt_fin7_powertrash_lateral_movement.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/TA/Lace-Tempest/README.md +0 -17
- package/bundled-rules/sigma-rules/community/2023/TA/Lace-Tempest/file_event_win_apt_lace_tempest_indicators.yml +0 -25
- package/bundled-rules/sigma-rules/community/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_eraser_script.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_malware_launcher.yml +0 -29
- package/bundled-rules/sigma-rules/community/2023/TA/Lace-Tempest/proc_creation_win_apt_lace_tempest_cobalt_strike_download.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/TA/Lace-Tempest/proc_creation_win_apt_lace_tempest_loader_execution.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/TA/Lazarus/README.md +0 -16
- package/bundled-rules/sigma-rules/community/2023/TA/Lazarus/image_load_apt_lazarus_side_load_activity.yml +0 -36
- package/bundled-rules/sigma-rules/community/2023/TA/Mint-Sandstorm/README.md +0 -17
- package/bundled-rules/sigma-rules/community/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_aspera_faspex_susp_child_process.yml +0 -117
- package/bundled-rules/sigma-rules/community/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_log4j_wstomcat_execution.yml +0 -24
- package/bundled-rules/sigma-rules/community/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_manage_engine_susp_child_process.yml +0 -123
- package/bundled-rules/sigma-rules/community/2023/TA/Mustang-Panda-Australia-Campaign/README.md +0 -15
- package/bundled-rules/sigma-rules/community/2023/TA/Mustang-Panda-Australia-Campaign/proc_creation_win_apt_mustang_panda_indicators.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/TA/Okta-Support-System-Breach/README.md +0 -15
- package/bundled-rules/sigma-rules/community/2023/TA/Okta-Support-System-Breach/okta_apt_suspicious_user_creation.yml +0 -27
- package/bundled-rules/sigma-rules/community/2023/TA/Onyx-Sleet/README.md +0 -11
- package/bundled-rules/sigma-rules/community/2023/TA/Onyx-Sleet/file_event_win_apt_onyx_sleet_indicators.yml +0 -21
- package/bundled-rules/sigma-rules/community/2023/TA/PaperCut-Print-Management-Exploitation/README.md +0 -15
- package/bundled-rules/sigma-rules/community/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_indicators.yml +0 -35
- package/bundled-rules/sigma-rules/community/2023/TA/PaperCut-Print-Management-Exploitation/proc_creation_win_papercut_print_management_exploitation_pc_app.yml +0 -41
- package/bundled-rules/sigma-rules/community/2023/TA/Peach-Sandstorm/proc_creation_win_apt_peach_sandstorm_indicators.yml +0 -22
- package/bundled-rules/sigma-rules/community/2023/TA/Peach-Sandstorm/proxy_apt_peach_sandstorm_falsefont_backdoor_c2_coms.yml +0 -24
- package/bundled-rules/sigma-rules/community/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/README.md +0 -23
- package/bundled-rules/sigma-rules/community/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_exfil_mail_pattern.yml +0 -23
- package/bundled-rules/sigma-rules/community/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/file_event_lnx_apt_unc4841_file_indicators.yml +0 -65
- package/bundled-rules/sigma-rules/community/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_openssl_connection.yml +0 -30
- package/bundled-rules/sigma-rules/community/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_compressed_file_tmep_sh.yml +0 -26
- package/bundled-rules/sigma-rules/community/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_apt_unc4841_wget_download_tar_files_direct_ip.yml +0 -48
- package/bundled-rules/sigma-rules/community/2023/TA/UNC4841-Barracuda-ESG-Zero-Day-Exploitation/proc_creation_lnx_atp_unc4841_seaspy_execution.yml +0 -24
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-1212/web_exploit_cve_2024_1212_.yml +0 -33
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-1708/file_event_win_exploit_cve_2024_1708_screenconnect.yml +0 -33
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-1708/win_security_exploit_cve_2024_1708_screenconnect.yml +0 -39
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-1709/file_event_win_exploit_cve_2024_1709_user_database_modification_screenconnect.yml +0 -33
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-1709/web_exploit_cve_2024_1709_screenconnect.yml +0 -25
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-1709/win_security_exploit_cve_2024_1709_user_database_modification_screenconnect.yml +0 -38
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-3094/proc_creation_lnx_exploit_cve_2024_3094_sshd_child_process.yml +0 -28
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-3400/file_event_paloalto_globalprotect_exploit_cve_2024_3400_command_inject_file_creation.yml +0 -33
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-3400/paloalto_globalprotect_exploit_cve_2024_3400_command_injection.yml +0 -48
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-35250/image_load_exploit_cve_2024_35250_privilege_escalation.yml +0 -46
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-37085/proc_creation_win_exploit_cve_2024_37085_esxi_admins_group_creation.yml +0 -47
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-37085/win_security_exploit_cve_2024_37085_esxi_admins_group.yml +0 -34
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-49113/win_application_error_exploit_cve_2024_49113_ldap_nightmare.yml +0 -30
- package/bundled-rules/sigma-rules/community/2024/Exploits/CVE-2024-50623/proc_creation_win_exploit_cve_2024_50623_cleo.yml +0 -36
- package/bundled-rules/sigma-rules/community/2024/Malware/CSharp-Streamer/image_load_malware_csharp_streamer_dotnet_load.yml +0 -24
- package/bundled-rules/sigma-rules/community/2024/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_save_temp.yml +0 -31
- package/bundled-rules/sigma-rules/community/2024/Malware/Generic/file_event_win_malware_generic_creation_configuration_rats.yml +0 -35
- package/bundled-rules/sigma-rules/community/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_lnk_lure_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/2024/Malware/KamiKakaBot/proc_creation_win_malware_kamikakabot_schtasks_persistence.yml +0 -32
- package/bundled-rules/sigma-rules/community/2024/Malware/KamiKakaBot/registry_set_malware_kamikakabot_winlogon_persistence.yml +0 -29
- package/bundled-rules/sigma-rules/community/2024/Malware/Lummac-Stealer/proc_creation_win_malware_lummac_more_vbc.yml +0 -33
- package/bundled-rules/sigma-rules/community/2024/Malware/Raspberry-Robin/image_load_malware_raspberry_robin_side_load_aclui_oleview.yml +0 -38
- package/bundled-rules/sigma-rules/community/2024/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_rundll32_shell32_cpl_exection.yml +0 -39
- package/bundled-rules/sigma-rules/community/2024/Malware/Raspberry-Robin/registry_set_malware_raspberry_robin_internet_settings_zonemap_tamper.yml +0 -49
- package/bundled-rules/sigma-rules/community/2024/Malware/kapeka/Kapeka.md +0 -17
- package/bundled-rules/sigma-rules/community/2024/Malware/kapeka/file_event_win_malware_kapeka_backdoor_indicators.yml +0 -31
- package/bundled-rules/sigma-rules/community/2024/Malware/kapeka/image_load_malware_kapeka_backdoor_wll.yml +0 -31
- package/bundled-rules/sigma-rules/community/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_persistence.yml +0 -51
- package/bundled-rules/sigma-rules/community/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_rundll32_execution.yml +0 -38
- package/bundled-rules/sigma-rules/community/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_autorun_persistence.yml +0 -34
- package/bundled-rules/sigma-rules/community/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_configuration.yml +0 -29
- package/bundled-rules/sigma-rules/community/2024/Malware/kapeka/win_security_malware_kapeka_backdoor_scheduled_task_creation.yml +0 -44
- package/bundled-rules/sigma-rules/community/2024/TA/DPRK/dns_query_win_apt_dprk_malicious_domains.yml +0 -23
- package/bundled-rules/sigma-rules/community/2024/TA/FIN7/proc_creation_win_apt_fin7_exploitation_indicators.yml +0 -29
- package/bundled-rules/sigma-rules/community/2024/TA/Forest-Blizzard/README.md +0 -17
- package/bundled-rules/sigma-rules/community/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_activity.yml +0 -50
- package/bundled-rules/sigma-rules/community/2024/TA/Forest-Blizzard/file_event_win_apt_forest_blizzard_constrained_js.yml +0 -25
- package/bundled-rules/sigma-rules/community/2024/TA/Forest-Blizzard/proc_creation_win_apt_forest_blizzard_activity.yml +0 -49
- package/bundled-rules/sigma-rules/community/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler.yml +0 -26
- package/bundled-rules/sigma-rules/community/2024/TA/Forest-Blizzard/registry_set_apt_forest_blizzard_custom_protocol_handler_dll.yml +0 -26
- package/bundled-rules/sigma-rules/community/2024/TA/SlashAndGrab-Exploitation-In-Wild/file_event_win_apt_unknown_exploitation_indicators.yml +0 -35
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml +0 -78
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-20333/proxy_exploit_cve_2025_20333.yml +0 -28
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-24054/file_event_win_exploit_cve_2025_24054_library_ms.yml +0 -31
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-30406/proc_creation_win_exploit_cve_2025_30406_centrestack_portal_child_process.yml +0 -31
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml +0 -45
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-31324/file_event_lnx_sap_netweaver_webshell_creation.yml +0 -37
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-31324/file_event_win_sap_netweaver_webshell_creation.yml +0 -37
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-31324/proc_creation_lnx_sap_netweaver_susp_child_process.yml +0 -60
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-31324/proc_creation_win_sap_netweaver_susp_child_process.yml +0 -49
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell.yml +0 -47
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-31324/web_lnx_exploit_cve_2025_31324_sap_netviewer_webshell_uploaded.yml +0 -32
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-32463/file_event_lnx_exploit_cve_2025_32463.yml +0 -29
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-33053/image_load_win_exploit_cve_2025_33053.yml +0 -45
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-33053/proc_access_win_exploit_cve_2025_33053.yml +0 -52
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-33053/proc_creation_win_exploit_cve_2025_33053.yml +0 -58
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-40551/proc_creation_win_exploit_cve_2025_40551.yml +0 -49
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-4427/web_invanti_epmm_cve_2025_4427_and_cve_2025_4428.yml +0 -50
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-49144/proc_creation_win_exploit_cve_2025_49144.yml +0 -35
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-53770/file_event_win_exploit_cve_2025_53770.yml +0 -37
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-53770/proc_creation_win_exploit_cve_2025_53770_indicators.yml +0 -39
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-53770/web_win_iis_exploit_cve_2025_53770.yml +0 -33
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-54309/proc_creation_win_exploit_cve_2025_54309.yml +0 -54
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-55182/proc_creation_lnx_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml +0 -129
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-55182/proc_creation_win_exploit_cve_2025_55182_susp_nodejs_server_child_process.yml +0 -142
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-57788/proc_creation_win_exploit_cve_2025_57788.yml +0 -32
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-57790/proc_creation_win_exploit_cve_2025_57790.yml +0 -32
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-57791/proc_creation_win_exploit_cve_2025_57791.yml +0 -30
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-59287/proc_creation_win_exploit_cve_2025_59287.yml +0 -38
- package/bundled-rules/sigma-rules/community/2025/Exploits/CVE-2025-59287/win_wsus_exploit_cve_2025_59287.yml +0 -37
- package/bundled-rules/sigma-rules/community/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml +0 -32
- package/bundled-rules/sigma-rules/community/2025/Malware/Atomic-MacOS-Stealer/proc_creation_macos_malware_amos_curl_post.yml +0 -40
- package/bundled-rules/sigma-rules/community/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon.yml +0 -50
- package/bundled-rules/sigma-rules/community/2025/Malware/Katz-Stealer/dns_query_win_katz_stealer_domain.yml +0 -32
- package/bundled-rules/sigma-rules/community/2025/Malware/Katz-Stealer/image_load_win_katz_stealer_payloads.yml +0 -27
- package/bundled-rules/sigma-rules/community/2025/Malware/Katz-Stealer/net_dns_katz_stealer_domain.yml +0 -31
- package/bundled-rules/sigma-rules/community/2025/Malware/Katz-Stealer/zeek_http_katz_stealer_susp_useragent.yml +0 -23
- package/bundled-rules/sigma-rules/community/2025/Malware/Shai-Hulud/file_event_lnx_mal_shai_hulud_workflow.yml +0 -25
- package/bundled-rules/sigma-rules/community/2025/Malware/Shai-Hulud/github_mal_shai_hulud_npm_attack.yml +0 -24
- package/bundled-rules/sigma-rules/community/2025/Malware/Shai-Hulud/proc_creation_lnx_mal_shai_hululd_exfiltration.yml +0 -28
- package/bundled-rules/sigma-rules/community/2025/Malware/file_event_win_malware_funklocker_ransomware_extension.yml +0 -23
- package/bundled-rules/sigma-rules/community/2025/Malware/proc_creation_win_malware_kalambur_curl_socks_tor.yml +0 -34
- package/bundled-rules/sigma-rules/community/README.md +0 -1
- package/bundled-rules/sigma-rules/community/VERSION +0 -5
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_full_data_export_triggered.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_global_permissions_change_detected.yml +0 -29
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_global_secret_scanning_rule_deleted.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_global_ssh_settings_change_detected.yml +0 -26
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_log_configuration_update_detected.yml +0 -23
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_project_secret_scanning_allowlist_added.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_secret_scanning_exempt_repository_detected.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_secret_scanning_rule_deleted.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_unauthorized_access_detected.yml +0 -23
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_unauthorized_full_data_export_triggered.yml +0 -26
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_user_details_export_attempt_detected.yml +0 -31
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_user_login_failure_detected.yml +0 -30
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_user_login_failure_via_ssh_detected.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/bitbucket/audit/bitbucket_audit_user_permissions_export_attempt_detected.yml +0 -31
- package/bundled-rules/sigma-rules/community/application/django/appframework_django_exceptions.yml +0 -36
- package/bundled-rules/sigma-rules/community/application/github/audit/github_delete_action_invoked.yml +0 -27
- package/bundled-rules/sigma-rules/community/application/github/audit/github_disable_high_risk_configuration.yml +0 -38
- package/bundled-rules/sigma-rules/community/application/github/audit/github_disabled_outdated_dependency_or_vulnerability.yml +0 -30
- package/bundled-rules/sigma-rules/community/application/github/audit/github_fork_private_repos_enabled_or_cleared.yml +0 -27
- package/bundled-rules/sigma-rules/community/application/github/audit/github_new_org_member.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/github/audit/github_new_secret_created.yml +0 -29
- package/bundled-rules/sigma-rules/community/application/github/audit/github_outside_collaborator_detected.yml +0 -31
- package/bundled-rules/sigma-rules/community/application/github/audit/github_pages_site_changed_to_public.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/github/audit/github_push_protection_bypass_detected.yml +0 -23
- package/bundled-rules/sigma-rules/community/application/github/audit/github_push_protection_disabled.yml +0 -30
- package/bundled-rules/sigma-rules/community/application/github/audit/github_repo_or_org_transferred.yml +0 -31
- package/bundled-rules/sigma-rules/community/application/github/audit/github_repository_archive_status_changed.yml +0 -27
- package/bundled-rules/sigma-rules/community/application/github/audit/github_secret_scanning_feature_disabled.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/github/audit/github_self_hosted_runner_changes_detected.yml +0 -45
- package/bundled-rules/sigma-rules/community/application/github/audit/github_ssh_certificate_config_changed.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/jvm/java_jndi_injection_exploitation_attempt.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/jvm/java_local_file_read.yml +0 -26
- package/bundled-rules/sigma-rules/community/application/jvm/java_ognl_injection_exploitation_attempt.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/jvm/java_rce_exploitation_attempt.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/jvm/java_xxe_exploitation_attempt.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml +0 -42
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_cronjob_modification.yml +0 -39
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_deployment_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_events_deleted.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_hostpath_mount.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_pod_in_system_namespace.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_privileged_pod_creation.yml +0 -30
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_rbac_permisions_listing.yml +0 -29
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_rolebinding_modification.yml +0 -35
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml +0 -26
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_secrets_modified_or_deleted.yml +0 -32
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_serviceaccount_creation.yml +0 -27
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml +0 -29
- package/bundled-rules/sigma-rules/community/application/kubernetes/audit/kubernetes_audit_unauthorized_unauthenticated_actions.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/nodejs/nodejs_rce_exploitation_attempt.yml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_ftp_login_attempt.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_git_clone_request.yml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_http_get.yml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_http_post_login_attempt.yml +0 -23
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_httpproxy_login_attempt.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_mssql_login_sqlauth.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_mssql_login_winauth.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_mysql_login_attempt.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_ntp_monlist.yml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_nmap_fin_scan.yaml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_nmap_null_scan.yaml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_nmap_os_scan.yaml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_nmap_xmas_scan.yaml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_portscan_syn_scan.yaml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_rdp_connection_attempt.yaml +0 -24
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_redis_command.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_sip_request.yml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_smb_file_open.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_snmp_cmd.yml +0 -24
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_ssh_login_attempt.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_ssh_new_connection.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_telnet_login_attempt.yml +0 -27
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_tftp_request.yml +0 -22
- package/bundled-rules/sigma-rules/community/application/opencanary/opencanary_vnc_connection_attempt.yml +0 -22
- package/bundled-rules/sigma-rules/community/application/python/app_python_sql_exceptions.yml +0 -25
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml +0 -34
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_atsvc_recon.yml +0 -30
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_dcsync_attack.yml +0 -32
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_efs_abuse.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_eventlog_recon.yml +0 -26
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml +0 -41
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml +0 -37
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml +0 -32
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_dcom_or_wmi.yml +0 -34
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml +0 -40
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml +0 -38
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml +0 -26
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml +0 -34
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_sasec_recon.yml +0 -30
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/ruby/appframework_ruby_on_rails_exceptions.yml +0 -29
- package/bundled-rules/sigma-rules/community/application/spring/spring_application_exceptions.yml +0 -28
- package/bundled-rules/sigma-rules/community/application/spring/spring_spel_injection.yml +0 -23
- package/bundled-rules/sigma-rules/community/application/sql/app_sqlinjection_errors.yml +0 -31
- package/bundled-rules/sigma-rules/community/application/velocity/velocity_ssti_injection.yml +0 -26
- package/bundled-rules/sigma-rules/community/category/antivirus/av_exploiting.yml +0 -49
- package/bundled-rules/sigma-rules/community/category/antivirus/av_hacktool.yml +0 -70
- package/bundled-rules/sigma-rules/community/category/antivirus/av_password_dumper.yml +0 -60
- package/bundled-rules/sigma-rules/community/category/antivirus/av_ransomware.yml +0 -58
- package/bundled-rules/sigma-rules/community/category/antivirus/av_relevant_files.yml +0 -79
- package/bundled-rules/sigma-rules/community/category/antivirus/av_webshell.yml +0 -86
- package/bundled-rules/sigma-rules/community/category/database/db_anomalous_query.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_bucket_deleted.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_console_login_failed_authentication.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_from_susp_locations.yml +0 -32
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_console_login_success_without_mfa.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_guardduty_detector_deleted_or_updated.yml +0 -47
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_imds_malicious_usage.yml +0 -33
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_new_acl_entries.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_new_route_added.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_pua_trufflehog.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_region_enabled.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_ingress_egress.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_loadbalancer.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_security_group_change_rds.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_ssm_malicious_usage.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_cloudtrail_vpc_flow_logs_deleted.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_config_disable_recording.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_console_getsignintoken.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_delete_identity.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_delete_saml_provider.yml +0 -32
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_disable_bucket_versioning.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ec2_import_key_pair_activity.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_enum_buckets.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_guardduty_disruption.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_iam_backdoor_users_keys.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml +0 -32
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_kms_import_key_material.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_lambda_function_url.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_new_lambda_layer_attached.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_rds_change_master_password.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_rds_dbcluster_actions.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_root_account_usage.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml +0 -36
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_sso_idp_change.yml +0 -34
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_sts_getcalleridentity_trufflehog.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_susp_saml_activity.yml +0 -36
- package/bundled-rules/sigma-rules/community/cloud/aws/cloudtrail/aws_update_login_profile.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_ad_user_added_to_admin_role.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_application_deleted.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_application_gateway_modified_or_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_application_security_group_modified_or_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_device_no_longer_managed_or_compliant.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_dns_zone_modified_or_deleted.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_firewall_rule_collection_modified_or_deleted.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_granting_permission_detection.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml +0 -35
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml +0 -34
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml +0 -41
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml +0 -36
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml +0 -33
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_pods_deleted.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_role_access.yml +0 -36
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml +0 -33
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml +0 -32
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_mfa_disabled.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_firewall_policy_modified_or_deleted.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_firewall_rule_modified_or_deleted.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_p2s_vpn_modified_or_deleted.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_security_modified_or_deleted.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_network_virtual_device_modified_or_deleted.yml +0 -35
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_new_cloudshell_created.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_owner_removed_from_application_or_service_principal.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_rare_operations.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_service_principal_created.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_service_principal_removed.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_subscription_permissions_elevation_via_activitylogs.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_suppression_rule_created.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_virtual_network_modified_or_deleted.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/azure/activity_logs/azure_vpn_connection_modified_or_deleted.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_account_created_deleted.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_account_created_deleted_nonapproved_user.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_certificate_based_authencation_enabled.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_new_root_ca_added.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_ad_users_added_to_device_admin_roles.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_credential_added.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_delegated_permissions_all_users.yml +0 -21
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_end_user_consent.yml +0 -21
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_end_user_consent_blocked.yml +0 -21
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_owner_added.yml +0 -21
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_permissions_msft.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_privileged_permissions.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_role_added.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_app_uri_modifications.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_auditlogs_laps_credential_dumping.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_change_to_authentication_method.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_federation_modified.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_guest_invite_failure.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_guest_to_member.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_pim_activation_approve_deny.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_pim_alerts_disabled.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_pim_change_settings.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_privileged_account_creation.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_tap_added.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_update_risk_and_mfa_registration_policy.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_user_account_mfa_disable.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/audit_logs/azure_user_password_change.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_anomalous_token.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_activity.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_atypical_travel.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_impossible_travel.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_inbox_forwarding_rule.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_leaked_credentials.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_malicious_ip_address_suspicious.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_new_coutry_region.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_prt_access.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_suspicious_browser.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_threat_intel.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_token_issuer_anomaly.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/identity_protection/azure_identity_protection_unfamilar_sign_in.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_account_stale.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_invalid_license.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_role_assigned_outside_of_pim.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_role_frequent_activation.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_role_no_mfa_required.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_role_not_used.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/privileged_identity_management/azure_pim_too_many_global_admins.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_account_lockout.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_account_signin_outside_hours.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_auth_failure_increase.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_auth_sucess_increase.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_auth_to_important_apps_using_single_factor_auth.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_sign_ins_from_noncompliant_devices.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_app_device_code_authentication.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_app_ropc_authentication.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_blocked_account_attempt.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_conditional_access_failure.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml +0 -35
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_login_to_disabled_account.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_mfa_denies.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_mfa_interrupted.yml +0 -32
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_privileged_account_no_saw_paw.yml +0 -35
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_privileged_account_sigin_expected_controls.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_privileged_account_signin_outside_hours.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_unusual_authentication_interruption.yml +0 -32
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/azure/signin_logs/azure_users_authenticating_to_other_azure_ad_tenants.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_access_policy_deleted.yml +0 -32
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_breakglass_container_workload_deployed.yml +0 -29
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_bucket_enumeration.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_bucket_modified_or_deleted.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_dlp_re_identifies_sensitive_information.yml +0 -22
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml +0 -42
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_kubernetes_cronjob.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml +0 -34
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_service_account_modified.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/gcp/audit/gcp_vpn_tunnel_modified_or_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_application_access_levels_modified.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_application_removed.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_granted_domain_api_access.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_mfa_disabled.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_role_modified_or_deleted.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_role_privilege_deleted.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/gcp/gworkspace/gcp_gworkspace_user_granted_admin_privileges.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/m365/audit/microsoft365_bypass_conditional_access.yml +0 -31
- package/bundled-rules/sigma-rules/community/cloud/m365/audit/microsoft365_disabling_mfa.yml +0 -23
- package/bundled-rules/sigma-rules/community/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/m365/audit/microsoft365_susp_email_forwarding_activity.yml +0 -49
- package/bundled-rules/sigma-rules/community/cloud/m365/audit/microsoft365_susp_inbox_rule_creation_or_update_activity.yml +0 -38
- package/bundled-rules/sigma-rules/community/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml +0 -30
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml +0 -27
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml +0 -26
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_impossible_travel_activity.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_logon_from_risky_ip_address.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_pst_export_alert.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml +0 -28
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml +0 -24
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml +0 -25
- package/bundled-rules/sigma-rules/community/cloud/okta/okta_password_health_report_query.yml +0 -25
- package/bundled-rules/sigma-rules/community/identity/cisco_duo/cisco_duo_mfa_bypass_via_bypass_code.yml +0 -26
- package/bundled-rules/sigma-rules/community/identity/okta/okta_admin_activity_from_proxy_query.yml +0 -23
- package/bundled-rules/sigma-rules/community/identity/okta/okta_admin_role_assigned_to_user_or_group.yml +0 -27
- package/bundled-rules/sigma-rules/community/identity/okta/okta_admin_role_assignment_created.yml +0 -21
- package/bundled-rules/sigma-rules/community/identity/okta/okta_api_token_created.yml +0 -22
- package/bundled-rules/sigma-rules/community/identity/okta/okta_api_token_revoked.yml +0 -23
- package/bundled-rules/sigma-rules/community/identity/okta/okta_application_modified_or_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/identity/okta/okta_application_sign_on_policy_modified_or_deleted.yml +0 -24
- package/bundled-rules/sigma-rules/community/identity/okta/okta_fastpass_phishing_detection.yml +0 -25
- package/bundled-rules/sigma-rules/community/identity/okta/okta_identity_provider_created.yml +0 -23
- package/bundled-rules/sigma-rules/community/identity/okta/okta_mfa_reset_or_deactivated.yml +0 -27
- package/bundled-rules/sigma-rules/community/identity/okta/okta_network_zone_deactivated_or_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/identity/okta/okta_new_behaviours_admin_console.yml +0 -30
- package/bundled-rules/sigma-rules/community/identity/okta/okta_password_in_alternateid_field.yml +0 -34
- package/bundled-rules/sigma-rules/community/identity/okta/okta_policy_modified_or_deleted.yml +0 -26
- package/bundled-rules/sigma-rules/community/identity/okta/okta_policy_rule_modified_or_deleted.yml +0 -25
- package/bundled-rules/sigma-rules/community/identity/okta/okta_security_threat_detected.yml +0 -23
- package/bundled-rules/sigma-rules/community/identity/okta/okta_suspicious_activity_enduser_report.yml +0 -22
- package/bundled-rules/sigma-rules/community/identity/okta/okta_unauthorized_access_to_app.yml +0 -22
- package/bundled-rules/sigma-rules/community/identity/okta/okta_user_account_locked_out.yml +0 -23
- package/bundled-rules/sigma-rules/community/identity/okta/okta_user_created.yml +0 -20
- package/bundled-rules/sigma-rules/community/identity/okta/okta_user_session_start_via_anonymised_proxy.yml +0 -23
- package/bundled-rules/sigma-rules/community/identity/onelogin/onelogin_assumed_another_user.yml +0 -21
- package/bundled-rules/sigma-rules/community/identity/onelogin/onelogin_user_account_locked.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_binary_padding.yml +0 -39
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_bpfdoor_port_redirect.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_change_file_time_attr.yml +0 -42
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_chattr_immutable_removal.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_clipboard_collection.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_clipboard_image_collection.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_coinminer.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_data_compressed.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_data_exfil_wget.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_dd_delete_file.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_file_or_folder_permissions.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_find_cred_in_files.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_hidden_files_directories.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_hidden_zip_files_steganography.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_masquerading_crond.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_modify_system_firewall.yml +0 -45
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_network_sniffing.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_screencapture_import.yml +0 -40
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_screencaputre_xwd.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_steghide_embed_steganography.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_steghide_extract_steganography.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_susp_cmds.yml +0 -36
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_susp_histfile_operations.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_susp_service_reload_or_restart.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_system_shutdown_reboot.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_unzip_hidden_zip_files_steganography.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/auditd/execve/lnx_auditd_user_discovery.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_audio_capture.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_disable_aslr_protection.yml +0 -40
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_password_policy_discovery.yml +0 -45
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_susp_c2_commands.yml +0 -49
- package/bundled-rules/sigma-rules/community/linux/auditd/lnx_auditd_system_info_discovery.yml +0 -47
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_auditing_config_change.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_bpfdoor_file_accessed.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_hidden_binary_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_ld_so_preload_mod.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_logging_config_change.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_magic_system_request_key.yml +0 -41
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_system_info_discovery2.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_systemd_service_creation.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/auditd/path/lnx_auditd_unix_shell_configuration_modification.yml +0 -54
- package/bundled-rules/sigma-rules/community/linux/auditd/service_stop/lnx_auditd_disable_system_firewall.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_clean_disable_dmesg_logs_via_syslog.yml +0 -41
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_create_account.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_load_module_insmod.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_network_service_scanning.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_split_file_into_pieces.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_susp_discovery_sysinfo_syscall.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_susp_exe_folders.yml +0 -44
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_susp_special_file_creation_via_mknod_syscall.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/auditd/syscall/lnx_auditd_web_rce.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/builtin/clamav/lnx_clamav_relevant_message.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/builtin/cron/lnx_cron_crontab_file_modification.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/builtin/guacamole/lnx_guacamole_susp_guacamole.yml +0 -22
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_apt_equationgroup_lnx.yml +0 -82
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_buffer_overflows.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_clear_syslog.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_file_copy.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_ldso_preload_injection.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_potential_susp_ebpf_activity.yml +0 -21
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_privileged_user_creation.yml +0 -36
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shell_clear_cmd_history.yml +0 -47
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shell_susp_commands.yml +0 -59
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shell_susp_log_entries.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shell_susp_rev_shells.yml +0 -45
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_shellshock.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_susp_dev_tcp.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_susp_jexboss.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/builtin/lnx_symlink_etc_passwd.yml +0 -22
- package/bundled-rules/sigma-rules/community/linux/builtin/sshd/lnx_sshd_susp_ssh.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/builtin/syslog/lnx_syslog_security_tools_disabling_syslog.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/builtin/syslog/lnx_syslog_susp_named.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/builtin/vsftpd/lnx_vsftpd_susp_error_messages.yml +0 -38
- package/bundled-rules/sigma-rules/community/linux/file/file_event/file_event_lnx_python_path_configuration_files.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/file/file_event/file_event_lnx_susp_long_filename_pattern.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_doas_conf_creation.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_persistence_cron_files.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_persistence_sudoers_files.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_susp_filename_with_embedded_base64_command.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_triple_cross_rootkit_lock_file.yml +0 -21
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_triple_cross_rootkit_persistence.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/file_event/file_event_lnx_wget_download_file_in_tmp_dir.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_crypto_mining_indicators.yml +0 -43
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_domain_localtonet_tunnel.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/network_connection/net_connection_lnx_susp_malware_callback_port.yml +0 -51
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_at_command.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_auditctl_clear_rules.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_av_kaspersky_av_disabled.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_awk_shell_spawn.yml +0 -38
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_base64_decode.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_base64_execution.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_base64_shebang_cli.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_bash_interactive_shell.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_cap_setgid.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_cap_setuid.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_capa_discovery.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_capsh_shell_invocation.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_chattr_immutable_removal.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_chroot_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_clear_logs.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_clear_syslog.yml +0 -87
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_clipboard_collection.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_crontab_removal.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_crypto_mining.yml +0 -42
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_curl_usage.yml +0 -22
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_curl_wget_exec_tmp.yml +0 -36
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_dd_file_overwrite.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_dd_process_injection.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_disable_ufw.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_doas_execution.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_env_shell_invocation.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_syslog_config_change.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_user_account_creation.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_file_deletion.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_find_shell_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml +0 -36
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_git_shell_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_groupdel.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_install_root_certificate.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_install_suspicious_packages.yml +0 -49
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_iptables_flush_ufw.yml +0 -41
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_local_account.yml +0 -52
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_local_groups.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation.yml +0 -21
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_mkfifo_named_pipe_creation_susp_location.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_mount_hidepid.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml +0 -59
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_nohup.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executescript.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_omigod_scx_runasprovider_executeshellcommand.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_perl_reverse_shell.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_php_reverse_shell.yml +0 -36
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_pnscan_binary_cli_pattern.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_proxy_connection.yml +0 -23
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml +0 -43
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_python_http_server_execution.yml +0 -36
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_python_pty_spawn.yml +0 -38
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_python_reverse_shell.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_python_shell_os_system.yml +0 -38
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_remote_access_tools_teamviewer_incoming_connection.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_remote_system_discovery.yml +0 -46
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_remove_package.yml +0 -42
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_rsync_shell_execution.yml +0 -44
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_rsync_shell_spawn.yml +0 -37
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_ruby_reverse_shell.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_schedule_task_job_cron.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_security_software_discovery.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_security_tools_disabling.yml +0 -83
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_services_stop_and_disable.yml +0 -26
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_setgid_setuid.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml +0 -36
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_chmod_directories.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_container_residence_discovery.yml +0 -38
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml +0 -42
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_curl_useragent.yml +0 -28
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_dockerenv_recon.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_find_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_git_clone.yml +0 -41
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_history_delete.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_history_recon.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_hktl_execution.yml +0 -97
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_inod_listing.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_interactive_bash.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_java_children.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_network_utilities_execution.yml +0 -43
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_pipe_shell.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_process_reading_sudoers.yml +0 -34
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_process_termination_via_kill.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_recon_indicators.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_running_process_discovery.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_sensitive_file_access.yml +0 -50
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml +0 -31
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml +0 -35
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_system_info_discovery.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_system_network_connections_discovery.yml +0 -30
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_system_network_discovery.yml +0 -33
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_systemctl_mask_power_settings.yml +0 -32
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_touch_susp.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_execve_hijack.yml +0 -22
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml +0 -27
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_userdel.yml +0 -24
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml +0 -25
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml +0 -42
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_webshell_detection.yml +0 -50
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml +0 -29
- package/bundled-rules/sigma-rules/community/linux/process_creation/proc_creation_lnx_xterm_reverse_shell.yml +0 -24
- package/bundled-rules/sigma-rules/community/macos/file/file_event/file_event_macos_python_path_configuration_files.yml +0 -33
- package/bundled-rules/sigma-rules/community/macos/file_event/file_event_macos_emond_launch_daemon.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/file_event/file_event_macos_susp_startup_item_created.yml +0 -30
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_applescript.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_base64_decode.yml +0 -23
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_binary_padding.yml +0 -31
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_change_file_time_attr.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml +0 -32
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_clear_system_logs.yml +0 -31
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_clipboard_data_via_osascript.yml +0 -29
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_create_account.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_create_hidden_account.yml +0 -33
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_creds_from_keychain.yml +0 -30
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_csrutil_disable.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_csrutil_status.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_disable_security_tools.yml +0 -43
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml +0 -32
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml +0 -30
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml +0 -30
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml +0 -32
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_find_cred_in_files.yml +0 -25
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_gui_input_capture.yml +0 -40
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_hdiutil_create.yml +0 -23
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_hdiutil_mount.yml +0 -28
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_installer_susp_child_process.yml +0 -44
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_ioreg_discovery.yml +0 -47
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_jamf_susp_child.yml +0 -26
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_jamf_usage.yml +0 -31
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_jxa_in_memory_execution.yml +0 -34
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_launchctl_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_local_account.yml +0 -42
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_local_groups.yml +0 -33
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_network_service_scanning.yml +0 -30
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_network_sniffing.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_nscurl_usage.yml +0 -32
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_office_susp_child_processes.yml +0 -42
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_osacompile_runonly_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_payload_decoded_and_decrypted.yml +0 -31
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_pbpaste_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_persistence_via_plistbuddy.yml +0 -30
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_remote_access_tools_meshagent_arguments.yml +0 -30
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_remote_access_tools_renamed_meshagent_execution.yml +0 -39
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_remote_access_tools_teamviewer_incoming_connection.yml +0 -31
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_remote_system_discovery.yml +0 -46
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_schedule_task_job_cron.yml +0 -25
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_screencapture.yml +0 -23
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_security_software_discovery.yml +0 -39
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_space_after_filename.yml +0 -24
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_split_file_into_pieces.yml +0 -22
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_browser_child_process.yml +0 -78
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_execution_macos_script_editor.yml +0 -55
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_find_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_histfile_operations.yml +0 -29
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_in_memory_download_and_compile.yml +0 -25
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml +0 -28
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_susp_system_network_discovery.yml +0 -34
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_suspicious_applet_behaviour.yml +0 -24
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_swvers_discovery.yml +0 -29
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml +0 -32
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml +0 -29
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_sysctl_discovery.yml +0 -37
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml +0 -38
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_system_shutdown_reboot.yml +0 -25
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_tail_base64_decode_from_image.yml +0 -46
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml +0 -27
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml +0 -28
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_xattr_gatekeeper_bypass.yml +0 -26
- package/bundled-rules/sigma-rules/community/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml +0 -47
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_clear_logs.yml +0 -24
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_collect_data.yml +0 -31
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_crypto_actions.yml +0 -26
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_disable_logging.yml +0 -23
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_discovery.yml +0 -40
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_dos.yml +0 -24
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_file_deletion.yml +0 -25
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_input_capture.yml +0 -22
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_local_accounts.yml +0 -23
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_modify_config.yml +0 -34
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_moving_data.yml +0 -30
- package/bundled-rules/sigma-rules/community/network/cisco/aaa/cisco_cli_net_sniff.yml +0 -23
- package/bundled-rules/sigma-rules/community/network/cisco/bgp/cisco_bgp_md5_auth_failed.yml +0 -32
- package/bundled-rules/sigma-rules/community/network/cisco/ldp/cisco_ldp_md5_auth_failed.yml +0 -32
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_external_service_interaction_domains.yml +0 -55
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_mal_cobaltstrike.yml +0 -26
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_pua_cryptocoin_mining_xmr.yml +0 -42
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_susp_b64_queries.yml +0 -23
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_susp_telegram_api.yml +0 -24
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_susp_txt_exec_strings.yml +0 -26
- package/bundled-rules/sigma-rules/community/network/dns/net_dns_wannacry_killswitch_domain.yml +0 -26
- package/bundled-rules/sigma-rules/community/network/firewall/net_firewall_cleartext_protocols.yml +0 -89
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_admin_account_created.yml +0 -25
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_firewall_address_object.yml +0 -25
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_firewall_policy_added.yml +0 -25
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_local_user_created.yml +0 -27
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_new_vpn_ssl_web_portal.yml +0 -28
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_user_group_modified.yml +0 -28
- package/bundled-rules/sigma-rules/community/network/fortinet/fortigate/fortinet_fortigate_vpn_ssl_settings_modified.yml +0 -28
- package/bundled-rules/sigma-rules/community/network/huawei/bgp/huawei_bgp_auth_failed.yml +0 -32
- package/bundled-rules/sigma-rules/community/network/juniper/bgp/juniper_bgp_missing_md5.yml +0 -32
- package/bundled-rules/sigma-rules/community/network/net_dns_low_reputation_etld.yml +0 -42
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dce_rpc_mitre_bzar_execution.yml +0 -55
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dce_rpc_mitre_bzar_persistence.yml +0 -40
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml +0 -31
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml +0 -25
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_default_cobalt_strike_certificate.yml +0 -22
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_kerberos_coercion_via_dns_object_spn_spoofing.yml +0 -38
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_mining_pools.yml +0 -100
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_nkn.yml +0 -24
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_susp_zbit_flag.yml +0 -56
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_dns_torproxy.yml +0 -72
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_http_executable_download_from_webdav.yml +0 -27
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_http_susp_file_ext_from_susp_tld.yml +0 -85
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_http_webdav_put_request.yml +0 -30
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_rdp_public_listener.yml +0 -33
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_atsvc_task.yml +0 -32
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_impacket_secretdump.yml +0 -28
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_lm_namedpipe.yml +0 -42
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_susp_psexec.yml +0 -33
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_susp_raccess_sensitive_fext.yml +0 -37
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_smb_converted_win_transferring_files_with_credential_data.yml +0 -35
- package/bundled-rules/sigma-rules/community/network/zeek/zeek_susp_kerberos_rc4.yml +0 -25
- package/bundled-rules/sigma-rules/community/other/netflow_cleartext_protocols.yml +0 -83
- package/bundled-rules/sigma-rules/community/product/qualys/qualys_default_credentials_usage.yml +0 -112
- package/bundled-rules/sigma-rules/community/product/qualys/qualys_host_without_firewall.yml +0 -31
- package/bundled-rules/sigma-rules/community/web/product/apache/web_apache_segfault.yml +0 -22
- package/bundled-rules/sigma-rules/community/web/product/apache/web_apache_threading_error.yml +0 -24
- package/bundled-rules/sigma-rules/community/web/product/nginx/web_nginx_core_dump.yml +0 -22
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_download_susp_dyndns.yml +0 -112
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml +0 -115
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_download_susp_tlds_whitelist.yml +0 -66
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_downloadcradle_webdav.yml +0 -24
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_f5_tm_utility_bash_api_request.yml +0 -26
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_hello_world_user_agent.yml +0 -24
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_hktl_baby_shark_default_agent_url.yml +0 -21
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_hktl_cobalt_strike_malleable_c2_requests.yml +0 -60
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_hktl_empire_ua_uri_patterns.yml +0 -27
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_pua_advanced_ip_scanner_update_check.yml +0 -32
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_pwndrop.yml +0 -23
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_raw_paste_service_access.yml +0 -31
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_susp_class_extension_request.yml +0 -23
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_susp_flash_download_loc.yml +0 -28
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml +0 -23
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_telegram_api.yml +0 -30
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_apt.yml +0 -65
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_base64_encoded.yml +0 -27
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_bitsadmin_susp_ip.yml +0 -35
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_bitsadmin_susp_tld.yml +0 -33
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_cryptominer.yml +0 -26
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_empty.yml +0 -25
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_frameworks.yml +0 -57
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_hacktool.yml +0 -73
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_malware.yml +0 -142
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_powershell.yml +0 -23
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_rclone.yml +0 -21
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_susp.yml +0 -50
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_ua_susp_base64.yml +0 -25
- package/bundled-rules/sigma-rules/community/web/proxy_generic/proxy_webdav_external_execution.yml +0 -55
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_f5_tm_utility_bash_api_request.yml +0 -27
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_iis_tilt_shortname_scan.yml +0 -31
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_java_payload_in_access_logs.yml +0 -36
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_jndi_exploit.yml +0 -41
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_path_traversal_exploitation_attempt.yml +0 -29
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_source_code_enumeration.yml +0 -22
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_sql_injection_in_access_logs.yml +0 -60
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_ssti_in_access_logs.yml +0 -35
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_susp_useragents.yml +0 -28
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_susp_windows_path_uri.yml +0 -28
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_webshell_regeorg.yml +0 -31
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_win_webshells_in_access_logs.yml +0 -62
- package/bundled-rules/sigma-rules/community/web/webserver_generic/web_xss_in_access_logs.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/builtin/application/Other/win_av_relevant_match.yml +0 -111
- package/bundled-rules/sigma-rules/community/windows/builtin/application/application_error/win_application_error_lsass_crash.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/application/application_error/win_application_error_msmpeng_crash.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/application/esent/win_esent_ntdsutil_abuse.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/application/esent/win_esent_ntdsutil_abuse_susp_location.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/application/microsoft_windows_software_restriction_policies/win_software_restriction_policies_block.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/application/msiinstaller/win_builtin_remove_application.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/application/msiinstaller/win_msi_install_from_susp_locations.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/application/msiinstaller/win_software_atera_rmm_agent_install.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_add_sysadmin_account.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_destructive_query.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_audit_log.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/application/mssqlserver/win_mssql_xp_cmdshell_change.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_command_exec.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_file_transfer.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/appmodel_runtime/win_appmodel_runtime_sysinternals_tools_appx_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_applocker_block.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_downloaded_from_file_sharing_domains.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_deployment_failed_signing_requirements.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_appx_package_in_staging_directory.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_policy_block.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxpackaging_server_full_trust_package_installation.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxpackaging_server_successful_package_installation.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/appxdeployment_server/win_appxpackaging_server_unsigned_package_installation.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/appxpackaging_om/win_appxpackaging_om_sups_appx_signature.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_job_via_bitsadmin.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_job_via_powershell.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_transfer_saving_susp_extensions.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml +0 -75
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_transfer_via_uncommon_tld.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/bits_client/win_bits_client_new_trasnfer_susp_local_folder.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/capi2/win_capi2_acquire_certificate_private_key.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/certificate_services_client_lifecycle_system/win_certificateservicesclient_lifecycle_system_cert_exported.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml +0 -125
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_blocked_protected_process_file.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_blocked.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_revoked_driver_loaded.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_revoked_image_blocked.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_revoked_image_loaded.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_unsigned_driver_loaded.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_unsigned_image_loaded.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/code_integrity/win_codeintegrity_whql_failure.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/diagnosis/scripted/win_diagnosis_scripted_load_remote_diagcab.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_anonymfiles_com.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_mal_cobaltstrike.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_mega_nz.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_put_io.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_tor_onion.yml +0 -75
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_client/win_dns_client_ufile_io.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_server/win_dns_server_failed_dns_zone_transfer.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/builtin/dns_server/win_dns_server_susp_server_level_plugin_dll.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/driverframeworks/win_usb_device_plugged.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_add_rule.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_change_rule.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_delete_all_rules.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_delete_rule.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_failed_load_gpo.yml +0 -20
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_reset_config.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/firewall_as/win_firewall_as_setting_change.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/iis-configuration/win_iis_logging_etw_disabled.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/iis-configuration/win_iis_logging_http_disabled.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/iis-configuration/win_iis_module_added.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/builtin/iis-configuration/win_iis_module_removed.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/ldap/win_ldap_recon.yml +0 -91
- package/bundled-rules/sigma-rules/community/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_proxylogon_oabvirtualdir.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_proxyshell_certificate_generation.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_proxyshell_mailbox_export.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_set_oabvirtualdirectory_externalurl.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_transportagent.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/msexchange/win_exchange_transportagent_failed.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/ntlm/win_susp_ntlm_auth.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/ntlm/win_susp_ntlm_brute_force.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/ntlm/win_susp_ntlm_rdp.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_access_token_abuse.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_admin_rdp_login.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_overpass_the_hash.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_rdp_localhost_login.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_scrcons_remote_wmi_scripteventconsumer.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_logon_newcredentials.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_rottenpotato.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/security/account_management/win_security_susp_wmi_login.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/security/object_access/win_security_wfp_endpoint_agent_blocked.yml +0 -96
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_aadhealth_svc_agent_regkey_access.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_account_discovery.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_ad_object_writedac_access.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_ad_replication_non_machine_account.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_ad_user_enumeration.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability_eku.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_add_remove_computer.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_admin_logon.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_admin_share_access.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_alert_active_directory_user_control.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_alert_ad_user_backdoors.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_alert_enable_weak_encryption.yml +0 -89
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_alert_ruler.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_atsvc_task.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_audit_log_cleared.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_camera_microphone_access.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_cobaltstrike_service_installs.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_codeintegrity_check_failure.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dce_rpc_smb_spoolss_named_pipe.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dcom_iertutil_dll_hijack.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dcsync.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_default_domain_gpo_modification.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_device_installation_blocked.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_disable_event_auditing.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_disable_event_auditing_critical.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dot_net_etw_tamper.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dpapi_domain_backupkey_extraction.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_dpapi_domain_masterkey_backup_attempt.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_exploit_cve_2020_1472.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_external_device.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_file_access_browser_credential.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_gpo_scheduledtasks.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_hidden_user_creation.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_hktl_edr_silencer.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_hktl_nofilter.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_impacket_psexec.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_impacket_secretdump.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_rundll_services_security.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_use_mshta_services_security.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_iso_mount.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_kerberoasting_activity.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_kerberos_asrep_roasting.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_lm_namedpipe.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_lsass_access_non_system_account.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_mal_creddumper.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_mal_wceaux_dll.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_metasploit_authentication.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_net_ntlm_downgrade.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_net_share_obj_susp_desktop_ini.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_not_allowed_rdp_access.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_password_policy_enumerated.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_pcap_drivers.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_petitpotam_network_share.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_possible_dc_shadow.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_potential_pass_the_hash.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_powershell_script_installed_as_service.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_protected_storage_service_access.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_rdp_reverse_tunnel.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_registry_permissions_weakness_check.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_remote_powershell_session.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_remote_registry_management_via_reg.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_replay_attack_detected.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_scheduled_task_deletion.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_scm_database_handle_failure.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_scm_database_privileged_operation.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_service_install_remote_access_software.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_service_installation_by_unusal_client.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_signal_sensitive_config_access.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_add_domain_trust.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_add_sid_history.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_computer_name.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_dsrm_password_change.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_failed_logon_reasons.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_group_policy_abuse_privilege_addition.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_interactive_logons.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_kerberos_manipulation.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_ldap_dataexchange.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_local_anon_logon_created.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_lsass_dump.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_lsass_dump_generic.yml +0 -114
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_net_recon_activity.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_outbound_kerberos_connection.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_psexec.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_raccess_sensitive_fext.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_rc4_kerberos.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_scheduled_task_creation.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_scheduled_task_update.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_susp_time_modification.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_svcctl_remote_service.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_syskey_registry_access.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_tap_driver_installation.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_transf_files_with_cred_data_via_network_shares.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_added_to_local_administrators.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_creation.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_driver_loaded.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_user_logoff.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_vssaudit_secevent_source_registration.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_windows_defender_exclusions_write_access.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_wmi_persistence.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_wmiprvse_wbemcomn_dll_hijack.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/security/win_security_workstation_was_locked.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/builtin/security_mitigations/win_security_mitigations_defender_load_unsigned_dll.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/security_mitigations/win_security_mitigations_unsigned_dll_from_susp_location.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/servicebus/win_hybridconnectionmgr_svc_running.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/shell_core/win_shell_core_susp_packages_installed.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/smbserver/connectivity/win_smbserver_connectivity_unsigned_and_unencrypted_share_connection.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/builtin/system/application_popup/win_system_application_sysmon_crash.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/system/lsasrv/win_system_lsasrv_ntlmv1.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_Iphlpsvc/win_system_isatap_router_address_set.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_certification_authority/win_system_adcs_enrollment_request_denied.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config_failed.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_distributed_com/win_system_lpe_indicators_tabtip.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_eventlog/win_system_eventlog_cleared.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_eventlog/win_system_susp_eventlog_cleared.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_tgs_no_suitable_encryption_key_found.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_kernel_general/win_system_susp_critical_hive_location_access_bits_cleared.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_ntfs/win_system_volume_shadow_copy_mount.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_wer_systemerrorreporting/win_system_crash_dump_created.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/system/microsoft_windows_windows_update_client/win_system_susp_system_update_error.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/system/netlogon/win_system_possible_zerologon_exploitation_using_wellknown_tools.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/system/netlogon/win_system_vul_cve_2020_1472.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_defender_disabled.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_obfuscated_iex_services.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_krbrelayup_service_installation.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_mal_creddumper.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_moriya_rootkit.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_powershell_script_installed_as_service.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_anydesk.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_csexecsvc.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_hacktools.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_mesh_agent.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_netsupport_manager.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_paexec.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_pdqdeploy_runner.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_pua_proceshacker.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_remcom.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_remote_access_software.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_remote_utilities.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_sups_unusal_client.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_susp.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_sysinternals_psexec.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_tacticalrmm.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_tap_driver.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_install_uncommon.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_terminated_error_generic.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_terminated_error_important.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_service_terminated_unexpectedly.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_susp_rtcore64_service_install.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_susp_service_installation_folder_pattern.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/system/service_control_manager/win_system_susp_service_installation_script.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/builtin/taskscheduler/win_taskscheduler_execution_from_susp_locations.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/taskscheduler/win_taskscheduler_lolbin_execution_via_task_scheduler.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/builtin/terminalservices/win_terminalservices_rdp_ngrok.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/builtin/win_alert_mimikatz_keywords.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_antimalware_platform_expired.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_asr_lsass_access.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_asr_psexec_wmi.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_config_change_exclusion_added.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_config_change_exploit_guard_tamper.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_config_change_sample_submission_consent.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_history_delete.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_malware_and_pua_scan_disabled.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_malware_detected_amsi_source.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_real_time_protection_disabled.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_real_time_protection_errors.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_restored_quarantine_file.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_threat.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/builtin/windefend/win_defender_virus_scan_disabled.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/builtin/wmi/win_wmi_persistence.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_keepass.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_loadlibrary.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_powershell_generic.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_powershell_lsass.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml +0 -98
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_target_shell_application.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml +0 -118
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_target_image.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_ads_executable.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_creation_internet_file.yml +0 -87
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_susp_extension.yml +0 -72
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_unusual_extension.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_hktl_generic_download.yml +0 -136
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_anonymfiles_com.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_appinstaller.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_cloudflared_communication.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_common_malware_hosting_services.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_devtunnels_communication.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_domain_azurewebsites.yml +0 -112
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_finger.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_mal_cobaltstrike.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_mega_nz.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_onelaunch_update_service.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_quickassist.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_regsvr32_dns_query.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml +0 -175
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml +0 -107
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_tor_onion_domain_query.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_ufile_io_query.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/dns_query/dns_query_win_wscript_cscript_resolution.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_mal_drivers.yml +0 -813
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_mal_drivers_names.yml +0 -93
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_pua_process_hacker.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_pua_system_informer.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_susp_temp_use.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_vuln_drivers.yml +0 -4456
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_vuln_drivers_names.yml +0 -298
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_vuln_hevd_driver.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_vuln_winring0_driver.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/driver_load/driver_load_win_windivert.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_browsers_chromium_sensitive_files.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_browsers_credential.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_office_outlook_mail_credential.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_credential_manager_access.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_credhist.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_crypto_currency_wallets.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_dpapi_master_key_access.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_gpo_access_uncommon_process.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_gpo_files.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_process_access_browser_cred_files.yml +0 -202
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_reg_and_hive.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_susp_unattend_xml.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_access/file_access_win_teams_sensitive_files.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_change/file_change_win_date_changed_to_another_year.yml +0 -60
- package/bundled-rules/sigma-rules/community/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_backup_file.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_event_log_files.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_own_image.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_powershell_command_history.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_prefetch.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_teamviewer_logs.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_zone_identifier_ads.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_adsi_cache_creation_by_uncommon_tool.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_advanced_ip_scanner.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_anydesk_artefact.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_anydesk_writing_susp_binaries.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_arcsoc_susp_file_created.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_aspnet_temp_files.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_bloodhound_collection.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_comodo_itsm_potentially_suspicious_file_creation.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_create_evtx_non_common_locations.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_create_non_existent_dlls.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_deno.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_new_shim_database.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_scr_binary_file.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_system_dll_files.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_system_file.yml +0 -145
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_creation_unquoted_service_path.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_cscript_wscript_dropper.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_csexec_service.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_csharp_compile_artefact.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_dcom_iertutil_dll_hijack.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_desktop_ini_created_by_uncommon_process.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_dll_sideloading_space_path.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_dump_file_creation.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_dump_file_susp_creation.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_errorhandler_persistence.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_exchange_webshell_drop.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_gotoopener_artefact.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_gup_uncommon_file_creation.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_dumpert.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_krbrelay_remote_ioc.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_nppspy.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_powerup_dllhijacking.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_remote_cred_dump.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_hktl_safetykatz.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_impacket_file_indicators.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_initial_access_dll_search_order_hijacking.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_install_teamviewer_desktop.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_iphlpapi_dll_sideloading.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_iso_file_mount.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_iso_file_recent.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_lolbin_gather_network_info_script_output.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_lsass_shtinkering.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_lsass_werfault_dump.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_mal_adwind.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_mal_octopus_scanner.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_msdt_susp_directories.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_mysqld_uncommon_file_creation.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_net_cli_artefact.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_new_files_in_uncommon_appdata_folder.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_new_scr_file.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_notepad_plus_plus_persistence.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ntds_dit_creation.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ntds_dit_uncommon_process.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ntds_exfil_tools.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_addin_persistence.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_macro_files_created.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_macro_files_downloaded.yml +0 -62
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_outlook_newform.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_outlook_susp_file_creation_in_temp_dir.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_publisher_files_in_susp_locations.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_startup_persistence.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_susp_file_extension.yml +0 -69
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_pcre_net_temp_file.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_perflogs_susp_files.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_pfx_file_creation.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_drop_binary_or_script.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_drop_powershell.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_exploit_scripts.yml +0 -282
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_module_creation.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_module_susp_creation.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_python_path_configuration_files.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_rclone_config_files.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_regedit_print_as_pdf.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_remcom_service.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_artefact.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_remote_access_tools_screenconnect_remote_file.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_ripzip_attack.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sam_dump.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_scheduled_task_creation.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sed_file_creation.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_shell_write_susp_directory.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml +0 -83
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_startup_folder_file_write.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_binary_dropper.yml +0 -123
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_colorcpl.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_default_gpo_dir_write.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_desktop_txt.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_desktopimgdownldr_file.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_diagcab.yml +0 -20
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_double_extension.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_exchange_aspx_write.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_executable_creation.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_file_write_in_webapps_root.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_filewrite_in_sharepoint_layouts_dir.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_get_variable.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml +0 -77
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location.yml +0 -71
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml +0 -58
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_powershell_profile.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_procexplorer_driver_created_in_tmp_folder.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_public_folder_extension.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_right_to_left_override_extension_spoofing.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_spool_drivers_color_drop.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_startup_folder_persistence.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_system_interactive_powershell.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_task_write.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_teamviewer_remote_session.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_vscode_powershell_profile.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_wdac_policy_creation.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_windows_terminal_profile.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_susp_winsxs_binary_creation.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_adexplorer_dump_written.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_livekd_default_dump_name.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_livekd_driver.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_livekd_driver_susp_creation.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_procmon_driver_susp_creation.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_psexec_service.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_system32_local_folder_privilege_escalation.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_taskmgr_lsass_dump.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_tsclient_filewrite_startup.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_consent_comctl32.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_dotnet_profiler.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_idiagnostic_profile.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_ieinstal.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_msconfig_gui.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_ntfs_reparse_point.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_winsat.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_uac_bypass_wmp.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_vhd_download_via_browsers.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_vscode_tunnel_indicators.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_vscode_tunnel_remote_creation_artefacts.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_vscode_tunnel_renamed_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wdac_policy_creation_in_codeintegrity_folder.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_webdav_tmpfile_creation.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_webshell_creation_detect.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_werfault_dll_hijacking.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_winrar_file_creation_in_startup_folder.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_winrm_awl_bypass.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wmi_persistence_script_event_consumer_write.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wmiexec_default_filename.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_wpbbin_persistence.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/file/file_event/file_event_win_writing_local_admin_share.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/file/file_rename/file_rename_win_non_dll_to_dll_ext.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/file/file_rename/file_rename_win_ransomware.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_clfs_load.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_amsi_suspicious_process.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_amsi_uncommon_process.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml +0 -58
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_bitsproxy_load_by_uncommon_process.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_comsvcs_load_renamed_version_by_rundll32.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_credui_uncommon_process_load.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_dbghelp_dbgcore_susp_load.yml +0 -74
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_dbghelp_dbgcore_unsigned_load.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_rstrtmgr_uncommon_load.yml +0 -60
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_system_drawing_load.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_system_management_automation_susp_load.yml +0 -94
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_taskschd_by_process_in_potentially_suspicious_location.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_tttracer_module_load.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_unsigned_node_load.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_vss_ps_susp_load.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_vssapi_susp_load.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_dll_vsstrace_susp_load.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_hktl_sharpevtmute.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_hktl_silenttrinity_stager.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_iexplore_dcom_iertutil_dll_hijack.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_lsass_unsigned_image_load.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_dotnet_assembly_dll_load.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_dotnet_clr_dll_load.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_dotnet_gac_dll_load.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_excel_xll_load.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_excel_xll_susp_load.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_outlook_outlvba_load.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_powershell_dll_load.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_vbadll_load.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_office_word_wll_load.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_rundll32_remote_share_load.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_7za.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_antivirus.yml +0 -101
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_appverifui.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_aruba_networks_virtual_intranet_access.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_avkkid.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_ccleaner_du.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_ccleaner_reactivator.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_chrome_frame_helper.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_classicexplorer32.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_comctl32.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_coregen.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_cpl_from_non_system_location.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_dbgcore.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_dbghelp.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_dbgmodel.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_eacore.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_edputil.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_from_non_system_location.yml +0 -511
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_goopdate.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_gup_libcurl.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_iviewers.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_jli.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_jsschhlp.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_keyscrambler.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_libvlc.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_mfdetours.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_mfdetours_unsigned.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_mpsvc.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_mscorsvc.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_non_existent_dlls.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_office_dlls.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_python.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_rcdll.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_rjvplatform_default_location.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_rjvplatform_non_default_location.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_robform.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_shell_chrome_api.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_shelldispatch.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_smadhook.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_solidpdfcreator.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_third_party.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_ualapi.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vivaldi_elf.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vmguestlib.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vmmap_dbghelp_signed.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vmmap_dbghelp_unsigned.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_vmware_xfer.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_waveedit.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_wazuh.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_windows_defender.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_side_load_wwlib.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_baaupdate_dll_load.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_clickonce_unsigned_module_loaded.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_dll_load_system_process.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_python_image_load.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_susp_unsigned_dll.yml +0 -77
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_thor_unsigned_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_uac_bypass_iscsicpl.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_uac_bypass_via_dism.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_win_mmc_loads_script_engine_dll.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_win_susp_dbgcore_dbghelp_load.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_win_trusted_path_bypass.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_win_werfaultsecure_dbgcore_dbghelp_load.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wmi_module_load_by_uncommon_process.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wmi_persistence_commandline_event_consumer.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wmiprvse_wbemcomn_dll_hijack.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/image_load/image_load_wsman_provider_image_load.yml +0 -76
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_addinutil_initiated.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_adws_unusual_connection.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_certutil_initiated_connection.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_cmstp_initiated_connection.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_dfsvc_non_local_ip.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_dfsvc_uncommon_ports.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_dialer_initiated_connection.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_azurewebsites.yml +0 -147
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_btunnels.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml +0 -251
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_dead_drop_resolvers.yml +0 -246
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_devtunnels.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_dropbox_api.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml +0 -111
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml +0 -82
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_mega_nz.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_ngrok.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_notion_api_susp_communication.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_portmap.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_eqnedt.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_finger.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_hh_http_connection.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_imewdbld.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_msiexec_http.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_notepad.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml +0 -317
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_office_uncommon_ports.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_powershell_network_connection.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_python.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml +0 -80
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_rdp_to_http.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_regasm_network_activity.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_regsvr32_network_activity.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_rundll32_net_connections.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_azurefd_connection.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_binary_no_cmdline.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_file_sharing_domains_susp_folders.yml +0 -78
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_initaited_public_folder.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_initiated_uncommon_or_suspicious_locations.yml +0 -77
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_malware_callback_port.yml +0 -94
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_malware_callback_ports_uncommon.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_rdp_from_domain_controller.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_winlogon_net_connections.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_wordpad_uncommon_ports.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_wscript_cscript_local_connection.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_wscript_cscript_outbound_connection.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/network_connection/net_connection_win_wuauclt_network_connection.yml +0 -58
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml +0 -74
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_coercedpotato.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_diagtrack_eop.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_efspotato.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_powershell_execution_pipe.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_pua_csexec_default_pipe.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_scrcons_wmi_consumer_namedpipe.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_alternate_powershell_hosts.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_bxor_operator_usage.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_exe_calling_ps.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_powercat.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_remotefxvgpudisablement_abuse.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_susp_download.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_susp_get_nettcpconnection.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_susp_zip_compress.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_tamper_windows_defender_set_mp.yml +0 -81
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_active_directory_module_dll_import.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_clear_powershell_history.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_decompress_commands.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_exploit_scripts.yml +0 -278
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_get_clipboard.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_hktl_evil_winrm_execution.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml +0 -252
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_ad_group_reco.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_download.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_invocation_specific.yml +0 -80
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_local_group_reco.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_netfirewallrule_recon.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml +0 -58
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_amsi_null_bits_bypass.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_audio_exfiltration.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_automated_collection.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_capture_screenshots.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_compress_archive_usage.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_copy_item_system_directory.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_cor_profiler.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_create_local_user.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_directorysearcher.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_download_com_cradles.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_dsinternals_cmdlets.yml +0 -90
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_email_forwarding_activity.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_exchange_mailbox_smpt_forwarding_rule.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_export_certificate.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_acl_service.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_adgroup.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_import_module_susp_dirs.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_inbox_rule_creation_or_update_activity.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_install_unsigned_appx_packages.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_keylogging.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_localuser.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_mailbox_access.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml +0 -260
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_msxml_com.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_new_netfirewallrule_allow.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_new_smbmapping_quic.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml +0 -106
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_packet_capture.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_potential_invoke_mimikatz.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_powershell_web_access_installation.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml +0 -133
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_psasyncshell.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_psattack.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_registry_reconnaissance.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_remotefxvgpudisablement_abuse.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_remove_item_path.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_root_certificate_installed.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_send_mailmessage.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_set_acl.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_set_acl_susp_location.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_shellintel_malicious_commandlets.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_software_discovery.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_store_file_in_alternate_data_stream.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_ace_tampering.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_ad_group_reco.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_download.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_extracting.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_follina_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_get_addefaultdomainpasswordpolicy.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_get_current_user.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_get_process.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_getprocess_lsass.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_gettypefromclsid.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_invocation_generic.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_invocation_specific.yml +0 -81
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_iofilestream.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_keywords.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_local_group_reco.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_mail_acces.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_mounted_share_deletion.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_networkcredential.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_proxy_scripts.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_recon_export.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_service_dacl_modification_set_service.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_smb_share_reco.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_start_process.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_unblock_file.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_wallpaper.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_win32_pnpentity.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_windowstyle.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_write_eventlog.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_susp_zip_compress.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_rem_mp.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml +0 -86
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_test_netconnection.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_timestomp.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_token_obfuscation.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_user_profile_tampering.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_using_set_service_to_hide_services.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_vbscript_registry_modification.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win32_nteventlogfile_usage.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win32_product_install_msi.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win_api_functions_access.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml +0 -69
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_win_defender_exclusions_added.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_wmi_persistence.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_wmi_unquoted_service_search.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_wmimplant.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_x509enrollment.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/powershell/powershell_script/posh_ps_xml_iex.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_cmstp_execution_by_access.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_generic_access.yml +0 -110
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_littlecorporal_generated_maldoc.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_hktl_sysmonente.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_memdump.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_powershell_access.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_python_based_tool.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_seclogon_access.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_susp_access_flag.yml +0 -125
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_susp_source_process.yml +0 -137
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_uncommon_access_flag.yml +0 -110
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_werfault.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_susp_all_access_uncommon_target.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml +0 -73
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_susp_potential_shellcode_injection.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_svchost_credential_dumping.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_svchost_susp_access_request.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_7zip_exfil_dmp_files.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_7zip_password_compression.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_7zip_password_extraction.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_acccheckconsole_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_adplus_memory_dump.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_amsi_registry_tampering.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_appvlp_uncommon_child_process.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_arcsoc_susp_child_process.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_at_interactive_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_attrib_hiding_files.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_attrib_system.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_autorun_registry_modified_via_wmic.yml +0 -62
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_baaupdate_susp_child_process.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bash_command_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bash_file_execution.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bcdedit_susp_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bcp_export_data.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitlockertogo_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml +0 -77
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml +0 -75
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml +0 -71
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_boinc_execution.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_headless_exec.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download.yml +0 -60
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_load_extension.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_mockbin_abuse.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_inline_file_download.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_browsers_tor_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_calc_uncommon_exec.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certoc_download.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certoc_download_direct_ip.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certoc_load_dll.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certreq_download.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_certificate_installation.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_decode.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_download.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml +0 -78
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml +0 -75
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_encode.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_export_pfx.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_certutil_ntlm_coercion.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_citrix_trolleyexpress_procdump.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_clip_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cloudflared_portable_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cloudflared_quicktunnel_execution.yml +0 -88
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_assoc_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_assoc_tamper_exe_file_association.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_copy_dmp_from_share.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_del_execution.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_dir_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_dosfuscation.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_http_appdata.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag.yml +0 -78
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_mklink_shadow_copies_access_symlink.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_net_use_and_exec_combo.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml +0 -66
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_ntdllpipe_redirect.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_path_traversal.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_ping_copy_combined_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_redirect.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_redirection_susp_folder.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_rmdir_execution.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_set_prompt_abuse.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_stdin_redirect.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_type_arbitrary_file_download.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmd_unusual_parent.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmdkey_recon.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_cmstp_execution_by_creation.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_configsecuritypolicy_download_file.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_headless_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_legacy_option.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_path_traversal.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_uncommon_parent.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_control_panel_item.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml +0 -62
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csc_compilation.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml +0 -73
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csc_susp_parent.yml +0 -86
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csi_execution.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csvde_export.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_cookie_hijacking.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_download.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec.yml +0 -81
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_download_direct_ip_susp_extensions.yml +0 -78
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml +0 -97
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_fileupload.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_insecure_connection.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_insecure_proxy_or_doh.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_local_file_read.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_susp_download.yml +0 -72
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_useragent.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_customshellhost_susp_exec.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dctask64_arbitrary_command_and_dll_execution.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_defaultpack_uncommon_child_process.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_defender_default_action_modified.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_defender_remove_context_menu.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_desktopimgdownldr_remote_file_download.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_desktopimgdownldr_susp_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_device_credential_deployment.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dfsvc_child_processes.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dfsvc_suspicious_child_processes.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dirlister_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_discovery_via_reg_queries.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_diskshadow_child_process.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_diskshadow_script_mode.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dism_enable_powershell_web_access_feature.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dism_remove.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dll_sideload_vmware_xfer.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dns_exfiltration_tools_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dns_susp_child_process.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dnscmd_discovery.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dnscmd_install_new_server_level_plugin_dll.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dotnetdump_memory_dump.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_driverquery_recon.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_driverquery_usage.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dsacls_password_spray.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dump64_defender_av_bypass_rename.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dumpminitool_execution.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dumpminitool_susp_execution.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_dxcap_arbitrary_binary_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_esentutl_params.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_esentutl_webcache.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_event_logging_disable_via_key_minint.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_eventvwr_susp_child_process.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_expand_cabinet_files.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_explorer_child_of_shell_process.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_explorer_nouaccheck.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_extexport_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_download.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_gpp_passwords.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_lnk.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_lsass.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_password_recon.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_recon_everyone.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_recon_pipe_output.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup.yml +0 -69
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_findstr_sysmon_discovery_via_default_altitude.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_finger_execution.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_forfiles_child_process_masquerading.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_forfiles_proxy_execution_.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_format_uncommon_filesystem_load.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fsi_fsharp_code_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_fsutil_usage.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ftp_arbitrary_command_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gfxdownloadwrapper_arbitrary_file_download.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_git_susp_clone.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_github_self_hosted_runner.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_googleupdate_susp_child_process.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpg4win_decryption.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpg4win_encryption.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpg4win_susp_location.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gpresult_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gup_arbitrary_binary_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gup_download.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gup_susp_child_process.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_gup_suspicious_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hh_chm_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hh_chm_remote_download_or_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hh_susp_execution.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_adcspwn.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_c3_rundll32_pattern.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_certify.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_certipy.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_cmd.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_cobaltstrike_bloopers_modules.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_cobaltstrike_load_by_rundll32.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_covenant.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml +0 -77
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_crackmapexec_patterns.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_crackmapexec_powershell_obfuscation.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_createminidump.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_dinjector.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_doppelganger.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_dumpert.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_edr_freeze.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_edrsilencer.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_evil_winrm.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml +0 -112
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_gmer.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_handlekatz.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_hashcat.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_hollowreaper.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_hydra.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml +0 -68
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml +0 -75
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_impersonate.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_inveigh.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_koadic.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_krbrelay.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_krbrelay_remote.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_krbrelayup.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_lazagne.yml +0 -140
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_localpotato.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_mimikatz_command_line.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_pchunter.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_powertool.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_purplesharp_indicators.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_pypykatz.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_quarks_pwdump.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_rubeus.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_safetykatz.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharp_dpapi_execution.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharp_ldap_monitor.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpersist.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpevtmute.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpldapwhoami.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpmove.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpsuccessor_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpup.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpview.yml +0 -141
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sharpwsus_wsuspendu_execution.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_silenttrinity_stager.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_soaphound_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_stracciatella_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_sysmoneop.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_trufflesnout.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_uacme.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_wce.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_winpeas.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_winpwn.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_wmiexec_default_powershell.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_wsass.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_xordump.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hktl_zipexec.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hostname_execution.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hvci_registry_tampering.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hwp_exploits.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_hxtsr_masquerading.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_icacls_deny.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ieexec_download.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iexpress_execution.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_appcmd_http_logging.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_appcmd_service_account_password_dumped.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_appcmd_susp_rewrite_rule.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_connection_strings_decryption.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_logs_deletion.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_iis_susp_module_registration.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ilasm_il_code_compilation.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_imagingdevices_unusual_parents.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_imewbdld_download.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_installutil_download.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_keytool_susp_child_process.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml +0 -60
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_remote_debugging.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_susp_child_process.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_susp_child_process_2.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_java_sysaidserver_susp_child_process.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_jsc_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_kavremover_uncommon_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_kd_execution.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_keyscrambler_susp_child_process.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ksetup_password_change_computer.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ksetup_password_change_user.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ldifde_export.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ldifde_file_load.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lodctr_performance_counter_tampering.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_logman_disable_eventlog.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_diantz_ads.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_diantz_remote_cab.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_extrac32.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_extrac32_ads.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_gather_network_info.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_gpscript.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_launch_vsdevshell.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_openconsole.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_openwith.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pcalua.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pcwutl.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pester.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pester_1.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_printbrm.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_pubprn.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_register_app.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_remote.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_replace.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_settingsynchost.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_sftp.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_susp_grpconv.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_tracker.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_ttdinject.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_utilityfunctions.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_visual_basic_compiler.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_vsiisexelauncher.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolbin_wfc.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lolscript_register_app.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_lsass_process_clone.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mftrace_child_process.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mmc_default_domain_gpo_modification_via_gpme.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mmc_mmc20_lateral_movement.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mmc_rlo_abuse_pattern.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mmc_susp_child_process.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mode_codepage_change.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mode_codepage_russian.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mofcomp_execution.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mpcmdrun_dll_sideload_defender.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mpcmdrun_remove_windows_defender_definition.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msdt_answer_file_exec.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msdt_susp_parent.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msedge_proxy_download.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_http.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_javascript.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_lethalhta_technique.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_susp_child_processes.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_susp_execution.yml +0 -74
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_dll.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_embedding.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_install_remote.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_masquerading.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msiexec_web_install.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msix_ai_stub_execution.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msohtmed_download.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mspub_download.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msra_process_injection.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mssql_susp_child_process.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_rdp_hijack_shadowing.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_remote_connection.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_mstsc_run_local_rpd_file_susp_parent.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msxsl_execution.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_msxsl_remote_execution.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_execution.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml +0 -58
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_quic.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_share_unmount.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_start_service.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_stop_service.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_mount_admin_share.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_mount_internet_share.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_mount_share.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_use_password_plaintext.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_user_add.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_user_add_never_expire.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_user_default_accounts_manipulation.yml +0 -68
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_net_view_share_and_sessions_enum.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_add_rule.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_allow_program_in_susp_location.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_allow_rdp.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_delete_rule.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_disable.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_fw_set_rule.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_packet_capture.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_port_forwarding_3389.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_netsh_wifi_credential_harvesting.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_nltest_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_nltest_recon.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_node_abuse.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_node_adobe_creative_cloud_abuse.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_nslookup_domain_discovery.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_nslookup_poweshell_download.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ntdsutil_usage.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_driver_install_susp.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_exec_susp_locations.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr_susp.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_response_file.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_response_file_susp.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_odbcconf_uncommon_child_process.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_excel_dcom_lateral_movement.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_onenote_embedded_script_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_onenote_susp_child_processes.yml +0 -125
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_outlook_execution_from_temp.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_spawn_exe_from_users_directory.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_susp_child_processes.yml +0 -135
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_svchost_parent.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_office_winword_dll_load.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_offlinescannershell_mpclient_sideloading.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pdqdeploy_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pdqdeploy_runner_susp_children.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_perl_inline_command_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_php_inline_command_execution.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ping_hex_ip.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pktmon_execution.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_plink_port_forwarding.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_plink_susp_tunneling.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powercfg_execution.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_abnormal_commandline_size.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_amsi_null_bits_bypass.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_audio_capture.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_encoded_obfusc.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml +0 -79
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_iex.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml +0 -76
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cl_invocation.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cl_loadassembly.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cl_mutexverifiers.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_console_history_file_access.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_create_service.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_crypto_namespace.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_decrypt_pattern.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml +0 -86
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_disable_firewall.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_disable_ie_features.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_downgrade_attack.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_com_cradles.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_cradle_obfuscated.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_dll.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_iex.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_patterns.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_download_susp_file_sharing_domains.yml +0 -71
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_dsinternals_cmdlets.yml +0 -89
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_email_exfil.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_encode.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_exec_data_file.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_export_certificate.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_frombase64string.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_frombase64string_archive.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_get_localgroup_member_recon.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_getprocess_lsass.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_import_module.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_import_module_susp_dirs.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_install_unsigned_appx_packages.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_invocation_specific.yml +0 -73
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_direct_ip.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_invoke_webrequest_download.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_kerberos_kerberos_ticket_request_via_cli.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml +0 -250
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_msexchange_transport_agent.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_new_netfirewallrule_allow.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_public_folder.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_remove_mppreference.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_reverse_shell_connection.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_run_script_from_ads.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_run_script_from_input_stream.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_sam_access.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_script_engine_parent.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_service_dacl_modification_set_service.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_set_acl.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_set_acl_susp_location.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_set_service_disabled.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_stop_service.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_download_patterns.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml +0 -133
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_parent_process.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_uninstall_defender_feature.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml +0 -174
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_powershell_zip_compress.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_presentationhost_download.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_presentationhost_uncommon_location_exec.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_print_remote_file_copy.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_protocolhandler_download.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_psr_capture_screenshots.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_adfind_execution.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml +0 -66
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_advanced_port_scanner.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_advancedrun.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_chisel.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_cleanwipe.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_crassus.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_csexec.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_defendercheck.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_ditsnap.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_frp.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_iox.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_kdu_driver_tool.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_netcat.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_netscan.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_ngrok.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nimgrab.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nimscan.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nircmd.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nircmd_as_system.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nmap_zenmap.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nps.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_nsudo.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_pingcastle.yml +0 -185
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_pingcastle_script_parent.yml +0 -90
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_process_hacker.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_radmin.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_rclone_execution.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_restic.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_runxcmd.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_seatbelt.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_system_informer.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_trufflehog.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_webbrowserpassview.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_pua_wsudo_susp_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_python_adidnsdump.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_python_inline_command_execution.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_python_pty_spawn.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_qemu_suspicious_execution.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_query_session_exfil.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_quickassist_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rar_compress_data.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rar_compression_with_password.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rar_susp_greedy_compression.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rasdial_execution.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rdp_enable_or_disable_via_win32_terminalservicesetting_wmi_class.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reagentc_disable_windows_recovery_environment.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_add_run_key.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_add_safeboot.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_bitlocker.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_credential_access_via_password_filter.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_defender_exclusion.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_delete_runmru.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_delete_safeboot.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_delete_services.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_desktop_background_change.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_direct_asep_registry_keys_modification.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_disable_defender_wmi_autologger.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_enable_windows_recall.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_enumeration_for_credentials_in_registry.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_import_from_suspicious_paths.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_lsa_disable_restricted_admin.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_lsa_ppl_protection_disabled.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_machineguid.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_modify_group_policy_settings.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_nolmhash.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_query_registry.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_rdp_keys_tamper.yml +0 -68
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_screensaver.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_service_imagepath_change.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_software_discovery.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_susp_paths.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_system_language_discovery.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_volsnap_disable.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml +0 -72
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_reg_write_protect_for_storage_disabled.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regasm_no_flag_or_dll_execution.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_extension_execution.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regasm_regsvcs_uncommon_location_execution.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_export_critical_keys.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_export_keys.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_import_keys.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_import_keys_ads.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regedit_trustedinstaller.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regini_ads.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regini_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_export_of_thirdparty_creds.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_install_reg_debugger_backdoor.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_logon_script.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_new_network_provider.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_office_disable_python_security_warnings.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_privilege_escalation_via_service_key.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_set_unsecure_powershell_policy.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_registry_typed_paths_persistence.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_dllregisterserver_exec.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_flags_anomaly.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_network_pattern.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_remote_share.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_1.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_exec_path_2.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_extensions.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_susp_parent.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_regsvr32_uncommon_extension.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_action1_code_exec_and_remote_sessions.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_ammyy_admin_execution.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_piped_password_via_cli.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_revoked_cert.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_silent_install.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_susp_exec.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_anyviewer_shell_exec.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_logmein.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_arguments.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_meshagent_exec.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_netsupport.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_netsupport_susp_exec.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_renamed_meshagent_execution.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_rurat_non_default_location.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_child_proc.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_installation_cli_param.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_remote_execution_susp.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_webshell.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_simple_help.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_tacticalrmm_agent_registration_via_cli.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_teamviewer_incoming_connection.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_access_tools_ultraviewer.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_remote_time_discovery.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_adfind.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_autohotkey.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_autoit.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_binary.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml +0 -88
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_boinc.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_browsercore.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_cloudflared.yml +0 -88
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_createdump.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_curl.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_dctask64.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_ftp.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_gpg4win.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_jusched.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_mavinject.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_megasync.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_msdt.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_msteams.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_netsupport_rat.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_nircmd.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_office_processes.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_paexec.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_pingcastle.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_plink.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_pressanykey.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_rurat.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_schtasks_execution.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_sysinternals_debugview.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_sysinternals_procdump.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_sysinternals_psexec_service.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_vmnat.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_renamed_whoami.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ruby_inline_command_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_ads_stored_dll_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_by_ordinal.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_dllregisterserver.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_inline_vbs.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_installscreensaver.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_keymgr.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_mshtml_runhtmlapplication.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_no_params.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_ntlmrelay.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_obfuscated_ordinal_call.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_parent_explorer.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml +0 -58
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_registered_com_objects.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_run_locations.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_shell32_susp_execution.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_shelldispatch_potential_abuse.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_spawn_explorer.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml +0 -107
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_execution_with_image_extension.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_ordinal_execution.yml +0 -68
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_susp_shimcache_flush.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_sys.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_udl_exec.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_unc_path.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_uncommon_dll_extension.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_user32_dll.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_webdav_client_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_rundll32_without_parameters.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_runonce_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_create_service.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_disable_service.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_new_kernel_driver.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_query.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_query_interesting_services.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_sdset_modification.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_service_path_modification.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_service_tamper_for_persistence.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sc_stop_service.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_change.yml +0 -74
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_creation.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_creation_from_susp_parent.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_creation_temp_folder.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_delete.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_delete_all.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_disable.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_env_folder.yml +0 -78
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_folder_combos.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_one_time_only_midnight_task.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_openssh_tunnelling.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_persistence_windows_telemetry.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_schedule_type_system.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_schedule_via_masqueraded_xml_file.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml +0 -69
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_system.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_schtasks_system_process.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_scrcons_susp_child_process.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sdbinst_shim_persistence.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sdbinst_susp_extension.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sdclt_child_process.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_secedit_execution.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_security_susp_node_js_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_servu_susp_child_process.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_setspn_spn_enumeration.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_setup16_custom_lst_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_shutdown_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_shutdown_logoff.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sigverif_uncommon_child_process.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sndvol_susp_child_processes.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_soundrecorder_audio_capture.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_speechruntime_child_process.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_splwow64_cli_anomaly.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_spoolsv_susp_child_processes.yml +0 -82
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sqlcmd_veeam_db_recon.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sqlite_firefox_gecko_profile_data.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_squirrel_download.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml +0 -70
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ssh_port_forward.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ssh_rdp_tunneling.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_16bit_application.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_add_user_local_admin_group.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_add_user_privileged_group.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_add_user_remote_desktop_group.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_alternate_data_streams.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_always_install_elevated_windows_installer.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_appx_execution.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_arbitrary_shell_execution_via_settingcontent.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_automated_collection.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml +0 -60
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_browser_launch_from_document_reader_process.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode_img.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_clickfix_filefix_execution.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_clickfix_filefix_whitespace_padding.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_cmd_for_loop_execution_with_recursive_directory_search.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_commandline_path_traversal_evasion.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_compression_params.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_copy_browser_data.yml +0 -72
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_copy_lateral_movement.yml +0 -62
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_crypto_mining_monero.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_data_exfiltration_via_cli.yml +0 -71
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_disable_raccine.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_double_extension.yml +0 -88
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_double_extension_parent.yml +0 -63
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_download_office_domain.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_dumpstack_log_evasion.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_elavated_msi_spawned_shell.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_electron_app_children.yml +0 -66
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_electron_execution_proxy.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_elevated_system_shell.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_elevated_system_shell_uncommon_parent.yml +0 -73
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_embed_exe_lnk.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_1.yml +0 -997
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_2.yml +0 -1014
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_3.yml +0 -1020
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_emoji_usage_in_cli_4.yml +0 -765
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_event_log_query.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml +0 -76
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_eventlog_content_recon.yml +0 -117
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_execution_from_guid_folder_names.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_execution_from_public_folder_as_parent.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_execution_path.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_execution_path_webserver.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_exfil_and_tunneling_tool_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_file_characteristics.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_file_permission_modifications.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_filefix_execution_pattern.yml +0 -72
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_gather_network_info_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_homoglyph_cyrillic_lookalikes.yml +0 -77
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_image_missing.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_inline_base64_mz_header.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_inline_node_js_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_inline_win_api_access.yml +0 -82
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_jwt_token_search.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_lnk_exec_hidden_cmd.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_local_system_owner_account_discovery.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ms_appinstaller_download.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_network_command.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_network_sniffing.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_no_image_name.yml +0 -20
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_non_exe_image.yml +0 -80
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_non_priv_reg_or_ps.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntds.yml +0 -72
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_nteventlogfile_usage.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml +0 -71
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_open_html_file_from_download_folder.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_parent_execute_itself.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_parents.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_powershell_execution_via_dll.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_priv_escalation_via_named_pipe.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_private_keys_recon.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_privilege_escalation_cli_patterns.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_progname.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_recon.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_recycle_bin_fake_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_registry_modification_of_ms_setting_protocol_handler.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_remote_desktop_tunneling.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_script_exec_from_compressed_parent.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml +0 -58
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_script_exec_from_temp.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_sensitive_file_access_shadowcopy.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_service_creation.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_service_dir.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_service_tamper.yml +0 -295
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml +0 -66
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_sysnative.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml +0 -111
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml +0 -103
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_sysvol_access.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_task_folder_evasion.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_userinit_child.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_velociraptor_child_process.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_whoami_as_param.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_susp_workfolders.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_execution_with_no_cli_flags.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_masqueraded_execution.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_termserv_proc_spawn.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_svchost_uncommon_parent_process.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_adexplorer_execution.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_adexplorer_susp_execution.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_eula_accepted.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_livekd_execution.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_procdump.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_procdump_evasion.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexec_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexec_paexec_escalate_system.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexec_remote_execution.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexesvc.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_psservice.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_pssuspend_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_pssuspend_susp_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_sdelete.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_sysmon_config_update.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_sysmon_uninstall.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml +0 -239
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_sysprep_appdata.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_systeminfo_execution.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_takeown_recursive_own.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tapinstall_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tar_compression.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tar_extraction.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_taskkill_execution.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_taskkill_sep.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tasklist_basic_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tasklist_module_enumeration.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_taskmgr_localsystem.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_taskmgr_susp_child_process.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_teams_suspicious_command_line_cred_access.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tpmvscmgr_add_virtual_smartcard.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tscon_localsystem.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_tscon_rdp_session_hijacking.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_cleanmgr.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_computerdefaults.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_consent_comctl32.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_dismhost.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_eventvwr_recentviews.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_hijacking_firwall_snap_in.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_icmluautil.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_idiagnostic_profile.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_ieinstal.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_msconfig_gui.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_ntfs_reparse_point.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_pkgmgr_dism.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_sdclt.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_winsat.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_wmp.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ultravnc.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_ultravnc_susp_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_uninstall_crowdstrike_falcon.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_user_shell_folders_registry_modification.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_userdomain_variable_enumeration.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vaultcmd_list_creds.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vbscript_registry_modification.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_verclsid_runs_com.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_virtualbox_execution.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_virtualbox_vboxdrvinst_execution.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence_susp.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vmware_vmtoolsd_susp_child_process.yml +0 -57
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_tunnel_execution.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_tunnel_remote_shell_.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_tunnel_renamed_execution.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vscode_tunnel_service_install.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vsdiagnostics_execution_proxy.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vshadow_exec.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_vulnerable_driver_blocklist_registry_tampering.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_w32tm.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wab_unusual_parents.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_delete_backups.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_dump_sensitive_files.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_restore_file.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wbadmin_restore_sensitive_files.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webdav_process_execution.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_chopper.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_hacking.yml +0 -101
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_recon_commands_and_processes.yml +0 -115
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_susp_process_spawned_from_webserver.yml +0 -88
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_webshell_tool_recon.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_werfault_lsass_shtinkering.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_werfaultsecure_abuse.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wget_download_direct_ip.yml +0 -61
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml +0 -95
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wget_download_susp_locations.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_where_browser_data_recon.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_all_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_groups_discovery.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_output.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_whoami_priv_discovery.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winget_add_custom_source.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrar_exfil_dmp_files.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrar_susp_child_process.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrar_uncommon_folder_execution.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrm_awl_bypass.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrm_remote_powershell_session_process.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrm_susp_child_process.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrs_local_command_execution.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winrshost_command_execution.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winscp_command_open_ftp.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winscp_portable_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_winzip_password_compression.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmi_password_never_expire.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmi_persistence_script_event_consumer.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_eventconsumer_creation.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_process_creation.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_computersystem.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_csproduct.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_group.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_hotfix.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_process.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_product.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_service.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_system_info.yml +0 -66
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_recon_volume.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_remote_execution.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_service_manipulation.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_stdregprov_reg_modification.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_susp_execution_via_office_process.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml +0 -55
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_terminate_application.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_uninstall_application.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml +0 -85
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmic_xsl_script_processing.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmiprvse_spawning_process.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wpbbin_potential_persistence.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wscript_cscript_dropper.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wscript_cscript_script_exec.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wscript_cscript_susp_child_processes.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_arbitrary_command_execution.yml +0 -52
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_kali_linux_installation.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_kali_linux_usage.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wsl_windows_binaries_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wuauclt_no_cli_flags_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wusa_cab_files_extraction.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wusa_cab_files_extraction_from_susp_paths.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_wusa_susp_parent_execution.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_xwizard_execution_non_default_location.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_xwizard_runwizard_com_object_exec.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/process_tampering/proc_tampering_susp_process_hollowing.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/raw_access_thread/raw_access_thread_susp_disk_access_using_uncommon_tools.yml +0 -71
- package/bundled-rules/sigma-rules/community/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml +0 -64
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_defender_context_menu.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_disable_credential_guard.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_enable_windows_recall.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_removal_amsi_registry_key.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml +0 -97
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_runmru.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_index_value_removal.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_add_local_hidden_user.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_defender_threat_action_modified.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_esentutl_volume_shadow_copy_service_keys.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_hack_wce_reg.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_hybridconnectionmgr_svc_installation.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_mal_azorult.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_modify_screensaver_binary_path.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_office_test_regadd.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_office_trust_record_modification.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_portproxy_registry_key.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_runkey_winekey.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_runonce_persistence.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_scheduled_task_creation.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_stickykey_like_backdoor.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_atbroker_change.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_download_run_key.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_event/registry_set_enable_anonymous_connection.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml +0 -54
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_add_port_monitor.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_aedebug_persistence.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_amsi_com_hijack.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_amsi_disable.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml +0 -59
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml +0 -79
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml +0 -62
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml +0 -181
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml +0 -102
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml +0 -86
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml +0 -119
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bginfo_custom_db.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bginfo_custom_vbscript.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bginfo_custom_wmi_query.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_change_rdp_port.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_change_security_zones.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_change_sysmon_driver_altitude.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_chrome_extension.yml +0 -132
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_cobaltstrike_service_installs.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_comhijack_sdclt.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_crashdump_disabled.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_create_minint_key.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_creation_service_susp_folder.yml +0 -53
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_credential_guard_disabled.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_defender_exclusions.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_desktop_background_change.yml +0 -60
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_devdrv_disallow_antivirus_filter.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedpagingtranslation_disabled.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_administrative_share.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_defender_firewall.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_function_user.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_privacy_settings_experience.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_security_center_notifications.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_system_restore.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_windows_defender_service.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_windows_event_log_access.yml +0 -50
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_windows_firewall.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disable_winevt_logging.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disabled_exploit_guard_net_protection_on_ms_defender.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disabled_microsoft_defender_eventlog.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disabled_pua_protection_on_microsoft_defender.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disabled_tamper_protection_on_microsoft_defender.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disallowrun_execution.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml +0 -48
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dns_server_level_plugin_dll.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_dsrm_tampering.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_enable_periodic_backup.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_enable_windows_recall.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_enabling_turnoffcheck.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_evtx_file_key_tamper.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_exploit_guard_susp_allowed_apps.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_fax_change_service_user.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_fax_dll_persistance.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_file_association_exefile.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_filefix_typedpath_commands.yml +0 -65
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hhctrl_persistence.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hidden_extention.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hide_file.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hide_function_user.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hide_scheduled_task_via_index_tamper.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_hvci_disallowed_images.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_ime_non_default_extension.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_ime_suspicious_paths.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_legalnotice_susp_message.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_lolbin_onedrivestandaloneupdater.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_lsa_disablerestrictedadmin.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_lsass_usermode_dumping.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_net_cli_ngenassemblyusagelog.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_netsh_help_dll_persistence_susp_location.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml +0 -37
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_new_application_appcompat.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_new_network_provider.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_odbc_driver_registered.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_odbc_driver_registered_susp.yml +0 -49
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_disable_protected_view_features.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_disable_python_security_warnings.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_enable_dde.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_outlook_enable_unsafe_client_mail_rules.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_outlook_security_settings.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_trust_record_susp_location.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_trusted_location.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml +0 -45
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_optimize_file_sharing_network.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_amsi_providers.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_app_cpmpat_layer_registerapprestart.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_app_paths.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_appx_debugger.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_chm.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_com_hijacking_builtin.yml +0 -85
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_com_key_linking.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_custom_protocol_handler.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_globalflags.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_ie.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_ifilter.yml +0 -71
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_logon_scripts_userinitmprlogonscript.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_lsa_extension.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_mpnotify.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_mycomputer.yml +0 -22
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_natural_language.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_office_vsto.yml +0 -67
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_outlook_todaypage.yml +0 -43
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_reflectdebugger.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_scrobj_dll.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_shim_database.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_shim_database_uncommon_location.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_typed_paths.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_persistence_xll.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_policies_associations_tamper.yml +0 -38
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_potential_clickfix_execution.yml +0 -75
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_potential_oci_dll_redirection.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_as_service.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_crypto_namespace.yml +0 -46
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_enablescripts_enabled.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_execution_policy.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_pua_sysinternals_execution_via_eula.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula.yml +0 -68
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_pua_sysinternals_susp_execution_via_eula.yml +0 -39
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_renamed_sysinternals_eula_accepted.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_rpcrt4_etw_tamper.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_runmru_command_execution.yml +0 -47
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_runmru_susp_command_execution.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_sentinelone_shell_context_tampering.yml +0 -29
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_service_image_path_user_controlled_folder.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_servicedll_hijack.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_services_etw_tamper.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_set_nopolicies_user.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_shell_context_menu_tampering.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_sip_persistence.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_sophos_av_tamper.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_special_accounts.yml +0 -35
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_suppress_defender_notifications.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml +0 -34
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_printer_driver.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_reg_persist_explorer_run.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml +0 -69
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_runmru_space_character.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_service_installed.yml +0 -36
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_shell_open_keys_modification_patterns.yml +0 -42
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_typedpaths_space_characters.yml +0 -44
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_user_shell_folders.yml +0 -56
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_susp_wfp_filter_added.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_suspicious_env_variables.yml +0 -60
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_system_lsa_nolmhash.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_taskcache_entry.yml +0 -77
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_telemetry_persistence.yml +0 -51
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml +0 -40
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_terminal_server_tampering.yml +0 -85
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_timeproviders_dllname.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_tls_protocol_old_version_enabled.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_treatas_persistence.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_turn_on_dev_features.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_bypass_eventvwr.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_bypass_winsat.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_bypass_wmp.yml +0 -24
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_disable.yml +0 -30
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_disable_notification.yml +0 -32
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_uac_disable_secure_desktop_prompt.yml +0 -31
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_vbs_payload_stored.yml +0 -41
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_vulnerable_driver_blocklist_disable.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_wdigest_enable_uselogoncredential.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_windows_defender_tamper.yml +0 -66
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_winget_enable_local_manifest.yml +0 -23
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_winlogon_allow_multiple_tssessions.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/registry/registry_set/registry_set_winlogon_notify_key.yml +0 -26
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_config_modification.yml +0 -25
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_config_modification_error.yml +0 -33
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_config_modification_status.yml +0 -27
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_file_block_executable.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_file_block_shredding.yml +0 -20
- package/bundled-rules/sigma-rules/community/windows/sysmon/sysmon_file_executable_detected.yml +0 -21
- package/bundled-rules/sigma-rules/community/windows/wmi_event/sysmon_wmi_event_subscription.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/wmi_event/sysmon_wmi_susp_encoded_scripts.yml +0 -28
- package/bundled-rules/sigma-rules/community/windows/wmi_event/sysmon_wmi_susp_scripting.yml +0 -39
- package/bundled-rules/sigma-rules/custom/account-creation.yml +0 -73
- package/bundled-rules/sigma-rules/custom/admin-panel-access.yml +0 -52
- package/bundled-rules/sigma-rules/custom/anomalous-network.yml +0 -51
- package/bundled-rules/sigma-rules/custom/api-rate-abuse.yml +0 -66
- package/bundled-rules/sigma-rules/custom/brute-force.yml +0 -24
- package/bundled-rules/sigma-rules/custom/cloud-api-abuse.yml +0 -113
- package/bundled-rules/sigma-rules/custom/config-file-access.yml +0 -48
- package/bundled-rules/sigma-rules/custom/container-escape.yml +0 -88
- package/bundled-rules/sigma-rules/custom/credential-dumping.yml +0 -78
- package/bundled-rules/sigma-rules/custom/cron-persistence.yml +0 -66
- package/bundled-rules/sigma-rules/custom/crypto-mining.yml +0 -95
- package/bundled-rules/sigma-rules/custom/data-exfiltration.yml +0 -91
- package/bundled-rules/sigma-rules/custom/directory-traversal.yml +0 -41
- package/bundled-rules/sigma-rules/custom/dns-zone-transfer.yml +0 -43
- package/bundled-rules/sigma-rules/custom/email-exfil.yml +0 -56
- package/bundled-rules/sigma-rules/custom/file-integrity.yml +0 -55
- package/bundled-rules/sigma-rules/custom/file-permission-change.yml +0 -52
- package/bundled-rules/sigma-rules/custom/firewall-disable.yml +0 -52
- package/bundled-rules/sigma-rules/custom/kernel-module-load.yml +0 -74
- package/bundled-rules/sigma-rules/custom/log-tampering.yml +0 -84
- package/bundled-rules/sigma-rules/custom/memory-dump.yml +0 -80
- package/bundled-rules/sigma-rules/custom/mysql-injection.yml +0 -51
- package/bundled-rules/sigma-rules/custom/port-scanning.yml +0 -78
- package/bundled-rules/sigma-rules/custom/privilege-escalation.yml +0 -63
- package/bundled-rules/sigma-rules/custom/process-injection.yml +0 -59
- package/bundled-rules/sigma-rules/custom/ransomware-indicators.yml +0 -78
- package/bundled-rules/sigma-rules/custom/rdp-brute-force.yml +0 -72
- package/bundled-rules/sigma-rules/custom/registry-persistence.yml +0 -43
- package/bundled-rules/sigma-rules/custom/reverse-shell.yml +0 -69
- package/bundled-rules/sigma-rules/custom/scheduled-task-creation.yml +0 -53
- package/bundled-rules/sigma-rules/custom/service-creation.yml +0 -71
- package/bundled-rules/sigma-rules/custom/ssh-key-theft.yml +0 -54
- package/bundled-rules/sigma-rules/custom/ssh-lateral-movement.yml +0 -71
- package/bundled-rules/sigma-rules/custom/supply-chain-attack.yml +0 -94
- package/bundled-rules/sigma-rules/custom/suspicious-dns.yml +0 -79
- package/bundled-rules/sigma-rules/custom/suspicious-download.yml +0 -54
- package/bundled-rules/sigma-rules/custom/suspicious-network-tool.yml +0 -56
- package/bundled-rules/sigma-rules/custom/suspicious-powershell.yml +0 -95
- package/bundled-rules/sigma-rules/custom/suspicious-process.yml +0 -57
- package/bundled-rules/sigma-rules/custom/suspicious-user-agent.yml +0 -46
- package/bundled-rules/sigma-rules/custom/timestomping.yml +0 -50
- package/bundled-rules/sigma-rules/custom/tor-connection.yml +0 -75
- package/bundled-rules/sigma-rules/custom/vpn-anomaly.yml +0 -62
- package/bundled-rules/sigma-rules/custom/web-shell-upload.yml +0 -80
- package/bundled-rules/sigma-rules/custom/xss-attempt.yml +0 -55
- package/bundled-rules/yara-rules/.gitkeep +0 -0
- package/bundled-rules/yara-rules/auto-generated/auth-bypass-panguard_auth_bypass_cisa-kev.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/auth-bypass-panguard_auth_bypass_exploitd.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/auth-bypass-panguard_auth_bypass_github-a.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/code-injection-panguard_code_injection_2701701.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/code-injection-panguard_code_injection_github-a.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/code-injection-panguard_code_injection_nvd:CVE-.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/code-injection-panguard_code_injection_nvd_CVE-.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_3456148.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_3584149.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_cisa-kev.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_exploitd.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_github-a.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_nvd:CVE-.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/command-injection-panguard_command_injection_nvd_CVE-.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/deserialization-panguard_deserialization_cisa-kev.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/deserialization-panguard_deserialization_github-a.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_cisa-kev.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_exploitd.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_github-a.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_nvd:CVE-.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/file-upload-panguard_file_upload_nvd_CVE-.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_3066548.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_3360293.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_3463719.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_cisa-kev.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_exploitd.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_github-a.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_nvd:CVE-.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/information-disclosure-panguard_information_disclosure_nvd_CVE-.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/path-traversal-panguard_path_traversal_cisa-kev.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/path-traversal-panguard_path_traversal_exploitd.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/path-traversal-panguard_path_traversal_github-a.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_3277276.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_3293803.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_cisa-kev.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_exploitd.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/sqli-panguard_sqli_github-a.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/ssrf-panguard_ssrf_cisa-kev.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/ssrf-panguard_ssrf_exploitd.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/ssrf-panguard_ssrf_github-a.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_3424998.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_3447021.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_cisa-kev.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_exploitd.yar +0 -22
- package/bundled-rules/yara-rules/auto-generated/xss-panguard_xss_github-a.yar +0 -23
- package/bundled-rules/yara-rules/auto-generated/xxe-panguard_xxe_cisa-kev.yar +0 -21
- package/bundled-rules/yara-rules/auto-generated/xxe-panguard_xxe_exploitd.yar +0 -21
- package/bundled-rules/yara-rules/community/VERSION +0 -19
- package/bundled-rules/yara-rules/community/albertzsigovits/backdoor_shamanic.yar +0 -36
- package/bundled-rules/yara-rules/community/albertzsigovits/botnet_gafgyt.yar +0 -19
- package/bundled-rules/yara-rules/community/albertzsigovits/botnet_mirai.yar +0 -23
- package/bundled-rules/yara-rules/community/albertzsigovits/crypter_titancrypt.yar +0 -15
- package/bundled-rules/yara-rules/community/albertzsigovits/debug_dotnet.yar +0 -76
- package/bundled-rules/yara-rules/community/albertzsigovits/debug_lnk.yar +0 -41
- package/bundled-rules/yara-rules/community/albertzsigovits/infostealer_redline.yar +0 -64
- package/bundled-rules/yara-rules/community/albertzsigovits/linux_shdownloader.yar +0 -31
- package/bundled-rules/yara-rules/community/albertzsigovits/loader_cruloader.yar +0 -48
- package/bundled-rules/yara-rules/community/albertzsigovits/msil_tinydownloader.yar +0 -124
- package/bundled-rules/yara-rules/community/albertzsigovits/pe_signed.yar +0 -17
- package/bundled-rules/yara-rules/community/albertzsigovits/programlangs.yar +0 -137
- package/bundled-rules/yara-rules/community/albertzsigovits/ransomware_blackbasta.yar +0 -42
- package/bundled-rules/yara-rules/community/albertzsigovits/ransomware_blackcocaine.yar +0 -21
- package/bundled-rules/yara-rules/community/albertzsigovits/ransomware_cl0p.yar +0 -46
- package/bundled-rules/yara-rules/community/albertzsigovits/ransomware_darkbit.yar +0 -127
- package/bundled-rules/yara-rules/community/albertzsigovits/ransomware_esxiargs.yar +0 -41
- package/bundled-rules/yara-rules/community/albertzsigovits/ransomware_kangaroo.yar +0 -51
- package/bundled-rules/yara-rules/community/albertzsigovits/ransomware_royal.yar +0 -28
- package/bundled-rules/yara-rules/community/albertzsigovits/rat_rokrat.yar +0 -46
- package/bundled-rules/yara-rules/community/albertzsigovits/rat_toxiceye.yar +0 -206
- package/bundled-rules/yara-rules/community/albertzsigovits/trojan_fakepdf.yar +0 -23
- package/bundled-rules/yara-rules/community/baderj/agent_tesla.yar +0 -36
- package/bundled-rules/yara-rules/community/baderj/amadey.yar +0 -27
- package/bundled-rules/yara-rules/community/baderj/async_rat.yar +0 -39
- package/bundled-rules/yara-rules/community/baderj/aurora_stealer.yar +0 -77
- package/bundled-rules/yara-rules/community/baderj/danabot.yar +0 -25
- package/bundled-rules/yara-rules/community/baderj/discord_pws.yar +0 -27
- package/bundled-rules/yara-rules/community/baderj/erbium_stealer.yar +0 -27
- package/bundled-rules/yara-rules/community/baderj/ffdroider.yar +0 -49
- package/bundled-rules/yara-rules/community/baderj/gcleaner.yar +0 -45
- package/bundled-rules/yara-rules/community/baderj/imminent_rat.yar +0 -50
- package/bundled-rules/yara-rules/community/baderj/laplas_clipper.yar +0 -55
- package/bundled-rules/yara-rules/community/baderj/lime_rat.yar +0 -21
- package/bundled-rules/yara-rules/community/baderj/lu0bot_loader.yar +0 -53
- package/bundled-rules/yara-rules/community/baderj/matiex_keylogger.yar +0 -106
- package/bundled-rules/yara-rules/community/baderj/modern_loader.yar +0 -58
- package/bundled-rules/yara-rules/community/baderj/neshta.yar +0 -16
- package/bundled-rules/yara-rules/community/baderj/nj_rat.yar +0 -133
- package/bundled-rules/yara-rules/community/baderj/origin_logger.yar +0 -90
- package/bundled-rules/yara-rules/community/baderj/phorpiex.yar +0 -69
- package/bundled-rules/yara-rules/community/baderj/quasar_rat.yar +0 -91
- package/bundled-rules/yara-rules/community/baderj/rekoobe.yar +0 -41
- package/bundled-rules/yara-rules/community/baderj/shai-hulud.yar +0 -37
- package/bundled-rules/yara-rules/community/baderj/vidar.yar +0 -52
- package/bundled-rules/yara-rules/community/baderj/win_bitcoin_genesis_b9.yara +0 -49
- package/bundled-rules/yara-rules/community/baderj/ws_rat.yar +0 -28
- package/bundled-rules/yara-rules/community/baderj/xfiles_loader.yar +0 -40
- package/bundled-rules/yara-rules/community/baderj/xworm.yar +0 -53
- package/bundled-rules/yara-rules/community/barrosleo/forensics_rule1.yar +0 -16
- package/bundled-rules/yara-rules/community/barrosleo/malware_rule1.yar +0 -16
- package/bundled-rules/yara-rules/community/barrosleo/malware_rule2.yar +0 -16
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Autumn_Backdoor.yar +0 -36
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Autumn_Backdoor_Loader.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Confucius_B.yar +0 -28
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Cotx_RAT.yar +0 -56
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/EE_Dropper.yar +0 -30
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/EE_Loader.yar +0 -33
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/NikiCert.yar +0 -26
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/NikiGo.yar +0 -36
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/NikiHTTP.yar +0 -37
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/RokRAT.yar +0 -41
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/RoyalRoad_RTF.yar +0 -28
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/StormDNS.yar +0 -36
- package/bundled-rules/yara-rules/community/bartblaze/rules/APT/Unk_Mythic_Loader.yar +0 -37
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Andromeda.yar +0 -41
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/ArechClient.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/ArechClient_Campaign_July2021.yar +0 -25
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/AuroraStealer.yar +0 -58
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/AveMaria.yar +0 -31
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/BazarBackdoor.yar +0 -28
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/BazarLoader.yar +0 -32
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/BroEx.yar +0 -50
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/CrunchyRoll.yar +0 -25
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Ganelp.yar +0 -39
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/IcedID.yar +0 -64
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/JSSLoader.yar +0 -37
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Jupyter.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/KeyBase.yar +0 -37
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/LNKR.yar +0 -162
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Monero_Compromise.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/OfflRouter.yar +0 -29
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Oyster.yar +0 -34
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Parallax.yar +0 -32
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Prometei.yar +0 -103
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Pulsar_RAT.yar +0 -29
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/PureZip.yar +0 -26
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/PurpleFox.yar +0 -106
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/RedLine.yar +0 -165
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/RedLine_Campaign_June2021.yar +0 -25
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/SaintBot.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/ShinnyShield.yar +0 -42
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/SystemBC.yar +0 -62
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Unk_BR_Banker.yar +0 -38
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Unk_Crime_Downloader_1.yar +0 -29
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Unk_Crime_Downloader_2.yar +0 -31
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/Unk_DesktopLoader.yar +0 -29
- package/bundled-rules/yara-rules/community/bartblaze/rules/crimeware/ZLoader.yar +0 -46
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/AutoIT.yar +0 -60
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Costura_Protobuf.yar +0 -25
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/DotNet_Reactor.yar +0 -38
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/EnigmaStub.yar +0 -30
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Generic_Phishing_PDF.yar +0 -26
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/GrimResource.yar +0 -29
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Hidden.yar +0 -32
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/IEuser_author_doc.yar +0 -25
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/ISO_exec.yar +0 -24
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/LNK_Ruleset.yar +0 -465
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/MalScript_Tricks.yar +0 -25
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/MiniTor.yar +0 -38
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/OLEfile_in_CAD_FAS_LSP.yar +0 -30
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/OneNote_BuildPath.yar +0 -24
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/PyInstaller.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Rclone.yar +0 -31
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Specialist_Repack_Doc.yar +0 -24
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/VMProtectStub.yar +0 -31
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/Webshell_in_image.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/WinRAR_ADS_Traversal.yar +0 -31
- package/bundled-rules/yara-rules/community/bartblaze/rules/generic/oAuth_Phishing_PDF.yar +0 -26
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Adaptix_Beacon.yar +0 -51
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Adfind.yar +0 -31
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/CreateMiniDump.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/DefenderControl.yar +0 -29
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Extract_MachineKey_SharePoint.yar +0 -51
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/GhostShell_SharePoint.yar +0 -39
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Gmer.yar +0 -28
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Gmer_Driver.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/HiddenVNC.yar +0 -29
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/IISRaid.yar +0 -31
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/IIS_Backdoor.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Impacket.yar +0 -43
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/KPortScan.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/LaZagne.yar +0 -30
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Mythic.yar +0 -165
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/NLBrute.yar +0 -23
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Orca.yar +0 -64
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/PowerTool.yar +0 -33
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/RDPWrap.yar +0 -29
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Responder.yar +0 -39
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/SharpAdidnsdump.yar +0 -39
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/SharpHostInfo.yar +0 -36
- package/bundled-rules/yara-rules/community/bartblaze/rules/hacktools/Windows_Credentials_Editor.yar +0 -46
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Avaddon.yar +0 -36
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/BlackKingDom.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/CryLock.yar +0 -33
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Darkside.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/DearCry.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Ekans.yar +0 -28
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Fusion.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Maze.yar +0 -40
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Pysa.yar +0 -30
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/REvil_Cert.yar +0 -26
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/REvil_Dropper.yar +0 -41
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/RagnarLocker.yar +0 -27
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Satan_Mutexes.yar +0 -34
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Sfile.yar +0 -42
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Warlock.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/WhiteBlack.yar +0 -26
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/WickrMe.yar +0 -35
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/WinLock.yar +0 -38
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/XiaoBa.yar +0 -28
- package/bundled-rules/yara-rules/community/bartblaze/rules/ransomware/Zeppelin.yar +0 -33
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32_and_Resources_Dropper_v1_45_to_v4_x.yara +0 -89
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Artifact32svc_Exe_v1_49_to_v4_x.yara +0 -77
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Artifact64_v1_49_to_v4_x.yara +0 -128
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Beacon_Dll_All_Versions_MemEnabled.yara +0 -1665
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bind64_Bin_v2_5_through_v4_x.yara +0 -109
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bind_Bin_v2_5_through_v4_x.yara +0 -111
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_Dll_v4_0_to_v4_x.yara +0 -60
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Browserpivot_x64_Bin_v1_48_to_v3_14_and_Sleeve_Browserpivot_x64_Dll_v4_0_to_v4_x.yara +0 -64
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_Dll_v1_49_to_v3_14_and_Sleeve_Bypassuac_Dll_v4_0_to_v4_x.yara +0 -94
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuac_x64_Dll_v3_3_to_v3_14_and_Sleeve_Bypassuac_x64_Dll_v4_0_and_v4_x.yara +0 -86
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_Dll_v3_11_to_v3_14.yara +0 -151
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Bypassuactoken_x64_Dll_v3_11_to_v3_14.yara +0 -118
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Command_Ps1_v2_5_to_v3_7_and_Resources_Compress_Ps1_v3_8_to_v4_x.yara +0 -33
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_Dll_v2_1_to_v4_x.yara +0 -120
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Covertvpn_injector_Exe_v1_44_to_v2_0_49.yara +0 -116
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Dnsstager_Bin_v1_47_through_v4_x.yara +0 -78
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_Dll_v4_x.yara +0 -68
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Elevate_X64_Dll_v3_0_to_v3_14_and_Sleeve_Elevate_X64_Dll_v4_x.yara +0 -71
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager64_Bin_v3_2_through_v4_x.yara +0 -90
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Httpsstager_Bin_v2_5_through_v4_x.yara +0 -95
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager64_Bin_v3_2_through_v4_x.yara +0 -85
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Httpstager_Bin_v2_5_through_v4_x.yara +0 -93
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Reverse64_Bin_v2_5_through_v4_x.yara +0 -99
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Reverse_Bin_v2_5_through_v4_x.yara +0 -104
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Smbstager_Bin_v2_5_through_v4_x.yara +0 -95
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_Py_v3_3_to_v4_x.yara +0 -36
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_Sct_v3_3_to_v4_x.yara +0 -38
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_Vbs_v3_3_to_v4_x.yara +0 -41
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template__x32_x64_Ps1_v1_45_to_v2_5_and_v3_11_to_v3_14.yara +0 -43
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_x64_Ps1_v3_0_to_v4_x_excluding_3_12_3_13.yara +0 -37
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Template_x86_Vba_v3_8_to_v4_x.yara +0 -37
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__32bit_v2_x_to_4_x.yara +0 -38
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Resources_Xor_Bin__64bit_v3_12_to_4_x.yara +0 -39
- package/bundled-rules/yara-rules/community/chronicle/YARA/CobaltStrike/CobaltStrike__Sleeve_BeaconLoader_all.yara +0 -555
- package/bundled-rules/yara-rules/community/chronicle/YARA/Sliver/Sliver__Implant_32bit.yara +0 -81
- package/bundled-rules/yara-rules/community/chronicle/YARA/Sliver/Sliver__Implant_64bit.yara +0 -84
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_knownbad_certs.yar +0 -9004
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_knownbad_id.yar +0 -1739
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_office.yar +0 -953
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_packed.yar +0 -804
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_rmm.yar +0 -580
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_suspicious.yar +0 -2633
- package/bundled-rules/yara-rules/community/ditekshen/yara/indicator_tools.yar +0 -1908
- package/bundled-rules/yara-rules/community/ditekshen/yara/malware.yar +0 -11957
- package/bundled-rules/yara-rules/community/eset/animalfarm/animalfarm.yar +0 -96
- package/bundled-rules/yara-rules/community/eset/badiis/badiis.yar +0 -552
- package/bundled-rules/yara-rules/community/eset/groundbait/prikormka.yar +0 -141
- package/bundled-rules/yara-rules/community/eset/invisimole/invisimole.yar +0 -297
- package/bundled-rules/yara-rules/community/eset/keydnap/keydnap.yar +0 -86
- package/bundled-rules/yara-rules/community/eset/kobalos/kobalos.yar +0 -73
- package/bundled-rules/yara-rules/community/eset/moose/linux-moose.yar +0 -110
- package/bundled-rules/yara-rules/community/eset/mozi/mozi.yar +0 -51
- package/bundled-rules/yara-rules/community/eset/mumblehard/mumblehard_packer.yar +0 -47
- package/bundled-rules/yara-rules/community/eset/nukesped_lazarus/rich_headers_IconicPayloads_3CX.yar +0 -23
- package/bundled-rules/yara-rules/community/eset/potao/PotaoNew.yara +0 -108
- package/bundled-rules/yara-rules/community/eset/rakos/rakos.yar +0 -53
- package/bundled-rules/yara-rules/community/eset/redline/redline.yar +0 -172
- package/bundled-rules/yara-rules/community/eset/sparklinggoblin/SparklingGoblin.yar +0 -489
- package/bundled-rules/yara-rules/community/eset/sshdoor/sshdoor.yar +0 -572
- package/bundled-rules/yara-rules/community/eset/stantinko/stantinko.yar +0 -255
- package/bundled-rules/yara-rules/community/eset/ta410/ta410.yar +0 -741
- package/bundled-rules/yara-rules/community/eset/turla/carbon.yar +0 -69
- package/bundled-rules/yara-rules/community/eset/turla/gazer.yar +0 -85
- package/bundled-rules/yara-rules/community/eset/turla/turla-outlook.yar +0 -169
- package/bundled-rules/yara-rules/community/eset/windigo/ebury.yar +0 -97
- package/bundled-rules/yara-rules/community/eset/windigo/helimod.yar +0 -105
- package/bundled-rules/yara-rules/community/eset/windigo/windigo-onimiki.yar +0 -59
- package/bundled-rules/yara-rules/community/eset/winnti_group/skip20_sqllang_hook.yar +0 -69
- package/bundled-rules/yara-rules/community/intezer/APT15.yar +0 -48
- package/bundled-rules/yara-rules/community/intezer/AgeLocker.yar +0 -19
- package/bundled-rules/yara-rules/community/intezer/ChinaZ_Managers.yar +0 -60
- package/bundled-rules/yara-rules/community/intezer/DarkComet.yar +0 -262
- package/bundled-rules/yara-rules/community/intezer/Doki_Attack.yar +0 -17
- package/bundled-rules/yara-rules/community/intezer/EvilGnome.yar +0 -49
- package/bundled-rules/yara-rules/community/intezer/Gh0stRAT.yar +0 -37
- package/bundled-rules/yara-rules/community/intezer/GreedyAntd.yar +0 -13
- package/bundled-rules/yara-rules/community/intezer/HiddenWasp.yar +0 -44
- package/bundled-rules/yara-rules/community/intezer/IPStorm.yar +0 -18
- package/bundled-rules/yara-rules/community/intezer/Iranian_Wipers.yar +0 -111
- package/bundled-rules/yara-rules/community/intezer/Lazarus_2020.yar +0 -32
- package/bundled-rules/yara-rules/community/intezer/NexePirateSteal.yar +0 -13
- package/bundled-rules/yara-rules/community/intezer/QNAPCrypt.yar +0 -19
- package/bundled-rules/yara-rules/community/intezer/RedDelta.yar +0 -59
- package/bundled-rules/yara-rules/community/intezer/Rekoobe.yar +0 -16
- package/bundled-rules/yara-rules/community/intezer/RussianAPT.yar +0 -7634
- package/bundled-rules/yara-rules/community/intezer/Trickbot.yar +0 -184
- package/bundled-rules/yara-rules/community/intezer/WatchBog.yar +0 -25
- package/bundled-rules/yara-rules/community/intezer/xe_group.yar +0 -168
- package/bundled-rules/yara-rules/community/jpcert/APT10/apt10.yara +0 -254
- package/bundled-rules/yara-rules/community/jpcert/APT29/apt29.yara +0 -87
- package/bundled-rules/yara-rules/community/jpcert/BlackTech/blacktech.yara +0 -495
- package/bundled-rules/yara-rules/community/jpcert/Darkhotel/darkhotel.yara +0 -88
- package/bundled-rules/yara-rules/community/jpcert/DragonOK/dragonok.yara +0 -28
- package/bundled-rules/yara-rules/community/jpcert/Kimsuky/Kimsuky.yara +0 -130
- package/bundled-rules/yara-rules/community/jpcert/Lazarus/applejeus.yara +0 -34
- package/bundled-rules/yara-rules/community/jpcert/Lazarus/contagiousinterview.yara +0 -34
- package/bundled-rules/yara-rules/community/jpcert/Lazarus/crypthunter.yara +0 -349
- package/bundled-rules/yara-rules/community/jpcert/Lazarus/lazarus.yara +0 -705
- package/bundled-rules/yara-rules/community/jpcert/Tick/tick.yara +0 -323
- package/bundled-rules/yara-rules/community/jpcert/UNC5174/unc5174.yara +0 -38
- package/bundled-rules/yara-rules/community/jpcert/other/3proxy.yara +0 -15
- package/bundled-rules/yara-rules/community/jpcert/other/Atlas.yara +0 -42
- package/bundled-rules/yara-rules/community/jpcert/other/IcedID.yara +0 -20
- package/bundled-rules/yara-rules/community/jpcert/other/MedusaLocker.yara +0 -17
- package/bundled-rules/yara-rules/community/jpcert/other/Remcos.yara +0 -16
- package/bundled-rules/yara-rules/community/jpcert/other/RestyLink.yara +0 -107
- package/bundled-rules/yara-rules/community/jpcert/other/StealthWorker.yara +0 -14
- package/bundled-rules/yara-rules/community/jpcert/other/TokyoX.yara +0 -28
- package/bundled-rules/yara-rules/community/jpcert/other/Voldemort.yara +0 -50
- package/bundled-rules/yara-rules/community/jpcert/other/adminer.yara +0 -19
- package/bundled-rules/yara-rules/community/jpcert/other/agenttesla.yara +0 -33
- package/bundled-rules/yara-rules/community/jpcert/other/antiupx.yara +0 -45
- package/bundled-rules/yara-rules/community/jpcert/other/ares.yara +0 -25
- package/bundled-rules/yara-rules/community/jpcert/other/asyncrat.yara +0 -20
- package/bundled-rules/yara-rules/community/jpcert/other/azorult.yara +0 -15
- package/bundled-rules/yara-rules/community/jpcert/other/b374k.yara +0 -18
- package/bundled-rules/yara-rules/community/jpcert/other/bebloh.yara +0 -16
- package/bundled-rules/yara-rules/community/jpcert/other/brc4.yara +0 -19
- package/bundled-rules/yara-rules/community/jpcert/other/cobaltstrike.yara +0 -33
- package/bundled-rules/yara-rules/community/jpcert/other/cve202120837.yara +0 -33
- package/bundled-rules/yara-rules/community/jpcert/other/darkcloud.yara +0 -18
- package/bundled-rules/yara-rules/community/jpcert/other/donut.yara +0 -20
- package/bundled-rules/yara-rules/community/jpcert/other/doplugs.yara +0 -55
- package/bundled-rules/yara-rules/community/jpcert/other/doraemon.yara +0 -32
- package/bundled-rules/yara-rules/community/jpcert/other/dtsft.yara +0 -53
- package/bundled-rules/yara-rules/community/jpcert/other/emotet.yara +0 -18
- package/bundled-rules/yara-rules/community/jpcert/other/filesman.yara +0 -27
- package/bundled-rules/yara-rules/community/jpcert/other/flubot.yara +0 -18
- package/bundled-rules/yara-rules/community/jpcert/other/formbook.yara +0 -15
- package/bundled-rules/yara-rules/community/jpcert/other/fortinet.yara +0 -59
- package/bundled-rules/yara-rules/community/jpcert/other/foxwso.yara +0 -14
- package/bundled-rules/yara-rules/community/jpcert/other/getrdoor.yara +0 -19
- package/bundled-rules/yara-rules/community/jpcert/other/gobrat.yara +0 -185
- package/bundled-rules/yara-rules/community/jpcert/other/hawkeye.yara +0 -15
- package/bundled-rules/yara-rules/community/jpcert/other/huiloader.yara +0 -25
- package/bundled-rules/yara-rules/community/jpcert/other/inetget.yara +0 -30
- package/bundled-rules/yara-rules/community/jpcert/other/ivanti_connect_secure.yara +0 -16
- package/bundled-rules/yara-rules/community/jpcert/other/lodeinfo.yara +0 -558
- package/bundled-rules/yara-rules/community/jpcert/other/lokibot.yara +0 -16
- package/bundled-rules/yara-rules/community/jpcert/other/machOdownloader.yara +0 -47
- package/bundled-rules/yara-rules/community/jpcert/other/maldocinpdf.yara +0 -20
- package/bundled-rules/yara-rules/community/jpcert/other/nanocore.yara +0 -15
- package/bundled-rules/yara-rules/community/jpcert/other/netwire.yara +0 -18
- package/bundled-rules/yara-rules/community/jpcert/other/nimfilecoder.yara +0 -51
- package/bundled-rules/yara-rules/community/jpcert/other/njrat.yara +0 -14
- package/bundled-rules/yara-rules/community/jpcert/other/noderat.yara +0 -15
- package/bundled-rules/yara-rules/community/jpcert/other/pangolin8rat.yara +0 -95
- package/bundled-rules/yara-rules/community/jpcert/other/phantomstealer.yara +0 -17
- package/bundled-rules/yara-rules/community/jpcert/other/phpfilemanager.yara +0 -16
- package/bundled-rules/yara-rules/community/jpcert/other/phpmal.yara +0 -71
- package/bundled-rules/yara-rules/community/jpcert/other/plugx.yara +0 -25
- package/bundled-rules/yara-rules/community/jpcert/other/poisonivy.yara +0 -15
- package/bundled-rules/yara-rules/community/jpcert/other/poohlydown.yara +0 -13
- package/bundled-rules/yara-rules/community/jpcert/other/pskiller_sys.yara +0 -130
- package/bundled-rules/yara-rules/community/jpcert/other/pulsesecure.yara +0 -31
- package/bundled-rules/yara-rules/community/jpcert/other/qbot.yara +0 -21
- package/bundled-rules/yara-rules/community/jpcert/other/quasar.yara +0 -21
- package/bundled-rules/yara-rules/community/jpcert/other/seaspy.yara +0 -28
- package/bundled-rules/yara-rules/community/jpcert/other/shellcode.yara +0 -124
- package/bundled-rules/yara-rules/community/jpcert/other/smokeloader.yara +0 -15
- package/bundled-rules/yara-rules/community/jpcert/other/snakekeylogger.yara +0 -16
- package/bundled-rules/yara-rules/community/jpcert/other/spygrace.yara +0 -35
- package/bundled-rules/yara-rules/community/jpcert/other/sqroot.yara +0 -206
- package/bundled-rules/yara-rules/community/jpcert/other/stealc.yara +0 -32
- package/bundled-rules/yara-rules/community/jpcert/other/steelclover.yara +0 -36
- package/bundled-rules/yara-rules/community/jpcert/other/stonemite.yara +0 -16
- package/bundled-rules/yara-rules/community/jpcert/other/sysrvbot.yara +0 -61
- package/bundled-rules/yara-rules/community/jpcert/other/tool.yara +0 -22
- package/bundled-rules/yara-rules/community/jpcert/other/ursnif.yara +0 -32
- package/bundled-rules/yara-rules/community/jpcert/other/vboxuserrat.yara +0 -51
- package/bundled-rules/yara-rules/community/jpcert/other/veletrix.yara +0 -43
- package/bundled-rules/yara-rules/community/jpcert/other/waterpamola.yara +0 -131
- package/bundled-rules/yara-rules/community/jpcert/other/webrcs.yara +0 -47
- package/bundled-rules/yara-rules/community/jpcert/other/webview2loader.yara +0 -32
- package/bundled-rules/yara-rules/community/jpcert/other/windealer.yara +0 -42
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/other/yara-rules_mal_drivers_strict.yar +0 -855
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/other/yara-rules_vuln_drivers.yar +0 -12131
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/other/yara-rules_vuln_drivers_strict_renamed.yar +0 -12131
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/yara-rules_mal_drivers.yar +0 -855
- package/bundled-rules/yara-rules/community/loldrivers/detections/yara/yara-rules_vuln_drivers_strict.yar +0 -12131
- package/bundled-rules/yara-rules/community/mandiant/all-yara.yar +0 -2947
- package/bundled-rules/yara-rules/community/mandiant/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/ADPASSHUNT/production/yara/APT_HackTool_MSIL_ADPassHunt_2.yar +0 -23
- package/bundled-rules/yara-rules/community/mandiant/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/ADPASSHUNT/production/yara/CredTheft_MSIL_ADPassHunt_2.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/ALLTHETHINGS/production/yara/Loader_MSIL_AllTheThings_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/BASICPIPESHELL/production/yara/APT_Backdoor_PS1_BASICPIPESHELL_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/BEACON/supplemental/yara/Loader_Win_Generic_17.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/BEACON/supplemental/yara/Loader_Win_Generic_18.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/BEACON/supplemental/yara/Trojan_Raw_Generic_4.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/BEACON/supplemental/yara/Trojan_Win_Generic_101.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_1.yar +0 -25
- package/bundled-rules/yara-rules/community/mandiant/rules/BELTALOWDA/production/yara/HackTool_MSIL_SEATBELT_2.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/COREHOUND/production/yara/HackTool_MSIL_CoreHound_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Backdoor_Win_DShell_1.yar +0 -191
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Backdoor_Win_DShell_3.yar +0 -90
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_1.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_2.yar +0 -21
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/production/yara/APT_Loader_Win32_DShell_3.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/DSHELL/supplemental/yara/APT_Backdoor_Win_DShell_2.yar +0 -132
- package/bundled-rules/yara-rules/community/mandiant/rules/DTRIM/production/yara/APT_HackTool_MSIL_DTRIM_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/HackTool_MSIL_HOLSTER_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_2.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/Loader_MSIL_DUEDLLIGENCE_3.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/DUEDLLIGENCE/production/yara/MSIL_Launcher_DUEDLLIGENCE_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_1.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/production/yara/APT_HackTool_Win64_EXCAVATOR_2.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/production/yara/CredTheft_Win_EXCAVATOR_2.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_22.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/EXCAVATOR/supplemental/yara/Trojan_Win64_Generic_23.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/FLUFFY/production/yara/APT_HackTool_MSIL_FLUFFY_2.yar +0 -21
- package/bundled-rules/yara-rules/community/mandiant/rules/G2JS/production/yara/Builder_MSIL_G2JS_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/G2JS/production/yara/Hunting_B64Engine_DotNetToJScript_Dos.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/G2JS/production/yara/Hunting_DotNetToJScript_Functions.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/G2JS/production/yara/Hunting_GadgetToJScript_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/GETDOMAINPASSWORDPOLICY/production/yara/HackTool_MSIL_GETDOMAINPASSWORDPOLICY_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/GPOHUNT/production/yara/APT_HackTool_MSIL_GPOHUNT_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/IMPACKETOBF (Smbexec)/production/yara/HackTool_PY_ImpacketObfuscation_1.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/IMPACKETOBF (Wmiexec)/production/yara/HackTool_PY_ImpacketObfuscation_2.yar +0 -21
- package/bundled-rules/yara-rules/community/mandiant/rules/INVEIGHZERO/production/yara/HackTool_MSIL_INVEIGHZERO_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/JUSTASK/production/yara/APT_HackTool_MSIL_JUSTASK_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/KEEFARCE/production/yara/HackTool_MSIL_KeeFarce_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/KEEPERSIST/production/yara/HackTool_MSIL_KeePersist_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/LNKSMASHER/production/yara/Dropper_LNK_LNKSmasher_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/LNKSMASHER/supplemental/yara/Hunting_LNK_Win_GenericLauncher.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/LUALOADER/production/yara/APT_HackTool_MSIL_LUALOADER_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/LUALOADER/production/yara/APT_Loader_MSIL_LUALOADER_2.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Builder_PY_MATRYOSHKA_1.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Builder_Win64_MATRYOSHKA_1.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Dropper_Win64_MATRYOSHKA_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Dropper_Win_MATRYOSHKA_1.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_1.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Loader_Win64_MATRYOSHKA_2.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/MATRYOSHKA/production/yara/APT_Loader_Win_MATRYOSHKA_1.yar +0 -24
- package/bundled-rules/yara-rules/community/mandiant/rules/MEMCOMP/production/yara/Loader_MSIL_InMemoryCompilation_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/NETASSEMBLYINJECT/production/yara/Loader_MSIL_NETAssemblyInject_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/NETSHSHELLCODERUNNER/production/yara/Loader_MSIL_NetshShellCodeRunner_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/NOAMCI/production/yara/APT_HackTool_MSIL_NOAMCI_1.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_MSIL_PGF_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_MSIL_PGF_2.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_1.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_2.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_3.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_4.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win32_PGF_5.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_1.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_2.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_3.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_4.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win64_PGF_5.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win_PGF_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/PGF/production/yara/APT_Loader_Win_PGF_2.yar +0 -21
- package/bundled-rules/yara-rules/community/mandiant/rules/PREPSHELLCODE/production/yara/HackTool_MSIL_PrepShellcode_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/PUPPYHOUND/production/yara/HackTool_MSIL_PuppyHound_1.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/PUPPYHOUND/production/yara/HackTool_MSIL_SharpHound_3.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/PXELOOT/production/yara/HackTool_MSIL_PXELOOT_2.yar +0 -27
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_1.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Builder_PY_REDFLARE_2.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Controller_Linux_REDFLARE_1.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Downloader_Win32_REDFLARE_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Downloader_Win64_REDFLARE_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Keylogger_Win32_REDFLARE_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Keylogger_Win64_REDFLARE_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Raw32_REDFLARE_1.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Raw64_REDFLARE_1.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Win32_REDFLARE_2.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_1.yar +0 -17
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Loader_Win64_REDFLARE_2.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_1.yar +0 -21
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_2.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_3.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_4.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_5.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_7.yar +0 -21
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/production/yara/APT_Trojan_Win_REDFLARE_8.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/supplemental/yara/APT_Trojan_Linux_REDFLARE_1.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE/supplemental/yara/APT_Trojan_Win_REDFLARE_6.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_MacOS_GORAT_1.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_1.yar +0 -23
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_2.yar +0 -34
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_3.yar +0 -39
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_4.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GORAT_5.yar +0 -23
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/APT_Backdoor_Win_GoRat_Memory.yar +0 -27
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Module_PowerShell_1.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/REDFLARE (Gorat)/production/yara/Trojan_MSIL_GORAT_Plugin_DOTNET_1.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/RESUMEPLEASE/production/yara/Trojan_Macro_RESUMEPLEASE_1.yar +0 -21
- package/bundled-rules/yara-rules/community/mandiant/rules/REVOLVER/production/yara/APT_HackTool_MSIL_REVOLVER_1.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/REVOLVER/production/yara/APT_Loader_MSIL_REVOLVER_1.yar +0 -14
- package/bundled-rules/yara-rules/community/mandiant/rules/RUBEUS/production/yara/HackTool_MSIL_Rubeus_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SAFETYKATZ/production/yara/HackTool_MSIL_SAFETYKATZ_4.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPERSIST/production/yara/HackTool_MSIL_SharPersist_2.yar +0 -23
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPGENERATOR/production/yara/Builder_MSIL_SharpGenerator_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_2.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_3.yar +0 -31
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPIVOT/production/yara/HackTool_MSIL_SharPivot_4.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPPGREP/production/yara/Tool_MSIL_SharpGrep_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSACK/production/yara/APT_HackTool_MSIL_SHARPSACK_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSCHTASK/production/yara/HackTool_MSIL_SharpSchtask_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSECTIONINJECTION/production/yara/Loader_MSIL_CSharpSectionInjection_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_1.yar +0 -24
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSTOMP/production/yara/APT_HackTool_MSIL_SHARPSTOMP_2.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPSTOMP/production/yara/HackTool_MSIL_SharpStomp_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPUTILS/production/yara/Tool_MSIL_CSharpUtils_1.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPY/production/yara/Loader_MSIL_SharPy_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SHARPZEROLOGON/production/yara/HackTool_MSIL_SHARPZEROLOGON_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SINFULOFFICE/production/yara/Builder_MSIL_SinfulOffice_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/SINFULOFFICE/supplemental/yara/Methodology_OLE_CHARENCODING_2.yar +0 -23
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/APT_HackTool_MSIL_TITOSPECIAL_1.yar +0 -20
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_1.yar +0 -27
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/CredTheft_MSIL_TitoSpecial_2.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/HackTool_Win32_AndrewSpecial_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/TITOSPECIAL/production/yara/HackTool_Win64_AndrewSpecial_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_1.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/new/yara/Loader_MSIL_RURALBISHOP_2.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_1.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/production/yara/APT_Loader_MSIL_TRIMBISHOP_2.yar +0 -22
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/production/yara/Loader_MSIL_RuralBishop_3.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/TRIMBISHOP/production/yara/Loader_MSIL_TrimBishop_1.yar +0 -26
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_DNSOVERHTTPS_C2_1.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_MODIFIEDSHARPVIEW_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_PRAT_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_REDTEAMMATERIALS_1.yar +0 -16
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDACL_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPDNS_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPGOPHER_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNATIVEZIPPER_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPNFS_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPPATCHCHECK_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPSQLCLIENT_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPTEMPLATE_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPWEBCRAWLER_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/APT_HackTool_MSIL_SHARPZIPLIBZIPPER_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_CredSnatcher_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/production/yara/CredTheft_MSIL_WCMDump_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/supplemental/yara/Loader_MSIL_Generic_1.yar +0 -21
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_19.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/UNCATEGORIZED/supplemental/yara/Loader_Win_Generic_20.yar +0 -19
- package/bundled-rules/yara-rules/community/mandiant/rules/WILDCHILD/production/yara/APT_Loader_MSIL_WILDCHILD_1.yar +0 -18
- package/bundled-rules/yara-rules/community/mandiant/rules/WILDCHILD/production/yara/Dropper_HTA_WildChild_1.yar +0 -24
- package/bundled-rules/yara-rules/community/mandiant/rules/WILDCHILD/production/yara/Loader_MSIL_WildChild_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/WMIRUNNER/production/yara/Loader_MSIL_WMIRunner_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/WMISHARP/production/yara/HackTool_MSIL_WMISharp_1.yar +0 -15
- package/bundled-rules/yara-rules/community/mandiant/rules/WMISPY/production/yara/APT_HackTool_MSIL_WMISPY_2.yar +0 -24
- package/bundled-rules/yara-rules/community/mandiant/rules/WMISPY/production/yara/HackTool_MSIL_WMIspy_1.yar +0 -15
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.AgentRacoon.yara +0 -128
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.AsyncRAT.yara +0 -149
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.LimeRAT.yara +0 -91
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.Menorah.yara +0 -169
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.NjRAT.yara +0 -266
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.OrcusRAT.yara +0 -134
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.ResolverRAT.yara +0 -94
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/ByteCode.MSIL.Backdoor.Veaty.yara +0 -84
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.AutoColor.yara +0 -177
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.BPFDoor.yara +0 -326
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.ChaosRAT.yara +0 -270
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.GTPDOOR.yara +0 -264
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.GobRAT.yara +0 -168
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.Krasue.yara +0 -127
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.Linodas.yara +0 -216
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.NoodRAT.yara +0 -162
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.PondRAT.yara +0 -99
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.PygmyGoat.yara +0 -135
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.Sshdinjector.yara +0 -197
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Backdoor.WolfsBane.yara +0 -124
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Linux.Trojan.ChinaZ.yara +0 -246
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win32.Backdoor.Konni.yara +0 -190
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.BackConnect.yara +0 -154
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.EggStremeFuel.yara +0 -144
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.Konni.yara +0 -205
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.Minodo.yara +0 -110
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.MiyaRAT.yara +0 -264
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.SideTwist.yara +0 -154
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.Voldemort.yara +0 -208
- package/bundled-rules/yara-rules/community/reversinglabs/yara/backdoor/Win64.Backdoor.wmRAT.yara +0 -144
- package/bundled-rules/yara-rules/community/reversinglabs/yara/certificate/blocklist.yara +0 -17288
- package/bundled-rules/yara-rules/community/reversinglabs/yara/downloader/Win32.Downloader.dlMarlboro.yara +0 -79
- package/bundled-rules/yara-rules/community/reversinglabs/yara/exploit/Win32.Exploit.CVE20200601.yara +0 -253
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/ByteCode.MSIL.Infostealer.GomorrahStealer.yara +0 -111
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win32.Infostealer.LumarStealer.yara +0 -190
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win32.Infostealer.MultigrainPOS.yara +0 -88
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win32.Infostealer.ProjectHookPOS.yara +0 -98
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win32.Infostealer.StealC.yara +0 -57
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win64.Infostealer.Daolpu.yara +0 -322
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win64.Infostealer.Skuld.yara +0 -192
- package/bundled-rules/yara-rules/community/reversinglabs/yara/infostealer/Win64.Infostealer.WeaselStore.yara +0 -198
- package/bundled-rules/yara-rules/community/reversinglabs/yara/pua/Win32.PUA.Domaiq.yara +0 -169
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Apis.yara +0 -75
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.ChupaCabra.yara +0 -90
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Cring.yara +0 -66
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Dusk.yara +0 -73
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.EAF.yara +0 -89
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Eternity.yara +0 -74
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Fantom.yara +0 -97
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.GhosTEncryptor.yara +0 -69
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Ghostbin.yara +0 -61
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.GoodWill.yara +0 -89
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.HarpoonLocker.yara +0 -96
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Hog.yara +0 -70
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Invert.yara +0 -66
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Janelle.yara +0 -96
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Khonsari.yara +0 -68
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.McBurglar.yara +0 -75
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Moisha.yara +0 -86
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Namaste.yara +0 -81
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Oct.yara +0 -68
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Pacman.yara +0 -68
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.PoliceRecords.yara +0 -79
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Povlsomware.yara +0 -64
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Retis.yara +0 -74
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.TaRRaK.yara +0 -96
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Thanos.yara +0 -106
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.TimeCrypt.yara +0 -69
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.TimeTime.yara +0 -75
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.Venom.yara +0 -68
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.WildFire.yara +0 -77
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.WormLocker.yara +0 -69
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/ByteCode.MSIL.Ransomware.ZeroLocker.yara +0 -70
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Bytecode.MSIL.Ransomware.CobraLocker.yara +0 -59
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.GwisinLocker.yara +0 -354
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.Helldown.yara +0 -127
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.KillDisk.yara +0 -144
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.LuckyJoe.yara +0 -146
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Linux.Ransomware.RedAlert.yara +0 -146
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.5ss5c.yara +0 -267
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.ASN1Encoder.yara +0 -136
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Acepy.yara +0 -69
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Afrodita.yara +0 -119
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ako.yara +0 -152
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Alcatraz.yara +0 -91
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.AnteFrigus.yara +0 -210
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Archiveus.yara +0 -50
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Armage.yara +0 -128
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Atlas.yara +0 -99
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Avaddon.yara +0 -148
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.AvosLocker.yara +0 -108
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BKRansomware.yara +0 -79
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Babuk.yara +0 -117
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BadBlock.yara +0 -100
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Badbeeteam.yara +0 -137
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Balaclava.yara +0 -113
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Bam2021.yara +0 -167
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BananaCrypt.yara +0 -103
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BandarChor.yara +0 -97
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BitCrypt.yara +0 -112
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BlackBasta.yara +0 -531
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BlackCat.yara +0 -109
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BlackMoon.yara +0 -70
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Blitzkrieg.yara +0 -127
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BlueLocker.yara +0 -130
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.BrainCrypt.yara +0 -121
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Buran.yara +0 -91
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.ChiChi.yara +0 -66
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Cicada3301.yara +0 -309
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Cincoo.yara +0 -78
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Clop.yara +0 -109
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Conti.yara +0 -74
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Cryakl.yara +0 -64
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Crypmic.yara +0 -56
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Crypren.yara +0 -144
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoBit.yara +0 -113
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoFortress.yara +0 -162
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoJoker.yara +0 -140
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoLocker.yara +0 -154
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CryptoWall.yara +0 -312
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Crysis.yara +0 -108
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Cuba.yara +0 -126
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.CyberVolk.yara +0 -293
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DMALocker.yara +0 -149
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DMR.yara +0 -214
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DarkSide.yara +0 -94
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DearCry.yara +0 -96
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Defray.yara +0 -157
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Delphimorix.yara +0 -67
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DenizKizi.yara +0 -88
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DesuCrypt.yara +0 -93
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Dharma.yara +0 -108
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DirtyDecrypt.yara +0 -112
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.District.yara +0 -194
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.DogeCrypt.yara +0 -114
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Dragon.yara +0 -149
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Dualshot.yara +0 -112
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Elpaco.yara +0 -316
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Encoded01.yara +0 -141
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Erica.yara +0 -76
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FCT.yara +0 -86
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FLKR.yara +0 -71
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FarAttack.yara +0 -93
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FenixLocker.yara +0 -143
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ferrlock.yara +0 -131
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Flamingo.yara +0 -54
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.FuxSocy.yara +0 -114
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GPGQwerty.yara +0 -83
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GandCrab.yara +0 -892
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GarrantyDecrypt.yara +0 -79
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Gibon.yara +0 -122
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GlobeImposter.yara +0 -171
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Gomer.yara +0 -106
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Good.yara +0 -82
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Gpcode.yara +0 -67
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.GusCrypter.yara +0 -129
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HDDCryptor.yara +0 -157
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HDMR.yara +0 -161
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HakunaMatata.yara +0 -373
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Henry.yara +0 -80
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HentaiOniichan.yara +0 -140
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Hermes.yara +0 -284
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Horsedeal.yara +0 -106
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HowAreYou.yara +0 -205
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.HydraCrypt.yara +0 -174
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.IFN643.yara +0 -90
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.InfoDot.yara +0 -115
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.JSWorm.yara +0 -93
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Jamper.yara +0 -110
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Jemd.yara +0 -105
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Jormungand.yara +0 -135
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.JuicyLemon.yara +0 -116
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Kangaroo.yara +0 -91
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.KawaiiLocker.yara +0 -135
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.KillDisk.yara +0 -80
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Knot.yara +0 -118
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Kovter.yara +0 -141
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Koxic.yara +0 -87
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Kraken.yara +0 -151
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ladon.yara +0 -101
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.LeChiffre.yara +0 -123
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.LockBit.yara +0 -282
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Lolkek.yara +0 -106
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.LooCipher.yara +0 -87
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Lorenz.yara +0 -252
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MRAC.yara +0 -69
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MZP.yara +0 -147
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Mafia.yara +0 -142
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Magniber.yara +0 -114
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Major.yara +0 -261
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Makop.yara +0 -99
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Maktub.yara +0 -116
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Marlboro.yara +0 -117
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MarsJoke.yara +0 -157
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Matsnu.yara +0 -116
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MedusaLocker.yara +0 -174
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Meow.yara +0 -84
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Monalisa.yara +0 -83
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Montserrat.yara +0 -118
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Motocos.yara +0 -75
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.MountLocker.yara +0 -86
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.NB65.yara +0 -68
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.NanoLocker.yara +0 -79
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Nefilim.yara +0 -150
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Nemty.yara +0 -205
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Networm.yara +0 -103
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.NotPetya.yara +0 -73
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Oni.yara +0 -82
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.OphionLocker.yara +0 -105
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ouroboros.yara +0 -175
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Outsider.yara +0 -88
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.PXJ.yara +0 -158
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Paradise.yara +0 -81
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Pay2Key.yara +0 -99
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Petya.yara +0 -58
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Plague17.yara +0 -263
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.PrincessLocker.yara +0 -92
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Prometey.yara +0 -156
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.RagnarLocker.yara +0 -108
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ragnarok.yara +0 -110
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ransoc.yara +0 -114
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.RansomPlus.yara +0 -95
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ransomexx.yara +0 -147
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Redeemer.yara +0 -105
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.RegretLocker.yara +0 -206
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.RetMyData.yara +0 -79
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Reveton.yara +0 -118
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Revil.yara +0 -101
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Rokku.yara +0 -147
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Ryuk.yara +0 -199
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sage.yara +0 -77
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sanwai.yara +0 -71
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sarbloh.yara +0 -88
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Satan.yara +0 -152
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Satana.yara +0 -123
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Saturn.yara +0 -105
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sepsis.yara +0 -126
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Serpent.yara +0 -122
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.SevenSevenSeven.yara +0 -148
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.ShadowCryptor.yara +0 -89
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sherminator.yara +0 -157
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sifrelendi.yara +0 -67
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sifreli.yara +0 -119
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Sigrun.yara +0 -111
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Skystars.yara +0 -97
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Spora.yara +0 -124
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TBLocker.yara +0 -85
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TargetCompany.yara +0 -141
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TechandStrat.yara +0 -106
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TeleCrypt.yara +0 -109
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Termite.yara +0 -151
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Teslacrypt.yara +0 -665
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Teslarvng.yara +0 -137
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Thanatos.yara +0 -85
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.TorrentLocker.yara +0 -98
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.VHDLocker.yara +0 -152
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.VanHelsing.yara +0 -464
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.VegaLocker.yara +0 -100
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Velso.yara +0 -230
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.WannaCry.yara +0 -135
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.WaspLocker.yara +0 -76
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Wastedlocker.yara +0 -86
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.WinWord64.yara +0 -215
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.WsIR.yara +0 -73
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Xorist.yara +0 -150
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Zeoticus.yara +0 -90
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Zeppelin.yara +0 -109
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.ZeroCrypt.yara +0 -94
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Zhen.yara +0 -176
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win32.Ransomware.Zoldon.yara +0 -107
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Ako.yara +0 -173
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Albabat.yara +0 -139
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.AntiWar.yara +0 -146
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.AwesomeScott.yara +0 -101
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.BlackBasta.yara +0 -293
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Cactus.yara +0 -190
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Curator.yara +0 -94
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.DST.yara +0 -170
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.HermeticRansom.yara +0 -105
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.HotCoffee.yara +0 -111
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Nokoyawa.yara +0 -104
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Pandora.yara +0 -95
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.RedRoman.yara +0 -82
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Rook.yara +0 -122
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.SeedLocker.yara +0 -91
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Seth.yara +0 -122
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Solaso.yara +0 -171
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Vovalex.yara +0 -81
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Warlock.yara +0 -162
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.WhiteBlackCrypt.yara +0 -91
- package/bundled-rules/yara-rules/community/reversinglabs/yara/ransomware/Win64.Ransomware.Wintenzz.yara +0 -83
- package/bundled-rules/yara-rules/community/reversinglabs/yara/rootkit/Linux.Rootkit.Pumakit.yara +0 -161
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Linux.Trojan.AcidRain.yara +0 -67
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Linux.Trojan.BiBiWiper.yara +0 -76
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.BiBiWiper.yara +0 -102
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.CaddyWiper.yara +0 -95
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.Dridex.yara +0 -80
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.Emotet.yara +0 -182
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.HermeticWiper.yara +0 -50
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.IsaacWiper.yara +0 -76
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.PathWiper.yara +0 -280
- package/bundled-rules/yara-rules/community/reversinglabs/yara/trojan/Win32.Trojan.TrickBot.yara +0 -46
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Linux.Virus.Vit.yara +0 -36
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Awfull.yara +0 -33
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Cmay.yara +0 -73
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.DeadCode.yara +0 -76
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Elerad.yara +0 -33
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Greenp.yara +0 -46
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Mocket.yara +0 -58
- package/bundled-rules/yara-rules/community/reversinglabs/yara/virus/Win32.Virus.Negt.yara +0 -94
- package/bundled-rules/yara-rules/community/trellix/APT/APT_Derusbi.yar +0 -248
- package/bundled-rules/yara-rules/community/trellix/APT/APT_KimSuky_dllbckdr.yar +0 -50
- package/bundled-rules/yara-rules/community/trellix/APT/APT_MiniASP_pdb.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/APT/APT_Operation_SoftCell.yar +0 -308
- package/bundled-rules/yara-rules/community/trellix/APT/APT_Tortoiseshell_Syskit.yar +0 -40
- package/bundled-rules/yara-rules/community/trellix/APT/APT_Troj_HermWiper.yar +0 -27
- package/bundled-rules/yara-rules/community/trellix/APT/APT_acidbox.yar +0 -98
- package/bundled-rules/yara-rules/community/trellix/APT/APT_auriga_biscuit.yar +0 -39
- package/bundled-rules/yara-rules/community/trellix/APT/APT_babar_pdb.yar +0 -35
- package/bundled-rules/yara-rules/community/trellix/APT/APT_blackenergy_pdb.yar +0 -38
- package/bundled-rules/yara-rules/community/trellix/APT/APT_decade_of_RATs.yar +0 -221
- package/bundled-rules/yara-rules/community/trellix/APT/APT_elise_pdb.yar +0 -29
- package/bundled-rules/yara-rules/community/trellix/APT/APT_gdocupload_pdb.yar +0 -32
- package/bundled-rules/yara-rules/community/trellix/APT/APT_hangover.yar +0 -229
- package/bundled-rules/yara-rules/community/trellix/APT/APT_hikit_rootkit_pdb.yar +0 -28
- package/bundled-rules/yara-rules/community/trellix/APT/APT_karkoff_dnspionaje.yar +0 -30
- package/bundled-rules/yara-rules/community/trellix/APT/APT_lagulon_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/APT/APT_manitsme_trojan_pdb.yar +0 -36
- package/bundled-rules/yara-rules/community/trellix/APT/APT_milum_wildpressure.yar +0 -29
- package/bundled-rules/yara-rules/community/trellix/APT/APT_mirage_pdb.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/APT/APT_operation_aurora.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/APT/APT_operation_skeleton.yar +0 -33
- package/bundled-rules/yara-rules/community/trellix/APT/APT_operation_troy.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/APT/APT_turla_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/APT/APT_winnti.yar +0 -27
- package/bundled-rules/yara-rules/community/trellix/APT/enfal_pdb.yar +0 -29
- package/bundled-rules/yara-rules/community/trellix/APT/flamer_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/APT/gauss_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/APT/ixeshe_bled_pdb.yar +0 -24
- package/bundled-rules/yara-rules/community/trellix/malware/MALDOC_rtf_bluetea_builder.yar +0 -31
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_Eicar.yar +0 -22
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_MsWordExploit_DOC.yar +0 -24
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_NionSpy.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_Rovnix.yar +0 -38
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_Shifu.yar +0 -24
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_VPNfilter.yar +0 -41
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_alina_pos_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_backdoor_havex_pdb.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_backdoor_kankan_pdb.yar +0 -27
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_backdoor_katorxa_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_blackpos_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_browser_fox_adware.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_chickdos_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_cobaltstrike.yar +0 -38
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_cutwail.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_downloader_darkmegi.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_dridex_p2p_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_dropper_demekaf_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_emotet.yar +0 -32
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_festi_botnet_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_fritzfrog.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_inabot_worm_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_jatboss.yar +0 -36
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_kelhios_botnet_pdb.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_likseput_backdoor_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_liquorbot.yar +0 -23
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_mangzamel_trojan_pdb.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_masslogger_stealer.yar +0 -63
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_medfos_pdb.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_redline.yar +0 -38
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_rietspoof_loader.yar +0 -22
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_screenlocker_5h311_1nj3c706.yar +0 -33
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_shellcode_mykins_botnet.yar +0 -27
- package/bundled-rules/yara-rules/community/trellix/malware/MALW_vbs_mykins_botnet.yar +0 -29
- package/bundled-rules/yara-rules/community/trellix/malware/MAL_cyax_sharp_loader.yar +0 -16
- package/bundled-rules/yara-rules/community/trellix/miners/MINER_Monero.yar +0 -44
- package/bundled-rules/yara-rules/community/trellix/miners/Trojan_CoinMiner.yar +0 -23
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Anatova.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Avoslocker.yar +0 -27
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_BabukLocker_Jan2021.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Babuk_Packed_Feb2021.yar +0 -30
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_BadRabbit.yar +0 -101
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Bitpaymer.yar +0 -72
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Buran.yar +0 -27
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_CTBLocker.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_ClopRansomNote.yar +0 -34
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_CryptoNar.yar +0 -36
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Cryptolocker.yar +0 -81
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Darkside.yar +0 -47
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Exorcist.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_GPGQwerty.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Kraken.yar +0 -108
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Linux_HelloKitty0721.yar +0 -28
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Lockbit2.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_LockerGoga.yar +0 -36
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Loocipher.yar +0 -46
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_MONGOLOCK.yar +0 -42
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_MegaCortex.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_NEFILIM.yar +0 -98
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Nemty.yar +0 -80
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Pico.yar +0 -37
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_PureLocker.yar +0 -25
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_RobbinHood.yar +0 -38
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Ryuk.yar +0 -113
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_SamSam.yar +0 -105
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Shiva.yar +0 -37
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Sodinokibi.yar +0 -53
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_Suncrypt.yar +0 -50
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_acroware.yar +0 -29
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_amba.yar +0 -41
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_coronavirus.yar +0 -80
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_egregor.yar +0 -31
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_jeff_dev.yar +0 -28
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_locdoor.yar +0 -32
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_makop.yar +0 -32
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_mountlocker.yar +0 -32
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_netwalker.yar +0 -140
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_ragnarlocker.yar +0 -45
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_shrug2.yar +0 -30
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_snake_ransomware.yar +0 -26
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_termite.yar +0 -32
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_thiefquest.yar +0 -46
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_wannaren.yar +0 -34
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_wastedlocker.yar +0 -32
- package/bundled-rules/yara-rules/community/trellix/ransomware/RANSOM_xinof.yar +0 -82
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Conti.yar +0 -37
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Maze.yar +0 -40
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Mespinoza.yar +0 -27
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_ThunderX.yar +0 -46
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Vovalex1.yar +0 -42
- package/bundled-rules/yara-rules/community/trellix/ransomware/Ransom_Win_BlackCat_public.yar +0 -24
- package/bundled-rules/yara-rules/community/trellix/ransomware/ransom_BlackKingDom.yar +0 -49
- package/bundled-rules/yara-rules/community/trellix/stealer/STEALER_EmiratesStatement.yar +0 -24
- package/bundled-rules/yara-rules/community/trellix/stealer/STEALER_Lokibot.yar +0 -40
- package/bundled-rules/yara-rules/community/trellix/stealer/STEALER_credstealer.yar +0 -24
- package/bundled-rules/yara-rules/community/volexity/2021/2021-03-02 - Operation Exchange Marauder/indicators/yara.yar +0 -89
- package/bundled-rules/yara-rules/community/volexity/2021/2021-05-27 - Suspected APT29 Operation Launches Election Fraud Themed Phishing Campaigns/indicators/yara.yar +0 -87
- package/bundled-rules/yara-rules/community/volexity/2021/2021-08-17 - InkySquid Part 1/indicators/yara.yar +0 -120
- package/bundled-rules/yara-rules/community/volexity/2021/2021-08-24 - InkySquid Part 2/indicators/yara.yar +0 -112
- package/bundled-rules/yara-rules/community/volexity/2021/2021-12-06 - XEGroup/indicators/yara.yar +0 -208
- package/bundled-rules/yara-rules/community/volexity/2022/2022-03-22 GIMMICK/indicators/yara.yar +0 -86
- package/bundled-rules/yara-rules/community/volexity/2022/2022-06-02 Active Exploitation Of Confluence 0-day/indicators/yara.yar +0 -84
- package/bundled-rules/yara-rules/community/volexity/2022/2022-06-15 DriftingCloud - Zero-Day Sophos Firewall Exploitation and an Insidious Breach/indicators/yara.yar +0 -230
- package/bundled-rules/yara-rules/community/volexity/2022/2022-07-28 SharpTongue SharpTongue Deploys Clever Mail-Stealing Browser Extension SHARPEXT/yara.yar +0 -52
- package/bundled-rules/yara-rules/community/volexity/2022/2022-08-10 Mass exploitation of (Un)authenticated Zimbra RCE CVE-2022-27925/yara.yar +0 -86
- package/bundled-rules/yara-rules/community/volexity/2022/2022-12-01 Buyer Beware - Fake Cryptocurrency Applications Serving as Front for AppleJeus Malware/yara.yar +0 -165
- package/bundled-rules/yara-rules/community/volexity/2023/2023-03-07 AVBurner/yara.yar +0 -40
- package/bundled-rules/yara-rules/community/volexity/2023/2023-03-30 3CX/indicators/rules.yar +0 -152
- package/bundled-rules/yara-rules/community/volexity/2023/2023-06-28 POWERSTAR/indicators/rules.yar +0 -150
- package/bundled-rules/yara-rules/community/volexity/2023/2023-09-22 EvilBamboo/indicators/rules.yar +0 -472
- package/bundled-rules/yara-rules/community/volexity/2024/2024-01-10 Ivanti Connect Secure/indicators/yara.yar +0 -114
- package/bundled-rules/yara-rules/community/volexity/2024/2024-02-13 CharmingCypress/rules.yar +0 -352
- package/bundled-rules/yara-rules/community/volexity/2024/2024-04-12 Palo Alto Networks GlobalProtect/indicators/rules.yar +0 -116
- package/bundled-rules/yara-rules/community/volexity/2024/2024-06-13 DISGOMOJI/indicators/rules.yar +0 -267
- package/bundled-rules/yara-rules/community/volexity/2024/2024-08-02 StormBamboo/rules.yar +0 -383
- package/bundled-rules/yara-rules/community/volexity/2024/2024-11-15 BrazenBamboo/rules.yar +0 -613
- package/bundled-rules/yara-rules/community/volexity/2025/2025-10-08 UTA0388/rules.yar +0 -134
- package/bundled-rules/yara-rules/community/withsecure/Andariel2025/andariel.yara +0 -152
- package/bundled-rules/yara-rules/community/withsecure/DUCKTAIL/ducktail_artifacts.yar +0 -20
- package/bundled-rules/yara-rules/community/withsecure/DUCKTAIL/ducktail_dotnet_core_infostealer.yar +0 -103
- package/bundled-rules/yara-rules/community/withsecure/DUCKTAIL/ducktail_exceldna_packed.yara +0 -27
- package/bundled-rules/yara-rules/community/withsecure/DUCKTAIL/ducktail_nativeaot.yara +0 -22
- package/bundled-rules/yara-rules/community/withsecure/Kapeka/kapeka_backdoor.yar +0 -21
- package/bundled-rules/yara-rules/community/withsecure/SILKLOADER/silkloader.yar +0 -20
- package/bundled-rules/yara-rules/community/withsecure/TangleCrypt/TangleCrypt_YARA.yar +0 -27
- package/bundled-rules/yara-rules/custom/malware-indicators.yar +0 -83
- package/bundled-rules/yara-rules/custom/suspicious-scripts.yar +0 -72
- package/bundled-rules/yara-rules/custom/webshells.yar +0 -61
- package/dist/monitors/falco-monitor.d.ts +0 -62
- package/dist/monitors/falco-monitor.d.ts.map +0 -1
- package/dist/monitors/falco-monitor.js +0 -226
- package/dist/monitors/falco-monitor.js.map +0 -1
- package/dist/monitors/suricata-monitor.d.ts +0 -80
- package/dist/monitors/suricata-monitor.d.ts.map +0 -1
- package/dist/monitors/suricata-monitor.js +0 -227
- package/dist/monitors/suricata-monitor.js.map +0 -1
package/dist/cli/index.js
CHANGED
|
@@ -101,6 +101,7 @@ async function commandStart(dataDir, verbose = false, managerUrl, noTelemetry =
|
|
|
101
101
|
config.managerUrl = managerUrl;
|
|
102
102
|
}
|
|
103
103
|
if (noTelemetry) {
|
|
104
|
+
config.threatCloudUploadEnabled = false;
|
|
104
105
|
config.telemetryEnabled = false;
|
|
105
106
|
}
|
|
106
107
|
if (showUploadData) {
|
|
@@ -134,7 +135,7 @@ async function commandStart(dataDir, verbose = false, managerUrl, noTelemetry =
|
|
|
134
135
|
: []),
|
|
135
136
|
]));
|
|
136
137
|
// Threat intelligence sharing transparency message
|
|
137
|
-
if (config.telemetryEnabled === false) {
|
|
138
|
+
if (config.threatCloudUploadEnabled === false || config.telemetryEnabled === false) {
|
|
138
139
|
console.log(` ${symbols.info} Threat intelligence sharing: ${c.dim('disabled')}`);
|
|
139
140
|
console.log(` ${c.dim(' No data will be uploaded to Panguard Threat Cloud')}`);
|
|
140
141
|
}
|
|
@@ -386,11 +387,11 @@ async function showFirstRunWelcome(dashboardPort) {
|
|
|
386
387
|
console.log(` ${c.underline(`http://localhost:${dashboardPort}`)}`);
|
|
387
388
|
console.log('');
|
|
388
389
|
console.log(` ${c.bold('Quick commands / :')}`);
|
|
389
|
-
console.log(` ${c.sage('
|
|
390
|
-
console.log(` ${c.sage('
|
|
391
|
-
console.log(` ${c.sage('
|
|
392
|
-
console.log(` ${c.sage('
|
|
393
|
-
console.log(` ${c.sage('
|
|
390
|
+
console.log(` ${c.sage('pga')} Open interactive menu /`);
|
|
391
|
+
console.log(` ${c.sage('pga up')} Start protection + dashboard / + `);
|
|
392
|
+
console.log(` ${c.sage('pga status')} Check protection status / `);
|
|
393
|
+
console.log(` ${c.sage('pga scan')} Scan all installed skills / `);
|
|
394
|
+
console.log(` ${c.sage('pga audit <dir>')} Audit a skill before installing / `);
|
|
394
395
|
console.log('');
|
|
395
396
|
console.log(` ${c.bold('What Guard does / Guard :')}`);
|
|
396
397
|
console.log(` ${symbols.pass} Monitors new skill installations in real-time`);
|
package/dist/cli/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,CAAC,EACD,MAAM,EACN,MAAM,EACN,OAAO,EACP,OAAO,EACP,WAAW,EACX,OAAO,EACP,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,CAAwB,CAAC;AACnE,2BAA2B;AAC3B,MAAM,CAAC,MAAM,WAAW,GAAW,IAAI,CAAC,OAAO,CAAC;AAEhD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAClC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,gBAAgB,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAE3D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,MAAM,YAAY,CAChB,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,WAAW,CACZ,CAAC;YACF,MAAM;QACR,KAAK,MAAM;YACT,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM;QACR,KAAK,QAAQ;YACX,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,SAAS;YACZ,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,WAAW;YACd,MAAM,gBAAgB,EAAE,CAAC;YACzB,MAAM;QACR,KAAK,QAAQ;YACX,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAkC,CAAC;YACjE,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvF,MAAM;QACR,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM;QACR,CAAC;QACD,KAAK,UAAU;YACb,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,MAAM;YACT,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM;QACR,KAAK,MAAM,CAAC;QACZ;YACE,SAAS,EAAE,CAAC;YACZ,MAAM;IACV,CAAC;AACH,CAAC;AAED,sCAAsC;AACtC,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,OAAO,GAAG,KAAK,EACf,UAAmB,EACnB,WAAW,GAAG,KAAK,EACnB,cAAc,GAAG,KAAK,EACtB,aAAa,GAAG,KAAK,EACrB,eAAe,GAAG,KAAK;IAEvB,oDAAoD;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,mCAAmC,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IAExD,4DAA4D;IAC5D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAE7C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC,cAAc;IACd,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,QAAQ,KAAK,CAAC,GAAG,EAAE,CAAC;IAEzC,aAAa;IACb,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,0BAA0B,EAAE;QACtC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;QAC/D,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;QACpD,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC7C,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE;QAC/C,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5C,GAAG,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,oBAAoB,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;YAC1F,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,mBAAmB;YAC5B,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CACH,CAAC;IAEF,mDAAmD;IACnD,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,CAAC,sEAAsE,CAAC,EAAE,CACrF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,yBAAyB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,0CAA0C;IAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;IAE1F,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,EAAE,QAAQ,KAAK,QAAQ,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,EAAE,QAAQ,KAAK,QAAQ,CAAC;IACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAC9B,CAAC;IAEF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GACZ,MAAM,CAAC,EAAE,EAAE,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,uBAAuB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CACxF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,iBAAiB,EAAE,CAAC;IACtB,CAAC;IAED,+DAA+D;IAC/D,MAAM,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,gBAAgB,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,uEAAuE;IACvE,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7E,wEAAwE;IACxE,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;QACpC,YAAY,EAAE,MAAM;QACpB,YAAY,EAAE,MAAM,CAAC,uBAAuB,EAAE;QAC9C,iBAAiB,EAAE,MAAM,CAAC,uBAAuB,EAAE;KACpD,CAAC,CAAC;IAEH,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,MAA4C,EAAE,EAAE;QAC9E,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,iBAAiB,EAAE,CAAC;YACtB,iBAAiB,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,UAAU,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,YAAY,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,MAA4C,EAAE,EAAE;QAChF,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,iBAAiB,EAAE,CAAC;YACtB,iBAAiB,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,mBAAmB,MAAM,CAAC,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,YAAY,CAAC,EAAE,CACb,sBAAsB,EACtB,CAAC,MAAwF,EAAE,EAAE;QAC3F,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GACR,MAAM,CAAC,SAAS,KAAK,KAAK;YACxB,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ;gBAC7B,CAAC,CAAC,OAAO,CAAC,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACrB,MAAM,SAAS,GACb,MAAM,CAAC,SAAS,KAAK,KAAK;YACxB,CAAC,CAAC,CAAC,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ;gBAC7B,CAAC,CAAC,CAAC,CAAC,OAAO;gBACX,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEnB,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe;gBACtC,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,iBAAiB,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI;gBACJ,OAAO,EAAE,gBAAgB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE;aACjF,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,SAAS,OAAO,CACpH,CAAC;YACF,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,mBAAmB,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CACF,CAAC;IAEF,KAAK,YAAY,CAAC,KAAK,EAAE,CAAC;IAE1B,sEAAsE;IACtE,MAAM,YAAY,GAAG,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,YAAY,CAAC,KAAK,EAAE,CAAC;IAErB,uEAAuE;IACvE,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IAClC,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;QAClC,YAAY,CAAC,IAAI,EAAE,CAAC;QACpB,YAAY,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,iBAAiB;YAAE,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,gBAAgB,EAAE,CAAC;IAC3B,CAAC,CAAC;IACF,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC;IAErD,uEAAuE;IACvE,IAAI,iBAAiB,EAAE,CAAC;QACtB,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,GAAmB,EAAE;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,OAAO;oBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;wBAC1B,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,WAAW;oBACf,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,KAAK;gBACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,CAAC;gBAChD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;gBACxC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ;gBAC/B,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK;gBACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aAC1C,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,iBAAiB,CAAC,UAAU,CAAC;oBAC3B,IAAI;oBACJ,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;oBAC/C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;oBAC7C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;iBACzC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,SAAS,CAAC;oBAC1B,IAAI;oBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,cAAc,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,SAAS;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,+EAA+E;QAC/E,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YACrC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,IAAI,GAAG,GAAG,cAAc,GAAG,MAAM;oBAAE,OAAO;gBAC1C,cAAc,GAAG,GAAG,CAAC;gBACrB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBAE/C,qBAAqB;gBACrB,YAAY,CAAC,WAAW,EAAE,CAAC;gBAE3B,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,GAAG,CACH,MAAM,IAAI,aAAa,MAAM,CAAC,cAAc,EAAE,eAAe,OAAO,gBAAgB,QAAQ,EAAE,CAC/F,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,CAAC;gBACvD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC;gBAEhD,qBAAqB;gBACrB,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAEpE,4BAA4B;gBAC5B,MAAM,YAAY,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;gBACxD,MAAM,OAAO,GAAkB;oBAC7B,QAAQ;oBACR,QAAQ;oBACR,UAAU;oBACV,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;oBACtC,SAAS,EAAE,IAAI;iBAChB,CAAC;gBAEF,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;oBAC5B,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;qBAAM,IAAI,YAAY,KAAK,aAAa,IAAI,WAAW,EAAE,CAAC;oBACzD,KAAK,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpC,CAAC;qBAAM,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;oBAClC,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,sEAAsE;oBACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;oBAC3E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC/C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACjD,OAAO,CAAC,GAAG,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;oBAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;oBACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,0BAA0B;AAC1B,8EAA8E;AAE9E;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IACtD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAEpE,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,gDAAgD,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,+CAA+C,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,qDAAqD,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,uDAAuD,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,kDAAkD;AAClD,SAAS,iBAAiB;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IAE/C,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,CAAC,GAAG,CAAC,4DAA4D,SAAS,gBAAgB,CAAC,EAAE,CACzG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,eAAe,SAAS,eAAe,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,CAAC,GAAG,CAAC,yFAAyF,CAAC,EAAE,CAC7G,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,+DAA+D,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,+BAA+B,CAAC,CAAC,GAAG,CAAC,+CAA+C,CAAC,EAAE,CACxF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,CAAC,GAAG,CAAC,4DAA4D,SAAS,gBAAgB,CAAC,EAAE,CACzG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,qEAAqE,CACvG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,CAAC,mFAAmF,CAAC,EAAE,CAClG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,IAAa,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAA0C;QAC3E,KAAK,EAAE,CAAC,CAAC,oBAAoB,EAAE,oCAAoC,CAAC;QACpE,IAAI;QACJ,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,QAAiB;gBACxB,KAAK,EAAE,CAAC,CAAC,+BAA+B,EAAE,mCAAmC,CAAC;aAC/E;YACD;gBACE,KAAK,EAAE,QAAiB;gBACxB,KAAK,EAAE,CAAC,CAAC,4BAA4B,EAAE,iCAAiC,CAAC;aAC1E;YACD,EAAE,KAAK,EAAE,QAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;YAClE,EAAE,KAAK,EAAE,MAAe,EAAE,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE;SACjF;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,0DAA0D,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,wDAAwD,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,4CAA4C,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,CAAC,8EAA8E,CAAC,EAAE,CAC7F,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,WAAW,GAAG,MAAM,YAAY,CAAS;YAC7C,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,0BAA0B,CAAC;YACpD,IAAI;YACJ,OAAO,EAAE;gBACP,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,6BAA6B,EAAE,0BAA0B,CAAC,EAAE;gBAC1F;oBACE,KAAK,EAAE,UAAU;oBACjB,KAAK,EAAE,CAAC,CAAC,+BAA+B,EAAE,gCAAgC,CAAC;iBAC5E;gBACD,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;gBAC1D,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE;aAC1E;SACF,CAAC,CAAC;QAEH,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,0BAA0B,CAAC;gBAClD,WAAW,EAAE,UAAU;gBACvB,IAAI;aACL,CAAC,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,WAAW,IAAI,UAAU,CAAC;QACpC,CAAC;QAED,QAAQ,GAAG,wBAAwB,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,mBAAmB;QACnB,MAAM,OAAO,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC/E,MAAM,SAAS,GACb,QAAQ,KAAK,QAAQ;YACnB,CAAC,CAAC,gCAAgC;YAClC,CAAC,CAAC,sCAAsC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,2BAA2B,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC;YAChC,KAAK,EAAE,CAAC,CAAC,YAAY,OAAO,GAAG,EAAE,YAAY,OAAO,GAAG,CAAC;YACxD,WAAW,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;YAC5D,SAAS,EAAE,IAAI;YACf,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,oCAAoC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7E,CAAC;IAED,cAAc;IACd,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,YAAY,GAA4B,EAAE,CAAC;IAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7D,IAAI,MAAM;QAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACxC,IAAI,QAAQ;QAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;IAE9C,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC9B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAExE,uCAAuC;IACvC,IAAI,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,mBAAmB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,uCAAuC,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,0CAA0C,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,qCAAqC;AACrC,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAE3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,+BAA+B,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,0CAA0C,CAAC,CAAC;QACzE,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,0BAA0B,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,kCAAkC;AAClC,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAiB;QAC1B;YACE,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,UAAoB;SAC5D;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;KAC7C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,MAAM,CAAC,gBAAgB;gBAC5B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;SACtB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;YACxE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,SAAmB;SACrE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,0CAA0C;AAC1C,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvD,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,EAAE,CAAC,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IAED,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAmB,CAAC;IAE5E,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;QACnC,OAAO,EAAE;YACP,EAAE,EAAE,yCAAyC;YAC7C,OAAO,EAAE,uBAAuB;SACjC;QACD,YAAY,EAAE,IAAI;QAClB,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG;QACd,GAAG,MAAM;QACT,wBAAwB,EAAE,QAAQ;QAClC,mBAAmB,EAAE,QAAQ;YAC3B,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,4BAA4B,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,mBAAmB;KAC/B,CAAC;IACF,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,0BAA0B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,4BAA4B,CAAC,EAAE,CACjH,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,wCAAwC,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,GAAG,CACH,wFAAwF,CACzF,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,KAAK,UAAU,gBAAgB;IAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,EAAE,CAAC,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,kCAAkC;AAClC,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG;QACf,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE;QAClE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE;QAChD,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE;QAC9C,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE;QAC7C,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,8BAA8B,EAAE;QACzD,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,2BAA2B,EAAE;QACrD,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACnD,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,EAAE;QACrD,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;KACxC,CAAC;IAEF,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,CACtG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAC5F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,mCAAmC,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,qCAAqC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CACpG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,uCAAuC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,WAAW,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,IAAc,EAAE,MAAc;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,YAAY,MAAM,2BAA2B,CAAC,CAAC;gBAC9E,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEzD,IAAI,WAAW,EAAE,CAAC;IAChB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1C,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EACL,CAAC,EACD,MAAM,EACN,MAAM,EACN,OAAO,EACP,OAAO,EACP,WAAW,EACX,OAAO,EACP,WAAW,EACX,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,CAAwB,CAAC;AACnE,2BAA2B;AAC3B,MAAM,CAAC,MAAM,WAAW,GAAW,IAAI,CAAC,OAAO,CAAC;AAEhD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,IAAc;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAClC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,gBAAgB,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAE3D,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,MAAM,YAAY,CAChB,OAAO,EACP,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,SAAS,EACT,WAAW,CACZ,CAAC;YACF,MAAM;QACR,KAAK,MAAM;YACT,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM;QACR,KAAK,QAAQ;YACX,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,SAAS;YACZ,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,WAAW;YACd,MAAM,gBAAgB,EAAE,CAAC;YACzB,MAAM;QACR,KAAK,QAAQ;YACX,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM;QACR,KAAK,cAAc,CAAC,CAAC,CAAC;YACpB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAkC,CAAC;YACjE,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvF,MAAM;QACR,CAAC;QACD,KAAK,gBAAgB,CAAC,CAAC,CAAC;YACtB,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YACxD,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpB,MAAM;QACR,CAAC;QACD,KAAK,UAAU;YACb,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,MAAM;YACT,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM;QACR,KAAK,MAAM,CAAC;QACZ;YACE,SAAS,EAAE,CAAC;YACZ,MAAM;IACV,CAAC;AACH,CAAC;AAED,sCAAsC;AACtC,KAAK,UAAU,YAAY,CACzB,OAAe,EACf,OAAO,GAAG,KAAK,EACf,UAAmB,EACnB,WAAW,GAAG,KAAK,EACnB,cAAc,GAAG,KAAK,EACtB,aAAa,GAAG,KAAK,EACrB,eAAe,GAAG,KAAK;IAEvB,oDAAoD;IACpD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,mCAAmC,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IAExD,4DAA4D;IAC5D,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;IACjC,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,wBAAwB,GAAG,KAAK,CAAC;QACxC,MAAM,CAAC,gBAAgB,GAAG,KAAK,CAAC;IAClC,CAAC;IACD,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IAEvC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC;QAClE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAE7C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACrB,EAAE,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC,cAAc;IACd,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,QAAQ,KAAK,CAAC,GAAG,EAAE,CAAC;IAEzC,aAAa;IACb,OAAO,CAAC,GAAG,CACT,WAAW,CAAC,0BAA0B,EAAE;QACtC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;QAC/D,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE;QACpD,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC7C,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE;QAC/C,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5C,GAAG,CAAC,MAAM,CAAC,gBAAgB;YACzB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,oBAAoB,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,CAAC;YAC1F,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,MAAM,CAAC,mBAAmB;YAC5B,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACvE,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CACH,CAAC;IAEF,mDAAmD;IACnD,IAAI,MAAM,CAAC,wBAAwB,KAAK,KAAK,IAAI,MAAM,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,CAAC,sEAAsE,CAAC,EAAE,CACrF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,yBAAyB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,0CAA0C;IAC1C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,uDAAuD,CAAC,CAAC;IAE1F,yDAAyD;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,EAAE,QAAQ,KAAK,QAAQ,CAAC;IACpD,MAAM,UAAU,GAAG,MAAM,CAAC,EAAE,EAAE,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,EAAE,QAAQ,KAAK,QAAQ,CAAC;IACxF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CACvB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAC9B,CAAC;IAEF,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC,EAAE,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,QAAQ,GACZ,MAAM,CAAC,EAAE,EAAE,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,uBAAuB,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,UAAU,CACxF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,iBAAiB,EAAE,CAAC;IACtB,CAAC;IAED,+DAA+D;IAC/D,MAAM,mBAAmB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEhD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,gBAAgB,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,uEAAuE;IACvE,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE7E,wEAAwE;IACxE,MAAM,YAAY,GAAG,IAAI,YAAY,CAAC;QACpC,YAAY,EAAE,MAAM;QACpB,YAAY,EAAE,MAAM,CAAC,uBAAuB,EAAE;QAC9C,iBAAiB,EAAE,MAAM,CAAC,uBAAuB,EAAE;KACpD,CAAC,CAAC;IAEH,YAAY,CAAC,EAAE,CAAC,aAAa,EAAE,CAAC,MAA4C,EAAE,EAAE;QAC9E,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,iBAAiB,EAAE,CAAC;YACtB,iBAAiB,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,EAAE;aACjE,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,UAAU,EAAE,CACrG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,YAAY,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,MAA4C,EAAE,EAAE;QAChF,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,iBAAiB,EAAE,CAAC;YACtB,iBAAiB,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,kBAAkB,MAAM,CAAC,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,mBAAmB,MAAM,CAAC,IAAI,SAAS,MAAM,CAAC,UAAU,EAAE,CAClG,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,YAAY,CAAC,EAAE,CACb,sBAAsB,EACtB,CAAC,MAAwF,EAAE,EAAE;QAC3F,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,IAAI,GACR,MAAM,CAAC,SAAS,KAAK,KAAK;YACxB,CAAC,CAAC,OAAO,CAAC,IAAI;YACd,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ;gBAC7B,CAAC,CAAC,OAAO,CAAC,IAAI;gBACd,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACrB,MAAM,SAAS,GACb,MAAM,CAAC,SAAS,KAAK,KAAK;YACxB,CAAC,CAAC,CAAC,CAAC,IAAI;YACR,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,QAAQ;gBAC7B,CAAC,CAAC,CAAC,CAAC,OAAO;gBACX,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAEnB,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe;gBACtC,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,iBAAiB,CAAC,SAAS,CAAC;gBAC1B,IAAI;gBACJ,IAAI;gBACJ,OAAO,EAAE,gBAAgB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE;aACjF,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CACT,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,MAAM,CAAC,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,SAAS,OAAO,CACpH,CAAC;YACF,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,mBAAmB,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CACF,CAAC;IAEF,KAAK,YAAY,CAAC,KAAK,EAAE,CAAC;IAE1B,sEAAsE;IACtE,MAAM,YAAY,GAAG,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;IACxD,YAAY,CAAC,KAAK,EAAE,CAAC;IAErB,uEAAuE;IACvE,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,CAAC,IAAI,sBAAsB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAE1E,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IAClC,MAAM,gBAAgB,GAAG,KAAK,IAAI,EAAE;QAClC,YAAY,CAAC,IAAI,EAAE,CAAC;QACpB,YAAY,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,iBAAiB;YAAE,iBAAiB,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,gBAAgB,EAAE,CAAC;IAC3B,CAAC,CAAC;IACF,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,gBAAgB,EAAE,CAAC,CAAC;IAErD,uEAAuE;IACvE,IAAI,iBAAiB,EAAE,CAAC;QACtB,8CAA8C;QAC9C,MAAM,QAAQ,GAAG,GAAmB,EAAE;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YACrC,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,OAAO;oBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU;wBAC1B,CAAC,CAAC,UAAU;wBACZ,CAAC,CAAC,WAAW;oBACf,CAAC,CAAC,SAAS;gBACb,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,KAAK;gBACjB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,IAAI,CAAC;gBAChD,aAAa,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;gBACxC,UAAU,EAAE,MAAM,CAAC,EAAE,EAAE,QAAQ;gBAC/B,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK;gBACzB,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;aAC1C,CAAC;QACJ,CAAC,CAAC;QAEF,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,iBAAiB,CAAC,UAAU,CAAC;oBAC3B,IAAI;oBACJ,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;oBAC/C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;oBAC7C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;oBAC3C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;iBACzC,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,iBAAiB,CAAC,SAAS,CAAC;oBAC1B,IAAI;oBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,OAAO,EAAE,cAAc,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,EAAE,SAAS;iBACtF,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;SAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,+EAA+E;QAC/E,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YACrC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACvB,IAAI,GAAG,GAAG,cAAc,GAAG,MAAM;oBAAE,OAAO;gBAC1C,cAAc,GAAG,GAAG,CAAC;gBACrB,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACpD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;gBAE/C,qBAAqB;gBACrB,YAAY,CAAC,WAAW,EAAE,CAAC;gBAE3B,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,GAAG,CACH,MAAM,IAAI,aAAa,MAAM,CAAC,cAAc,EAAE,eAAe,OAAO,gBAAgB,QAAQ,EAAE,CAC/F,CACF,CAAC;YACJ,CAAC;iBAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,kBAAkB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;gBACvE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,CAAC;gBACvD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC;gBAEhD,qBAAqB;gBACrB,YAAY,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,EAAE,QAAQ,CAAC,CAAC;gBAEpE,4BAA4B;gBAC5B,MAAM,YAAY,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;gBACxD,MAAM,OAAO,GAAkB;oBAC7B,QAAQ;oBACR,QAAQ;oBACR,UAAU;oBACV,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;oBACtC,SAAS,EAAE,IAAI;iBAChB,CAAC;gBAEF,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;oBAC5B,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACtC,CAAC;qBAAM,IAAI,YAAY,KAAK,aAAa,IAAI,WAAW,EAAE,CAAC;oBACzD,KAAK,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBACpC,CAAC;qBAAM,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;oBAClC,uBAAuB,CAAC,OAAO,CAAC,CAAC;gBACnC,CAAC;qBAAM,CAAC;oBACN,sEAAsE;oBACtE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAC;oBAC3E,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC/C,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBACjD,OAAO,CAAC,GAAG,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;oBAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAC;oBACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,0BAA0B;AAC1B,8EAA8E;AAE9E;;;GAGG;AACH,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IACtD,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAEpE,IAAI,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IAEnC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,EAAE,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,+CAA+C,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,mCAAmC,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,uCAAuC,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,sCAAsC,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,gDAAgD,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,+CAA+C,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,qDAAqD,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,uDAAuD,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,aAAa,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,kDAAkD;AAClD,SAAS,iBAAiB;IACxB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IAE/C,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,CAAC,GAAG,CAAC,4DAA4D,SAAS,gBAAgB,CAAC,EAAE,CACzG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC3E,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,eAAe,SAAS,eAAe,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,CAAC,GAAG,CAAC,yFAAyF,CAAC,EAAE,CAC7G,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,+DAA+D,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,+BAA+B,CAAC,CAAC,GAAG,CAAC,+CAA+C,CAAC,EAAE,CACxF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CACT,UAAU,CAAC,CAAC,GAAG,CAAC,4DAA4D,SAAS,gBAAgB,CAAC,EAAE,CACzG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,qEAAqE,CACvG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,GAAG,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,qDAAqD,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,CAAC,mFAAmF,CAAC,EAAE,CAClG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,gDAAgD;AAChD,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,IAAI,GAAG,IAAa,CAAC;IAC3B,MAAM,CAAC,GAAG,CAAC,EAAU,EAAE,EAAU,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IAE5D,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAA0C;QAC3E,KAAK,EAAE,CAAC,CAAC,oBAAoB,EAAE,oCAAoC,CAAC;QACpE,IAAI;QACJ,OAAO,EAAE;YACP;gBACE,KAAK,EAAE,QAAiB;gBACxB,KAAK,EAAE,CAAC,CAAC,+BAA+B,EAAE,mCAAmC,CAAC;aAC/E;YACD;gBACE,KAAK,EAAE,QAAiB;gBACxB,KAAK,EAAE,CAAC,CAAC,4BAA4B,EAAE,iCAAiC,CAAC;aAC1E;YACD,EAAE,KAAK,EAAE,QAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;YAClE,EAAE,KAAK,EAAE,MAAe,EAAE,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE;SACjF;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,0DAA0D,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,wDAAwD,CAAC,EAAE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,QAAQ,GAAG,EAAE,CAAC;IAElB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,4CAA4C,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,GAAG,CAAC,8EAA8E,CAAC,EAAE,CAC7F,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,WAAW,GAAG,MAAM,YAAY,CAAS;YAC7C,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,0BAA0B,CAAC;YACpD,IAAI;YACJ,OAAO,EAAE;gBACP,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,6BAA6B,EAAE,0BAA0B,CAAC,EAAE;gBAC1F;oBACE,KAAK,EAAE,UAAU;oBACjB,KAAK,EAAE,CAAC,CAAC,+BAA+B,EAAE,gCAAgC,CAAC;iBAC5E;gBACD,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE;gBAC1D,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,cAAc,EAAE,0BAA0B,CAAC,EAAE;aAC1E;SACF,CAAC,CAAC;QAEH,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,0BAA0B,CAAC;gBAClD,WAAW,EAAE,UAAU;gBACvB,IAAI;aACL,CAAC,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,UAAU,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,WAAW,IAAI,UAAU,CAAC;QACpC,CAAC;QAED,QAAQ,GAAG,wBAAwB,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,mBAAmB;QACnB,MAAM,OAAO,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QAC/E,MAAM,SAAS,GACb,QAAQ,KAAK,QAAQ;YACnB,CAAC,CAAC,gCAAgC;YAClC,CAAC,CAAC,sCAAsC,CAAC;QAE7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,2BAA2B,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC;YAChC,KAAK,EAAE,CAAC,CAAC,YAAY,OAAO,GAAG,EAAE,YAAY,OAAO,GAAG,CAAC;YACxD,WAAW,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ;YAC5D,SAAS,EAAE,IAAI;YACf,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,oCAAoC,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,aAAa,CAAC;IAC7E,CAAC;IAED,cAAc;IACd,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,4CAA4C;IAC5C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAClD,IAAI,YAAY,GAA4B,EAAE,CAAC;IAC/C,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAA4B,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7D,IAAI,MAAM;QAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;IACxC,IAAI,QAAQ;QAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC;IAE9C,YAAY,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;IAC9B,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAExE,uCAAuC;IACvC,IAAI,MAAM,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,mBAAmB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,mBAAmB,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,uCAAuC,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,eAAe,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,0CAA0C,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,qCAAqC;AACrC,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAE3B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,+BAA+B,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,0CAA0C,CAAC,CAAC;QACzE,OAAO,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,0BAA0B,CAAC,CAAC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,oBAAoB,GAAG,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,kCAAkC;AAClC,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAEtB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAEpC,MAAM,KAAK,GAAiB;QAC1B;YACE,KAAK,EAAE,QAAQ;YACf,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,UAAoB;SAC5D;QACD,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;KAC7C,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,MAAM,CAAC,gBAAgB;gBAC5B,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzD,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;SACtB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;YACxE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,SAAmB;SACrE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAmB,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,0CAA0C;AAC1C,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,MAAM,EAAE,GAAG,OAAO,CAAC,+CAA+C,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACvD,EAAE,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,EAAE,CAAC,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IAED,6CAA6C;IAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAmB,CAAC;IAE5E,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC;QACnC,OAAO,EAAE;YACP,EAAE,EAAE,yCAAyC;YAC7C,OAAO,EAAE,uBAAuB;SACjC;QACD,YAAY,EAAE,IAAI;QAClB,IAAI,EAAE,MAAM;KACb,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG;QACd,GAAG,MAAM;QACT,wBAAwB,EAAE,QAAQ;QAClC,mBAAmB,EAAE,QAAQ;YAC3B,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,IAAI,4BAA4B,CAAC;YAC9D,CAAC,CAAC,MAAM,CAAC,mBAAmB;KAC/B,CAAC;IACF,IAAI,CAAC;QACH,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAClC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,qCAAqC,GAAG,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CACT,KAAK,OAAO,CAAC,IAAI,0BAA0B,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,4BAA4B,CAAC,EAAE,CACjH,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,wCAAwC,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CACT,CAAC,CAAC,GAAG,CACH,wFAAwF,CACzF,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,KAAK,UAAU,gBAAgB;IAC7B,MAAM,EAAE,GAAG,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,EAAE,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,EAAE,CAAC,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;AACH,CAAC;AAED,kCAAkC;AAClC,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,MAAM,QAAQ,GAAG;QACf,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE;QAClE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE;QAChD,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE;QAC9C,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,EAAE;QAC7C,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,8BAA8B,EAAE;QACzD,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,2BAA2B,EAAE;QACrD,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,uBAAuB,EAAE;QACnD,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,EAAE;QACrD,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE;KACxC,CAAC;IAEF,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,8BAA8B,CAAC,EAAE,CACtG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAC5F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,mCAAmC,CAAC,CAAC;IAC1F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,sCAAsC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,qCAAqC,CAAC,CAAC;IAC/F,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,8BAA8B,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,EAAE,CACpG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,uCAAuC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,iCAAiC,CAAC,CAAC;IAC5F,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,WAAW,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,kDAAkD;AAClD,SAAS,aAAa,CAAC,IAAc,EAAE,MAAc;IACnD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;YAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrD,OAAO,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,IAAI,YAAY,MAAM,2BAA2B,CAAC,CAAC;gBAC9E,OAAO,SAAS,CAAC;YACnB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,sCAAsC;AACtC,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC,CAAC;AAEzD,IAAI,WAAW,EAAE,CAAC;IAChB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1C,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,cAAc,EACd,WAAW,EACX,aAAa,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAA0B,MAAM,mBAAmB,CAAC;AAqBjF,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAO;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,UAAU,CAA0C;IAC5D,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;gBAEpD,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,qBAAqB;IAkB7D,eAAe,CAAC,MAAM,EAAE,MAAM,WAAW,GAAG,IAAI;IAI1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAuDtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B3B,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI;IASpD,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAQtC,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAYxC,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAgB9C,YAAY,IAAI,MAAM;IAItB,OAAO,CAAC,aAAa;IAyGrB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,eAAe;IAgCvB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,kBAAkB;IA2E1B,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAejC,OAAO,CAAC,cAAc;IA0BtB,OAAO,CAAC,oBAAoB;IAkD5B,OAAO,CAAC,qBAAqB;YA6Cf,wBAAwB;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/dashboard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,cAAc,EACd,WAAW,EACX,aAAa,EACd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAA0B,MAAM,mBAAmB,CAAC;AAqBjF,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAgD;IAC9D,OAAO,CAAC,SAAS,CAA4B;IAC7C,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,YAAY,CAAwB;IAC5C,OAAO,CAAC,SAAS,CAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAO;IACvC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,SAAS,CAAoC;IACrD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,UAAU,CAA0C;IAC5D,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;gBAEpD,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,qBAAqB;IAkB7D,eAAe,CAAC,MAAM,EAAE,MAAM,WAAW,GAAG,IAAI;IAI1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAuDtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA2B3B,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,IAAI;IASpD,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAQtC,UAAU,CAAC,OAAO,EAAE,aAAa,GAAG,IAAI;IAYxC,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI;IAgB9C,YAAY,IAAI,MAAM;IAItB,OAAO,CAAC,aAAa;IAyGrB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,UAAU;IAOlB,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,eAAe;IAgCvB,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,kBAAkB;IA2E1B,OAAO,CAAC,MAAM,CAAC,kBAAkB;IAejC,OAAO,CAAC,cAAc;IA0BtB,OAAO,CAAC,oBAAoB;IAkD5B,OAAO,CAAC,qBAAqB;YA6Cf,wBAAwB;IAyFtC,OAAO,CAAC,YAAY;IAUpB,OAAO,CAAC,SAAS;IAcjB,OAAO,CAAC,gBAAgB;IA4BxB,cAAc,IAAI,oBAAoB,GAAG,IAAI;CAG9C"}
|
package/dist/dashboard/index.js
CHANGED
|
@@ -523,13 +523,25 @@ export class DashboardServer {
|
|
|
523
523
|
const discover = mcpConfig['discoverAllSkills'];
|
|
524
524
|
if (discover) {
|
|
525
525
|
const discovered = await discover();
|
|
526
|
+
const discoveredNames = new Set(discovered.map((s) => s.name));
|
|
526
527
|
allSkills = discovered.map((s) => ({
|
|
527
528
|
name: s.name,
|
|
528
|
-
platform: s.platform,
|
|
529
|
+
platform: s.platformId ?? s.platform ?? 'unknown',
|
|
529
530
|
command: s.command,
|
|
530
531
|
whitelisted: whitelistedNames.has(s.name),
|
|
531
532
|
source: whitelist.find((w) => w.name === s.name)?.source,
|
|
532
533
|
}));
|
|
534
|
+
// Merge whitelist entries that were not found by discovery
|
|
535
|
+
for (const w of whitelist) {
|
|
536
|
+
if (!discoveredNames.has(w.name)) {
|
|
537
|
+
allSkills.push({
|
|
538
|
+
name: w.name,
|
|
539
|
+
platform: 'whitelist-only',
|
|
540
|
+
whitelisted: true,
|
|
541
|
+
source: w.source,
|
|
542
|
+
});
|
|
543
|
+
}
|
|
544
|
+
}
|
|
533
545
|
}
|
|
534
546
|
}
|
|
535
547
|
catch {
|
|
@@ -540,6 +552,15 @@ export class DashboardServer {
|
|
|
540
552
|
source: s.source,
|
|
541
553
|
}));
|
|
542
554
|
}
|
|
555
|
+
// If discovery returned nothing but whitelist has entries, merge them in
|
|
556
|
+
if (allSkills.length === 0 && whitelist.length > 0) {
|
|
557
|
+
allSkills = whitelist.map((s) => ({
|
|
558
|
+
name: s.name,
|
|
559
|
+
platform: 'whitelist-only',
|
|
560
|
+
whitelisted: true,
|
|
561
|
+
source: s.source,
|
|
562
|
+
}));
|
|
563
|
+
}
|
|
543
564
|
this.jsonResponse(res, {
|
|
544
565
|
skills: allSkills,
|
|
545
566
|
total: allSkills.length,
|
|
@@ -752,13 +773,10 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;b
|
|
|
752
773
|
<span>PANGUARD AI</span>
|
|
753
774
|
</div>
|
|
754
775
|
<div class="sb-nav">
|
|
755
|
-
<div class="ni on" data-tab="
|
|
756
|
-
<div class="ni" data-tab="skills"><svg viewBox="0 0 24 24"><path d="M12 1L3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5l-9-4z"/></svg><span data-i18n="n_sk">Skills & Trust</span></div>
|
|
757
|
-
<div class="ni" data-tab="ai"><svg viewBox="0 0 24 24"><path d="M21 10.12h-6.78l2.74-2.82c-2.73-2.7-7.15-2.8-9.88-.1-2.73 2.71-2.73 7.08 0 9.79s7.15 2.71 9.88 0C18.32 15.65 19 14.08 19 12.1h2c0 2.48-.94 4.96-2.83 6.86-3.72 3.72-9.75 3.72-13.47 0s-3.72-9.75 0-13.47c3.72-3.72 9.75-3.72 13.47 0L21 2.62v7.5z"/></svg><span data-i18n="n_ai">AI Setup</span></div>
|
|
758
|
-
<div class="ni" data-tab="rules"><svg viewBox="0 0 24 24"><path d="M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm-1 9H8v-2h5v2zm3 4H8v-2h8v2zm-3-8V3.5L18.5 9H13z"/></svg><span data-i18n="n_ru">Rules</span></div>
|
|
759
|
-
<div class="ni" data-tab="tcloud"><svg viewBox="0 0 24 24"><path d="M19.35 10.04A7.49 7.49 0 0012 4C9.11 4 6.6 5.64 5.35 8.04A5.994 5.994 0 000 14c0 3.31 2.69 6 6 6h13c2.76 0 5-2.24 5-5 0-2.64-2.05-4.78-4.65-4.96z"/></svg><span data-i18n="n_tc">Threat Cloud</span></div>
|
|
776
|
+
<div class="ni on" data-tab="dashboard"><svg viewBox="0 0 24 24"><path d="M12 1L3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5l-9-4z"/></svg><span data-i18n="n_db">Dashboard</span></div>
|
|
760
777
|
<div class="ni" data-tab="threats"><svg viewBox="0 0 24 24"><path d="M1 21h22L12 2 1 21zm12-3h-2v-2h2v2zm0-4h-2v-4h2v4z"/></svg><span data-i18n="n_th">Threats</span></div>
|
|
761
|
-
<div class="ni" data-tab="
|
|
778
|
+
<div class="ni" data-tab="rules"><svg viewBox="0 0 24 24"><path d="M14 2H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h12c1.1 0 2-.9 2-2V8l-6-6zm-1 9H8v-2h5v2zm3 4H8v-2h8v2zm-3-8V3.5L18.5 9H13z"/></svg><span data-i18n="n_ru">Rules</span></div>
|
|
779
|
+
<div class="ni" data-tab="settings"><svg viewBox="0 0 24 24"><path d="M19.14 12.94c.04-.3.06-.61.06-.94 0-.32-.02-.64-.07-.94l2.03-1.58a.49.49 0 00.12-.61l-1.92-3.32a.49.49 0 00-.59-.22l-2.39.96c-.5-.38-1.03-.7-1.62-.94l-.36-2.54a.48.48 0 00-.48-.41h-3.84c-.24 0-.43.17-.47.41l-.36 2.54c-.59.24-1.13.57-1.62.94l-2.39-.96a.49.49 0 00-.59.22L2.74 8.87c-.12.21-.08.47.12.61l2.03 1.58c-.05.3-.07.62-.07.94s.02.64.07.94l-2.03 1.58a.49.49 0 00-.12.61l1.92 3.32c.12.22.37.29.59.22l2.39-.96c.5.38 1.03.7 1.62.94l.36 2.54c.05.24.24.41.48.41h3.84c.24 0 .44-.17.47-.41l.36-2.54c.59-.24 1.13-.56 1.62-.94l2.39.96c.22.08.47 0 .59-.22l1.92-3.32c.12-.22.07-.47-.12-.61l-2.01-1.58zM12 15.6A3.6 3.6 0 1115.6 12 3.6 3.6 0 0112 15.6z"/></svg><span data-i18n="n_st">Settings</span></div>
|
|
762
780
|
</div>
|
|
763
781
|
<div class="sb-ft">
|
|
764
782
|
<div class="ws-b"><div class="ws-d" id="wd"></div><span id="wl">Disconnected</span></div>
|
|
@@ -772,56 +790,62 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;b
|
|
|
772
790
|
<span class="pb-txt" id="pb-txt">PROTECTED</span>
|
|
773
791
|
<span id="pb-detail">| -- rules active | Last event: --</span>
|
|
774
792
|
</div>
|
|
775
|
-
<!-- Overview -->
|
|
776
|
-
<div class="pg on" id="p-
|
|
777
|
-
<div class="pt" data-i18n="
|
|
778
|
-
|
|
779
|
-
|
|
780
|
-
<div
|
|
781
|
-
<div
|
|
782
|
-
<div
|
|
783
|
-
<div
|
|
793
|
+
<!-- Dashboard (merged Overview + Skills & Trust) -->
|
|
794
|
+
<div class="pg on" id="p-dashboard">
|
|
795
|
+
<div class="pt" data-i18n="t_db"><em>Dashboard</em></div>
|
|
796
|
+
|
|
797
|
+
<!-- Security Score -->
|
|
798
|
+
<div id="sec-score" style="background:linear-gradient(135deg,rgba(139,154,142,0.15),rgba(139,154,142,0.05));border:1px solid var(--bd);border-radius:12px;padding:24px;margin-bottom:20px">
|
|
799
|
+
<div style="display:flex;justify-content:space-between;align-items:center;margin-bottom:12px">
|
|
800
|
+
<div style="font-size:14px;font-weight:600;color:var(--fg)" data-i18n="sec_score">Security Score</div>
|
|
801
|
+
<div style="font-size:13px;font-weight:600" id="sec-tier">Tier 1-2 (Regex + Heuristic)</div>
|
|
784
802
|
</div>
|
|
785
|
-
<div
|
|
786
|
-
<div
|
|
787
|
-
<div
|
|
788
|
-
<div class="cd"><div class="cl" data-i18n="memory">Memory</div><div class="cv sg" id="v-mem">0 MB</div></div>
|
|
789
|
-
<div class="cd"><div class="cl" data-i18n="actions">Actions</div><div class="cv sg" id="v-act">0</div></div>
|
|
803
|
+
<div style="display:flex;align-items:baseline;gap:8px;margin-bottom:8px">
|
|
804
|
+
<div style="font-size:48px;font-weight:700;color:var(--ok)" id="sec-num">--</div>
|
|
805
|
+
<div style="font-size:16px;color:var(--tm)">/100</div>
|
|
790
806
|
</div>
|
|
791
|
-
<div
|
|
792
|
-
<div
|
|
793
|
-
<div class="cd"><div class="cl">ATR</div><div class="cv-sm sg" id="v-atr">--</div></div>
|
|
807
|
+
<div style="background:var(--bg);border-radius:6px;height:8px;overflow:hidden;margin-bottom:12px">
|
|
808
|
+
<div id="sec-bar" style="height:100%;background:var(--ok);border-radius:6px;width:0%;transition:width 0.5s"></div>
|
|
794
809
|
</div>
|
|
795
|
-
<div
|
|
796
|
-
<
|
|
797
|
-
<
|
|
798
|
-
<
|
|
799
|
-
<
|
|
810
|
+
<div style="display:flex;gap:20px;font-size:12px;color:var(--tm)">
|
|
811
|
+
<span><span id="v-ev" style="color:var(--ok);font-weight:600">0</span> events scanned</span>
|
|
812
|
+
<span><span id="v-th" style="font-weight:600">0</span> threats blocked</span>
|
|
813
|
+
<span><span id="v-atr" style="color:var(--sage);font-weight:600">--</span> rules active</span>
|
|
814
|
+
<span data-i18n="uptime">Uptime</span>: <span id="v-up" style="font-weight:600">0s</span>
|
|
800
815
|
</div>
|
|
801
|
-
<div class="st" data-i18n="timeline">Event Timeline</div>
|
|
802
|
-
<div class="tl" id="evl"><div class="reassure" id="evl-empty">No threats detected. Your agents are running safely.</div></div>
|
|
803
816
|
</div>
|
|
804
817
|
|
|
805
|
-
<!--
|
|
806
|
-
<div
|
|
807
|
-
<div
|
|
808
|
-
<div
|
|
809
|
-
<div
|
|
810
|
-
<div
|
|
811
|
-
<div
|
|
812
|
-
<
|
|
818
|
+
<!-- LLM Upgrade CTA (shown when no Layer 3) -->
|
|
819
|
+
<div id="llm-cta" style="background:linear-gradient(135deg,rgba(223,179,23,0.1),rgba(223,179,23,0.03));border:1px solid rgba(223,179,23,0.3);border-radius:12px;padding:20px;margin-bottom:20px;display:none">
|
|
820
|
+
<div style="display:flex;justify-content:space-between;align-items:flex-start">
|
|
821
|
+
<div>
|
|
822
|
+
<div style="font-size:14px;font-weight:600;color:var(--fg);margin-bottom:6px" data-i18n="upgrade_title">Upgrade Your Protection</div>
|
|
823
|
+
<div style="font-size:12px;color:var(--tm);margin-bottom:10px;line-height:1.5" data-i18n="upgrade_desc">Your Guard runs Tier 1-2 (regex only, 62.7% detection). Connect an LLM to unlock Tier 3:</div>
|
|
824
|
+
<div style="font-size:12px;color:var(--tm);line-height:1.8">
|
|
825
|
+
<span style="color:var(--ok)">+</span> <span data-i18n="up1">Catch attacks in ANY language</span><br>
|
|
826
|
+
<span style="color:var(--ok)">+</span> <span data-i18n="up2">Detect paraphrased injection</span><br>
|
|
827
|
+
<span style="color:var(--ok)">+</span> <span data-i18n="up3">Context-aware: know if "delete all" is real or attack</span><br>
|
|
828
|
+
<span style="color:var(--ok)">+</span> <span data-i18n="up4">New attack types detected automatically</span>
|
|
813
829
|
</div>
|
|
814
|
-
|
|
815
|
-
<
|
|
816
|
-
|
|
817
|
-
<
|
|
818
|
-
|
|
819
|
-
|
|
830
|
+
</div>
|
|
831
|
+
<button class="btn btn-s" onclick="nav('settings')" style="white-space:nowrap" data-i18n="connect_llm">Connect LLM</button>
|
|
832
|
+
</div>
|
|
833
|
+
<div style="font-size:11px;color:var(--tm);margin-top:8px" data-i18n="free_options">Free options: Gemini (free tier) / Ollama (local)</div>
|
|
834
|
+
</div>
|
|
835
|
+
|
|
836
|
+
<!-- Skills -->
|
|
837
|
+
<div class="st" data-i18n="all_skills">All Skills</div>
|
|
838
|
+
<div id="isk-loading" class="empty"><span class="spin"></span> Loading skills...</div>
|
|
839
|
+
<table class="tb" id="isk-table" style="display:none"><thead><tr><th>#</th><th data-i18n="name">Name</th><th data-i18n="platform">Platform</th><th data-i18n="trust">Status</th></tr></thead><tbody id="isk-tb"></tbody></table>
|
|
840
|
+
|
|
841
|
+
<!-- Event Timeline -->
|
|
842
|
+
<div class="st" style="margin-top:20px" data-i18n="timeline">Recent Activity</div>
|
|
843
|
+
<div class="tl" id="evl"><div class="reassure" id="evl-empty" data-i18n="no_threats">No threats detected. Your agents are running safely.</div></div>
|
|
820
844
|
</div>
|
|
821
845
|
|
|
822
|
-
<!-- AI Setup -->
|
|
823
|
-
<div class="pg" id="p-
|
|
824
|
-
<div class="pt" data-i18n="
|
|
846
|
+
<!-- Settings (merged AI Setup + Guide) -->
|
|
847
|
+
<div class="pg" id="p-settings">
|
|
848
|
+
<div class="pt" data-i18n="t_st"><em>Settings</em></div>
|
|
825
849
|
<div class="pd" data-i18n="d_ai">Panguard uses a 3-layer detection system. Layer 1 (rules) and Layer 2 (fingerprint & heuristic) are always active with zero config. Layer 3 uses cloud AI for the deepest analysis -- configure your API key below.</div>
|
|
826
850
|
|
|
827
851
|
<div class="fs">
|
|
@@ -897,11 +921,29 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;b
|
|
|
897
921
|
<h3 data-i18n="why_contrib">Why Contribute?</h3>
|
|
898
922
|
<div class="desc" data-i18n="why_desc">Threat actors evolve constantly. Community-contributed ATR rules create a collective defense network where every participant strengthens the security of all. Your device's unique threat observations may detect patterns unseen by others.</div>
|
|
899
923
|
</div>
|
|
924
|
+
<hr class="divider">
|
|
925
|
+
<div class="st" data-i18n="t_tc">Threat Cloud</div>
|
|
926
|
+
<div id="tc-loading-inline" class="empty"><span class="spin"></span> Loading Threat Cloud status...</div>
|
|
927
|
+
<div id="tc-content-inline" style="display:none">
|
|
928
|
+
<div class="cg">
|
|
929
|
+
<div class="cd"><div class="cl" data-i18n="tc_status">Status</div><div class="cv-sm" id="tc-en2">--</div></div>
|
|
930
|
+
<div class="cd"><div class="cl" data-i18n="tc_uploaded">Uploaded</div><div class="cv-sm sg" id="tc-up2">0</div></div>
|
|
931
|
+
<div class="cd"><div class="cl" data-i18n="tc_received">Rules Received</div><div class="cv-sm sg" id="tc-recv2">0</div></div>
|
|
932
|
+
</div>
|
|
933
|
+
<div class="fs">
|
|
934
|
+
<h3 data-i18n="upload_toggle">Anonymous Upload</h3>
|
|
935
|
+
<div class="desc" data-i18n="upload_desc">When enabled, anonymized threat data is uploaded to Threat Cloud. No personal data, file contents, or source code is ever sent.</div>
|
|
936
|
+
<div style="display:flex;align-items:center;gap:12px;margin-bottom:12px">
|
|
937
|
+
<div class="toggle" id="tc-toggle2" onclick="toggleUpload()"></div>
|
|
938
|
+
<span id="tc-toggle-label2" style="font-size:13px;font-weight:600">--</span>
|
|
939
|
+
</div>
|
|
940
|
+
</div>
|
|
941
|
+
</div>
|
|
900
942
|
</div>
|
|
901
943
|
</div>
|
|
902
944
|
|
|
903
|
-
<!-- Threat Cloud -->
|
|
904
|
-
<div class="pg" id="p-tcloud">
|
|
945
|
+
<!-- Threat Cloud (merged into Rules page as section) -->
|
|
946
|
+
<div class="pg" id="p-tcloud" style="display:none">
|
|
905
947
|
<div class="pt" data-i18n="t_tc"><em>Threat Cloud</em></div>
|
|
906
948
|
<div class="pd" data-i18n="d_tc">Threat Cloud is Panguard's anonymous threat intelligence sharing network. Your device can optionally upload anonymized threat data to help the community, and receives updated detection rules in return.</div>
|
|
907
949
|
<div id="tc-loading" class="empty"><span class="spin"></span> Loading Threat Cloud status...</div>
|
|
@@ -966,8 +1008,8 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;b
|
|
|
966
1008
|
<div class="tl" id="vl"></div>
|
|
967
1009
|
</div>
|
|
968
1010
|
|
|
969
|
-
<!-- Guide -->
|
|
970
|
-
<div class="pg" id="p-guide">
|
|
1011
|
+
<!-- Guide (hidden, merged into Settings) -->
|
|
1012
|
+
<div class="pg" id="p-guide" style="display:none">
|
|
971
1013
|
<div class="pt" data-i18n="t_gd"><em>Getting Started</em></div>
|
|
972
1014
|
<div class="pd" data-i18n="d_gd">Follow these steps to activate full protection. Each step builds on the previous one. Once all steps are complete, Panguard Guard will continuously monitor and protect your system.</div>
|
|
973
1015
|
<div class="fs">
|
|
@@ -986,9 +1028,11 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;b
|
|
|
986
1028
|
|
|
987
1029
|
<script>
|
|
988
1030
|
var T={
|
|
989
|
-
en:{
|
|
990
|
-
|
|
991
|
-
|
|
1031
|
+
en:{n_db:'Dashboard',n_th:'Threats',n_ru:'Rules',n_st:'Settings',
|
|
1032
|
+
t_db:'<em>Dashboard</em>',t_st:'<em>Settings</em>',t_ru:'<em>Detection Rules</em>',t_th:'<em>Threat Intelligence</em>',
|
|
1033
|
+
sec_score:'Security Score',upgrade_title:'Upgrade Your Protection',upgrade_desc:'Your Guard runs Tier 1-2 (regex only, 62.7% detection). Connect an LLM to unlock Tier 3:',
|
|
1034
|
+
up1:'Catch attacks in ANY language',up2:'Detect paraphrased injection',up3:'Context-aware: know if "delete all" is real or attack',up4:'New attack types detected automatically',
|
|
1035
|
+
connect_llm:'Connect LLM',free_options:'Free options: Gemini (free tier) / Ollama (local)',no_threats:'No threats detected. Your agents are running safely.',
|
|
992
1036
|
d_sk:'Panguard audits every MCP skill installed on your system. Safe skills are auto-whitelisted; risky ones are flagged for your review.',
|
|
993
1037
|
d_ai:'Panguard uses a 3-layer detection system. Layer 1 (rules) and Layer 2 (fingerprint & heuristic) are always active with zero config. Layer 3 uses cloud AI for the deepest analysis -- configure your API key below.',
|
|
994
1038
|
d_ru:'Panguard uses a 3-layer rule system to detect threats. Rules sync automatically from Threat Cloud every hour. ATR rules are community-driven, auto-drafted by AI from real threat patterns.',
|
|
@@ -1027,8 +1071,11 @@ wc_s2t:'Connecting Dashboard',wc_s2d:'Establishing real-time data channels...',
|
|
|
1027
1071
|
wc_s3t:'Loading System Status',wc_s3d:'Reading current protection state and metrics...',
|
|
1028
1072
|
wc_s4t:'Ready',wc_s4d:'All systems initialized. Welcome aboard.',
|
|
1029
1073
|
wc_btn:'Enter Dashboard'},
|
|
1030
|
-
zh:{
|
|
1031
|
-
|
|
1074
|
+
zh:{n_db:'\u5100\u8868\u677f',n_th:'\u5a01\u8105\u60c5\u5831',n_ru:'\u5075\u6e2c\u898f\u5247',n_st:'\u8a2d\u5b9a',
|
|
1075
|
+
t_db:'<em>\u5100\u8868\u677f</em>',t_st:'<em>\u8a2d\u5b9a</em>',t_ru:'<em>\u5075\u6e2c\u898f\u5247</em>',t_th:'<em>\u5a01\u8105\u60c5\u5831</em>',
|
|
1076
|
+
sec_score:'\u5b89\u5168\u5206\u6578',upgrade_title:'\u5347\u7d1a\u4fdd\u8b77',upgrade_desc:'\u60a8\u7684 Guard \u76ee\u524d\u904b\u884c Tier 1-2\uff08\u50c5 regex\uff0c62.7% \u5075\u6e2c\u7387\uff09\u3002\u9023\u63a5 LLM \u89e3\u9396 Tier 3\uff1a',
|
|
1077
|
+
up1:'\u652f\u63f4\u4efb\u4f55\u8a9e\u8a00\u7684\u653b\u64ca\u5075\u6e2c',up2:'\u5075\u6e2c\u91cd\u65b0\u6392\u5217\u7684\u6ce8\u5165\u653b\u64ca',up3:'\u8a9e\u5883\u611f\u77e5\uff1a\u5224\u65b7\u300c\u522a\u9664\u5168\u90e8\u300d\u662f\u6b63\u5e38\u6307\u4ee4\u9084\u662f\u653b\u64ca',up4:'\u81ea\u52d5\u5075\u6e2c\u65b0\u578b\u653b\u64ca\uff0c\u7121\u9700\u7b49\u5f85\u898f\u5247\u66f4\u65b0',
|
|
1078
|
+
connect_llm:'\u9023\u63a5 LLM',free_options:'\u514d\u8cbb\u9078\u9805\uff1aGemini\uff08\u514d\u8cbb\u65b9\u6848\uff09/ Ollama\uff08\u672c\u5730\u57f7\u884c\uff09',no_threats:'\u672a\u5075\u6e2c\u5230\u5a01\u8105\u3002\u60a8\u7684 AI \u4ee3\u7406\u6b63\u5b89\u5168\u904b\u884c\u3002',
|
|
1032
1079
|
d_ov:'\u5373\u6642\u7cfb\u7d71\u72c0\u614b\u3002\u6240\u6709\u6307\u6a19\u900f\u904e WebSocket \u81ea\u52d5\u66f4\u65b0\u3002',
|
|
1033
1080
|
d_sk:'Panguard \u6703\u5be9\u8a08\u60a8\u7cfb\u7d71\u4e0a\u5b89\u88dd\u7684\u6bcf\u500b MCP skill\u3002\u5b89\u5168\u7684 skill \u6703\u81ea\u52d5\u52a0\u5165 whitelist\uff0c\u6709\u98a8\u96aa\u7684\u6703\u6a19\u8a18\u4f9b\u60a8\u5be9\u67e5\u3002',
|
|
1034
1081
|
d_ai:'Panguard \u4f7f\u7528\u4e09\u5c64\u5075\u6e2c\u7cfb\u7d71\u3002Layer 1 (Rules) \u548c Layer 2 (Fingerprint & Heuristic) \u59cb\u7d42\u6d3b\u8e8d\uff0c\u96f6\u914d\u7f6e\u3002Layer 3 \u4f7f\u7528 Cloud AI \u9032\u884c\u6700\u6df1\u5ea6\u5206\u6790 -- \u5728\u4e0b\u65b9\u914d\u7f6e API key\u3002',
|
|
@@ -1073,7 +1120,7 @@ var lang=(function(){try{var s=localStorage.getItem('panguard_lang');if(s==='zh'
|
|
|
1073
1120
|
|
|
1074
1121
|
function TL(){lang=lang==='en'?'zh':'en';try{localStorage.setItem('panguard_lang',lang)}catch(e){}document.querySelectorAll('[data-i18n]').forEach(function(e){var k=e.getAttribute('data-i18n');if(T[lang][k]){if(e.tagName==='INPUT')e.placeholder=T[lang][k];else if(k.indexOf('t_')===0||k.indexOf('d_')===0||k==='go_ai')e.innerHTML=T[lang][k];else e.textContent=T[lang][k]}});document.querySelectorAll('[data-i18n-wc]').forEach(function(e){var k=e.getAttribute('data-i18n-wc');if(T[lang][k]){if(k==='wc_title')e.innerHTML=T[lang][k];else e.textContent=T[lang][k]}});updateG6();}
|
|
1075
1122
|
|
|
1076
|
-
function nav(t){document.querySelectorAll('.ni').forEach(function(n){n.classList.remove('on')});document.querySelector('[data-tab="'+t+'"]').classList.add('on');document.querySelectorAll('.pg').forEach(function(p){p.classList.remove('on')});document.getElementById('p-'+t).classList.add('on')
|
|
1123
|
+
function nav(t){document.querySelectorAll('.ni').forEach(function(n){n.classList.remove('on')});var tab=document.querySelector('[data-tab="'+t+'"]');if(tab)tab.classList.add('on');document.querySelectorAll('.pg').forEach(function(p){p.classList.remove('on')});var pg=document.getElementById('p-'+t);if(pg){pg.style.display='';pg.classList.add('on')}if(t==='dashboard'){ldSk();ldISk();ldSecScore()}if(t==='settings'){loadAI();updG()}if(t==='rules'){ldRules();ldTCloud()}if(t==='threats')ldTh()}
|
|
1077
1124
|
document.querySelectorAll('.ni').forEach(function(n){n.addEventListener('click',function(){nav(this.getAttribute('data-tab'))})});
|
|
1078
1125
|
|
|
1079
1126
|
function toast(m){var t=document.getElementById('toast');t.textContent=m;t.classList.add('show');setTimeout(function(){t.classList.remove('show')},2500)}
|
|
@@ -1113,7 +1160,8 @@ function updG(){af('/api/status').then(function(r){return r.json()}).then(functi
|
|
|
1113
1160
|
function updateG6(){var el=document.getElementById('g6-status');var gn=document.getElementById('g6n');var mode=document.getElementById('v-mode').textContent;if(mode==='protection'||mode==='learning'){gn.classList.add('done');el.style.background='rgba(46,213,115,.1)';el.style.color='var(--ok)';el.textContent=lang==='zh'?'\u9632\u8b77\u5df2\u555f\u52d5 - Guard \u904b\u884c\u4e2d':'Protection Active - Guard is running'}else{el.style.background='rgba(239,68,68,.1)';el.style.color='var(--bad)';el.textContent=lang==='zh'?'\u5c1a\u672a\u555f\u52d5 - \u8acb\u57f7\u884c\u6b65\u9a5f 4':'Not started - complete step 4'}}
|
|
1114
1161
|
|
|
1115
1162
|
/* Installed Skills */
|
|
1116
|
-
function ldISk(){af('/api/installed-skills').then(function(r){return r.json()}).then(function(d){document.getElementById('isk-loading').style.display='none';document.getElementById('isk-table').style.display='';
|
|
1163
|
+
function ldISk(){af('/api/installed-skills').then(function(r){return r.json()}).then(function(d){document.getElementById('isk-loading').style.display='none';document.getElementById('isk-table').style.display='';var tb=document.getElementById('isk-tb');tb.innerHTML='';if(!d.skills||d.skills.length===0){tb.innerHTML='<tr><td colspan="4" class="empty">'+(lang==='zh'?'\u672a\u627e\u5230\u6280\u80fd':'No skills found')+'</td></tr>';return}d.skills.sort(function(a,b){return a.whitelisted===b.whitelisted?0:a.whitelisted?1:-1});d.skills.forEach(function(s,i){var tr=document.createElement('tr');var st=s.whitelisted?'<span class="badge badge-ok">'+(lang==='zh'?'\u5b89\u5168':'Safe')+'</span>':'<span class="badge badge-w">'+(lang==='zh'?'\u8ffd\u8e64\u4e2d':'Tracked')+'</span>';tr.innerHTML='<td>'+(i+1)+'</td><td>'+esc(s.name||'')+'</td><td style="color:var(--tm);font-size:12px">'+esc(s.platform||'--')+'</td><td>'+st+'</td>';tb.appendChild(tr)})}).catch(function(){document.getElementById('isk-loading').innerHTML='<span style="color:var(--bad)">Failed to load skills</span>'})}
|
|
1164
|
+
function ldSecScore(){af('/api/status').then(function(r){return r.json()}).then(function(d){var hasL3=d.config&&d.config.layer3&&d.config.layer3.provider;var base=hasL3?85:70;var evBonus=Math.min((d.eventCount||0)/10000,10);var thPenalty=Math.min((d.threatCount||0)*5,20);var score=Math.max(0,Math.min(100,Math.round(base+evBonus-thPenalty)));document.getElementById('sec-num').textContent=score;document.getElementById('sec-bar').style.width=score+'%';document.getElementById('sec-bar').style.background=score>=80?'var(--ok)':score>=50?'#dfb317':'var(--bad)';document.getElementById('sec-tier').textContent=hasL3?'Tier 1-3 (Regex + Heuristic + LLM)':'Tier 1-2 (Regex + Heuristic)';document.getElementById('sec-tier').style.color=hasL3?'var(--ok)':'#dfb317';var cta=document.getElementById('llm-cta');if(cta)cta.style.display=hasL3?'none':'block'}).catch(function(){})}
|
|
1117
1165
|
|
|
1118
1166
|
/* Rules */
|
|
1119
1167
|
function ldRules(){af('/api/rules').then(function(r){return r.json()}).then(function(d){document.getElementById('ru-loading').style.display='none';document.getElementById('ru-content').style.display='';document.getElementById('ru-atr').textContent=d.atr||0;document.getElementById('v-atr').textContent=d.atr||0;document.getElementById('ru-atr-m').textContent=d.atrMatchCount||0;document.getElementById('ru-atr-p').textContent=d.atrDrafterPatterns||0;document.getElementById('ru-atr-s').textContent=d.atrDrafterSubmitted||0;var sub=d.atrDrafterSubmitted||0;var cm=document.getElementById('contrib-msg');if(sub>0){cm.textContent=lang==='zh'?'\u60a8\u7684\u88dd\u7f6e\u5df2\u5411\u793e\u7fa4\u8ca2\u737b '+sub+' \u500b ATR \u63d0\u6848':'Your device has contributed '+sub+' ATR proposal(s) to the community'}else{cm.textContent=lang==='zh'?'\u5c1a\u7121\u8ca2\u737b\u3002\u5b88\u8b77\u5f15\u64ce\u6301\u7e8c\u904b\u884c\u5f8c\u6703\u81ea\u52d5\u751f\u6210':'No contributions yet. ATR proposals will be auto-generated as the guard engine runs.'}var sync=d.lastSync?new Date(d.lastSync).toLocaleString():'--';document.getElementById('ru-sync').textContent=lang==='zh'?'\u4e0a\u6b21\u540c\u6b65: '+sync:'Last sync: '+sync}).catch(function(){document.getElementById('ru-loading').innerHTML='<span style="color:var(--bad)">Failed to load rules</span>'})}
|
|
@@ -1141,7 +1189,7 @@ gTk();
|
|
|
1141
1189
|
function enterDashboard(){
|
|
1142
1190
|
localStorage.setItem('panguard_welcomed','1');
|
|
1143
1191
|
document.getElementById('welcome').classList.add('hide');
|
|
1144
|
-
setTimeout(function(){document.getElementById('welcome').style.display='none';nav('
|
|
1192
|
+
setTimeout(function(){document.getElementById('welcome').style.display='none';nav('dashboard');showFirstVisitToast()},600);
|
|
1145
1193
|
}
|
|
1146
1194
|
function showFirstVisitToast(){
|
|
1147
1195
|
var t=document.getElementById('toast');
|